Skip to content

release: Fix new sigstore format and update VERIFY.md #130

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
zvonkok merged 1 commit into from
Jan 15, 2026
Merged

release: Fix new sigstore format and update VERIFY.md #130

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 3 additions & 10 deletions .github/workflows/release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -342,24 +342,17 @@ jobs:
- name: Install Cosign
uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3

- name: Install Rekor CLI and jq
- name: Install Rekor CLI
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
set -euxo pipefail

ASSET=rekor-cli-linux-amd64
gh release download --repo sigstore/rekor --pattern "${ASSET}" --dir . --clobber
if gh release download --repo sigstore/rekor --pattern "${ASSET}-keyless.pem" --pattern "${ASSET}-keyless.sig" --dir . --clobber; then
CERT="${ASSET}-keyless.pem"; SIG="${ASSET}-keyless.sig"
else
gh release download --repo sigstore/rekor --pattern "${ASSET}_cert.pem" --dir . --clobber
gh release download --repo sigstore/rekor --pattern "${ASSET}_signature.sig" --dir . --clobber
CERT="${ASSET}_cert.pem"; SIG="${ASSET}_signature.sig"
fi
gh release download --repo sigstore/rekor --pattern "${ASSET}-keyless.sigstore.json" --dir . --clobber
cosign verify-blob \
--certificate "$CERT" \
--signature "$SIG" \
--bundle "${ASSET}-keyless.sigstore.json" \
--certificate-identity "keyless@projectsigstore.iam.gserviceaccount.com" \
--certificate-oidc-issuer "https://accounts.google.com" \
"${ASSET}"
Expand Down
134 changes: 91 additions & 43 deletions VERIFY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,10 +2,6 @@

This guide shows how to verify the **tarball**, the **extracted binary**, the
**SBOM**, and the **SLSA provenance** for a given release.
Releases ship **two flavors** per target:

- `NVRC` (standard)
- `NVRC-confidential` (built with `--features=confidential`)

## Prerequisites

Expand All @@ -18,44 +14,46 @@ Releases ship **two flavors** per target:
## 1) Set variables

```bash
# Choose your flavor (binary name prefix) and target:
export BIN=NVRC # or: NVRC-confidential
# Choose your target architecture:
export TARGET=x86_64-unknown-linux-musl # or: aarch64-unknown-linux-musl

# Set the release tag and repository:
export TAG="vX.Y.Z"
export REPO="owner/repo"
export REPO="NVIDIA/nvrc"
```

**Example:**

```bash
export BIN=NVRC-confidential
export TARGET=x86_64-unknown-linux-musl
export TAG="v0.0.1"
export TAG="v0.1.0"
export REPO="NVIDIA/nvrc"
```

---

## 2) Download the release assets

The release contains a **single tarball** per (flavor, target) and a
The release contains a **tarball** per target architecture and a
per-artifact **SLSA provenance** file.

```bash
gh release download "$TAG" --repo "$REPO" --pattern "${BIN}-${TARGET}.tar.xz" --pattern "${BIN}-${TARGET}.tar.xz.*" --pattern "${BIN}-${TARGET}.intoto.jsonl" --dir .
gh release download "$TAG" --repo "$REPO" \
--pattern "NVRC-${TARGET}.tar.xz" \
--pattern "NVRC-${TARGET}.tar.xz.*" \
--pattern "NVRC-${TARGET}.intoto.jsonl" \
--dir .
```

You should now have:

```text
${BIN}-${TARGET}.tar.xz
${BIN}-${TARGET}.tar.xz.sig
${BIN}-${TARGET}.tar.xz.cert
${BIN}-${TARGET}.tar.xz.bundle.json
NVRC-${TARGET}.tar.xz
NVRC-${TARGET}.tar.xz.sig
NVRC-${TARGET}.tar.xz.cert
NVRC-${TARGET}.tar.xz.bundle.json

${BIN}-${TARGET}.intoto.jsonl
NVRC-${TARGET}.intoto.jsonl
```

