security: sign release artifacts with keyless cosign + SLSA provenance (#104)#105
Merged
Conversation
find had no --show-price — only the deprecated search (which #44 merged into find) and the spot-centric spot command exposed pricing, so the canonical 'what does this cost' question couldn't be answered with the canonical search command. Add --show-price to find, populating the on-demand $/hr column via awsClient.OnDemandPrice (SageMaker ml.* keeps its management-premium rate). Composes with --regions. Default output is unchanged (no price column). Mirrors the old search behavior. Test: TestFindCommand_Flags asserts the flag; docs-gen/find.md regenerated (drift gate). Closes #50
#104) Signs checksums.txt with keyless cosign (Sigstore) using the release workflow's GitHub OIDC identity — no long-lived key. Since checksums.txt lists every artifact's SHA-256, one signature transitively authenticates the whole release: verify the bundle, then each file against checksums.txt. - .goreleaser.yaml: signs: block → cosign sign-blob --bundle (cosign 3.x emits the modern Sigstore bundle; the old --output-signature/-certificate flags are gone). Publishes checksums.txt.bundle. - release.yaml: install cosign (pinned installer), add id-token + attestations permissions, add actions/attest-build-provenance over checksums.txt for SLSA provenance. Validated locally end-to-end (key-based stand-in for the OIDC-only piece): GoReleaser invokes cosign, writes the bundle, cosign verify-blob --bundle returns Verified OK, and a tampered checksums.txt is rejected. Takes effect from the next tagged release. Refs spore-host#344. Closes #104
Trivy flagged google.golang.org/grpc v1.80.0/v1.81.1 (indirect) for GHSA-hrxh-6v49-42gf (HIGH). Repo-wide advisory-DB finding, folded into this signing PR to keep it green.
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of the suite-wide supply-chain effort (spore-host#344). Signs the downloadable CLI artifacts, which previously shipped with
checksums.txtonly (corruption detection, not publisher authentication).What
.goreleaser.yaml— asigns:block runs keylesscosign sign-blob --bundleoverchecksums.txt. Because that file lists the SHA-256 of every archive/package, one signature transitively authenticates the whole release. Keyless uses the release workflow's GitHub OIDC identity via Fulcio/Rekor — no long-lived key to manage or leak. Publisheschecksums.txt.bundle.release.yaml— installs cosign (pinnedcosign-installer), addsattestations: write, and addsactions/attest-build-provenanceoverchecksums.txtfor SLSA build provenance. (id-token: writewas already present.)cosign 3.x note
cosign 3.x emits the modern Sigstore bundle (
--bundle, bundling signature + Fulcio cert + Rekor entry) and no longer supports the old--output-signature/--output-certificateflags. Thesigns:block uses--bundleaccordingly — same lesson as the spored KMS work.Verified locally (end-to-end)
Using a key-based stand-in for the OIDC-only piece:
dist/checksums.txt.bundle✓cosign verify-blob --bundle …→ Verified OK ✓checksums.txt→ rejected (invalid signature) ✓goreleaser checkvalid (only the pre-existingbrewsdeprecation, untouched)Takes effect from the next tagged release. Closes #104.