feat(release): sign checksums.txt with cosign keyless (Sigstore)#20
Merged
Palbahngmiyine merged 3 commits intoMay 11, 2026
Merged
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces keyless signing for release artifacts using Sigstore/Cosign. The ".goreleaser.yaml" configuration is updated to generate signatures and certificates for the checksum file, and the "README.md" now includes a detailed guide for manual verification. Feedback was provided to improve the regular expression in the verification command to ensure it correctly handles pre-release version tags.
Adds Sigstore-based keyless signing of checksums.txt via goreleaser's signs section. Each release will now publish checksums.txt.sig and checksums.txt.pem alongside the existing checksums file. The goreleaser job in release-please.yml gains id-token: write permission (for OIDC) and a sigstore/cosign-installer step. Mirrors the kubectl signed-artifact pattern: install scripts still verify SHA256 only (no change), and signature verification is documented as an optional advanced step in README.md. No user-facing behavior change for existing install/upgrade flows. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Moves the cosign verification walkthrough out of README into a dedicated VERIFYING.md and replaces the README section with a short pointer. VERIFYING.md adds the parts that didn't fit in README: trust model, cosign install instructions per platform, certificate identity explanation, and troubleshooting for the common verify-blob failures. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Palbahngmiyine
force-pushed
the
feat/cosign-release-signing
branch
from
a57b948 to
db82053
Compare
Removes "kubectl 와 동일한 모델/패턴" lines from README.md and VERIFYING.md per review feedback. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
signssection to.goreleaser.yaml— cosign keyless signschecksums.txt, producingchecksums.txt.sigandchecksums.txt.pemin each GitHub release.id-token: writeto thegoreleaserjob in.github/workflows/release-please.yml(job-scoped, not workflow-scoped) and add asigstore/cosign-installer@v3step.README.md, with the full walkthrough inVERIFYING.md.Security model
install.sh/install.ps1verify SHA256 againstchecksums.txt. No new dependencies forced on end users.cosign verify-blobagainstchecksums.txtusing the published.sig+.pemand the documented certificate identity regex / OIDC issuer. This proves the checksums file was produced by this repo's release workflow at a tagged commit, after which the existing SHA256 step extends that trust to each binary.Trade-offs considered
Effective from
The next release after this PR is merged. The current latest (
v0.1.7) is unaffected — no retroactive signatures.Test plan
checksums.txt.sig+checksums.txt.pemappear in the GitHub release assets.VERIFYING.mdsnippet against the new release and confirmVerified OK.install.sh/install.ps1continue to work unchanged (no .sig fetch, no behavior change).release-please.yml@refs/tags/<tag>.🤖 Generated with Claude Code