From 1af9ab2644bfd7b68b917b61540a4a549f9cbef5 Mon Sep 17 00:00:00 2001 From: Hai Huang Date: Tue, 3 Nov 2026 10:32:57 -0500 Subject: [PATCH] Fix: Attest build provenance for every release tarball Only the cortex-cpex tarballs got build provenance. The default cortex and agentop tarballs, which most users install, had checksums only, so gh attestation verify failed for them. The attest step now covers dist/*.tar.gz. The release notes, the laptop docs and CLAUDE.md now say that every tarball carries provenance. Part of #1641 Assisted-By: Claude (Anthropic AI) Signed-off-by: Hai Huang --- .github/workflows/release-binaries.yaml | 11 ++++++----- CLAUDE.md | 2 +- docs/laptop-service.md | 4 ++-- 3 files changed, 9 insertions(+), 8 deletions(-) diff --git a/.github/workflows/release-binaries.yaml b/.github/workflows/release-binaries.yaml index cefb44c66..d1d97dd1b 100644 --- a/.github/workflows/release-binaries.yaml +++ b/.github/workflows/release-binaries.yaml @@ -309,7 +309,7 @@ jobs: # pre-enable check in CONTRIBUTING for that reason. Nothing in this job # compiles: it receives finished tarballs from jobs that cannot write. contents: write - # Build provenance for the cortex-cpex tarballs (actions/attest-build-provenance). + # Build provenance for every tarball (actions/attest-build-provenance). id-token: write attestations: write env: @@ -357,12 +357,12 @@ jobs: ls -l dist cat dist/checksums.txt - - name: Attest build provenance for cortex-cpex + - name: Attest build provenance # Same condition as the publish step: a dry run attests nothing. if: github.event_name == 'push' uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 with: - subject-path: dist/cortex-cpex_*.tar.gz + subject-path: dist/*.tar.gz - name: Publish to GitHub Release # A main push publishes too, which is the whole point of the channel; the @@ -411,8 +411,9 @@ jobs: fi add 'Prebuilt `agentop` and `cortex` binaries for linux and macOS (amd64/arm64).' add '`cortex-cpex_*` is `cortex` built with the cpex policy plugin, for macOS arm64 and' - add 'linux amd64/arm64 (static). Install it with `install.sh --cpex`; its provenance' - add 'verifies with `gh attestation verify --repo rossoctl/cortex`.' + add 'linux amd64/arm64 (static). Install it with `install.sh --cpex`.' + add 'Every tarball carries build provenance:' + add '`gh attestation verify --repo rossoctl/cortex`.' add '' # The rename shipped with no alias, so it has to be said somewhere a v0.7.0 # user will look. Drop this once no supported release predates it. diff --git a/CLAUDE.md b/CLAUDE.md index ec4c53954..5173f90cc 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -373,7 +373,7 @@ darwin/amd64 FFI. The executable inside is still `cortex`, and `cortex --version` prints `cortex (cpex) `. The workflow's jobs are `version`, `build`, `build-cpex` (both `contents: read`) and `publish`, which alone writes, refuses to publish unless every expected tarball arrived, writes one -`checksums.txt` over all of them, and attests the cpex tarballs' build +`checksums.txt` over all of them, and attests every tarball's build provenance. `install.sh --cpex` installs it; `make cortex-cpex` builds the same thing locally to `bin/cortex-cpex/cortex`. diff --git a/docs/laptop-service.md b/docs/laptop-service.md index 630b4ea57..4c19cb357 100644 --- a/docs/laptop-service.md +++ b/docs/laptop-service.md @@ -136,8 +136,8 @@ cortex --version # cortex (cpex) v0.9.3 curl -s http://127.0.0.1:47601/v1/plugins | grep -c '"name":"cpex"' # 1 ``` -The tarballs carry build provenance as well as their `checksums.txt` entry: -`gh attestation verify cortex-cpex___.tar.gz --repo rossoctl/cortex`. +Every release tarball, cpex or not, carries build provenance as well as its `checksums.txt` +entry: `gh attestation verify --repo rossoctl/cortex`. The choice is not remembered. Re-running the installer without `--cpex` installs the default build again, and says so first; keep passing `--cpex` to stay on it. Against a