Uh oh!
There was an error while loading. Please reload this page.
fix(install): anchor cosign identity to version tags (D29, #1269 row 4) - #415
Merged
Merged
Conversation
install.sh verified downloaded binaries against certificate-identity-regexp '.../release.yml@.*' — @.* matches ANY ref, so a binary signed by release.yml running on a feature branch verified identically to a tagged release. Anchor to '@refs/tags/v.*' so only tag-built releases are trusted. Same anchor applied to the documented verify command in release.yml. Part of tracebloc/backend#1269 (row 4). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
LukasWodka
commented
Jul 27, 2026
ContributorAuthor
bugbot run |
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit f3de673. Configure here.
shujaatTracebloc
approved these changes
Jul 27, 2026
shujaatTracebloc
left a comment
Contributor
There was a problem hiding this comment.
Reviewed. Correct, well-scoped security fix: anchoring the cosign identity to @refs/tags/v.* closes the @.*-matches-any-ref hole (#1269 row 4). Verified the primary release path (push: tags: v*.*.*) signs under a refs/tags/v* OIDC identity, so legit releases still verify. CI green, Bugbot clean, no unresolved threads.
Note (non-blocking): the workflow_dispatch fallback signs under whatever ref the run is dispatched on — dispatch on the tag itself (not a branch) so its binaries still verify.
Uh oh!
There was an error while loading. Please reload this page.
LukasWodka added a commit
that referenced
this pull request
Jul 28, 2026
The train reads this file to cut tags: vX.Y.Z-rc.N on every staging promotion (pre-release binaries for FR; 'latest' never sees them) and vX.Y.Z on the prod promotion. The binary's own version still derives from the tag at build time (release.yml ldflags) -- this file only declares intent, uniform with tracebloc-py-package's pyproject version. 0.10.1 ships the cosign identity anchor fix (#415). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
LukasWodka added a commit
that referenced
this pull request
Jul 28, 2026
…#417) * chore: declare next release in VERSION (0.10.1) for the release train The train reads this file to cut tags: vX.Y.Z-rc.N on every staging promotion (pre-release binaries for FR; 'latest' never sees them) and vX.Y.Z on the prod promotion. The binary's own version still derives from the tag at build time (release.yml ldflags) -- this file only declares intent, uniform with tracebloc-py-package's pyproject version. 0.10.1 ships the cosign identity anchor fix (#415). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * feat(release): enforce tag==VERSION + strict prerelease detection Two guards raised in release-train review: (1) any tag's base X.Y.Z must match the VERSION file (train-cut or manual), so the file can never go silently stale after an out-of-train release; pre-VERSION tags are grandfathered for rebuilds. (2) STRICT stability: only plain vX.Y.Z is a stable release -- rc tags AND malformed variants (v1.2.3rc1, no dash) are prereleases, so 'releases/latest' (the installer bootstrap) can only ever resolve a real production build. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * style: quote GITHUB_OUTPUT redirects (shellcheck SC2086) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
LukasWodka added a commit
that referenced
this pull request
Jul 29, 2026
…415) install.sh rejects signatures from non-tag workflow runs; install.ps1 still accepted @.* -- Windows trusted what Unix refused. Same anchor now: refs/tags/v.* (covers rc tags too). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
LukasWodka
commented
Jul 29, 2026
ContributorAuthor
/fr-pass |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
#1269 row 4.
install.shverified with--certificate-identity-regexp '.../release.yml@.*'—@.*matches any ref, so a binary signed byrelease.ymlon a feature branch verified identically to a tagged release. Anchored to@refs/tags/v.*(real verify in install.sh + the documented command in release.yml). shellcheck clean. Part of tracebloc/backend#1269.Note
Low Risk
Security-hardening change to install-time signature policy; behavior may reject previously accepted non-tag-signed artifacts, which is intended.
Overview
Tightens cosign verification so installers only accept signatures whose OIDC identity comes from the release workflow on a version tag, not an arbitrary Git ref.
The
--certificate-identity-regexpinscripts/install.shchanges fromrelease.yml@.*torelease.yml@refs/tags/v.*, so a binary signed from a feature-branch workflow run no longer passes the same check as a tagged release. The documented customer verify command in.github/workflows/release.ymlis updated to match.Reviewed by Cursor Bugbot for commit f3de673. Bugbot is set up for automated code reviews on this repo. Configure here.