Consider naming the generated attestation file `attestation.intoto.json` or allow users to configure it

[edgarrmondragon]

This would make it slightly easier for projects to comply with OSSF's Scorecard: https://github.com/ossf/scorecard/blob/7ce8609469289d5f3b1bf5ee3122f42b4e3054fb/docs/checks.md#signed-releases.

The alternative at the moment is for users to override the asset name the file is uploaded with to the release.

---

I can start a PR if y'all like the idea. If we make it configurable, we'd probably want to follow up with a corresponding PR in actions/attest-build-provenance.

[SRv6d]

Doesn't intoto.jsonl use a different format/schema? I think the scorecard doesn't actually verify attestations but only checks for file existence, meaning even incorrect attestation files/formats would lead to a positive result.

[scop]

As the files are in the JSON encoded Sigstore bundle format, the "proper" filename extension for it would be .sigstore.json, so for example attestation.sigstore.json or artifacts.sigstore.json. I'm not sure if there is a normative spec reference supporting this filename extension, but it is the widespread practice at the moment, refs e.g. at

• https://docs.sigstore.dev/quickstart/quickstart-cosign/
• https://docs.sigstore.dev/cosign/verifying/verify/
• https://docs.sigstore.dev/cosign/signing/signing_with_blobs/

Current OpenSSF Scorecard detects .sigstore.json too, https://github.com/ossf/scorecard/blob/64febf8c5229a2a65d09c6b543677b28a51abb09/docs/checks.md?plain=1#L632

[scop]

Using the "correct" filename would pave way to general recognizability, not only in OpenSSF Scorecard, but with other tools and people, too. Having it correct out of the box could mean one thing fewer to remember (no need to rename it) when one wants to upload the bundle to project release assets, which I think more projects should be doing.