Closes M-10 (supply-chain authenticity). Replaces the TODO comment with
a working cosign keyless OIDC signing flow.
Workflow (release.yml):
- Add id-token: write permission (required for GitHub OIDC token).
- Add sigstore/cosign-installer@v3 step.
- After SHA256SUMS is generated, cosign sign-blob --yes produces
SHA256SUMS.pem (certificate) and SHA256SUMS.sig (signature).
These are uploaded alongside the existing release assets.
- No long-lived secret is stored on GitHub; the signing identity is
the ephemeral GitHub Actions OIDC token bound to this workflow + tag.
- Release notes body updated with the cosign verify-blob command so
users know how to verify authenticity end-to-end.
Installers (install.sh / update.sh):
- Add verify_release_cosign() function. OPT-IN via
THREE_M_UI_VERIFY_COSIGN=1 (off by default to keep the curl|bash UX
simple — SHA256SUMS integrity is already fail-closed).
- When enabled AND cosign is installed, downloads SHA256SUMS.pem +
SHA256SUMS.sig and runs cosign verify-blob against the identity
'https://github.com/<repo>/.github/workflows/release.yml@refs/tags/<tag>'.
- If cosign is missing or the release predates signing, prints a
warning and continues (does not hard-fail).
- If verification runs and FAILS, aborts (fail-closed, bypassable via
THREE_M_UI_INSECURE=1).
Threat model:
- Before: SHA256SUMS provided integrity but not authenticity — an
attacker who could modify the release assets could also modify
SHA256SUMS, defeating the checksum.
- After: cosign signature ties SHA256SUMS to the GitHub Actions OIDC
identity, so a modified sums file fails signature verification even
if the attacker controls the release CDN.
Verification command (for end users):
cosign verify-blob \
--certificate SHA256SUMS.pem \
--signature SHA256SUMS.sig \
--certificate-identity 'https://github.com/kazeyukiro/3m-ui/.github/workflows/release.yml@refs/tags/<tag>' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
SHA256SUMS
feat(release): cosign keyless signing of SHA256SUMS
Closes M-10 (supply-chain authenticity). Replaces the TODO comment with
a working cosign keyless OIDC signing flow.
Workflow (release.yml):
- Add id-token: write permission (required for GitHub OIDC token).
- Add sigstore/cosign-installer@v3 step.
- After SHA256SUMS is generated, cosign sign-blob --yes produces
SHA256SUMS.pem (certificate) and SHA256SUMS.sig (signature).
These are uploaded alongside the existing release assets.
- No long-lived secret is stored on GitHub; the signing identity is
the ephemeral GitHub Actions OIDC token bound to this workflow + tag.
- Release notes body updated with the cosign verify-blob command so
users know how to verify authenticity end-to-end.
Installers (install.sh / update.sh):
- Add verify_release_cosign() function. OPT-IN via
THREE_M_UI_VERIFY_COSIGN=1 (off by default to keep the curl|bash UX
simple — SHA256SUMS integrity is already fail-closed).
- When enabled AND cosign is installed, downloads SHA256SUMS.pem +
SHA256SUMS.sig and runs cosign verify-blob against the identity
'https://github.com/<repo>/.github/workflows/release.yml@refs/tags/<tag>'.
- If cosign is missing or the release predates signing, prints a
warning and continues (does not hard-fail).
- If verification runs and FAILS, aborts (fail-closed, bypassable via
THREE_M_UI_INSECURE=1).
Threat model:
- Before: SHA256SUMS provided integrity but not authenticity — an
attacker who could modify the release assets could also modify
SHA256SUMS, defeating the checksum.
- After: cosign signature ties SHA256SUMS to the GitHub Actions OIDC
identity, so a modified sums file fails signature verification even
if the attacker controls the release CDN.
Verification command (for end users):
cosign verify-blob \
--certificate SHA256SUMS.pem \
--signature SHA256SUMS.sig \
--certificate-identity 'https://github.com/kazeyukiro/3m-ui/.github/workflows/release.yml@refs/tags/<tag>' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
SHA256SUMS
feat(release): cosign keyless signing of SHA256SUMS
Closes M-10 (supply-chain authenticity). Replaces the TODO comment with
a working cosign keyless OIDC signing flow.
