---
name: "glab-attestation-verify"
section: "1"
platform: "linux"
package: "glab"
version: "1.126.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/glab-attestation-verify"
---

# glab-attestation-verify(1)

Verify the provenance of a specific artifact or file. (EXPERIMENTAL)

## NAME

glab-attestation-verify - Verify the provenance of a specific artifact or file. (EXPERIMENTAL)

## SYNOPSIS

**glab attestation verify   \[flags\]**

## DESCRIPTION

Verify the provenance of an artifact built by a GitLab CI/CD pipeline. This command checks the artifact's signed attestation against the expected GitLab project and pipeline.

This command requires the cosign binary. To install it, see Cosign installation ⟨https://docs.sigstore.dev/cosign/system\_config/installation/⟩.

This command works only on GitLab.com.

For more information about attestations, see:

- •

  Attestations API ⟨https://docs.gitlab.com/api/attestations/⟩

- •

  SLSA provenance specification ⟨https://docs.gitlab.com/ci/pipeline\_security/slsa/provenance\_v1/⟩

- •

  SLSA software attestations ⟨https://slsa.dev/spec/v1.2/attestation-model⟩

This feature is an experiment and is not ready for production use. It might be unstable or removed at any time. For more information, see https://docs.gitlab.com/policy/development\_stages\_support/.

## OPTIONS INHERITED FROM PARENT COMMANDS

**-h**, **--help**\[=false\]\
 	Show help for this command.

## EXAMPLE

```
# Verify attestation for filename.txt in the gitlab-org/gitlab project
glab attestation verify gitlab-org/gitlab filename.txt
# Verify attestation for filename.txt in the project with ID 123
glab attestation verify 123 filename.txt
```

## SEE ALSO

**[glab-attestation(1)](/glab-attestation/1.md)**