Repository navigation
Fix: Attest build provenance for every release tarball - #1648
Conversation
Only the cortex-cpex tarballs got build provenance. The default cortex and agentop tarballs, which most users install, had checksums only, so gh attestation verify failed for them. The attest step now covers dist/*.tar.gz. The release notes, the laptop docs and CLAUDE.md now say that every tarball carries provenance. Part of rossoctl#1641 Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com> Signed-off-by: Hai Huang <huang195@gmail.com>
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 44 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. CodeRabbit Verify
|
clawgenti
left a comment
clawgenti
left a comment
There was a problem hiding this comment.
Summary
Widening subject-path from dist/cortex-cpex_*.tar.gz to dist/*.tar.gz makes the existing provenance step cover all 11 release tarballs (8 agentop/cortex plus 3 cortex-cpex). The step still runs after the fail-closed presence check and before publish, keeps the same event_name == 'push' gate (a dispatch dry run attests nothing), and the job already holds id-token: write / attestations: write. The glob matches only the tarballs (checksums.txt is excluded), so it lines up with what gh release upload/create publishes. The release notes, docs/laptop-service.md and CLAUDE.md now match the workflow, and no other doc still says provenance is cpex-only. One non-blocking nit inline.
Author: huang195 (MEMBER — maintainer)
Areas reviewed: CI/GitHub Actions, Docs
Agent/IDE config (.claude/.vscode): none
Commits: 1 commit, all signed-off: yes
CI status: all completed checks passing (a few Go/Python jobs still pending; none failing). The attest step is push-only, so as the PR notes, the first real check is gh attestation verify on the next release.
|
|
||
| The tarballs carry build provenance as well as their `checksums.txt` entry: | ||
| `gh attestation verify cortex-cpex_<version>_<os>_<arch>.tar.gz --repo rossoctl/cortex`. | ||
| Every release tarball, cpex or not, carries build provenance as well as its `checksums.txt` |
There was a problem hiding this comment.
nit: "Every release tarball" is true from the next release onward, but the agentop/cortex tarballs of releases already published have no attestation, so gh attestation verify will fail for them. Consider naming the first release that carries it (e.g. "From vX.Y.Z, every release tarball...") so a user checking an older default tarball does not read the failure as tampering.
github-project-automation
Bot
moved this from New/ToDo
to Done
in Rossoctl Issue Prioritization
Problem
Part of #1641.
release-binaries.yamlattests build provenance only for thecortex-cpextarballs. The defaultcortexandagentoptarballs, which most users install, have achecksums.txtentry but no provenance.gh attestation verifyfails for them, so a user cannot prove that a binary came from this repo's CI.Change
attest-build-provenancestep now coversdist/*.tar.gz, which is every tarball. The step condition is the same as before (event_name == 'push'), so a dry run still attests nothing.docs/laptop-service.mdandCLAUDE.mdnow say that every tarball carries provenance.Verification
v*tag, ormainwhen the main channel is on), so this PR cannot exercise it. The first real check is the next release:gh attestation verify cortex_<ver>_<os>_<arch>.tar.gz --repo rossoctl/cortexmust pass.Not in this PR
project.ymlpart of security: Supply chain: provenance for all release binaries, bump go-jose to 4.1.6, pin project.yml #1641 (pass onlyADD_TO_PROJECT_PAT) needs fix: Declare ADD_TO_PROJECT_PAT so callers can pass only that secret .github#137 first. It follows as a separate PR.go-spiffe, and only for JWT-SVIDs and bundles from the local SPIRE agent.Assisted-By: Claude (Anthropic AI) noreply@anthropic.com