feat(ci): migrate from Cosign/Sigstore to GitHub native attestations#786
Merged
Conversation
added 6 commits
February 25, 2026 10:54
… attestations Replace Cosign keyless signing with GitHub's actions/attest-build-provenance and actions/attest-sbom actions, eliminating external Sigstore/Rekor dependencies. Re-enable SBOM attestation (previously disabled due to Rekor rejecting payloads). Add build provenance attestation for release binary assets. - Replace cosign sign with actions/attest-build-provenance for all images - Replace cosign attest with actions/attest-sbom for SBOM attestation - Add binary release asset attestation (tar.gz and SHA256SUMS) - Delete sign-image.sh, sign-binary.sh, sign-image.yml - Remove attest_sbom_with_retry and attest_sbom_to_multiarch from sbom-scan.sh - Rewrite verify-image.sh to use gh attestation verify - Support both GHCR orgs (midnight-ntwrk and midnightntwrk) JIRA: SRE-1910
The --format '{{.Manifest.Digest}}' template only works for manifest
lists, not single-arch v2 manifests. Replace with --raw | sha256sum
which computes the correct content-addressable digest for any manifest
type.
Replace cosign verify-blob with gh attestation verify. Add test job to test-attestation.yml to validate the script against an attested test binary.
…testations Replace all cosign/Sigstore references with GitHub native attestation commands (gh attestation verify). Remove .sig/.pem file references, Rekor/Fulcio architecture descriptions, and Sigstore outage procedures. Remove test-attestation.yml (validated, no longer needed).
Contributor
|
KICS version: v2.1.16
|
mladen-shielded
approved these changes
Feb 25, 2026
justinfrevert
approved these changes
Feb 25, 2026
Resolves GHSA-mw96-cpmx-2vgc (arbitrary file write via path traversal in rollup 4.0.0-4.58.0).
gilescope
pushed a commit
that referenced
this pull request
Apr 8, 2026
fixes: - (race condition) governed map observability tests could fail if partner chains node created a block referencing stable main chain block just after main has created <security_param + 1> block
m2ux
added a commit
that referenced
this pull request
Apr 23, 2026
fixes: - (race condition) governed map observability tests could fail if partner chains node created a block referencing stable main chain block just after main has created <security_param + 1> block Signed-off-by: Mike Clay <mike.clay@shielded.io>
m2ux
added a commit
that referenced
this pull request
Apr 23, 2026
fixes: - (race condition) governed map observability tests could fail if partner chains node created a block referencing stable main chain block just after main has created <security_param + 1> block Signed-off-by: Mike Clay <mike.clay@shielded.io>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
cosign sign/cosign attestwithactions/attest-build-provenanceandactions/attest-sbomfor all container images (GHCR midnight-ntwrk, GHCR midnightntwrk, Docker Hub)scripts/verify-image.shandscripts/verify-binary.shto usegh attestation verifysign-image.sh,sign-image.yml,sign-binary.sh(no longer needed)Why
gh attestation verifyinstead of cosign + certificate chainsFiles changed (17 files, -869/+581 lines)
.github/workflows/main.yml— all signing steps replaced with attestation.github/workflows/release-image.yml— signing replaced, binary attestation added.github/workflows/sbom-scan-image.yml— cosign removed, usesactions/attest-sbom.github/scripts/sbom-scan.sh— removedattest_sbom_with_retry()(Syft/Grype unchanged).github/scripts/sign-image.sh— deleted.github/scripts/sign-binary.sh— deleted.github/workflows/sign-image.yml— deletedscripts/verify-image.sh— rewritten forgh attestation verifyscripts/verify-binary.sh— rewritten forgh attestation verifydocs/security/*— updated all 6 security docs from cosign to gh CLI.github/ISSUE_TEMPLATE/node-release-checklist.md— "signatures" → "attestations"Test plan
test-attestation.ymlworkflow — all 7 jobs passed (binary attest, verify-binary.sh, build provenance, SBOM attest, SBOM verify, verify-image.sh, summary)gh attestation verify oci://ghcr.io/midnight-ntwrk/midnight-node:TAG --owner midnightntwrkworksgh attestation verifywith--predicate-type https://spdx.dev/Documentfor SBOMJIRA: https://shielded.atlassian.net/browse/SRE-1910
🤖 Generated with Claude Code