---
Expand All @@ -69,30 +67,40 @@ bundle.)

```bash
# Online verification (Rekor)
cosign verify-blob --rekor-url https://rekor.sigstore.dev --certificate "${BIN}-${TARGET}.tar.xz.cert" --signature "${BIN}-${TARGET}.tar.xz.sig" --certificate-identity-regexp "^https://github.com/$REPO/.github/workflows/.+@refs/heads/main$" --certificate-oidc-issuer "https://token.actions.githubusercontent.com" "${BIN}-${TARGET}.tar.xz"
cosign verify-blob \
--rekor-url https://rekor.sigstore.dev \
--certificate "NVRC-${TARGET}.tar.xz.cert" \
--signature "NVRC-${TARGET}.tar.xz.sig" \
--certificate-identity-regexp "^https://github.com/$REPO/.github/workflows/.+@refs/heads/main$" \
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
"NVRC-${TARGET}.tar.xz"

# Offline verification (bundle)
cosign verify-blob --bundle "${BIN}-${TARGET}.tar.xz.bundle.json" --certificate-identity-regexp "^https://github.com/$REPO/.github/workflows/.+@refs/heads/main$" --certificate-oidc-issuer "https://token.actions.githubusercontent.com" "${BIN}-${TARGET}.tar.xz"
cosign verify-blob \
--bundle "NVRC-${TARGET}.tar.xz.bundle.json" \
--certificate-identity-regexp "^https://github.com/$REPO/.github/workflows/.+@refs/heads/main$" \
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
"NVRC-${TARGET}.tar.xz"
```

Extract files for further checks:

```bash
tar -xf "${BIN}-${TARGET}.tar.xz"
tar -xf "NVRC-${TARGET}.tar.xz"
```

After extraction, you should see (per (flavor, target)):
After extraction, you should see:

```text
${BIN}-${TARGET}
${BIN}-${TARGET}.sig
${BIN}-${TARGET}.cert
${BIN}-${TARGET}.bundle.json

sbom-${BIN}-${TARGET}.spdx.json
sbom-${BIN}-${TARGET}.spdx.json.sig
sbom-${BIN}-${TARGET}.spdx.json.cert
sbom-${BIN}-${TARGET}.spdx.json.bundle.json
NVRC-${TARGET}
NVRC-${TARGET}.sig
NVRC-${TARGET}.cert
NVRC-${TARGET}.bundle.json

sbom-NVRC-${TARGET}.spdx.json
sbom-NVRC-${TARGET}.spdx.json.sig
sbom-NVRC-${TARGET}.spdx.json.cert
sbom-NVRC-${TARGET}.spdx.json.bundle.json
```

---
Expand All @@ -101,17 +109,38 @@ sbom-${BIN}-${TARGET}.spdx.json.bundle.json

```bash
# Binary
cosign verify-blob --rekor-url https://rekor.sigstore.dev --certificate "${BIN}-${TARGET}.cert" --signature "${BIN}-${TARGET}.sig" --certificate-identity-regexp "^https://github.com/$REPO/.github/workflows/.+@refs/heads/main$" --certificate-oidc-issuer "https://token.actions.githubusercontent.com" "${BIN}-${TARGET}"
cosign verify-blob \
--rekor-url https://rekor.sigstore.dev \
--certificate "NVRC-${TARGET}.cert" \
--signature "NVRC-${TARGET}.sig" \
--certificate-identity-regexp "^https://github.com/$REPO/.github/workflows/.+@refs/heads/main$" \
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
"NVRC-${TARGET}"

# SBOM (SPDX JSON)
cosign verify-blob --rekor-url https://rekor.sigstore.dev --certificate "sbom-${BIN}-${TARGET}.spdx.json.cert" --signature "sbom-${BIN}-${TARGET}.spdx.json.sig" --certificate-identity-regexp "^https://github.com/$REPO/.github/workflows/.+@refs/heads/main$" --certificate-oidc-issuer "https://token.actions.githubusercontent.com" "sbom-${BIN}-${TARGET}.spdx.json"
cosign verify-blob \
--rekor-url https://rekor.sigstore.dev \
--certificate "sbom-NVRC-${TARGET}.spdx.json.cert" \
--signature "sbom-NVRC-${TARGET}.spdx.json.sig" \
--certificate-identity-regexp "^https://github.com/$REPO/.github/workflows/.+@refs/heads/main$" \
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
"sbom-NVRC-${TARGET}.spdx.json"
```

### (Optional) Offline verification using bundles

```bash
cosign verify-blob --bundle "${BIN}-${TARGET}.bundle.json" "${BIN}-${TARGET}"
cosign verify-blob --bundle "sbom-${BIN}-${TARGET}.spdx.json.bundle.json" "sbom-${BIN}-${TARGET}.spdx.json"
cosign verify-blob \
--bundle "NVRC-${TARGET}.bundle.json" \
--certificate-identity-regexp "^https://github.com/$REPO/.github/workflows/.+@refs/heads/main$" \
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
"NVRC-${TARGET}"

cosign verify-blob \
--bundle "sbom-NVRC-${TARGET}.spdx.json.bundle.json" \
--certificate-identity-regexp "^https://github.com/$REPO/.github/workflows/.+@refs/heads/main$" \
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
"sbom-NVRC-${TARGET}.spdx.json"
```

