v0.4.1 - wsc-attestation crate

🎉 wsc WebAssembly Components Release

📦 What's Included

Component Library (WIT Interface):

• wsc-component.wasm - WebAssembly component library with WIT bindings
• wsc-component.wasm.sha256 - SHA256 checksum
• Signed OCI artifact: ghcr.io/pulseengine/wsc:v0.4.1

CLI Tool (WASI Binary):

• wsc-cli.wasm - WASI command-line tool for Wasmtime
• wsc-cli.wasm.sha256 - SHA256 checksum
• Signed OCI artifact: ghcr.io/pulseengine/wsc:v0.4.1-cli

🔐 Security Features

• ✅ WASM Module Signing - Signed with wsc keyless signing (dogfooding!)
• ✅ OCI Artifact Signing - Signed with Cosign using GitHub OIDC (keyless)
• ✅ SLSA Provenance - Build attestation included
• ✅ SHA256 Checksums - For download verification

wsc Keyless Signing:

• Identity: GitHub Actions OIDC
• Certificate: Short-lived from Fulcio (Sigstore)
• Transparency: Logged in Rekor transparency log

🚀 Usage

Download WASM Component

# Download and verify checksum
TAG=v0.4.1
wget https://github.com/pulseengine/wsc/releases/download/${TAG}/wsc.wasm
wget https://github.com/pulseengine/wsc/releases/download/${TAG}/wsc.wasm.sha256
sha256sum -c wsc.wasm.sha256

Pull Signed OCI Artifact

TAG=v0.4.1

# Pull the signed OCI artifact with oras
oras pull ghcr.io/pulseengine/wsc:${TAG}

# Verify signature with Cosign
cosign verify \
  --certificate-identity-regexp="https://github.com/pulseengine/wsc" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/pulseengine/wsc:${TAG}

# Verify SLSA provenance
cosign verify-attestation \
  --type slsaprovenance \
  --certificate-identity-regexp="https://github.com/pulseengine/wsc" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/pulseengine/wsc:${TAG}

🔍 Verification

Verify WASM Module Signature (wsc)

# Verify keyless signature (offline - no network required!)
wsc verify --keyless \
  --cert-identity "https://github.com/pulseengine/wsc/.github/workflows/release.yml@refs/tags/${TAG}" \
  --cert-oidc-issuer "https://token.actions.githubusercontent.com" \
  -i wsc-component.wasm

# Or verify without identity constraints
wsc verify --keyless -i wsc-component.wasm

Verify OCI Artifact Signature (Cosign)

TAG=v0.4.1

# Verify Cosign signature
cosign verify \
  --certificate-identity-regexp="https://github.com/pulseengine/wsc" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/pulseengine/wsc:${TAG}

# Verify SLSA provenance
cosign verify-attestation \
  --type slsaprovenance \
  --certificate-identity-regexp="https://github.com/pulseengine/wsc" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/pulseengine/wsc:${TAG}

All releases are:

• Built in GitHub Actions with full transparency
• Signed with wsc keyless signing (WASM modules)
• Signed with Cosign using keyless signing (OCI artifacts)
• Attested with SLSA provenance
• Checksummed with SHA256

📚 Documentation

See README.md for usage details.