Workflow (release.yml):
- Add id-token: write permission (required for GitHub OIDC token).
- Add sigstore/cosign-installer@v3 step.
- After SHA256SUMS is generated, cosign sign-blob --yes produces
SHA256SUMS.pem (certificate) and SHA256SUMS.sig (signature).
These are uploaded alongside the existing release assets.
- No long-lived secret is stored on GitHub; the signing identity is
the ephemeral GitHub Actions OIDC token bound to this workflow + tag.
- Release notes body updated with the cosign verify-blob command so
users know how to verify authenticity end-to-end.
Installers (install.sh / update.sh):
- Add verify_release_cosign() function. OPT-IN via
THREE_M_UI_VERIFY_COSIGN=1 (off by default to keep the curl|bash UX
simple — SHA256SUMS integrity is already fail-closed).
- When enabled AND cosign is installed, downloads SHA256SUMS.pem +
SHA256SUMS.sig and runs cosign verify-blob against the identity
'https://github.com/<repo>/.github/workflows/release.yml@refs/tags/<tag>'.
- If cosign is missing or the release predates signing, prints a
warning and continues (does not hard-fail).
- If verification runs and FAILS, aborts (fail-closed, bypassable via
THREE_M_UI_INSECURE=1).
Threat model:
- Before: SHA256SUMS provided integrity but not authenticity — an
attacker who could modify the release assets could also modify
SHA256SUMS, defeating the checksum.
- After: cosign signature ties SHA256SUMS to the GitHub Actions OIDC
identity, so a modified sums file fails signature verification even
if the attacker controls the release CDN.
Verification command (for end users):
cosign verify-blob \
--certificate SHA256SUMS.pem \
--signature SHA256SUMS.sig \
--certificate-identity 'https://github.com/kazeyukiro/3m-ui/.github/workflows/release.yml@refs/tags/<tag>' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
SHA256SUMS
feat(release): cosign keyless signing of SHA256SUMS
Closes M-10 (supply-chain authenticity). Replaces the TODO comment with
a working cosign keyless OIDC signing flow.
Workflow (release.yml):
- Add id-token: write permission (required for GitHub OIDC token).
- Add sigstore/cosign-installer@v3 step.
- After SHA256SUMS is generated, cosign sign-blob --yes produces
SHA256SUMS.pem (certificate) and SHA256SUMS.sig (signature).
These are uploaded alongside the existing release assets.
- No long-lived secret is stored on GitHub; the signing identity is
the ephemeral GitHub Actions OIDC token bound to this workflow + tag.
- Release notes body updated with the cosign verify-blob command so
users know how to verify authenticity end-to-end.
Installers (install.sh / update.sh):
- Add verify_release_cosign() function. OPT-IN via
THREE_M_UI_VERIFY_COSIGN=1 (off by default to keep the curl|bash UX
simple — SHA256SUMS integrity is already fail-closed).
- When enabled AND cosign is installed, downloads SHA256SUMS.pem +
SHA256SUMS.sig and runs cosign verify-blob against the identity
'https://github.com/<repo>/.github/workflows/release.yml@refs/tags/<tag>'.
- If cosign is missing or the release predates signing, prints a
warning and continues (does not hard-fail).
- If verification runs and FAILS, aborts (fail-closed, bypassable via
THREE_M_UI_INSECURE=1).
Threat model:
- Before: SHA256SUMS provided integrity but not authenticity — an
attacker who could modify the release assets could also modify
SHA256SUMS, defeating the checksum.
- After: cosign signature ties SHA256SUMS to the GitHub Actions OIDC
identity, so a modified sums file fails signature verification even
if the attacker controls the release CDN.
Verification command (for end users):
cosign verify-blob \
--certificate SHA256SUMS.pem \
--signature SHA256SUMS.sig \
--certificate-identity 'https://github.com/kazeyukiro/3m-ui/.github/workflows/release.yml@refs/tags/<tag>' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
SHA256SUMS
feat(release): cosign keyless signing of SHA256SUMS
Closes M-10 (supply-chain authenticity). Replaces the TODO comment with
a working cosign keyless OIDC signing flow.
