bug: release checksums have duplicated content

[jiparis]

The installer is failing:

Step 1.2: Verifying checksum
sha256sum: chainloop-linux-amd64.sig: No such file or directory
chainloop-linux-amd64: OK
sha256sum: WARNING: 1 listed file could not be read
chainloop-linux-amd64.sig: FAILED open or read

[migmartri]

Root Cause

The .sig files appearing in checksums.txt is caused by the goreleaser GitHub Action using version: latest (release.yaml L115). A newer goreleaser version was picked up between v1.88.1 and v1.89.0 that changed how signed artifacts interact with the checksum file.

The goreleaser config itself hasn't changed — the signs block has artifacts: all which signs all artifacts. The new goreleaser version now also includes those .sig files in checksums.txt.

v1.88.1 checksums.txt (4 entries — binaries only):

chainloop-darwin-amd64
chainloop-darwin-arm64
chainloop-linux-amd64
chainloop-linux-arm64

v1.89.0 checksums.txt (9 entries — binaries + .sig files + checksums.txt.sig):

chainloop-darwin-amd64
chainloop-darwin-amd64.sig
chainloop-darwin-arm64
chainloop-darwin-arm64.sig
chainloop-linux-amd64
chainloop-linux-amd64.sig
chainloop-linux-arm64
chainloop-linux-arm64.sig
checksums.txt.sig

Possible Fixes

1. Pin the goreleaser version in .github/workflows/release.yaml to avoid surprise behavior changes
2. Change artifacts: all to artifacts: checksum in .goreleaser.yml signs block to only sign the checksums file, which would stop .sig files from appearing in checksums.txt

[migmartri]

Update: Exact Root Cause Found

The goreleaser version changed between releases:

• v1.88.1: GoReleaser v2.14.3
• v1.89.0: GoReleaser v2.15.0

The behavior change comes from goreleaser/goreleaser#6490 ("feat: add UploadableTypes canonical var and use it across pipes"), which refactored the checksums and signing pipes to use a single canonical UploadableTypes list. In doing so, it added UploadableFile to the checksum pipe, which causes .sig files to be included in checksums.txt.

From the PR description:

Also fixes reportsizes and checksums missing several uploadable types (UploadableBinary, UploadableFile, UploadableSourceArchive, SBOM, PyWheel, PySdist in reportsizes; UploadableFile in checksums)

This is picked up because our release workflow uses version: latest for goreleaser (release.yaml L115).

[migmartri]

Signature Verification Broken

Confirmed that cosign verify-blob fails for v1.89.0's checksums.txt:

$ cosign verify-blob --key cosign.pub --signature checksums.txt.sig checksums.txt
Error: verifying blob [checksums.txt]: invalid signature when validating ASN.1 encoded signature

v1.88.1 verifies fine.

The cause is the circular dependency introduced by goreleaser v2.15.0 (goreleaser/goreleaser#6490):

1. checksums.txt is generated
2. It gets signed → checksums.txt.sig
3. The hash of checksums.txt.sig is appended back into checksums.txt
4. checksums.txt no longer matches its signature

No existing upstream issue found — needs to be filed against goreleaser/goreleaser. In the meantime, we should pin goreleaser to v2.14.3 in release.yaml.