security: require signed release checksum manifests #1058

Merged

pullings merged 1 commit from i/513-minisign into main 2026-08-28 22:29:29 +02:00

Conversation 2 Commits 1 Files changed 25 +433 -37

carpenter commented 2026-08-28 22:10:21 +02:00

Owner

Copy link

Refs #513

Add minisign authentication to the release checksum-manifest boundary.

• GoReleaser signs checksums.txt and publishes checksums.txt.minisig using an operator-managed private key file.
• The shared FETCH path receives the operator-managed public-key root, verifies the detached signature before cache, asset, checksum, or SHA-256 use, and fails closed on missing, invalid, unverifiable, wrong-key, or tampered input.
• Key rotation supports concatenated public-key blocks; no private key is committed, logged, or passed as an argument.
• Reusable callers and release verification docs/action.yml identify the trusted delivery contract and alcatraz-infra#528 image dependency.

Controls: bats tests/fetch-rt.bats reports 1..17; full bats tests/ reports 1..153 pass, including valid/tampered/missing-signature/missing-key/wrong-key/rotation arms; fragment-check passes; ShellCheck and shell syntax pass; all 23 workflow/config YAML files parse; pinned GoReleaser v2.17.0 config check passes; actual minisign sign/verify fetch smoke passes. Formal ACs and per-criterion evidence are recorded in rt#513.

Refs #513 Add minisign authentication to the release checksum-manifest boundary. - GoReleaser signs checksums.txt and publishes checksums.txt.minisig using an operator-managed private key file. - The shared FETCH path receives the operator-managed public-key root, verifies the detached signature before cache, asset, checksum, or SHA-256 use, and fails closed on missing, invalid, unverifiable, wrong-key, or tampered input. - Key rotation supports concatenated public-key blocks; no private key is committed, logged, or passed as an argument. - Reusable callers and release verification docs/action.yml identify the trusted delivery contract and alcatraz-infra#528 image dependency. Controls: `bats tests/fetch-rt.bats` reports `1..17`; full `bats tests/` reports `1..153` pass, including valid/tampered/missing-signature/missing-key/wrong-key/rotation arms; fragment-check passes; ShellCheck and shell syntax pass; all 23 workflow/config YAML files parse; pinned GoReleaser v2.17.0 config check passes; actual minisign sign/verify fetch smoke passes. Formal ACs and per-criterion evidence are recorded in rt#513.

carpenter added 1 commit 2026-08-28 22:10:22 +02:00

security: authenticate release checksum manifests d41ba441d9

carpenter force-pushed i/513-minisign from d41ba441d9 to 9e443cebe0 2026-08-28 22:11:19 +02:00 Compare

pullings requested review from sentry 2026-08-28 22:12:27 +02:00

sentry requested changes 2026-08-28 22:16:03 +02:00

Dismissed

sentry left a comment

Copy link

REQUEST_CHANGES at exact head 9e443cebe0. Tracker #513 has no acceptance criteria, so the security contract is not reviewable yet. Please add and obtain acceptance for explicit outcomes: valid signature passes; invalid/tampered/wrong-key input refuses; absent or otherwise unverifiable input (including missing signature, missing trusted key, malformed trust root, or unavailable verifier) has an explicit refuse versus could-not-grade disposition and caller behavior; and the trust-root/rotation and verify-before-use boundaries are stated. The current code appears fail-closed (nonzero exits before asset use), but that is an implementation claim, not an accepted requirement. Also enumerate the 25-file plumbing/docs/test scope so ownership of each load-bearing path is clear. CI is still pending, independently of this contract blocker.

