From 0f2cac2f631fa91ea8b7c84a9fab5c2e164d76da Mon Sep 17 00:00:00 2001
From: Steve Tooke <steve@took.es>
Date: Sat, 14 Nov 2026 14:39:43 +0000
Subject: [PATCH] Pin the signer in the attest in-toto SBOM bundle example to
 the workflow file and ref

---
 cmd/kosli/attestInToto.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cmd/kosli/attestInToto.go b/cmd/kosli/attestInToto.go
index f9e5f1a77..6c1e4b9c0 100644
--- a/cmd/kosli/attestInToto.go
+++ b/cmd/kosli/attestInToto.go
@@ -273,7 +273,7 @@ kosli attest in-toto app.tar.gz \
 	--bundle app-sbom.sigstore.json \
 	--predicate-type sbom \
 	--name app.sbom \
-	--certificate-identity-regexp '^https://github.com/yourOrg/yourRepo/' \
+	--certificate-identity https://github.com/yourOrg/yourRepo/.github/workflows/build.yml@refs/heads/main \
 	--certificate-oidc-issuer https://token.actions.githubusercontent.com \
 	--flow yourFlowName \
 	--trail yourTrailName \