ci(release): signature verify gate + new-bundle-format fix + ADR-011 - #55
Merged
Conversation
Independent verification of the v0.4.0-beta.2 release showed the pipeline emits new Sigstore bundle-format signatures, while every cosign verify-blob site omitted --new-bundle-format and would fail closed against real bundles. - release.yml: add a verify-signing job that re-verifies the published image attestation (gh attestation verify) and the bundle signature (cosign verify-blob --new-bundle-format) on every tag - release.yml: make --new-bundle-format explicit on both sign-blob steps - install.sh, README.md: pass --new-bundle-format on verify-blob to match the emitted format - docs: add ADR-011 (release artifact signing) and index row Refs #15 🔏 - Generated by Copilot
Contributor
There was a problem hiding this comment.
Pull request overview
This PR hardens the release signing pipeline and documentation after independent verification of v0.4.0-beta.2 revealed a mismatch with Sigstore’s new bundle format expectations, ensuring both CI and consumers can reliably verify published artifacts.
Changes:
- Add
--new-bundle-formatto allcosign verify-blobusage sites (README + installer) to correctly verify modern bundle signatures. - Make the release workflow explicitly emit new-bundle-format bundles during signing (
cosign sign-blob --new-bundle-format) to lock the contract on both the signing and verifying sides. - Add a
verify-signingjob to the release workflow to re-verify the published image attestation and the published bundle signature on every tag; document the decision in ADR-011 and index it.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| README.md | Updates the release verification instructions to include --new-bundle-format for cosign verify-blob. |
| install.sh | Updates installer-time signature verification to include --new-bundle-format for fail-closed verification when cosign/signature are present. |
| docs/decisions/README.md | Adds ADR-011 to the ADR index with implementation pointers. |
| docs/decisions/ADR-011-release-signing.md | New ADR documenting the keyless hybrid approach, installer contract, and CI verification gate. |
| .github/workflows/release.yml | Explicitly signs with new-bundle-format and adds a verify-signing job to prevent silent signing regressions. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hardening follow-up after the signed beta
v0.4.0-beta.2shipped and was verified independently.Why
Independent verification of the published release exposed that the pipeline emits new Sigstore bundle-format signatures, while every
cosign verify-blobsite (installer, README, and the intended CI check) omitted--new-bundle-format. Those commands would have failed closed against real bundles.Evidence:
gh attestation verify oci://ghcr.io/jmservera/uberos/frontend:0.4.0-beta.2 --repo jmservera/UbeROS→Verification succeeded.cosign verify-blob checksums.txt --new-bundle-format --bundle checksums.txt.cosign.bundle ...→Verified OK(fails without the flag).mediaType, verificationMaterial, messageSignature(new format).What
verify-signingjob) inrelease.yml: on every tag, re-verifies the publishedfrontendimage attestation withgh attestation verifyand the bundle signature withcosign verify-blob --new-bundle-format. Signing can no longer silently regress.--new-bundle-formatadded toinstall.sh,README.md, and bothcosign sign-blobsteps (explicit on both sides so a cosign default change cannot break the contract).Validation
actionlint release.yml→ clean.sh -n install.sh+shellcheck --shell=sh install.sh→ clean.v0.4.0-beta.2bundle with the corrected flag →Verified OK.Refs #15