feat: verify GitHub release source attestations

crates/rattler_build_recipe/src/stage0/source.rs

@@ -113,7 +113,7 @@ pub struct GitSource {
 #[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
 pub struct AttestationConfig {
     /// URL to download the attestation bundle from (e.g., .sigstore.json file)
-    /// Auto-derived for PyPI sources if not specified.
+    /// Auto-derived for PyPI sources and uploaded GitHub release assets if not specified.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub bundle_url: Option<Value<String>>,
 

crates/rattler_build_recipe/src/stage1/source.rs

@@ -269,7 +269,7 @@ pub fn parse_publisher_string(s: &str) -> Result<Publisher, String> {
 #[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
 pub struct AttestationConfig {
     /// URL to download the attestation bundle from (e.g., .sigstore.json file)
-    /// Auto-derived for PyPI sources if not specified.
+    /// Auto-derived for PyPI sources and uploaded GitHub release assets if not specified.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub bundle_url: Option<Url>,
 

crates/rattler_build_recipe/tests/source_parsing_test.rs

@@ -780,6 +780,34 @@ fn test_parse_flask_attestation_example() {
     }
 }
 
+#[test]
+fn test_parse_uv_attestation_example() {
+    let yaml = include_str!("../../../examples/uv-attestation/recipe.yaml");
+    let recipe = parse_recipe_from_source(yaml).unwrap();
+
+    assert_eq!(recipe.package.name.as_concrete().unwrap().as_str(), "uv");
+
+    let source = get_concrete_source(&recipe.source.as_slice()[0]).unwrap();
+    match source {
+        Source::Url(url_src) => {
+            let att = url_src
+                .attestation
+                .as_ref()
+                .expect("attestation should be set");
+            assert!(
+                att.bundle_url.is_none(),
+                "GitHub release attestation should be discovered automatically"
+            );
+            assert_eq!(att.publishers.len(), 1);
+            assert_eq!(
+                att.publishers[0].as_concrete().unwrap(),
+                "github:astral-sh/uv"
+            );
+        }
+        _ => panic!("Expected URL source"),
+    }
+}
+
 #[test]
 fn test_parse_zstd_attestation_example() {
     let yaml = include_str!("../../../examples/zstd-attestation/recipe.yaml");