Workflow (release.yml):
- Add id-token: write permission (required for GitHub OIDC token).
- Add sigstore/cosign-installer@v3 step.
- After SHA256SUMS is generated, cosign sign-blob --yes produces
SHA256SUMS.pem (certificate) and SHA256SUMS.sig (signature).
These are uploaded alongside the existing release assets.
- No long-lived secret is stored on GitHub; the signing identity is
the ephemeral GitHub Actions OIDC token bound to this workflow + tag.
- Release notes body updated with the cosign verify-blob command so
users know how to verify authenticity end-to-end.
Installers (install.sh / update.sh):
- Add verify_release_cosign() function. OPT-IN via
THREE_M_UI_VERIFY_COSIGN=1 (off by default to keep the curl|bash UX
simple — SHA256SUMS integrity is already fail-closed).
- When enabled AND cosign is installed, downloads SHA256SUMS.pem +
SHA256SUMS.sig and runs cosign verify-blob against the identity
'https://github.com/<repo>/.github/workflows/release.yml@refs/tags/<tag>'.
- If cosign is missing or the release predates signing, prints a
warning and continues (does not hard-fail).
- If verification runs and FAILS, aborts (fail-closed, bypassable via
THREE_M_UI_INSECURE=1).
Threat model:
- Before: SHA256SUMS provided integrity but not authenticity — an
attacker who could modify the release assets could also modify
SHA256SUMS, defeating the checksum.
- After: cosign signature ties SHA256SUMS to the GitHub Actions OIDC
identity, so a modified sums file fails signature verification even
if the attacker controls the release CDN.
Verification command (for end users):
cosign verify-blob \
--certificate SHA256SUMS.pem \
--signature SHA256SUMS.sig \
--certificate-identity 'https://github.com/kazeyukiro/3m-ui/.github/workflows/release.yml@refs/tags/<tag>' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
SHA256SUMS
feat(release): cosign keyless signing of SHA256SUMS
Closes M-10 (supply-chain authenticity). Replaces the TODO comment with
a working cosign keyless OIDC signing flow.
Workflow (release.yml):
- Add id-token: write permission (required for GitHub OIDC token).
- Add sigstore/cosign-installer@v3 step.
- After SHA256SUMS is generated, cosign sign-blob --yes produces
SHA256SUMS.pem (certificate) and SHA256SUMS.sig (signature).
These are uploaded alongside the existing release assets.
- No long-lived secret is stored on GitHub; the signing identity is
the ephemeral GitHub Actions OIDC token bound to this workflow + tag.
- Release notes body updated with the cosign verify-blob command so
users know how to verify authenticity end-to-end.
Installers (install.sh / update.sh):
- Add verify_release_cosign() function. OPT-IN via
THREE_M_UI_VERIFY_COSIGN=1 (off by default to keep the curl|bash UX
simple — SHA256SUMS integrity is already fail-closed).
- When enabled AND cosign is installed, downloads SHA256SUMS.pem +
SHA256SUMS.sig and runs cosign verify-blob against the identity
'https://github.com/<repo>/.github/workflows/release.yml@refs/tags/<tag>'.
- If cosign is missing or the release predates signing, prints a
warning and continues (does not hard-fail).
- If verification runs and FAILS, aborts (fail-closed, bypassable via
THREE_M_UI_INSECURE=1).
Threat model:
- Before: SHA256SUMS provided integrity but not authenticity — an
attacker who could modify the release assets could also modify
SHA256SUMS, defeating the checksum.
- After: cosign signature ties SHA256SUMS to the GitHub Actions OIDC
identity, so a modified sums file fails signature verification even
if the attacker controls the release CDN.
Verification command (for end users):
cosign verify-blob \
--certificate SHA256SUMS.pem \
--signature SHA256SUMS.sig \
--certificate-identity 'https://github.com/kazeyukiro/3m-ui/.github/workflows/release.yml@refs/tags/<tag>' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
SHA256SUMS
feat(release): cosign keyless signing of SHA256SUMS
Closes M-10 (supply-chain authenticity). Replaces the TODO comment with
a working cosign keyless OIDC signing flow.
