From f3de67330471356a09568045c5a74bc45b490f8d Mon Sep 17 00:00:00 2001 From: Lukas Wuttke Date: Mon, 27 Jul 2026 10:44:38 +0200 Subject: [PATCH] fix(install): anchor cosign identity to version tags, not any ref (D29) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit install.sh verified downloaded binaries against certificate-identity-regexp '.../release.yml@.*' — @.* matches ANY ref, so a binary signed by release.yml running on a feature branch verified identically to a tagged release. Anchor to '@refs/tags/v.*' so only tag-built releases are trusted. Same anchor applied to the documented verify command in release.yml. Part of tracebloc/backend#1269 (row 4). Co-Authored-By: Claude Opus 4.8 --- .github/workflows/release.yml | 2 +- scripts/install.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 627d1bde..b18b4965 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -19,7 +19,7 @@ # # cosign verify-blob \ # --certificate-identity-regexp \ -# 'https://github.com/tracebloc/cli/.github/workflows/release.yml@.*' \ +# 'https://github.com/tracebloc/cli/.github/workflows/release.yml@refs/tags/v.*' \ # --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \ # --certificate .cert \ # --signature .sig \ diff --git a/scripts/install.sh b/scripts/install.sh index dcac1f5d..312ee668 100755 --- a/scripts/install.sh +++ b/scripts/install.sh @@ -361,7 +361,7 @@ verify_cosign_signature() { if "$COSIGN_BIN" verify-blob \ --certificate-identity-regexp \ - "https://github.com/${GITHUB_REPO}/.github/workflows/release.yml@.*" \ + "https://github.com/${GITHUB_REPO}/.github/workflows/release.yml@refs/tags/v.*" \ --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \ --certificate "$TMP/$BINARY_FILE.cert" \ --signature "$TMP/$BINARY_FILE.sig" \