GH-ATTESTATION-DOWNLOAD(1)

🦋 gh-attestation-download — bestie's guide to grabbing attestations offline ✨

okay so listen up, this is the gh attestation download page from the GitHub CLI manual, and I'm gonna walk you through it like we're texting at 2am 💅

---

🌸 NAME 🌸

gh-attestation-download — literally downloads an artifact's attestations so you can have them offline, no cap 🫶

---

⭐ SYNOPSIS ⭐

gh attestation download [<file-path> | oci://<image-uri>] [--owner | --repo] [flags]

that's the whole vibe. file path or OCI URI, then --owner or --repo, then whatever flags you want ✨

---

💖 DESCRIPTION 💖

NOTE: this feature is currently in public preview, and subject to change. so like… don't get too attached to the exact behavior, bestie 😭

So what does it actually do? It downloads the attestations associated with an artifact, for offline use. Iconic. Very demure. Very offline.

The command requires either:

• a file path to an artifact, or
• a container image URI (e.g. oci://<image-uri>)
  • (note that if you provide an OCI URL, you must already be authenticated with its container registry — like, you gotta be on the list already, iykyk 🔥)

In addition, the command requires either:

• the --repo flag (e.g. --repo github/example), or
• the --owner flag (e.g. --owner github)

The --repo flag value must match the name of the GitHub repository that the artifact is linked with. fr fr, it has to match.

The --owner flag value must match the name of the GitHub organization that the artifact's linked repository belongs to. same energy 👑

Any associated bundle(s) will be written to a file in the current directory, named after the artifact's digest. For example, if the digest is "sha256:1234", the file will be named "sha256:1234.jsonl". slay, it names itself 🎀

Now here's the Windows part, and this one matters: colons are special characters on Windows and cannot be used in file names. To accommodate, a dash will be used to separate the algorithm from the digest in the attestations file name. For example, if the digest is "sha256:1234", the file will be named "sha256-1234.jsonl". not me crying over filesystem rules 😭

---

✨ OPTIONS ✨

• -d, --digest-alg <string> (default "sha256") — the algorithm used to compute a digest of the artifact: {sha256|sha512}
• --hostname <string> — configure host to use
• -L, --limit <int> (default 30) — maximum number of attestations to fetch
• -o, --owner <string> — GitHub organization to scope attestation lookup by
• --predicate-type <string> — filter attestations by provided predicate type
• -R, --repo <string> — repository name in the format /

---

💀 EXIT CODES 💀

• 0 — successful execution 🎉
• 1 — error 🙈
• 2 — command canceled
• 4 — authentication required 🔐

NOTE: specific commands may have additional exit codes. refer to the command's help for more information. iykyk, always check the help bestie 💜

---

🌈 EXAMPLE 🌈

# Download attestations for a local artifact linked with an organization
$ gh attestation download example.bin -o github

# Download attestations for a local artifact linked with a repository
$ gh attestation download example.bin -R github/example

# Download attestations for an OCI image linked with an organization
$ gh attestation download oci://example.com/foo/bar:latest -o github

ate. no crumbs. 👑

---

🧚 SEE ALSO 🧚

• gh-attestation(1) — go read the parent page, it's giving main character energy ⭐

---

and that's the whole page, bestie!! 🍓 this was GitHub CLI v2.102.0, dated Oct 2026 — mwah, go download some attestations, ily 💖🫶✨