Workflow (release.yml):
- Add id-token: write permission (required for GitHub OIDC token).
- Add sigstore/cosign-installer@v3 step.
- After SHA256SUMS is generated, cosign sign-blob --yes produces
SHA256SUMS.pem (certificate) and SHA256SUMS.sig (signature).
These are uploaded alongside the existing release assets.
- No long-lived secret is stored on GitHub; the signing identity is
the ephemeral GitHub Actions OIDC token bound to this workflow + tag.
- Release notes body updated with the cosign verify-blob command so
users know how to verify authenticity end-to-end.
Installers (install.sh / update.sh):
- Add verify_release_cosign() function. OPT-IN via
THREE_M_UI_VERIFY_COSIGN=1 (off by default to keep the curl|bash UX
simple — SHA256SUMS integrity is already fail-closed).
- When enabled AND cosign is installed, downloads SHA256SUMS.pem +
SHA256SUMS.sig and runs cosign verify-blob against the identity
'https://github.com/<repo>/.github/workflows/release.yml@refs/tags/<tag>'.
- If cosign is missing or the release predates signing, prints a
warning and continues (does not hard-fail).
- If verification runs and FAILS, aborts (fail-closed, bypassable via
THREE_M_UI_INSECURE=1).
Threat model:
- Before: SHA256SUMS provided integrity but not authenticity — an
attacker who could modify the release assets could also modify
SHA256SUMS, defeating the checksum.
- After: cosign signature ties SHA256SUMS to the GitHub Actions OIDC
identity, so a modified sums file fails signature verification even
if the attacker controls the release CDN.
Verification command (for end users):
cosign verify-blob \
--certificate SHA256SUMS.pem \
--signature SHA256SUMS.sig \
--certificate-identity 'https://github.com/kazeyukiro/3m-ui/.github/workflows/release.yml@refs/tags/<tag>' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
SHA256SUMS
feat(release): cosign keyless signing of SHA256SUMS
Closes M-10 (supply-chain authenticity). Replaces the TODO comment with
a working cosign keyless OIDC signing flow.
Workflow (release.yml):
- Add id-token: write permission (required for GitHub OIDC token).
- Add sigstore/cosign-installer@v3 step.
- After SHA256SUMS is generated, cosign sign-blob --yes produces
SHA256SUMS.pem (certificate) and SHA256SUMS.sig (signature).
These are uploaded alongside the existing release assets.
- No long-lived secret is stored on GitHub; the signing identity is
the ephemeral GitHub Actions OIDC token bound to this workflow + tag.
- Release notes body updated with the cosign verify-blob command so
users know how to verify authenticity end-to-end.
Installers (install.sh / update.sh):
- Add verify_release_cosign() function. OPT-IN via
THREE_M_UI_VERIFY_COSIGN=1 (off by default to keep the curl|bash UX
simple — SHA256SUMS integrity is already fail-closed).
- When enabled AND cosign is installed, downloads SHA256SUMS.pem +
SHA256SUMS.sig and runs cosign verify-blob against the identity
'https://github.com/<repo>/.github/workflows/release.yml@refs/tags/<tag>'.
- If cosign is missing or the release predates signing, prints a
warning and continues (does not hard-fail).
- If verification runs and FAILS, aborts (fail-closed, bypassable via
THREE_M_UI_INSECURE=1).
Threat model:
- Before: SHA256SUMS provided integrity but not authenticity — an
attacker who could modify the release assets could also modify
SHA256SUMS, defeating the checksum.
- After: cosign signature ties SHA256SUMS to the GitHub Actions OIDC
identity, so a modified sums file fails signature verification even
if the attacker controls the release CDN.
Verification command (for end users):
cosign verify-blob \
--certificate SHA256SUMS.pem \
--signature SHA256SUMS.sig \
--certificate-identity 'https://github.com/kazeyukiro/3m-ui/.github/workflows/release.yml@refs/tags/<tag>' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
SHA256SUMS
feat(release): cosign keyless signing of SHA256SUMS
Closes M-10 (supply-chain authenticity). Replaces the TODO comment with
a working cosign keyless OIDC signing flow.
