fix(install): anchor cosign identity to version tags (D29, #1269 row 4) - #415
Conversation
install.sh verified downloaded binaries against certificate-identity-regexp '.../release.yml@.*' — @.* matches ANY ref, so a binary signed by release.yml running on a feature branch verified identically to a tagged release. Anchor to '@refs/tags/v.*' so only tag-built releases are trusted. Same anchor applied to the documented verify command in release.yml. Part of tracebloc/backend#1269 (row 4). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
bugbot run |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit f3de673. Configure here.
shujaatTracebloc
left a comment
shujaatTracebloc
left a comment
There was a problem hiding this comment.
Reviewed. Correct, well-scoped security fix: anchoring the cosign identity to @refs/tags/v.* closes the @.*-matches-any-ref hole (#1269 row 4). Verified the primary release path (push: tags: v*.*.*) signs under a refs/tags/v* OIDC identity, so legit releases still verify. CI green, Bugbot clean, no unresolved threads.
Note (non-blocking): the workflow_dispatch fallback signs under whatever ref the run is dispatched on — dispatch on the tag itself (not a branch) so its binaries still verify.
2 participants
#1269 row 4.
install.shverified with--certificate-identity-regexp '.../release.yml@.*'—@.*matches any ref, so a binary signed byrelease.ymlon a feature branch verified identically to a tagged release. Anchored to@refs/tags/v.*(real verify in install.sh + the documented command in release.yml). shellcheck clean. Part of tracebloc/backend#1269.Note
Low Risk
Security-hardening change to install-time signature policy; behavior may reject previously accepted non-tag-signed artifacts, which is intended.
Overview
Tightens cosign verification so installers only accept signatures whose OIDC identity comes from the release workflow on a version tag, not an arbitrary Git ref.
The
--certificate-identity-regexpinscripts/install.shchanges fromrelease.yml@.*torelease.yml@refs/tags/v.*, so a binary signed from a feature-branch workflow run no longer passes the same check as a tagged release. The documented customer verify command in.github/workflows/release.ymlis updated to match.Reviewed by Cursor Bugbot for commit f3de673. Bugbot is set up for automated code reviews on this repo. Configure here.