Repository navigation
ci(release): attest build provenance and attach the bundle to releases - #97
Merged
Merged
Conversation
The release job already requested attestations: write but produced no provenance. After goreleaser publishes, attest every artifact listed in checksums.txt (source tarball and SBOM) with actions/attest-build-provenance, which records SLSA v1 build provenance signed keyless via Sigstore in GitHub's attestation API, and upload the Sigstore bundle to the release as queue-<version>.sigstore.json so it can be verified without API access. The SLSA generic generator was considered and rejected: it is no longer maintained, must be referenced by tag (costing Pinned-Dependencies points), and the SLSA project itself now points new integrations at artifact attestations. Scorecard's Signed-Releases check stays at 8 until it learns to credit attestations (ossf/scorecard#5001); renaming the bundle to .intoto.jsonl to force a 10 would misdescribe its format and is not done. The release footer documents gh attestation verify, online and with the attached bundle. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #97 +/- ##
=========================================
Coverage 100.00% 100.00%
=========================================
Files 6 6
Lines 552 552
=========================================
Hits 552 552
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The release job has requested
attestations: writesince the cosign work but never produced provenance, which is why Scorecard's Signed-Releases sits at 8 with "does not have provenance" on every release. After goreleaser publishes, the job now attests every artifact listed inchecksums.txt(source tarball and SBOM) withactions/attest-build-provenance, giving SLSA v1 build provenance signed keyless via Sigstore and stored in GitHub's attestation API, then uploads the Sigstore bundle to the release asqueue-<version>.sigstore.jsonso it can be verified withgh attestation verify --bundlewithout API access. The release footer gains both verification commands. Existing cosign signatures are unchanged.The SLSA generic generator was the other route and was rejected after research: its README says it is no longer maintained and points new integrations at artifact attestations, it must be referenced by tag which would drop Pinned-Dependencies from 10, and it ships Node 20 actions with an unanswered Node 24 issue. Scorecard itself has an open proposal to stop using it (ossf/scorecard#5308).
Risk: Signed-Releases stays at 8 for now. Scorecard only credits a
.intoto.jsonlasset as provenance; attestation-API support is pending in ossf/scorecard#5001, after which every asset here is already attested. Renaming the bundle to.intoto.jsonlwould score 10 today but misdescribe a Sigstore bundle as DSSE JSON Lines, so it is deliberately not done.Verified with actionlint and YAML parsing only. The real test is the next tagged release: the bundle should appear as a release asset and
gh attestation verify queue-<version>-source.tar.gz -R adrianbrad/queueshould pass.