Usually nothing has to be online at the moment the verification command runs. What has to be online is the step before it: fetching the attestation bundle and the trust material the verifier will check against. Once those files are local, the check itself can run offline in the documented GitHub and NVIDIA AICR workflows. The main exception is AICR’s KMS URI key mode, where the verifier contacts the key provider every time it runs.
Separate fetching the inputs from performing the check
Most confusion about network requirements comes from treating verification as one action. It is really two. The first is obtaining the verification inputs: the signed attestation or bundle, the trusted roots or certificates, any transparency-log evidence, and the public key if one is used. The second is performing verification, which means checking the signature and the policy against those inputs. Only the first step usually needs a network connection.
As an Amazon Associate I earn from qualifying purchases.
That split explains why a verification can fail on a locked-down machine even though the verifier is installed correctly. The tool may be able to do the cryptographic work, but it cannot find something it was expected to fetch at runtime.
GitHub artifact attestations
GitHub’s documentation on verifying attestations offline states plainly: “Artifact attestations can be verified without an internet connection.” The same guidance describes the workflow that makes this possible. An online machine retrieves the attestation bundle from GitHub’s attestation API and obtains the trusted roots. The bundle and roots are then moved to the offline machine, where the local verification step consumes them.
#1 Best Overall
Offline preparation sequence
- On a machine with network access, download the attestation bundle for the exact artifact you plan to verify.
- Obtain the trusted root material the verifier needs for that bundle.
- Copy the artifact, bundle, and trusted roots to the restricted environment, keeping the file names and digests that your verification command expects.
- Run the verification command in the restricted environment, pointing it at the local bundle and local roots rather than at remote endpoints.
- Record the verifier version, the artifact digest, and the policy you checked, so the result can be reproduced later.
The GitHub material reviewed for this article does not publish an exact list of hostnames for the download step. If your network allows only certain destinations, confirm the required endpoints against the CLI version you are using and your enterprise network configuration rather than relying on a general list.
What offline does not mean
Offline verification does not mean the verifier can discover missing evidence on its own. If the bundle was never downloaded, or was downloaded for a different artifact digest, the local check has nothing correct to verify. The documentation’s guarantee covers verification with materials already present, not automatic lookup of materials that are absent.
NVIDIA AICR bundles
NVIDIA’s AICR documentation describes two different behaviors depending on how the signing key is supplied. They should be treated as separate cases.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePublic-trust bundle verification
In the public-trust path, AICR states that bundle verification is offline by default and makes no network calls at verification time. The bundle embeds the Rekor inclusion proof, so the verifier does not need a live request to the transparency log to confirm inclusion. If the trusted root is not in its cache, the verifier falls back to a copy embedded in the bundle. In this documented path, the practical requirement is simply that the bundle is present on the machine that verifies it.
KMS URI key mode
When the --key option is given a KMS URI, the verifier resolves that URI at verification time. Resolving it makes network calls to the KMS provider to fetch the public key, and the credentials needed to read that key must be available to the process. If the provider is unreachable or the credentials are missing, verification cannot complete in this mode.
AICR’s documentation also describes an alternative: export the public key once, then verify against the local PEM file. Verification with the PEM file avoids KMS access entirely, so the provider only needs to be reachable during the export.
Comparing the three cases
| Case | Needs network during verification? | What must already be local | Where the network is needed |
|---|---|---|---|
| GitHub artifact attestations, offline workflow | Not stated as required for the local check in the reviewed guidance | Attestation bundle and trusted roots | Preparation on an online machine, from GitHub’s attestation API and trust material |
| AICR public-trust bundle (default) | No network calls at verification time, per AICR documentation | Bundle, with embedded Rekor inclusion proof and embedded trusted-root fallback | Only to obtain the bundle beforehand |
AICR with --key as KMS URI |
Yes, to the KMS provider on each run | Credentials for the key provider | At verification time, to fetch the public key |
| AICR with exported local PEM key | No, for the verification step | Exported PEM public key and the bundle | Only during the one-time key export |
Checklist before you test
- Name the exact verifier and version. GitHub and AICR behavior should not be presented as universal across tools.
- Determine whether the verifier searches remotely for attestations or reads a bundle you downloaded yourself.
- Trace where each input comes from: local file, bundle-embedded data, a cache, an API, a transparency service, or a KMS provider.
- Check whether the command resolves a KMS URI or another remote key reference at runtime.
- Run the same command with the same configuration inside the target network. Documentation cannot substitute for that test in your environment.
When verification fails because of the network
- Error appears only on the restricted machine: the verifier is probably trying to fetch something at runtime. Check whether a KMS URI or remote reference is in use, or whether the bundle and roots were copied across.
- Key provider timeout or authentication error: the key is being resolved through a KMS URI. Either make the provider and credentials available or switch to a PEM public key exported in advance.
- Bundle not found or digest mismatch: the bundle was downloaded for a different artifact or version. Re-download it for the exact artifact digest.
- Passes on an online machine, fails offline: compare the file list on both machines. A missing trusted root or embedded proof is the most common cause in the workflows described above.
What a passing result proves
A successful check means the specified cryptographic and policy conditions held for the material you verified. GitHub’s documentation on artifact attestations describes them as links to the source code and build instructions that produced an artifact, and it notes that generating attestations alone provides no security benefit unless they are verified. GitHub also states that consumers still need to define policy and assess risk. A pass therefore does not certify that an artifact is safe. It shows that the artifact matches the evidence and policy you chose to check.
Free tools Windows power users keep installed
One-click scans. No signup required.
Limits of this guidance
The question does not name a verifier, artifact format, network environment, or policy, so no single firewall allowlist applies. The examples above come from GitHub’s artifact attestation documentation and NVIDIA AICR’s verification documentation. The GitHub page reviewed does not state a publication date, and the same applies to its statement that its attestations meet SLSA v1.0 Build Level 2. Confirm the behavior against the version you run before relying on it in a production or regulated setting.
Where your tool is not one of these, use the checklist above to establish its behavior directly, starting with its documentation for offline verification and its handling of remote key references.
(Not documented in the reviewed sources: a named individual speaker for the GitHub quotations. Attribution here is to GitHub Docs.)
Quoted sources: GitHub Docs, “Verifying attestations offline”; GitHub Docs, “Artifact attestations”; NVIDIA AICR verification documentation.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute”
The Bottom Line
For GitHub artifact attestations and for AICR’s public-trust bundles, the network is needed to fetch the bundle and trust material beforehand, not to pass the check itself. The exception is AICR’s KMS URI key mode, which must reach the key provider on every run. Test the exact tool and configuration in the environment where it will run.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