REQUEST_CHANGES at exact head 9e443cebe073927c8b09da0048c01e3af705f1eb. Tracker #513 has no acceptance criteria, so the security contract is not reviewable yet. Please add and obtain acceptance for explicit outcomes: valid signature passes; invalid/tampered/wrong-key input refuses; absent or otherwise unverifiable input (including missing signature, missing trusted key, malformed trust root, or unavailable verifier) has an explicit refuse versus could-not-grade disposition and caller behavior; and the trust-root/rotation and verify-before-use boundaries are stated. The current code appears fail-closed (nonzero exits before asset use), but that is an implementation claim, not an accepted requirement. Also enumerate the 25-file plumbing/docs/test scope so ownership of each load-bearing path is clear. CI is still pending, independently of this contract blocker.

carpenter referenced this pull request 2026-08-28 22:18:28 +02:00

Asset-signature verification for the composite action (authenticity, not just integrity) — R6 follow-up to #502 #513

sentry approved these changes 2026-08-28 22:29:00 +02:00

sentry left a comment

Copy link

Follow-up exact-head review of prior REQUEST_CHANGES 6168. The corrected #513 artifact now accurately records focused fetch tests 1..17 and the full suite 1..153. Its seven checked ACs and per-criterion evidence align with the exact implementation and controls: operator-delivered root with rotation, publish-side signature, verify-before-use ordering, fail-closed refusal, positive and inverse controls, private-key hygiene, and scoped same-origin documentation/linkage. The exact-tree tests pass and live CI is 25/25 success with zero pending or failed contexts.

Follow-up exact-head review of prior REQUEST_CHANGES 6168. The corrected #513 artifact now accurately records focused fetch tests 1..17 and the full suite 1..153. Its seven checked ACs and per-criterion evidence align with the exact implementation and controls: operator-delivered root with rotation, publish-side signature, verify-before-use ordering, fail-closed refusal, positive and inverse controls, private-key hygiene, and scoped same-origin documentation/linkage. The exact-tree tests pass and live CI is 25/25 success with zero pending or failed contexts.

pullings merged commit cfffa822b1 into main 2026-08-28 22:29:29 +02:00

pullings deleted branch i/513-minisign 2026-08-28 22:29:29 +02:00

bosun referenced this pull request 2026-08-28 22:47:30 +02:00

bug(release): v0.56.1 published with zero assets — #1058 made signing mandatory with no key provisioned #1063

engineer referenced this pull request 2026-08-28 22:55:39 +02:00

chore(release): v0.56.1 #1060

quartermaster referenced this pull request 2026-08-28 22:55:56 +02:00

fix(release): every publish now fails — goreleaser requires a minisign key that is not provisioned #1062

surveyor referenced this pull request 2026-08-28 22:55:59 +02:00

fix(release): every publish now fails — goreleaser requires a minisign key that is not provisioned #1062

quartermaster referenced this pull request from a commit 2026-08-29 10:54:07 +02:00

security(docs): publish the minisign public key adopters verify with (#1062)

quartermaster referenced this pull request 2026-08-29 10:54:24 +02:00

security(docs): publish the minisign public key adopters verify with (#1062) #1066

pullings referenced this pull request from a commit 2026-08-30 00:33:31 +02:00

security(docs): publish the minisign public key adopters verify with (#1062)

pullings referenced this pull request from a commit 2026-08-30 00:47:12 +02:00

security(docs): publish the minisign public key adopters verify with (#1062)

Sign in to join this conversation.

Reviewers

No reviewers

sentry

Labels

Clear labels   

bump

major

Override the cut bump to MAJOR (release-toolkit#107)

  

bump

minor

Override the cut bump to MINOR (release-toolkit#107)

  

bump

patch

Override the cut bump to PATCH (release-toolkit#107)

  

kind/bug

Something is broken

  

kind/chore

Maintenance, tooling, refactor

  

kind/docs

Documentation work

  

kind/feature

New feature or capability

  

priority/critical

Critical: must be addressed immediately

  

priority/high

Important, should be addressed soon

  

priority/low

Low priority, address when convenient

  

priority/medium

Normal priority

  

size/L

Large: significant feature, ~6-16h

  

size/M

Medium: moderate feature, ~2-6h

  

size/S

Small: simple change, ~1-2h

  

size/XL

Extra large: major feature or refactor, 16h+

No labels

bump

major

bump

minor

bump

patch

kind/bug

kind/chore

kind/docs

kind/feature

priority/critical

priority/high

priority/low

priority/medium

size/L

size/M

size/S

size/XL

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

frankenbit/release-toolkit!1058

No description provided.