Skip to content

Fix: Attest build provenance for every release tarball #1648

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
huang195 merged 1 commit into from
Nov 3, 2026
Merged

Fix: Attest build provenance for every release tarball #1648

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 6 additions & 5 deletions .github/workflows/release-binaries.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -309,7 +309,7 @@ jobs:
# pre-enable check in CONTRIBUTING for that reason. Nothing in this job
# compiles: it receives finished tarballs from jobs that cannot write.
contents: write
# Build provenance for the cortex-cpex tarballs (actions/attest-build-provenance).
# Build provenance for every tarball (actions/attest-build-provenance).
id-token: write
attestations: write
env:
Expand Down Expand Up @@ -357,12 +357,12 @@ jobs:
ls -l dist
cat dist/checksums.txt

- name: Attest build provenance for cortex-cpex
- name: Attest build provenance
# Same condition as the publish step: a dry run attests nothing.
if: github.event_name == 'push'
uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
with:
subject-path: dist/cortex-cpex_*.tar.gz
subject-path: dist/*.tar.gz

- name: Publish to GitHub Release
# A main push publishes too, which is the whole point of the channel; the
Expand Down Expand Up @@ -411,8 +411,9 @@ jobs:
fi
add 'Prebuilt `agentop` and `cortex` binaries for linux and macOS (amd64/arm64).'
add '`cortex-cpex_*` is `cortex` built with the cpex policy plugin, for macOS arm64 and'
add 'linux amd64/arm64 (static). Install it with `install.sh --cpex`; its provenance'
add 'verifies with `gh attestation verify <tarball> --repo rossoctl/cortex`.'
add 'linux amd64/arm64 (static). Install it with `install.sh --cpex`.'
add 'Every tarball carries build provenance:'
add '`gh attestation verify <tarball> --repo rossoctl/cortex`.'
add ''
# The rename shipped with no alias, so it has to be said somewhere a v0.7.0
# user will look. Drop this once no supported release predates it.
Expand Down
2 changes: 1 addition & 1 deletion CLAUDE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -373,7 +373,7 @@ darwin/amd64 FFI. The executable inside is still `cortex`, and `cortex
--version` prints `cortex (cpex) <ver>`. The workflow's jobs are `version`,
`build`, `build-cpex` (both `contents: read`) and `publish`, which alone
writes, refuses to publish unless every expected tarball arrived, writes one
`checksums.txt` over all of them, and attests the cpex tarballs' build
`checksums.txt` over all of them, and attests every tarball's build
provenance. `install.sh --cpex` installs it; `make cortex-cpex` builds the same
thing locally to `bin/cortex-cpex/cortex`.

Expand Down
4 changes: 2 additions & 2 deletions docs/laptop-service.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -136,8 +136,8 @@ cortex --version # cortex (cpex) v0.9.3
curl -s http://127.0.0.1:47601/v1/plugins | grep -c '"name":"cpex"' # 1
```

The tarballs carry build provenance as well as their `checksums.txt` entry:
`gh attestation verify cortex-cpex_<version>_<os>_<arch>.tar.gz --repo rossoctl/cortex`.
Every release tarball, cpex or not, carries build provenance as well as its `checksums.txt`

@clawgenti clawgenti Nov 3, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: "Every release tarball" is true from the next release onward, but the agentop/cortex tarballs of releases already published have no attestation, so gh attestation verify will fail for them. Consider naming the first release that carries it (e.g. "From vX.Y.Z, every release tarball...") so a user checking an older default tarball does not read the failure as tampering.

entry: `gh attestation verify <tarball> --repo rossoctl/cortex`.

The choice is not remembered. Re-running the installer without `--cpex` installs the
default build again, and says so first; keep passing `--cpex` to stay on it. Against a
Expand Down
Loading