Repository navigation
release: sign and attest the tarball, its .sha256 and machine.env - #104
Merged
Merged
Conversation
S1 of the supply-chain plan. Each file the release offers is signed and attested with its SLSA provenance (go tool provenance: this workflow at its commit, every versions.yaml pin), each bundle verified file by file against the identity that made it, and attestgate files checks the directory right before the upload. workflows_test holds every workflow to attesting before it publishes; the steps that upload only what a person reads, or what ci.yml pulls, are named with why. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
S1 of the supply-chain plan, for spin-machine.
release.ymlgetsid-token: writeand cosign. For each of the tarball, its.sha256andmachine.envit runssign-blobandattest-blob --type slsaprovenance1(the predicate comes fromgo tool provenance), then checks both bundles one file at a time. Right before Publish,go tool attestgate files -require provenance _output/releaseruns, and the bundles go up with the release.workflows/workflows_test.go: go-tools'attestgate.Gate. The CI artifacts, the lab log, the qemu runtime image (only ci.yml pulls it) and report.json are excused inNotPublished, each with its reason.provenanceandattestgatetools.Planted: removing
id-token: writefails the test (release.yml/release/Publish: attests with no id-token). The workflow change itself is only proven by the next release run.🤖 Generated with Claude Code
Need help on this PR? Tag
@codesmith-botwith what you need.