> Tip: if you later switch to tag-triggered builds, change the regex to:
Expand All @@ -124,9 +153,10 @@ cosign verify-blob --bundle "sbom-${BIN}-${TARGET}.spdx.json.bundle.json" "sbom-
Releases are built from `main`, so verify against the branch.

```bash
PROV="${BIN}-${TARGET}.intoto.jsonl"

slsa-verifier verify-artifact "${BIN}-${TARGET}" --provenance-path "$PROV" --source-uri "github.com/$REPO" --source-branch "main"
slsa-verifier verify-artifact "NVRC-${TARGET}" \
--provenance-path "NVRC-${TARGET}.intoto.jsonl" \
--source-uri "github.com/$REPO" \
--source-branch "main"
```

---
Expand All @@ -149,18 +179,36 @@ For maximum assurance, pin additional **GitHub-specific** claims embedded in
the Fulcio certificate. If you know your workflow file and branch, use:

```bash
WF_FILE="release.yml" # your workflow filename under .github/workflows/
WF_REF="refs/heads/main" # your release branch
WF_FILE="release.yaml" # workflow filename under .github/workflows/
WF_REF="refs/heads/main" # release branch
WF_REPO="$REPO" # e.g., NVIDIA/nvrc

# Tarball (same flags also apply to binary/SBOM verifies)
cosign verify-blob --rekor-url https://rekor.sigstore.dev --certificate-identity "https://github.com/$WF_REPO/.github/workflows/$WF_FILE@$WF_REF" --certificate-oidc-issuer "https://token.actions.githubusercontent.com" --certificate-github-workflow-repository "$WF_REPO" --certificate-github-workflow-ref "$WF_REF" "${BIN}-${TARGET}.tar.xz"
cosign verify-blob \
--rekor-url https://rekor.sigstore.dev \
--certificate-identity "https://github.com/$WF_REPO/.github/workflows/$WF_FILE@$WF_REF" \
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
--certificate-github-workflow-repository "$WF_REPO" \
--certificate-github-workflow-ref "$WF_REF" \
"NVRC-${TARGET}.tar.xz"

# Binary
cosign verify-blob --rekor-url https://rekor.sigstore.dev --certificate-identity "https://github.com/$WF_REPO/.github/workflows/$WF_FILE@$WF_REF" --certificate-oidc-issuer "https://token.actions.githubusercontent.com" --certificate-github-workflow-repository "$WF_REPO" --certificate-github-workflow-ref "$WF_REF" "${BIN}-${TARGET}"
cosign verify-blob \
--rekor-url https://rekor.sigstore.dev \
--certificate-identity "https://github.com/$WF_REPO/.github/workflows/$WF_FILE@$WF_REF" \
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
--certificate-github-workflow-repository "$WF_REPO" \
--certificate-github-workflow-ref "$WF_REF" \
"NVRC-${TARGET}"

# SBOM
cosign verify-blob --rekor-url https://rekor.sigstore.dev --certificate-identity "https://github.com/$WF_REPO/.github/workflows/$WF_FILE@$WF_REF" --certificate-oidc-issuer "https://token.actions.githubusercontent.com" --certificate-github-workflow-repository "$WF_REPO" --certificate-github-workflow-ref "$WF_REF" "sbom-${BIN}-${TARGET}.spdx.json"
cosign verify-blob \
--rekor-url https://rekor.sigstore.dev \
--certificate-identity "https://github.com/$WF_REPO/.github/workflows/$WF_FILE@$WF_REF" \
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
--certificate-github-workflow-repository "$WF_REPO" \
--certificate-github-workflow-ref "$WF_REF" \
"sbom-NVRC-${TARGET}.spdx.json"
```

Don't know the exact workflow filename? Stick with the **regex** form used
Expand All @@ -178,7 +226,7 @@ If you run releases via `workflow_dispatch`, you can also pin the trigger:

- If **identity check fails**, ensure `REPO` and the regex
(`@refs/heads/main` vs `@refs/tags/$TAG`) match how the release was built.
- If `${BIN}-${TARGET}.intoto.jsonl` is missing, confirm the release includes
per-(flavor,target) provenance.
- If `NVRC-${TARGET}.intoto.jsonl` is missing, confirm the release includes
per-target provenance.
- For more detail, add `--verbose` and optionally set `COSIGN_EXPERIMENTAL=1`
when experimenting locally.
Loading