Workflow (release.yml):
- Add id-token: write permission (required for GitHub OIDC token).
- Add sigstore/cosign-installer@v3 step.
- After SHA256SUMS is generated, cosign sign-blob --yes produces
SHA256SUMS.pem (certificate) and SHA256SUMS.sig (signature).
These are uploaded alongside the existing release assets.
- No long-lived secret is stored on GitHub; the signing identity is
the ephemeral GitHub Actions OIDC token bound to this workflow + tag.
- Release notes body updated with the cosign verify-blob command so
users know how to verify authenticity end-to-end.
Installers (install.sh / update.sh):
- Add verify_release_cosign() function. OPT-IN via
THREE_M_UI_VERIFY_COSIGN=1 (off by default to keep the curl|bash UX
simple — SHA256SUMS integrity is already fail-closed).
- When enabled AND cosign is installed, downloads SHA256SUMS.pem +
SHA256SUMS.sig and runs cosign verify-blob against the identity
'https://github.com/<repo>/.github/workflows/release.yml@refs/tags/<tag>'.
- If cosign is missing or the release predates signing, prints a
warning and continues (does not hard-fail).
- If verification runs and FAILS, aborts (fail-closed, bypassable via
THREE_M_UI_INSECURE=1).
Threat model:
- Before: SHA256SUMS provided integrity but not authenticity — an
attacker who could modify the release assets could also modify
SHA256SUMS, defeating the checksum.
- After: cosign signature ties SHA256SUMS to the GitHub Actions OIDC
identity, so a modified sums file fails signature verification even
if the attacker controls the release CDN.
Verification command (for end users):
cosign verify-blob \
--certificate SHA256SUMS.pem \
--signature SHA256SUMS.sig \
--certificate-identity 'https://github.com/kazeyukiro/3m-ui/.github/workflows/release.yml@refs/tags/<tag>' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
SHA256SUMS
feat(release): cosign keyless signing of SHA256SUMS
Closes M-10 (supply-chain authenticity). Replaces the TODO comment with
a working cosign keyless OIDC signing flow.
Workflow (release.yml):
- Add id-token: write permission (required for GitHub OIDC token).
- Add sigstore/cosign-installer@v3 step.
- After SHA256SUMS is generated, cosign sign-blob --yes produces
SHA256SUMS.pem (certificate) and SHA256SUMS.sig (signature).
These are uploaded alongside the existing release assets.
- No long-lived secret is stored on GitHub; the signing identity is
the ephemeral GitHub Actions OIDC token bound to this workflow + tag.
- Release notes body updated with the cosign verify-blob command so
users know how to verify authenticity end-to-end.
Installers (install.sh / update.sh):
- Add verify_release_cosign() function. OPT-IN via
THREE_M_UI_VERIFY_COSIGN=1 (off by default to keep the curl|bash UX
simple — SHA256SUMS integrity is already fail-closed).
- When enabled AND cosign is installed, downloads SHA256SUMS.pem +
SHA256SUMS.sig and runs cosign verify-blob against the identity
'https://github.com/<repo>/.github/workflows/release.yml@refs/tags/<tag>'.
- If cosign is missing or the release predates signing, prints a
warning and continues (does not hard-fail).
- If verification runs and FAILS, aborts (fail-closed, bypassable via
THREE_M_UI_INSECURE=1).
Threat model:
- Before: SHA256SUMS provided integrity but not authenticity — an
attacker who could modify the release assets could also modify
SHA256SUMS, defeating the checksum.
- After: cosign signature ties SHA256SUMS to the GitHub Actions OIDC
identity, so a modified sums file fails signature verification even
if the attacker controls the release CDN.
Verification command (for end users):
cosign verify-blob \
--certificate SHA256SUMS.pem \
--signature SHA256SUMS.sig \
--certificate-identity 'https://github.com/kazeyukiro/3m-ui/.github/workflows/release.yml@refs/tags/<tag>' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
SHA256SUMS
feat(release): cosign keyless signing of SHA256SUMS
Closes M-10 (supply-chain authenticity). Replaces the TODO comment with
a working cosign keyless OIDC signing flow.
