Hey I have a question about

atmos toolchain

on atmos release

1.220.0

there was an update to how the toolchain verifies downloaded packages, it now will do checksums and signature/attestations this is great but on the PR it mention that this should be no breaking but if the package only has checksums it will fail with 404 I believed this should be a warning unless this is intentional

Can you give me an example and I will take a look

Yeah here is the example:

atmos toolchain install --reinstall
🧪 toolchain is an experimental feature. Learn more <https://atmos.tools/experimental>
✓ Installed cloudposse/atmos@1.220.0
✓ Installed cli/cli@2.89.0
✓ Installed jqlang/jq@1.8.1
✓ Installed hashicorp/terraform@1.15.5
✗ Install failed : failed to verify downloaded asset: signature verification failed: /opt/homebrew/bin/gh [attestation verify _path_/atmos/toolchain/tflint_darwin_arm64.zip --repo
  terraform-linters/tflint --signer-workflow terraform-linters/tflint/.github/workflows/release.yml]: exit status 1

  Error: HTTP 404: Not Found (<https://api.github.com/repos/terraform->
  linters/tflint/attestations/sha256:6aab157b22367dcab1635b370e98d6e791d9b40b021d4f9baef010d88f53e16b?per_page=30&predicate_type=<https://slsa.dev/provenance/v1>)
✗ Install failed : failed to verify downloaded asset: signature verification failed: /opt/homebrew/bin/gh [attestation verify _path_/atmos/toolchain/tflint_darwin_arm64.zip --repo
  terraform-linters/tflint --signer-workflow terraform-linters/tflint/.github/workflows/release.yml]: exit status 1

  Error: HTTP 404: Not Found (<https://api.github.com/repos/terraform->
  linters/tflint/attestations/sha256:6aab157b22367dcab1635b370e98d6e791d9b40b021d4f9baef010d88f53e16b?per_page=30&predicate_type=<https://slsa.dev/provenance/v1>)
✓ Installed astral-sh/uv@0.11.2

✗ Installed 5 tools, failed 1

You can see that here the

tflint

package do not have a

signature/attestations

so the issue is that instead of just using checksum it will fail and error all other installs. In my opinion this should be a warning or manage per tool not global since I will like it to check if exist

Please test this when it's done building

@Erik Osterman (Cloud Posse) Sorry for the wait! I have just test it and it looks like it works!