Github attestation for Open3D binaries

.github/workflows/documentation.yml

@@ -22,6 +22,9 @@ jobs:
   headless-docs:   # Build headless and docs
     permissions:
       contents: write  # Artifact upload and release upload
+      id-token: write
+      attestations: write
+      artifact-metadata: write
     runs-on: ubuntu-latest
     env:
       DEVELOPER_BUILD: ${{ github.event.inputs.developer_build || 'ON' }}
@@ -49,6 +52,11 @@ jobs:
           # Rename from Github PR branch SHA to original branch SHA, if needed.
           mv open3d-*-docs.tar.gz open3d-${GITHUB_SHA}-docs.tar.gz
 
+      - name: Generate docs attestation
+        uses: actions/attest@v4
+        with:
+          subject-path: ${{ github.workspace }}/open3d-${{ github.sha }}-docs.tar.gz
+
       - name: Upload docs
         uses: actions/upload-artifact@v4
         with:

.github/workflows/macos.yml

@@ -29,6 +29,9 @@ jobs:
   MacOS:
     permissions:
       contents: write  # upload
+      id-token: write
+      attestations: write
+      artifact-metadata: write
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
@@ -86,6 +89,12 @@ jobs:
           zip -rv "open3d-${OPEN3D_VERSION_FULL}-app-macosx-10_15-${{ runner.arch }}.zip" Open3D.app
           ccache -s
 
+      - name: Generate package attestation
+        if: ${{ env.BUILD_SHARED_LIBS == 'ON' }}
+        uses: actions/attest@v4
+        with:
+          subject-path: build/package/${{ env.DEVEL_PKG_NAME }}
+
       - name: Upload package
         if: ${{ env.BUILD_SHARED_LIBS == 'ON' }}
         uses: actions/upload-artifact@v4
@@ -94,6 +103,12 @@ jobs:
           path: build/package/${{ env.DEVEL_PKG_NAME }}
           if-no-files-found: error
 
+      - name: Generate viewer attestation
+        if: ${{ env.BUILD_SHARED_LIBS == 'OFF' }}
+        uses: actions/attest@v4
+        with:
+          subject-path: build/bin/open3d-*-app-macosx-10_15-${{ runner.arch }}.zip
+
       - name: Upload Open3D viewer app
         uses: actions/upload-artifact@v4
         if: ${{ env.BUILD_SHARED_LIBS == 'OFF' }}
@@ -117,6 +132,9 @@ jobs:
     name: Build wheel
     permissions:
       contents: write  # upload
+      id-token: write
+      attestations: write
+      artifact-metadata: write
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
@@ -199,6 +217,11 @@ jobs:
           PIP_PKG_NAME="$(basename build/lib/python_package/pip_package/open3d*.whl)"
           echo "PIP_PKG_NAME=$PIP_PKG_NAME" >> $GITHUB_ENV
 
+      - name: Generate wheel attestation
+        uses: actions/attest@v4
+        with:
+          subject-path: build/lib/python_package/pip_package/${{ env.PIP_PKG_NAME }}
+
       - name: Upload wheel
         uses: actions/upload-artifact@v4
         with:

.github/workflows/ubuntu-cuda.yml

@@ -47,6 +47,9 @@ jobs:
     name: Build and run
     permissions:
       contents: write   # upload
+      id-token: write
+      attestations: write
+      artifact-metadata: write
     runs-on: ubuntu-latest
     needs: [skip-check]
     if: needs.skip-check.outputs.skip == 'no'
@@ -151,6 +154,12 @@ jobs:
               "${INSTANCE_NAME}":open3d-devel-linux*.tar.xz "$PWD"
           fi
 
+      - name: Generate package attestation
+        if: ${{ env.BUILD_PACKAGE == 'true' }}
+        uses: actions/attest@v4
+        with:
+          subject-path: ${{ github.workspace }}/open3d-devel-linux*.tar.xz
+
       - name: Upload package
         if: ${{ env.BUILD_PACKAGE == 'true' }}
         uses: actions/upload-artifact@v4

.github/workflows/ubuntu-openblas.yml

@@ -37,6 +37,9 @@ jobs:
   openblas-arm64:
     permissions:
       contents: write  # Release upload
+      id-token: write
+      attestations: write
+      artifact-metadata: write
     runs-on: ubuntu-24.04-arm   # latest
     strategy:
       fail-fast: false
@@ -83,6 +86,11 @@ jobs:
       - name: Docker test
         run: docker/docker_test.sh "${DOCKER_TAG}"
 
+      - name: Generate wheel attestation
+        uses: actions/attest@v4
+        with:
+          subject-path: ${{ github.workspace }}/${{ env.PIP_PKG_NAME }}
+
       - name: Upload wheel to GitHub artifacts
         uses: actions/upload-artifact@v4
         with:

