provide cosign signures for each release

[bb-Ricardo]

Hi,

It would be great to provide signature bundles for all release artifacts. This would improve integrity and provide proof about the origin.

Cheers
Ricardo

[nklmilojevic]

Thanks for raising this! Yes, but in a slightly different shape - most of it is already there, it's just not easy to get to.

Every release is already signed keylessly through Sigstore. The release workflow runs actions/attest-build-provenance over all archives, packages and SBOMs, and that produces a Sigstore bundle (v0.3, SLSA v1 provenance) tied to .github/workflows/release.yaml. It's the same bundle format cosign produces and verifies. Today you can check any asset with:

gh attestation verify sofka-v0.34.0-x86_64-unknown-linux-gnu.tar.gz -R nklmilojevic/sofka

What's missing:

1. Bundle as a release asset - the bundle only lives in GitHub's attestation API, so cosign users and offline verification have nothing to pass to --bundle. One bundle covers every asset, so we'll upload it as a single sofka-v<version>.sigstore.json next to the rest.
2. SHA256SUMS signed too - it isn't covered by the attestation right now, so the checksum file has no signed root. It goes into the same attestation.
3. Docs - how to verify with both gh attestation verify and cosign verify-blob-attestation.

Out of scope: a separate keyed cosign signature (keyless already proves the origin and a second signing path is just more to keep in sync), and re-signing past releases.

I'll create an issue for this and link it here.

[nklmilojevic]

Created #1036 for this. Closing this one, follow along there :)