From e505d5419aa2b659b5635c2b0355ac423435d423 Mon Sep 17 00:00:00 2001 From: "clap [bot]" Date: Wed, 18 Mar 2026 16:33:34 +0000 Subject: [PATCH 1/2] ci: sign release checksums with Sigstore/cosign (#21) Co-Authored-By: Claude Opus 4.6 --- .github/workflows/release.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d8f0c01..49dde29 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -7,6 +7,7 @@ on: permissions: contents: write + id-token: write jobs: release: @@ -24,6 +25,9 @@ jobs: - name: Run tests run: go test ./... -race -count=1 + - name: Install cosign + uses: sigstore/cosign-installer@v3 + - name: Build binaries run: | mkdir -p dist @@ -51,11 +55,15 @@ jobs: echo "=== checksums.txt ===" cat dist/checksums.txt + - name: Sign checksums with cosign + run: cosign sign-blob --yes dist/checksums.txt --bundle dist/checksums.txt.bundle + - name: Publish GitHub Release uses: softprops/action-gh-release@v2 with: files: | dist/*.tar.gz dist/checksums.txt + dist/checksums.txt.bundle generate_release_notes: true fail_on_unmatched_files: false From 0a0ba31f625a2b993bd3485d336afd7f62989eaf Mon Sep 17 00:00:00 2001 From: "clap [bot]" Date: Wed, 18 Mar 2026 16:33:38 +0000 Subject: [PATCH 2/2] docs: add release verification instructions (#21) Co-Authored-By: Claude Opus 4.6 --- README.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/README.md b/README.md index e24ccf9..e822424 100644 --- a/README.md +++ b/README.md @@ -270,6 +270,18 @@ To point canaries at your own server instead of snare.sh, edit `callback_base` i --- +## Verifying releases + +Release checksums are signed with [Sigstore/cosign](https://docs.sigstore.dev/) using keyless OIDC signing via GitHub Actions. To verify a downloaded release: + +```sh +cosign verify-blob --bundle checksums.txt.bundle checksums.txt +``` + +This confirms the checksums file was produced by the official GitHub Actions release workflow and has not been tampered with. + +--- + ## License Apache 2.0 — see [LICENSE](./LICENSE).