Skip to content

fix(release): migrate cosign signing to the Sigstore bundle format #459

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
joshua-temple merged 1 commit into from
Jul 5, 2026
Merged

fix(release): migrate cosign signing to the Sigstore bundle format #459

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 6 additions & 5 deletions .goreleaser.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,18 +41,19 @@ sboms:
- "{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}.sbom.spdx.json"

signs:
# cosign keyless signing (OIDC + sigstore)
# cosign keyless signing (OIDC + sigstore). cosign v3 defaults to the
# Sigstore bundle format and no longer supports the separate
# --output-signature/--output-certificate outputs, so the signature and
# certificate are packaged together in a single .bundle artifact.
- id: cosign
cmd: cosign
args:
- sign-blob
- --output-certificate=${certificate}
- --output-signature=${signature}
- --bundle=${signature}
- ${artifact}
- --yes
artifacts: checksum
signature: "${artifact}.sig"
certificate: "${artifact}.pem"
signature: "${artifact}.bundle"
output: true

# GPG signing. The release key has no passphrase (it lives only as a repo
Expand Down
7 changes: 3 additions & 4 deletions docs/release-verification.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,20 +8,19 @@ Cascade uses keyless cosign signing via Sigstore, which does not require key man

1. Install cosign (https://github.com/sigstore/cosign/releases).

2. Download the release artifacts and signatures from the GitHub release page (checksums.txt, checksums.txt.sig, checksums.txt.pem, and the archives).
2. Download the release artifacts and the signature bundle from the GitHub release page (checksums.txt, checksums.txt.bundle, and the archives). The bundle packages the signature and the signing certificate together in the Sigstore bundle format.

3. Verify the checksums file signature:

```bash
cosign verify-blob \
--certificate=checksums.txt.pem \
--signature=checksums.txt.sig \
--bundle=checksums.txt.bundle \
--certificate-identity-regexp='^https://github.com/stablekernel/cascade' \
--certificate-oidc-issuer=https://token.actions.githubusercontent.com \
checksums.txt
```

The certificate is issued by Sigstore's public certificate authority. cosign automatically verifies the certificate chain and confirms the signature was created by GitHub Actions during the release workflow run.
The bundle contains the signature and the certificate issued by Sigstore's public certificate authority. cosign automatically verifies the certificate chain and confirms the signature was created by GitHub Actions during the release workflow run.

4. Verify the checksums match the downloaded binaries:

Expand Down