Workflow (release.yml):
- Add id-token: write permission (required for GitHub OIDC token).
- Add sigstore/cosign-installer@v3 step.
- After SHA256SUMS is generated, cosign sign-blob --yes produces
SHA256SUMS.pem (certificate) and SHA256SUMS.sig (signature).
These are uploaded alongside the existing release assets.
- No long-lived secret is stored on GitHub; the signing identity is
the ephemeral GitHub Actions OIDC token bound to this workflow + tag.
- Release notes body updated with the cosign verify-blob command so
users know how to verify authenticity end-to-end.
Installers (install.sh / update.sh):
- Add verify_release_cosign() function. OPT-IN via
THREE_M_UI_VERIFY_COSIGN=1 (off by default to keep the curl|bash UX
simple — SHA256SUMS integrity is already fail-closed).
- When enabled AND cosign is installed, downloads SHA256SUMS.pem +
SHA256SUMS.sig and runs cosign verify-blob against the identity
'https://github.com/<repo>/.github/workflows/release.yml@refs/tags/<tag>'.
- If cosign is missing or the release predates signing, prints a
warning and continues (does not hard-fail).
- If verification runs and FAILS, aborts (fail-closed, bypassable via
THREE_M_UI_INSECURE=1).
Threat model:
- Before: SHA256SUMS provided integrity but not authenticity — an
attacker who could modify the release assets could also modify
SHA256SUMS, defeating the checksum.
- After: cosign signature ties SHA256SUMS to the GitHub Actions OIDC
identity, so a modified sums file fails signature verification even
if the attacker controls the release CDN.
Verification command (for end users):
cosign verify-blob \
--certificate SHA256SUMS.pem \
--signature SHA256SUMS.sig \
--certificate-identity 'https://github.com/kazeyukiro/3m-ui/.github/workflows/release.yml@refs/tags/<tag>' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
SHA256SUMS
feat(release): cosign keyless signing of SHA256SUMS
Closes M-10 (supply-chain authenticity). Replaces the TODO comment with
a working cosign keyless OIDC signing flow.
Workflow (release.yml):
- Add id-token: write permission (required for GitHub OIDC token).
- Add sigstore/cosign-installer@v3 step.
- After SHA256SUMS is generated, cosign sign-blob --yes produces
SHA256SUMS.pem (certificate) and SHA256SUMS.sig (signature).
These are uploaded alongside the existing release assets.
- No long-lived secret is stored on GitHub; the signing identity is
the ephemeral GitHub Actions OIDC token bound to this workflow + tag.
- Release notes body updated with the cosign verify-blob command so
users know how to verify authenticity end-to-end.
Installers (install.sh / update.sh):
- Add verify_release_cosign() function. OPT-IN via
THREE_M_UI_VERIFY_COSIGN=1 (off by default to keep the curl|bash UX
simple — SHA256SUMS integrity is already fail-closed).
- When enabled AND cosign is installed, downloads SHA256SUMS.pem +
SHA256SUMS.sig and runs cosign verify-blob against the identity
'https://github.com/<repo>/.github/workflows/release.yml@refs/tags/<tag>'.
- If cosign is missing or the release predates signing, prints a
warning and continues (does not hard-fail).
- If verification runs and FAILS, aborts (fail-closed, bypassable via
THREE_M_UI_INSECURE=1).
Threat model:
- Before: SHA256SUMS provided integrity but not authenticity — an
attacker who could modify the release assets could also modify
SHA256SUMS, defeating the checksum.
- After: cosign signature ties SHA256SUMS to the GitHub Actions OIDC
identity, so a modified sums file fails signature verification even
if the attacker controls the release CDN.
Verification command (for end users):
cosign verify-blob \
--certificate SHA256SUMS.pem \
--signature SHA256SUMS.sig \
--certificate-identity 'https://github.com/kazeyukiro/3m-ui/.github/workflows/release.yml@refs/tags/<tag>' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
SHA256SUMS
風雪
4f038eba42