v1.4.2

v1.4.1 was tagged but not released. The release job runs the test suite before it signs anything, and it did not install curl, which the new cleartext URL tests need, so the v1.4.1 tag failed them and nothing was signed or published. This release is v1.4.1 with that job fixed (#83); the script differs from the v1.4.1 tag's only in VERIFIER_VERSION. Everything below is released for the first time here.

verify-attestation.sh changes in this release. The new sha256 is 23dc7a87ede8a68dad5300eec966e3f73bec1b5badd35aed0db0f1bca54fa4a2; v1.4.0's was dc6f227a…. If you pin the script by hash, update the pin.

Output changes. Exit codes keep their meaning. Two things print differently: a value given on the command line and printed back, and curl's message about a failed fetch, now show control characters and non-ASCII bytes as \xHH; and a cleartext --status-keys URL whose host is not exactly localhost, 127.0.0.1 or [::1] is now refused instead of fetched with a warning.

Security

• A stricter loopback check for cleartext status URLs (#70, #73; hardening, no advisory).
  • The exception for http:// --status-keys and --status URLs matched URL prefixes, so some URLs whose host is not loopback counted as loopback. Only http://localhost, http://127.0.0.1 and http://[::1], with an optional port, now count; the host is matched case-sensitively, and a ? or # directly after the host or port does not count.
  • A loopback fetch ignores ~/.curlrc and the proxy settings; with a proxy set, it used to go to the proxy in cleartext.
  • A {a,b} or [1-9] in a URL is no longer expanded into several fetches.
  • An attacker who can choose the URL could already serve their own keys over https, so no verdict changes that --anchor-file does not already decide. Use --anchor-file to bind the status key.

Fixed

• The container image is built from this release on. The image job for v1.4.0 downloaded only some of the files that SHA256SUMS lists, so no v1.4.0 image exists. It now reads the list from the verified SHA256SUMS; ghcr.io/hodeitek/hodeishield-attest-verifier:v1.4.2 is the first image. See A signed image for how to verify it.
• Escaped command-line values (#71). --expect-slug, --expect-issuer, --expect-nonce, the --status and --status-keys URLs, an unknown argument and curl's message about a failed fetch reached the terminal as given. They are now printed like the values of a document: control characters and bytes outside printable ASCII as \xHH.

Changed

• More bash parsers read the script. The 10# arithmetic and two other constructs that Semgrep's bash parser rejected are written another way, with no change in behaviour. CI fails if semgrep --lang bash, pinned to an exact version, cannot parse the whole script.
• README (#72): the "Attested content" block shows a non-printable character as ? and prints other text as UTF-8; check lines and messages use \xHH.

Verify this release

sha256sum -c SHA256SUMS
cosign verify-blob --bundle verify-attestation.sh.sigstore.json \
  --certificate-identity "https://github.com/Hodeitek/hodeishield-attest-verifier/.github/workflows/release.yml@refs/tags/v1.4.2" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  verify-attestation.sh
cosign verify-blob --bundle keys-statement.json.sigstore.json \
  --certificate-identity "https://github.com/Hodeitek/hodeishield-attest-verifier/.github/workflows/release.yml@refs/tags/v1.4.2" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  keys-statement.json

verify-attestation.sh sha256: 23dc7a87ede8a68dad5300eec966e3f73bec1b5badd35aed0db0f1bca54fa4a2

Full changelog: v1.4.0...v1.4.2