feat(workflows): sign release images and bundle (keyless) - #52
Merged
Conversation
- attest SLSA build provenance for each GHCR image via GitHub OIDC - sign release archives and checksums with cosign sign-blob - document gh attestation and cosign verify-blob in the README 🔏 - Generated by Copilot
Contributor
There was a problem hiding this comment.
Pull request overview
Adds keyless supply-chain integrity signals to the release process by publishing GitHub build provenance attestations for container images and Sigstore cosign bundles for release archives, plus documentation for consumers to verify both.
Changes:
- Add build-provenance attestation generation for each pushed GHCR image in the release workflow.
- Add keyless
cosign sign-blob --bundlesigning for release archives and checksums, and upload the resulting.cosign.bundleassets. - Document verification commands for image attestations (
gh attestation verify) and bundle signatures (cosign verify-blob).
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
.github/workflows/release.yml |
Adds OIDC-based attestations for images and cosign bundle signing + upload for release artifacts. |
README.md |
Adds consumer-facing verification instructions for image attestations and cosign bundle signatures. |
Comment on lines
+254
to
+258
| cosign verify-blob \ | ||
| --bundle uberos-0.4.0-beta.tar.gz.cosign.bundle \ | ||
| --certificate-identity-regexp 'https://github.com/jmservera/UbeROS/.github/workflows/release.yml@.*' \ | ||
| --certificate-oidc-issuer https://token.actions.githubusercontent.com \ | ||
| uberos-0.4.0-beta.tar.gz |
Comment on lines
153
to
+155
| permissions: | ||
| contents: write | ||
| id-token: write # keyless cosign sign-blob via GitHub OIDC (issue #15) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds keyless supply-chain signing to the release pipeline (issue #15) using the hybrid model: GitHub build-provenance attestations for images, cosign
sign-blobfor the bundle. No private key is stored — both use GitHub Actions OIDC and the Sigstore transparency log.Changes
.github/workflows/release.ymlpublish-images: addsid-token: write+attestations: write, gives the build step anid, and addsactions/attest-build-provenance@v4.1.1per image keyed bysubject-digestwithpush-to-registry: true. One attestation per image covers both the pinned version tag and:beta(same digest).publish-release: addsid-token: write, installssigstore/cosign-installer@v4.1.0, signs each archive andchecksums.txtwithcosign sign-blob --bundle, and uploads the three.cosign.bundlefiles as release assets.README.mdgh attestation verify(images) andcosign verify-blob(bundle), notingchecksums.txtstill covers plain integrity.Verification for consumers
gh attestation verify oci://ghcr.io/jmservera/uberos/frontend:0.4.0-beta --repo jmservera/UbeROS cosign verify-blob \ --bundle uberos-0.4.0-beta.tar.gz.cosign.bundle \ --certificate-identity-regexp 'https://github.com/jmservera/UbeROS/.github/workflows/release.yml@.*' \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ uberos-0.4.0-beta.tar.gzValidation
actionlinton the workflow — clean.v*tag, so it validates end to end on the next release after merge. Steps are fail-closed so an unsigned or unattested artifact is never published silently.Notes
Follow-up: optional installer-side signature verification (
cosign verify-blobpreflight ininstall.sh) ships separately onrelease-signing/installer-verify.