Summary
The release workflow generates sha256sums.txt for tarballs/zips but does not cryptographically sign artifacts (no cosign, no GPG, no Authenticode for the Windows binary) and emits no SLSA provenance attestations proving the binary originated from this CI pipeline. Users must trust the integrity of GitHub's release storage; an attacker with write access to the release page (compromised PAT, compromised maintainer account) can replace artifacts and matching checksums simultaneously.
Distinct from #1553 (No SBOM shipped with releases) — that is about ingredient inventory; this is about authenticity attestation.
Where
.github/workflows/release.yml:236-241 (checksum generation; no signing)
Suggested approach
(1) Add actions/attest-build-provenance@v1 (GitHub-native, free, signs with Sigstore's Fulcio CA) on the build job — produces SLSA L3 provenance with no key management. (2) For Windows, add Authenticode signing via azure/trusted-signing-action if a code-signing cert is available. (3) Document verification in USER_GUIDE.md (gh attestation verify <artifact> -R Widthdom/CodeIndex).
Summary
The release workflow generates
sha256sums.txtfor tarballs/zips but does not cryptographically sign artifacts (no cosign, no GPG, no Authenticode for the Windows binary) and emits no SLSA provenance attestations proving the binary originated from this CI pipeline. Users must trust the integrity of GitHub's release storage; an attacker with write access to the release page (compromised PAT, compromised maintainer account) can replace artifacts and matching checksums simultaneously.Distinct from #1553 (No SBOM shipped with releases) — that is about ingredient inventory; this is about authenticity attestation.
Where
.github/workflows/release.yml:236-241(checksum generation; no signing)Suggested approach
(1) Add
actions/attest-build-provenance@v1(GitHub-native, free, signs with Sigstore's Fulcio CA) on the build job — produces SLSA L3 provenance with no key management. (2) For Windows, add Authenticode signing viaazure/trusted-signing-actionif a code-signing cert is available. (3) Document verification inUSER_GUIDE.md(gh attestation verify <artifact> -R Widthdom/CodeIndex).