.github/workflows/ubuntu-sycl.yml

@@ -26,6 +26,9 @@ jobs:
   ubuntu-sycl:
     permissions:
       contents: write  # Release upload
+      id-token: write
+      attestations: write
+      artifact-metadata: write
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -54,6 +57,14 @@ jobs:
             docker/docker_test.sh sycl-static
           fi
 
+      - name: Generate artifact attestation
+        if: ${{ matrix.BUILD_SHARED_LIBS == 'ON' }}
+        uses: actions/attest@v4
+        with:
+          subject-path: |
+            ${{ github.workspace }}/open3d*.whl
+            ${{ github.workspace }}/open3d-devel-*.tar.xz
+
       - name: Upload Python wheel and C++ binary package to GitHub artifacts
         if: ${{ matrix.BUILD_SHARED_LIBS == 'ON' }}
         uses: actions/upload-artifact@v4

.github/workflows/ubuntu-wheel.yml

@@ -26,6 +26,9 @@ jobs:
   build-wheel:
     permissions:
       contents: write  # Release upload
+      id-token: write
+      attestations: write
+      artifact-metadata: write
     name: Build wheel
     runs-on: ubuntu-latest
     strategy:
@@ -88,6 +91,12 @@ jobs:
           PIP_CPU_PKG_NAME="$(basename ${GITHUB_WORKSPACE}/open3d_cpu*.whl)"
           echo "PIP_PKG_NAME=$PIP_PKG_NAME" >> $GITHUB_ENV
           echo "PIP_CPU_PKG_NAME=$PIP_CPU_PKG_NAME" >> $GITHUB_ENV
+      - name: Generate artifact attestation
+        uses: actions/attest@v4
+        with:
+          subject-path: |
+            ${{ github.workspace }}/${{ env.PIP_PKG_NAME }}
+            ${{ github.workspace }}/${{ env.PIP_CPU_PKG_NAME }}
       - name: Upload wheel to GitHub artifacts
         uses: actions/upload-artifact@v4
         with:

.github/workflows/ubuntu.yml

@@ -22,6 +22,9 @@ jobs:
   ubuntu:
     permissions:
       contents: write  # Release upload
+      id-token: write
+      attestations: write
+      artifact-metadata: write
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -62,15 +65,28 @@ jobs:
           elif [ "${{ matrix.BUILD_SHARED_LIBS }}" = "ON"  ] && [ "${{ env.MLOPS }}" = "ON"  ] && [ "${{ env.DEVELOPER_BUILD }}" = "OFF" ]; then
             docker/docker_test.sh cpu-shared-ml-release
           fi
+      - name: Generate package attestation
+        if: ${{ matrix.BUILD_SHARED_LIBS == 'ON' }}
+        uses: actions/attest@v4
+        with:
+          subject-path: ${{ github.workspace }}/open3d-devel-*.tar.xz
+
       - name: Upload package to GitHub artifacts
-        if: ${{ env.BUILD_SHARED_LIBS == 'ON' }}
+        if: ${{ matrix.BUILD_SHARED_LIBS == 'ON' }}
         uses: actions/upload-artifact@v4
         with:
           name: open3d-devel-linux-x86_64
           path: open3d-devel-*.tar.xz
           if-no-files-found: error
+
+      - name: Generate viewer attestation
+        if: ${{ matrix.BUILD_SHARED_LIBS == 'OFF' }}
+        uses: actions/attest@v4
+        with:
+          subject-path: ${{ github.workspace }}/open3d-viewer-*-Linux.deb
+
       - name: Upload viewer to GitHub artifacts
-        if: ${{ env.BUILD_SHARED_LIBS == 'OFF' }}
+        if: ${{ matrix.BUILD_SHARED_LIBS == 'OFF' }}
         uses: actions/upload-artifact@v4
         with:
           name: open3d-viewer-Linux

.github/workflows/windows.yml

@@ -31,13 +31,17 @@ env:
   CUDA_VERSION: "12.6.0"
   SRC_DIR: "D:\\a\\open3d\\open3d"
   BUILD_DIR: "C:\\Open3D\\build"
+  INSTALL_DIR: "C:\\Program Files\\Open3D"
   NPROC: 6
   DEVELOPER_BUILD: ${{ github.event.inputs.developer_build || 'ON' }}
 
