build(deps): bump vanilla-os/vib-gh-action from 0.7.0 to 0.7.2; feat: attest published image, verify base image integrity; bump: vso gnome ext version

.github/workflows/vib-build.yml

@@ -12,18 +12,30 @@ on:
 env:
   BUILDX_NO_DEFAULT_ATTESTATIONS: 1
 
-permissions:
-    contents: write # Allow actions to create release
-    packages: write # Allow pushing images to GHCR
-
 jobs:
+  verify-image:
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Verify Base Image Integrity
+      run:
+        gh attestation verify oci://ghcr.io/vanilla-os/core:main --owner Vanilla-OS
+      env:
+        GH_TOKEN: ${{ github.token }}
+
   build:
     runs-on: ubuntu-latest
+    needs: verify-image
+    permissions:
+      contents: write # Allow actions to create release
+      packages: write # Allow pushing images to GHCR
+      attestations: write # To create and write attestations
+      id-token: write # Additional permissions for the persistence of the attestations
 
     steps:
     - uses: actions/checkout@v4
 
-    - uses: vanilla-os/[email protected].0
+    - uses: vanilla-os/[email protected].2
       with:
         recipe: 'recipe.yml'
         plugins: 'Vanilla-OS/vib-fsguard:v1.4'
@@ -37,14 +49,14 @@ jobs:
       run: |
         REPO_OWNER_LOWERCASE="$(echo ${{ github.repository_owner }} | tr '[:upper:]' '[:lower:]')"
         echo "REPO_OWNER_LOWERCASE=$REPO_OWNER_LOWERCASE" >> "$GITHUB_ENV"
-        echo "IMAGE_NAME=ghcr.io/$REPO_OWNER_LOWERCASE/desktop" >> "$GITHUB_ENV"
+        echo "IMAGE_URL=ghcr.io/$REPO_OWNER_LOWERCASE/desktop" >> "$GITHUB_ENV"
 
     - name: Docker meta
       id: docker_meta
       uses: docker/metadata-action@v5
       with:
         images: |
-          ${{ env. IMAGE_NAME }}
+          ${{ env. IMAGE_URL }}
         tags: |
           type=semver,pattern={{version}}
           type=semver,pattern={{major}}.{{minor}}
@@ -76,3 +88,12 @@ jobs:
         cache-to: type=gha,mode=max
         platforms: linux/amd64
         provenance: false
+
+    - name: Attest pushed image
+      uses: actions/attest-build-provenance@v1
+      id: attest
+      if: ${{ github.event_name != 'pull_request' }}
+      with:
+        subject-name: ${{ env.IMAGE_URL }}
+        subject-digest: ${{ steps.push.outputs.digest }}
+        push-to-registry: false

modules/00-vanilla-system-operator.yml

@@ -6,7 +6,7 @@ source:
   url: https://github.com/Vanilla-OS/vanilla-system-operator/releases/download/continuous/vso.tar.gz
 commands:
 - mkdir -p /usr/bin
-- cp /sources/vso /usr/bin/vso
+- cp /sources/vso/vso /usr/bin/vso
 - chmod +x /usr/bin/vso
 modules:
 - name: vso-manpage
@@ -15,7 +15,7 @@ modules:
     type: tar
     url: https://github.com/Vanilla-OS/vanilla-system-operator/releases/download/continuous/vso-man.tar.gz
   commands:
-  - mv /sources/man/vso.1 /usr/share/man/man1/
+  - mv /sources/vso-manpage/man/vso.1 /usr/share/man/man1/
 - name: vso-os-shell
   type: shell
   commands:
@@ -26,9 +26,9 @@ modules:
   type: shell
   source:
     type: tar
-    url: https://github.com/Vanilla-OS/vso-gnome-ext/archive/refs/tags/1.tar.gz
+    url: https://github.com/Vanilla-OS/vso-gnome-ext/archive/refs/tags/1.1.tar.gz
   commands:
-  - mv /sources/vso-gnome-ext-1/[email protected] /usr/share/gnome-shell/extensions/
+  - mv /sources/vso-gnome-ext/vso-gnome-ext-1.1/[email protected] /usr/share/gnome-shell/extensions/
 - name: vso-deps-install
   type: apt
   source:

modules/03-fswarn.yml

@@ -2,7 +2,7 @@ name: fswarn
 type: shell
 commands:
   - mkdir -p /boot/
-  - cp /sources/fswarn-x86_64.squash /boot/fswarn.squash
+  - cp /sources/fswarn/fswarn-x86_64.squash /boot/fswarn.squash
 source:
   type: tar
   url: https://github.com/Vanilla-OS/fswarn/releases/download/v1.0-1/fswarn.tar.xz

modules/21-gnome-control-center.yml

@@ -5,7 +5,7 @@ source:
   url: https://github.com/Vanilla-OS/gnome-control-center/releases/download/continuous/gnome-control-center.tar.xz
   checksum: cb4b55d7b3059fa861ce8d08048d6371923a5a8d7629a9ad51b8a09f58f44920
 commands:
-  - dpkg -i /sources/gnome-control-center-data_46~99-orchid-beta_all.deb 
-  - dpkg -i /sources/gnome-control-center_46~99-orchid-beta_amd64.deb
+  - dpkg -i /sources/gnome-control-center/gnome-control-center-data_46~99-orchid-beta_all.deb 
+  - dpkg -i /sources/gnome-control-center/gnome-control-center_46~99-orchid-beta_amd64.deb
   - apt -y install -f
   - apt-mark hold gnome-control-center

recipe.yml

@@ -32,8 +32,8 @@ stages:
       url: https://github.com/Vanilla-OS/vanilla-tools/releases/download/continuous/vanilla-tools.tar.gz
     commands:
     - mkdir -p /usr/bin
-    - cp /sources/vanilla-tools/lpkg /usr/bin/lpkg
-    - cp /sources/vanilla-tools/cur-gpu /usr/bin/cur-gpu
+    - cp /sources/vanilla-tools/vanilla-tools/lpkg /usr/bin/lpkg
+    - cp /sources/vanilla-tools/vanilla-tools/cur-gpu /usr/bin/cur-gpu
     - chmod +x /usr/bin/lpkg
     - chmod +x /usr/bin/cur-gpu