feat(install): verify release bundle signature - #54
Merged
Conversation
- sign the in-bundle checksums.txt and ship the signature in the bundle - verify it with cosign in release mode, gated when cosign is absent - cover valid, invalid, and cosign-absent paths in the installer harness 🔏 - Generated by Copilot
Contributor
There was a problem hiding this comment.
Pull request overview
This PR restores “release bundle authenticity” verification by signing the in-bundle checksums.txt during the release workflow and having install.sh verify that signature with cosign verify-blob when both cosign and the signature bundle are present.
Changes:
.github/workflows/release.yml: Signsdist/<bundle>/checksums.txtintochecksums.txt.cosign.bundleso the extracted bundle carries its own signature for installer verification.install.sh: Addsverify_release_signature()and invokes it fromverify_release_bundle()to verifychecksums.txtauthenticity via cosign (with identity/issuer pinning and env overrides).scripts/validate-wave3.sh: Adds a new block of installer tests covering valid signature, invalid signature (fail-closed), and cosign-absent behavior.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
.github/workflows/release.yml |
Adds an in-bundle signature generation step for checksums.txt to support offline installer authenticity verification. |
install.sh |
Verifies the in-bundle signature (when available) before any Docker/Compose operations run. |
scripts/validate-wave3.sh |
Adds harness coverage for the new signature-verification behavior in the installer. |
Comment on lines
+244
to
+248
| set -euo pipefail | ||
| bundle="dist/${ARCHIVE_BASE}" | ||
| cosign sign-blob --yes \ | ||
| --bundle "${bundle}/checksums.txt.cosign.bundle" \ | ||
| "${bundle}/checksums.txt" |
Comment on lines
+371
to
+383
| # A cosign that succeeds: the signed bundle installs and reaches Docker. | ||
| cat > "${FAKE_BIN}/cosign" <<EOF | ||
| #!/bin/sh | ||
| exit 0 | ||
| EOF | ||
| chmod +x "${FAKE_BIN}/cosign" | ||
| : > "${DOCKER_LOG}" | ||
| PATH="${FAKE_BIN}:${PATH}" sh "${SIG_ROOT}/install.sh" -y \ | ||
| --workspace "${SIG_WS}" --no-migrate >/dev/null \ | ||
| || fail "signed release bundle failed to install with a valid signature" | ||
| grep -q 'compose .* pull' "${DOCKER_LOG}" \ | ||
| || fail "signed release bundle did not reach the pull step" | ||
| pass "signed release bundle with a valid signature installs" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Recovers the installer signature-verification work (issue #15, plan Phase 3). The original PR #53 was auto-closed when its stacked base branch was deleted on #52's merge. Its base is now in
main, so this PR targetsmainand contains only the installer-verification delta.Makes release-mode installs verify authenticity, not just integrity.
Changes
.github/workflows/release.ymlchecksums.txtintochecksums.txt.cosign.bundle, shipped inside the bundle so the extracted payload carries its own signature.install.shverify_release_signature()(called fromverify_release_bundle()):cosign verify-blobagainst the in-bundle signature, pinning workflow identity and OIDC issuer (overridable viaUBEROS_SIGN_IDENTITY_REGEXP/UBEROS_SIGN_OIDC_ISSUER). Skips cleanly when the signature or cosign is absent; fails closed on a bad signature, before Docker.scripts/validate-wave3.shValidation
Previously green on #53 (lint, installer-modes sh/bash, all compose-modes, integration).
checksums.txtalready vouches for every bundled file, so one signature over it authenticates the whole payload. Gated so offline hosts keep the checksum-only path.