From 86ffae63c2e2240105a953d91c5c9d5fbbd97e38 Mon Sep 17 00:00:00 2001 From: Tore Martin Hagen Date: Fri, 16 Oct 2026 08:14:21 +0200 Subject: [PATCH] docs: attachments and SBOMs up to 100 MB CLI v2.48.0 uploads attachments straight to the Evidence Vault, so the 10 MB request limit, and the 9 MiB guard on an SBOM file that sat under it, no longer apply. The limit is now 100 MB per organization, raised by support, and the pages that stated the old limits said nothing about where the file goes or that no further network access is needed. Part of kosli-dev/server#7268 Co-Authored-By: Claude Fable 5.1 --- changelog/index.mdx | 10 ++++++++++ getting_started/attestations.md | 10 ++++++---- tutorials/attest_large_documents.md | 2 +- 3 files changed, 17 insertions(+), 5 deletions(-) diff --git a/changelog/index.mdx b/changelog/index.mdx index 68057d89..9ee5bdb8 100644 --- a/changelog/index.mdx +++ b/changelog/index.mdx @@ -4,6 +4,16 @@ description: "Release notes for Kosli products." rss: true --- + + +## New features + +- **Attachments up to 100 MB** — `--attachments` on every `kosli attest` command, and the file given to `kosli attest sbom`, now take files up to 100 MB (previously 10 MB, and 9 MiB for an SBOM). The CLI uploads the file straight to the Evidence Vault over the Kosli hostname, so no new network access is needed. The limit is per organization; contact Kosli support to raise it. See [attachments](/getting_started/attestations#when-to-use-which). + +[View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.48.0) + + + ## New features diff --git a/getting_started/attestations.md b/getting_started/attestations.md index b9f6580e..85828cdb 100644 --- a/getting_started/attestations.md +++ b/getting_started/attestations.md @@ -190,7 +190,12 @@ kosli attest generic \ Use **`--attachments`** when you want to archive files for audit purposes — such as test reports, scan output, or policy files — in the Evidence Vault for later retrieval. Provide multiple paths -as a comma-separated list. +as a comma-separated list. A single file is uploaded as it is; a directory, or several paths, are +packaged into one tar archive first. + +The upload can be up to 100 MB by default. The limit is per organization; contact Kosli support +to raise it. The CLI sends the file to the Evidence Vault over the same Kosli hostname it uses +for everything else, so no further network access is needed. ```shell kosli attest generic \ @@ -363,9 +368,6 @@ Currently, we support the following types of evidence: dot-qualified as `.` for an artifact-scoped one. Anything left out is absent from the input, and a rule reading it does not match rather than failing. - The CLI refuses an SBOM file larger than 9 MiB, which leaves room for the attestation - itself within the 10 MB the server accepts. We are working on raising this. - See [attest an SBOM to an artifact or a trail](/client_reference/kosli_attest_sbom/) for usage details and examples. diff --git a/tutorials/attest_large_documents.md b/tutorials/attest_large_documents.md index 2b898dfb..55977fa1 100644 --- a/tutorials/attest_large_documents.md +++ b/tutorials/attest_large_documents.md @@ -11,7 +11,7 @@ This two-part approach keeps attestation payloads focused on what compliance rul For SBOMs there is now a dedicated type, `kosli attest sbom`, which reads the format, tools, subject and package count from the file for you. It is in beta. This tutorial remains the approach for any report Kosli does not parse, such as SARIF. -The `--attestation-data` JSON payload sent by `kosli attest custom` is limited to 1 MB — exceeding it returns a 400 error. Distill larger reports into a summary and attach the full document with `--attachments`, as described below. +The `--attestation-data` JSON payload sent by `kosli attest custom` is limited to 1 MB — exceeding it returns a 400 error. Distill larger reports into a summary and attach the full document with `--attachments`, as described below. An attachment can be up to 100 MB by default; contact Kosli support to raise the limit for your organization. ## Prerequisites