 jobs:
   windows:
     permissions:
       contents: write  # upload
+      id-token: write
+      attestations: write
+      artifact-metadata: write
     runs-on: windows-2022
     strategy:
       fail-fast: false
@@ -136,7 +140,7 @@ jobs:
           cmake -G "Visual Studio 17 2022" -A x64 `
             -DDEVELOPER_BUILD=$Env:DEVELOPER_BUILD `
             -DBUILD_EXAMPLES=OFF `
-            -DCMAKE_INSTALL_PREFIX="C:\Program Files\Open3D" `
+            -DCMAKE_INSTALL_PREFIX="$env:INSTALL_DIR" `
             -DBUILD_SHARED_LIBS=${{ matrix.BUILD_SHARED_LIBS }} `
             -DSTATIC_WINDOWS_RUNTIME=${{ matrix.STATIC_RUNTIME }} `
             -DBUILD_COMMON_ISPC_ISAS=ON `
@@ -171,6 +175,12 @@ jobs:
           echo "DEVEL_PKG_NAME=$DEVEL_PKG_NAME" | Out-File -FilePath `
             $Env:GITHUB_ENV -Encoding utf8 -Append
 
+      - name: Generate package attestation
+        if: ${{ matrix.BUILD_SHARED_LIBS == 'ON' && matrix.BUILD_CUDA_MODULE == 'OFF' }}
+        uses: actions/attest@v4
+        with:
+          subject-path: ${{ env.BUILD_DIR }}/package/${{ env.DEVEL_PKG_NAME }}
+
       - name: Upload Package
         if: ${{ matrix.BUILD_SHARED_LIBS == 'ON' && matrix.BUILD_CUDA_MODULE == 'OFF' }}
         uses: actions/upload-artifact@v4
@@ -197,24 +207,34 @@ jobs:
             --target Open3DViewer
           cmake --build . --parallel ${{ env.NPROC }} --config ${{ matrix.CONFIG }} `
             --target INSTALL
+          $cmakeCachePath = Join-Path $env:BUILD_DIR "CMakeCache.txt"
+          $Env:OPEN3D_VERSION_FULL = (Select-String -Path $cmakeCachePath -Pattern "OPEN3D_VERSION_FULL").Line.Split('=')[1]
+          $open3dAppPath = Join-Path $env:INSTALL_DIR "bin\Open3D"
+          Compress-Archive -Path $open3dAppPath -DestinationPath `
+            "$Env:GITHUB_WORKSPACE/open3d-$Env:OPEN3D_VERSION_FULL-app-windows-amd64.zip"
+          echo "VIEWER_ZIP_NAME=open3d-$Env:OPEN3D_VERSION_FULL-app-windows-amd64.zip" | Out-File -FilePath `
+            $Env:GITHUB_ENV -Encoding utf8 -Append
+
+      - name: Generate viewer attestation
+        if: ${{ matrix.BUILD_SHARED_LIBS == 'OFF' && matrix.STATIC_RUNTIME == 'ON' && matrix.BUILD_CUDA_MODULE == 'OFF' && matrix.CONFIG == 'Release' }}
+        uses: actions/attest@v4
+        with:
+          subject-path: ${{ github.workspace }}/${{ env.VIEWER_ZIP_NAME }}
 
       - name: Upload Viewer
         if: ${{ matrix.BUILD_SHARED_LIBS == 'OFF' && matrix.STATIC_RUNTIME == 'ON' && matrix.BUILD_CUDA_MODULE == 'OFF' && matrix.CONFIG == 'Release' }}
         uses: actions/upload-artifact@v4
         with:
           name: open3d-app-windows-amd64
-          path: C:\Program Files\Open3D\bin\Open3D
+          path: ${{ github.workspace }}/${{ env.VIEWER_ZIP_NAME }}
           if-no-files-found: error
 
       - name: Update devel release with viewer
         if: ${{ github.ref == 'refs/heads/main' && matrix.BUILD_SHARED_LIBS == 'OFF' && matrix.STATIC_RUNTIME == 'ON' && matrix.BUILD_CUDA_MODULE == 'OFF' && matrix.CONFIG == 'Release' }}
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          $Env:OPEN3D_VERSION_FULL = (Select-String -Path "C:/Open3D/build/CMakeCache.txt" -Pattern "OPEN3D_VERSION_FULL").Line.Split('=')[1]
-          Compress-Archive -Path "C:/Program Files/Open3D/bin/Open3D" -DestinationPath `
-            "open3d-$Env:OPEN3D_VERSION_FULL-app-windows-amd64.zip"
-          bash .github/workflows/update_release.sh "open3d-$Env:OPEN3D_VERSION_FULL-app-windows-amd64.zip"
+          bash .github/workflows/update_release.sh "${{ env.VIEWER_ZIP_NAME }}"
 
