ci(release): sigstore keyless signing for SHA256SUMS + RELEASING.md#296
Merged
Conversation
Supply-Chain-Pentester finding (v0.10.0 adversarial review): SHA256SUMS shipped unsigned, so anyone who could replace a release asset could also replace the checksum file. The dossier sold defect detection (true) but quietly implied tamper detection (false). Closes 80% of that gap with sigstore keyless OIDC — no long-lived signing key, no KMS provisioning, no rotation. The trust anchor is the GitHub-Actions workflow identity (issuer `token.actions.githubusercontent.com`, subject `.github/workflows/release.yml@refs/tags/vX.Y.Z`). Workflow changes: - `permissions.id-token: write` so the runner can request its OIDC token (required by cosign keyless flow). - New `Install cosign` step (sigstore/cosign-installer@v3, v2.4.1). - New `Sign SHA256SUMS with cosign (keyless OIDC)` step between checksum generation and release creation. Emits three artifacts: - `SHA256SUMS.txt.cosign.bundle` (verifier-friendly bundle) - `SHA256SUMS.txt.sig` (detached signature) - `SHA256SUMS.txt.pem` (Fulcio-issued short-lived cert) - The existing `Collect assets` step's permissive `find` already picks up the new files; the release page will include them automatically. New `RELEASING.md` documents: - Why signed git tags matter + how to verify (`git tag -v`). - What CI signs (and why sigstore keyless was chosen). - How a consumer verifies a downloaded binary (two-step flow: cosign verify-blob on the bundle, then sha256sum -c). - What is explicitly NOT signed at v0.10.0+ (binary archives transitively only, VSIX, compliance tarball, the maintainer's GPG keylist — for parity with the dossier §0 honest scope). - The manual-republish procedure used for v0.10.0 (#294 context). This addresses the Supply-Chain-Pentester's "one minimum primitive that closes 80% of the gaps" recommendation. The remaining 20% (per-archive signatures, VSIX signing, attestation in-toto bundle) are separate workstreams. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Supply-Chain-Pentester finding from the v0.10.0 adversarial review (
SHA256SUMSwas unsigned). Ships sigstore keyless OIDC signing — no long-lived signing key, no KMS provisioning, no rotation.What changes
release.ymlgetspermissions.id-token: write(required for OIDC token).Trust anchor
The cert's identity claim binds the signature to the GitHub-Actions workflow identity:
Verification (in `RELEASING.md`):
```bash
cosign verify-blob \
--bundle SHA256SUMS.txt.cosign.bundle \
--certificate-identity-regexp 'https://github.com/pulseengine/rivet/.github/workflows/release.yml@.*' \
--certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
SHA256SUMS.txt
sha256sum -c SHA256SUMS.txt --ignore-missing
```
What's NOT in this PR (deliberate)
Test plan
🤖 Generated with Claude Code