Skip to content

docs: attachments and SBOMs up to 100 MB #461

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
AlexKantor87 merged 1 commit into from
Oct 16, 2026
+17 −5
Merged

docs: attachments and SBOMs up to 100 MB #461

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions changelog/index.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,16 @@ description: "Release notes for Kosli products."
rss: true
---

<Update label="October 15, 2026" description="v2.48.0" tags={["CLI"]}>

## New features

@mbevc1 mbevc1 Oct 16, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note: this is automatically generated every Monday


- **Attachments up to 100 MB** — `--attachments` on every `kosli attest` command, and the file given to `kosli attest sbom`, now take files up to 100 MB (previously 10 MB, and 9 MiB for an SBOM). The CLI uploads the file straight to the Evidence Vault over the Kosli hostname, so no new network access is needed. The limit is per organization; contact Kosli support to raise it. See [attachments](/getting_started/attestations#when-to-use-which).

[View on GitHub](https://github.com/kosli-dev/cli/releases/tag/v2.48.0)

</Update>

<Update label="October 9, 2026" description="v2.47.0" tags={["CLI"]}>

## New features
Expand Down
10 changes: 6 additions & 4 deletions getting_started/attestations.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -190,7 +190,12 @@ kosli attest generic \

Use **`--attachments`** when you want to archive files for audit purposes — such as test reports,
scan output, or policy files — in the Evidence Vault for later retrieval. Provide multiple paths
as a comma-separated list.
as a comma-separated list. A single file is uploaded as it is; a directory, or several paths, are
packaged into one tar archive first.

The upload can be up to 100 MB by default. The limit is per organization; contact Kosli support
to raise it. The CLI sends the file to the Evidence Vault over the same Kosli hostname it uses
for everything else, so no further network access is needed.

```shell
kosli attest generic \
Expand Down Expand Up @@ -363,9 +368,6 @@ Currently, we support the following types of evidence:
dot-qualified as `<artifact>.<name>` for an artifact-scoped one. Anything left out is absent
from the input, and a rule reading it does not match rather than failing.

The CLI refuses an SBOM file larger than 9 MiB, which leaves room for the attestation
itself within the 10 MB the server accepts. We are working on raising this.

See [attest an SBOM to an artifact or a trail](/client_reference/kosli_attest_sbom/) for usage details and examples.
</Accordion>
<Accordion title="Jira issues" icon="clipboard-list-check">
Expand Down
2 changes: 1 addition & 1 deletion tutorials/attest_large_documents.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ This two-part approach keeps attestation payloads focused on what compliance rul
For SBOMs there is now a dedicated type, `kosli attest sbom`, which reads the format, tools, subject and package count from the file for you. It is in beta. This tutorial remains the approach for any report Kosli does not parse, such as SARIF.

<Note>
The `--attestation-data` JSON payload sent by `kosli attest custom` is limited to 1 MB — exceeding it returns a 400 error. Distill larger reports into a summary and attach the full document with `--attachments`, as described below.
The `--attestation-data` JSON payload sent by `kosli attest custom` is limited to 1 MB — exceeding it returns a 400 error. Distill larger reports into a summary and attach the full document with `--attachments`, as described below. An attachment can be up to 100 MB by default; contact Kosli support to raise the limit for your organization.
</Note>

## Prerequisites
Expand Down
Loading