Internal

kokoro/axt_attest_artifacts.sh

@@ -59,6 +59,13 @@ find "$SCRATCH_DIR" -type f -name "*.pom" | while IFS= read -r pom_path; do
   echo "Added attestation: $target_attestation"
 done
 
+echo "Scanning for binary files (.aar, .apk, .jar) to add companion attestations..."
+find "$SCRATCH_DIR" -type f \( -name "*.aar" -o -name "*.apk" -o -name "*.jar" \) | while IFS= read -r bin_path; do
+  target_attestation="${bin_path}.intoto.jsonl"
+  cp "$ATTESTATION_FILE" "$target_attestation"
+  echo "Added binary attestation: $target_attestation"
+done
+
 echo "Re-zipping content to $OUTPUT_ZIP..."
 OUTPUT_ZIP_ABS="$(pwd)/$OUTPUT_ZIP"
 

kokoro/axt_build_artifacts.cfg

@@ -9,6 +9,9 @@ fileset_artifacts {
 
   # Globs replace the legacy 'regex' field.
   artifact_globs: "github/android-test-releases/axt_m2repository_unsigned.zip"
+  artifact_globs: "github/android-test-releases/m2repository/**/*.aar"
+  artifact_globs: "github/android-test-releases/m2repository/**/*.apk"
+  artifact_globs: "github/android-test-releases/m2repository/**/*.jar"
 
   # Removes the directory path prefix from the artifact output.
   strip_prefix: "github/android-test-releases"

kokoro/build_artifacts.sh

@@ -17,3 +17,7 @@ bazelisk build :axt_m2repository
 
 # copy the zip here so that we don't follow symlinks to get the files to upload
 cp bazel-bin/axt_m2repository.zip axt_m2repository_unsigned.zip
+
+# unpack the repository so kokoro can attest individual artifacts
+mkdir -p m2repository
+unzip -q axt_m2repository_unsigned.zip -d m2repository