Dependency Review

OpenSSF Scorecard

Scanned Files

• .github/workflows/cli.yml

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly enhances the supply chain security and verifiability of CLI releases by integrating Cosign keyless signing and Sigstore provenance bundles directly into GitHub Release assets. This change directly addresses a limitation identified by the OpenSSF Scorecard, improving the project's "Signed-Releases" score by making signature and provenance information readily available alongside release artifacts, rather than solely in GitHub's attestation store.

Highlights

• CLI Release Signing: Implemented Cosign keyless signing for checksums.txt in the CLI release job, generating .sig (detached signature) and .pem (Fulcio certificate) files that are attached to the GitHub Release.
• Sigstore Provenance Bundle: Added a Sigstore provenance bundle (.sigstore.json) for checksums.txt via a separate attest-build-provenance attestation, which is also uploaded as a release asset.
• Release Notes Enhancement: Updated the finalize-release workflow to extract CLI_COSIGN_DATA from hidden HTML comments and render a dedicated "CLI Binary Signatures" subsection within the combined Verification section of the release notes.
• Documentation Updates: Updated CLAUDE.md, docs/security.md, and docs/architecture/tech-stack.md to accurately reflect the newly introduced signing and provenance capabilities for CLI releases.

sequenceDiagram
    autonumber
    participant Dev as Release Trigger
    participant GH as GitHub Actions
    participant Cosign as Cosign (keyless)
    participant Sigstore as Sigstore/Provenance
    participant Release as GitHub Release

    Dev->>GH: push tag / create draft release
    GH->>Cosign: install & sign cli/dist/checksums.txt
    Cosign-->>GH: produces checksums.txt.sig + checksums.txt.pem
    GH->>Sigstore: generate SLSA/provenance bundle for checksums
    Sigstore-->>GH: returns provenance bundle (.sigstore.json)
    GH->>Release: upload artifacts (checksums, .sig, .pem, .sigstore.json)
    GH->>GH: embed verification blocks (CLI_COSIGN_DATA, CLI_SLSA_BUNDLE_DATA) into release body
    GH->>Release: finalize release notes with VERIFICATION section

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Greptile Summary

This PR wires up cosign keyless signing and a Sigstore provenance bundle for CLI releases, targeting the OpenSSF Scorecard "Signed-Releases" check by attaching checksums.txt.sig, checksums.txt.pem, and checksums.txt.sigstore.json as release assets. It also extends finalize-release to extract and render the new verification snippets into the published release notes.

• cli.yml: Installs cosign before GoReleaser, signs checksums.txt after build validation, uploads .sig/.pem alongside the archives, runs a second attest-build-provenance with subject-path to produce a harvestable bundle, then uploads it as checksums.txt.sigstore.json. Embedded HTML comments (CLI_COSIGN_DATA, CLI_SLSA_BUNDLE_DATA) carry the verification snippets for downstream consumption.
• finalize-release.yml: Extracts the two new comment blocks with the same sed range+fence pattern already used for CLI_VERIFICATION_DATA, renders them as "CLI Binary Signatures" and "CLI Provenance Bundle" subsections, and strips the comment blocks from the final body.
• Docs (CLAUDE.md, docs/security.md, docs/architecture/tech-stack.md): Updated to describe all three verification paths (cosign, gh attestation verify, cosign verify-blob-attestation).
• The --type slsaprovenance1 flag is now present in the .sigstore.json verification command, addressing the previously flagged verify-blob-attestation predicate-version mismatch.
• The "CLI Binary Signatures" section heading in finalize-release.yml is slightly misleading — only checksums.txt is signed by cosign, not the binary archives themselves.
• cosign sign-blob has no post-signing guard: if Fulcio is unreachable the command can exit zero with empty output files that are then uploaded silently.

Confidence Score: 4/5

• Safe to merge; the two open items are a slightly misleading heading and a missing post-sign sanity check, neither of which blocks the feature or causes a regression.
• The workflow logic is structurally sound: step ordering is correct, permissions include id-token: write for keyless signing, the bundle-path output is referenced via a properly-named id: attest-checksums step, the cleanup pipeline in finalize-release removes all three new comment blocks, and the --type slsaprovenance1 flag resolves the previously-noted cosign predicate-version issue. The two style-level findings (misleading section title, missing emptiness guard on .sig/.pem) are low-risk but worth fixing before the first real tag release exercises the full path.
• .github/workflows/cli.yml (post-sign emptiness guard) and .github/workflows/finalize-release.yml (section heading).

Important Files Changed

This is a comment left during a code review.
Path: .github/workflows/finalize-release.yml
Line: 159

Comment:
**Misleading section heading for cosign data**

`"### CLI Binary Signatures"` implies the binary archives (`.tar.gz`/`.zip`) are individually signed with cosign, but only `checksums.txt` is signed. A user who reads this heading and then runs `cosign verify-blob` on a binary archive will get a failure. A more accurate heading would be `"### CLI Checksums Signature"` or `"### Checksums File Signature"`, making it clear that the signed artifact is `checksums.txt` (which transitively covers the binaries through their SHA-256 entries).

```suggestion
              VERIFICATION="$(printf '%s\n\n### CLI Checksums Signature\n\n%s\n' "$VERIFICATION" "$CLI_COSIGN")"
```

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: .github/workflows/cli.yml
Line: 296-300

Comment:
**Consider failing explicitly if signing produces empty output files**

`cosign sign-blob --yes` exits zero on success, but if the OIDC token is unavailable or Fulcio is unreachable the command may still exit zero while producing empty `.sig`/`.pem` files. An empty certificate uploaded to the release would silently break verification for every user.

Adding a guard after signing (similar to the existing `Validate checksums file` check) would catch this before the upload step:

```bash
cosign sign-blob --yes cli/dist/checksums.txt \
  --output-signature cli/dist/checksums.txt.sig \
  --output-certificate cli/dist/checksums.txt.pem

if [ ! -s cli/dist/checksums.txt.sig ] || [ ! -s cli/dist/checksums.txt.pem ]; then
  echo "::error::cosign produced empty signature or certificate — signing may have failed silently"
  exit 1
fi
```

How can I resolve this? If you propose a fix, please make it concise.

_{Last reviewed commit: 5642a74}