From 45f41fdc97e26b4050a63f85ea1aa9535fcc3dfd Mon Sep 17 00:00:00 2001
From: Behnam Mozafari <behnam.mozafari@thetradedesk.com>
Date: Wed, 13 May 2026 11:08:18 +1000
Subject: [PATCH] docs: clarify <tag> in attestation verify command

Explain that <tag> is the Docker image tag (no v prefix) and document
where to find it. Also collapse the example command onto one line so it
copy-pastes on Windows and macOS shells.

UID2-6764

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 README.md | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/README.md b/README.md
index 8197d76f..cf66194b 100644
--- a/README.md
+++ b/README.md
@@ -211,12 +211,17 @@ Every non-snapshot image published by this repo's release workflow ships with a
 To verify an image, install [`gh`](https://cli.github.com/) (≥ 2.49) and run:
 
 ```bash
-gh attestation verify \
-  oci://ghcr.io/iabtechlab/uid2-admin:<tag> \
-  --owner IABTechLab \
-  --signer-repo IABTechLab/uid2-shared-actions
+gh attestation verify oci://ghcr.io/iabtechlab/uid2-admin:<tag> --owner IABTechLab --signer-repo IABTechLab/uid2-shared-actions
 ```
 
+`<tag>` refers to the **Docker image tag** — bare semantic version, no `v` prefix (e.g. `6.13.35`). Note that the corresponding GitHub release and git tag for the same build are named with a `v` (e.g. `v6.13.35`); the registry tag drops it by OCI convention.
+
+**Where to find a tag:**
+
+- **GitHub Packages** for this repo — [`uid2-admin` package](https://github.com/IABTechLab/uid2-admin/pkgs/container/uid2-admin) lists every published image tag and its digest.
+- Or take a [release](https://github.com/IABTechLab/uid2-admin/releases) name (e.g. `v6.13.35`) and drop the leading `v`.
+- To pin to an exact manifest instead of a mutable tag, use the digest form: `oci://ghcr.io/iabtechlab/uid2-admin@sha256:<digest>` (visible on the Packages page, or via `gh api /orgs/IABTechLab/packages/container/uid2-admin/versions`).
+
 A successful run prints `✓ Verification succeeded!` followed by the SLSA provenance fields — including `sourceRepositoryDigest` (the source commit), `workflow.path` (the signing workflow), and the runner identity.
 
 Snapshot tags (`-SNAPSHOT` suffix) deliberately skip attestation. `gh attestation verify` returns `no attestations found` against a snapshot — that's expected.