feat(plugin-host): cosign-based signing + registry publishing pipeline - #457
Merged
Conversation
…233) Adds packages/go/plugins/sign with: - Identity parser/matcher for github.com/<org>, gitlab.com/<group>, mailto:<email>, sha256:<fp> publisher identity schemes. - Verifier with keyless (Fulcio + Rekor) and keyed (long-lived cosign key) modes. Falls back to keyed when no Fulcio cert is present. - Canonical bundle-digest computation that excludes signatures/. - In-memory Rekor-result cache keyed by canonical digest. - EnvKeySource (COSIGN_PUBLIC_KEY / COSIGN_PUBLIC_KEY_FILE) and a bundle-local PEM override for self-contained air-gapped bundles. - Wire shape: signatures/cosign.sig, signatures/cosign.bundle, signatures/publisher.json. publisher.json lives in signatures/ (not manifest.json) because the gonext.io/v1 manifest schema is frozen with additionalProperties:false. Tests cover keyless happy path, identity mismatch rejection, Rekor unreachable, future-dated Rekor entries, keyed happy path, bundle-local PEM override, no-key keyed mode, missing signature, cache hit, env key source, and PEM fingerprint stability across CRLF/LF. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> Signed-off-by: Claude (for tayebmokni) <tayeb.mokni@gmail.com>
Wraps cosign sign-blob to produce the bundle's canonical-digest signature and writes signatures/cosign.sig, signatures/cosign.bundle, and signatures/publisher.json into the bundle zip. Keyless mode (default) requires --identity (the SAN cosign will bind); keyed mode (--key cosign.key) is for air-gapped publishers and embeds the public key into the bundle so verification is self-contained. The CLI's canonical-digest computation routes through plugins/sign.MarshalCanonicalBundleForSigning so the host verifier and the signer agree on what bytes the signature covers (signatures/ is stripped before hashing). Existing signatures are replaced when a bundle is re-signed. Tests cover dry-run digest+identity rendering, missing-identity rejection, bad-identity rejection, and missing-bundle handling. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> Signed-off-by: Claude (for tayebmokni) <tayeb.mokni@gmail.com>
Adds .github/workflows/plugin-publish.yml: triggered by `plugin/<slug>/v*`
tags, the workflow builds the bundle, runs `gonext plugin test`,
scans with trivy (HIGH+CRITICAL exit-on-find), computes a
capability-diff against the previous tag, signs with cosign keyless
(GitHub OIDC), and pushes to ghcr.io as an OCI artefact under
ghcr.io/<owner>/plugins/<slug>:<version>. cosign attaches the
signature to the OCI ref so operator-side install can verify against
the registry without unzipping.
OCI artefact contract documented inline in the workflow:
- layer mediaType: application/vnd.gonext.plugin.bundle.v1+zip
- config mediaType: application/vnd.gonext.plugin.config.v1+json
- config body: { slug, version, publisher }
Adds `gonext plugin diff` (cli/gonext/cmd/plugin/diff.go) that emits
the added/removed/unchanged capability set between two bundle
versions, in human or --json format. Accepts both v1-schema arrays
and legacy lifecycle map-shaped capabilities so the diff works
through the migration window. The pipeline writes the diff into the
GitHub-summary panel so operators see the surface they're accepting
before they activate.
Tests cover added/removed/unchanged splits, the legacy map shape,
the no-change message, and arg validation.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Signed-off-by: Claude (for tayebmokni) <tayeb.mokni@gmail.com>
tayebmokni
enabled auto-merge (squash)
May 25, 2026 19:29
|
Heads up — this PR touches strings that often signal a security disclosure ( If this PR fixes or describes a real vulnerability that has not yet been publicly disclosed, please stop and use the private path:
See If this is a false positive (test fixture, doc update, release notes, etc.) please ignore this comment — the check is advisory only and does not block the PR. Matched files:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #130, #233, #274.
Plugin supply chain:
Capability-diff prints what cap each new version added/removed -- operators see the surface they're accepting.
🤖 Generated with Claude Code