Skip to content

v0.2.3

Choose a tag to compare

View all tags
@github-actions github-actions released this 04 Jul 21:11
v0.2.3
ff13420

leash v0.2.3 makes every release verifiable. No behavior or config changes.

Container image: docker pull ghcr.io/sylvester-francis/leash:0.2.3

Added: a signed release supply chain

All keyless (signer identity is the GitHub Actions workflow via OIDC, recorded in the Rekor transparency log; there is no private key):

  • Binaries carry a cosign signature over checksums.txt (checksums.txt.sig + .pem), a CycloneDX SBOM per archive (*.sbom.json), and a SLSA build-provenance attestation.
  • The container image is cosign-signed by manifest digest and carries its own build-provenance attestation in GHCR.

Verify a download

# binaries
cosign verify-blob --certificate checksums.txt.pem --signature checksums.txt.sig \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp 'https://github.com/sylvester-francis/leash/.github/workflows/release.yml@.*' \
  checksums.txt
gh attestation verify leash_0.2.3_linux_amd64.tar.gz --repo sylvester-francis/leash

# image
cosign verify ghcr.io/sylvester-francis/leash:0.2.3 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp 'https://github.com/sylvester-francis/leash/.github/workflows/docker-publish.yml@.*'
gh attestation verify oci://ghcr.io/sylvester-francis/leash:0.2.3 --repo sylvester-francis/leash

Full detail in docs/security-model.md.

Assets 17
Loading