Uh oh!
There was an error while loading. Please reload this page.
security(R8): CODEOWNERS trust root + SHA-pin signing actions (client#282) - #287
Merged
Conversation
… signing actions (client#282) RFC-0001 R8 follow-up (tracebloc/backend#889). The R8 chain (tracebloc.io/i.sh → latest signed release → cosign-verified install.sh) trusts whatever the release workflow signs, so a change to the workflow / installer / sub-scripts / manifest generator changes what gets trusted. - Extend .github/CODEOWNERS to require code-owner review on the trust-root paths (release-helm-chart.yaml, install.sh, install-k8s.sh, gen-manifest.sh, manifest.sha256, scripts/lib/). - SHA-pin the signing-job actions (actions/checkout, sigstore/cosign-installer, softprops/action-gh-release) so a compromised action tag can't inject into the sign/publish path. Steps 2 + 3 of the ticket need repo-admin (out of PR scope): branch protection with "require review from Code Owners" on develop + main, and a protected-tag rule for v* — documented in the PR body. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
saadqbalforce-pushed
the
fix/282-codeowners-trust-root
branch
from
July 2, 2026 10:59
8fc9952 to
28a9230CompareshujaatTracebloc
approved these changes
Jul 2, 2026
Uh oh!
There was an error while loading. Please reload this page.
This was referenced Jul 2, 2026
saadqbal added a commit
that referenced
this pull request
Jul 2, 2026
Release carrier for the R8 supply-chain hardening now on develop (#287 CODEOWNERS/SHA-pins, #299 Windows install.ps1 pin+cosign-verify). The client chart templates are unchanged since v1.8.4; the bump versions the release that stamps + publishes the hardened install.sh/install.ps1 + signed manifest as release assets (RFC-0001 R8, client#283). Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes#282 (the file half). RFC-0001 R8 follow-up (tracebloc/backend#889). Now that
tracebloc.io/i.shserves the latest signed release, the trust root is "whatever the release workflow signs" — so the workflow, installer, sub-scripts, and manifest generator must be review-gated, and the signing actions pinned.In this PR (files)
.github/CODEOWNERS— extended to require code-owner review on the trust-root paths:release-helm-chart.yaml,install.sh,install-k8s.sh,gen-manifest.sh,manifest.sha256,scripts/lib/. (@saadqbalmatches the existing owner; swap to a platform/security team when one exists so review isn't single-person / self-approvable.)release-helm-chart.yaml—actions/checkout,sigstore/cosign-installer,softprops/action-gh-releasepinned to commit SHAs (# v4/v3/v2comments kept), so a compromised action tag can't inject into the sign/publish path.Still needs a repo-admin (ticket steps 2 + 3 — can't be done in a PR)
The filer has
maintain, notadmin. An admin needs to:developandmain: require a PR before merge + Require review from Code Owners (so the CODEOWNERS paths above actually gate). Settings → Branches (or a repository ruleset).v*: restrict who can create/update release tags (the keyless signer identity is the tag-triggered release workflow). Settings → Tags → New rule →v*(or atag-target ruleset with a create/update restriction).Once those two are set, the R8 trust root is fully locked. (The CODEOWNERS + SHA-pins here are inert for enforcement until the branch protection is enabled — but they're the prerequisite + safe to land now.)
🤖 Generated with Claude Code
Note
Medium Risk
Touches the release signing/publish workflow and installer trust boundary; changes are hardening (review gates + action pinning) but affect how releases and
curl | bashinstalls are produced.Overview
Locks the R8 signed-installer trust root by requiring code-owner review on paths that define what
tracebloc.io/i.shtrusts:release-helm-chart.yaml, installer scripts (install.sh,install-k8s.sh),gen-manifest.sh,manifest.sha256, andscripts/lib/. A new CODEOWNERS section documents that the release workflow’s keyless signer identity is the trust boundary.SHA-pins supply-chain-sensitive GitHub Actions in
release-helm-chart.yaml:actions/checkout,sigstore/cosign-installer, andsoftprops/action-gh-release(chart upload, manifest signing checkout, and installer asset attach) now reference immutable commit SHAs with version comments, so a compromised floating tag cannot run in the sign/publish path.Enforcement still depends on repo-admin branch protection and protected
v*tags (called out in the PR); this change is the in-repo prerequisite.Reviewed by Cursor Bugbot for commit 28a9230. Bugbot is set up for automated code reviews on this repo. Configure here.