chore: bump Vib version, improve docs

Signed-off-by: K.B.Dharun Krishna <[email protected]>

.github/workflows/vib-build.yml

@@ -31,7 +31,7 @@ jobs:
         sudo apt install -y debootstrap podman
         sudo sh build.sh
 
-    - uses: vanilla-os/[email protected].3
+    - uses: vanilla-os/[email protected].4
 
     - name: Generate image name
       run: |

README.md

@@ -14,3 +14,11 @@ cd rootfs && sh build.sh && cd ..
 vib build recipe.yml
 podman image build -t vanillaos/pico .
 ```
+
+## Verify Image Build Provenance Attestation
+
+All the image builds/pushes are attested for build provenance and integrity using the [attest-build-provenance`](https://github.com/actions/attest-build-provenance) action. The attestations can be verified [here](https://github.com/Vanilla-OS/pico-image/attestations) or by having the latest version of [GitHub CLI](https://github.com/cli/cli/releases/latest) installed in your system. Then, execute the following command:
+
+```sh
+gh attestation verify oci://ghcr.io/vanilla-os/pico:main --owner Vanilla-OS
+```