       - name: Run C++ unit tests
         if: ${{ matrix.BUILD_CUDA_MODULE == 'OFF' }}
@@ -229,16 +249,16 @@ jobs:
           mkdir build
           cd build
           cmake -G "Visual Studio 17 2022" -A x64 `
-            -DCMAKE_INSTALL_PREFIX="C:\Program Files\Open3D" `
+            -DCMAKE_INSTALL_PREFIX="$env:INSTALL_DIR" `
             -DSTATIC_WINDOWS_RUNTIME=${{ matrix.STATIC_RUNTIME }} `
             ..
           cmake --build . --config ${{ matrix.CONFIG }}
           if ( '${{ matrix.BUILD_CUDA_MODULE }}' -eq 'OFF' ) {    # FIXME
             .\${{ matrix.CONFIG }}\Draw.exe --skip-for-unit-test
           }
-          Remove-Item "C:\Program Files\Open3D" -Recurse
+          Remove-Item -LiteralPath $env:INSTALL_DIR -Recurse -Force -ErrorAction SilentlyContinue
       - name: Install Open3D python build requirements
-        working-directory: ${{ env.SOURCE_DIR }}
+        working-directory: ${{ env.SRC_DIR }}
         run: |
           $ErrorActionPreference = 'Stop'
           python -m pip install -U pip==${{ env.PIP_VER }}
@@ -261,6 +281,9 @@ jobs:
     name: Build wheel
     permissions:
       contents: write  # upload
+      id-token: write
+      attestations: write
+      artifact-metadata: write
     runs-on: windows-2022
     strategy:
       fail-fast: false
@@ -331,7 +354,7 @@ jobs:
             $Env:DEVELOPER_BUILD = "ON"
           }
           cmake -G "Visual Studio 17 2022" -A x64 `
-            -DCMAKE_INSTALL_PREFIX="C:\Program Files\Open3D" `
+            -DCMAKE_INSTALL_PREFIX="$env:INSTALL_DIR" `
             -DDEVELOPER_BUILD="$Env:DEVELOPER_BUILD" `
             -DBUILD_SHARED_LIBS=OFF `
             -DSTATIC_WINDOWS_RUNTIME=ON `
@@ -351,6 +374,11 @@ jobs:
           $PIP_PKG_NAME=(Get-ChildItem lib/python_package/pip_package/open3d*.whl).Name
           echo "PIP_PKG_NAME=$PIP_PKG_NAME"  | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf8 -Append
 
+      - name: Generate wheel attestation
+        uses: actions/attest@v4
+        with:
+          subject-path: ${{ env.BUILD_DIR }}/lib/python_package/pip_package/${{ env.PIP_PKG_NAME }}
+
       - name: Upload wheel
         uses: actions/upload-artifact@v4
         with:

README.md

@@ -91,6 +91,13 @@ To get the latest features in Open3D, install the
 To compile Open3D from source, refer to
 [compiling from source](https://www.open3d.org/docs/release/compilation.html).
 
+Release artifacts (Python wheels and C++ binaries) include signed
+[SLSA](https://slsa.dev) build-provenance attestations (GitHub Artifact
+Attestations), aligned with [OpenSSF](https://openssf.org) supply-chain
+guidance. See
+[Getting started — supply chain attestations](https://www.open3d.org/docs/latest/getting_started.html#supply-chain-attestations)
+for verification with the GitHub CLI.
+
 ## C++ quick start
 
 Checkout the following links to get started with Open3D C++ API

docs/getting_started.in.rst

@@ -20,6 +20,29 @@ version (``HEAD`` of ``main`` branch) viewer app is provided here [#]_:
 .. [#] Please use these links from the `latest version of this page <https://www.open3d.org/docs/latest/getting_started.html>`__ only.
 .. [#] To check the `glibc` version on your system, run :code:`ldd --version`.
 
+.. _supply_chain_attestations:
+
+Supply chain attestations
+=========================
+
+Development artifacts linked on this page—viewer packages, pip wheels, C++
+devel archives, and documentation tarballs—are produced by GitHub Actions with
+signed `SLSA build provenance <https://slsa.dev>`__ attestations (`GitHub
+Artifact Attestations
+<https://docs.github.com/en/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds>`__),
+consistent with `OpenSSF <https://openssf.org>`__ supply-chain recommendations.
+
+After saving a file locally, verify it with the `GitHub CLI
+<https://cli.github.com/>`__:
+
+.. code-block:: bash
+
+    gh attestation verify /path/to/<artifact> -R isl-org/Open3D
+
+Replace ``/path/to/<artifact>`` with the wheel, ``.deb``, ``.zip``, ``.tar.xz``,
+or docs ``.tar.gz`` you downloaded. A successful check confirms the file matches
+provenance recorded for this repository.
+
 Python
 ======