fix(website): add manual verification instructions to install script#2484
Merged
jakobmoellerdev merged 9 commits intoMay 11, 2026
Conversation
…l script When gh CLI is unavailable or unauthenticated, the install script now prints actionable instructions for three verification methods: - Option A: gh attestation verify (after authenticating) - Option B: cosign verify-blob-attestation (no GitHub auth needed) - Option C: Manual SHA-256 hash comparison via public attestation API All methods were tested against cli/v0.5.0 and cli/v0.6.0-rc.1 releases. The GitHub attestation API is publicly accessible without authentication, enabling both cosign and manual hash verification without gh auth. Closes: open-component-model#2348 On-behalf-of: @SAP <jakob.moeller@sap.com> Signed-off-by: Jakob Möller <contact@jakob-moeller.com>
✅ Deploy Preview for ocm-website ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Contributor
|
ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
✅ Files skipped from review due to trivial changes (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughAdds a helper that prints multi-option manual verification steps when GitHub attestation cannot run (missing or unauthenticated ChangesManual Verification Instructions Workflow
Sequence Diagram(s)sequenceDiagram
participant Installer
participant verify_binary
participant print_verify_instructions
participant gh
Installer->>verify_binary: call verify_binary(binary_path)
verify_binary->>gh: check gh presence & auth (gh auth status --hostname github.com)
alt gh missing or not authenticated
verify_binary->>print_verify_instructions: print reason ("GitHub CLI is not authenticated" / "gh not found")
print_verify_instructions->>Installer: emit BINARY NOT CRYPTOGRAPHICALLY VERIFIED + manual steps
verify_binary->>Installer: return 0 (continue install)
else gh available and authenticated
verify_binary->>gh: gh attestation verify --subject <binary>
alt attestation succeeds
verify_binary->>Installer: return 0
else attestation fails
verify_binary->>Installer: fatal (terminate)
end
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
The test assertion grepped for the old one-liner skip message which no longer exists. Updated to check for the new structured warning output. On-behalf-of: @SAP <jakob.moeller@sap.com> Signed-off-by: Jakob Möller <contact@jakob-moeller.com>
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@website/static/install-cli.sh`:
- Around line 206-224: The manual verification instructions that call sha256sum
on the asset name "ocm-${OS}-${ARCH}" are brittle and non-portable; update the
warn blocks that build DIGEST and show the manual hash check to (1) detect a
cross-platform hash command (prefer sha256sum, fallback to shasum -a 256) and
use that command name when computing DIGEST, and (2) reference the actual binary
path the user should verify (use ${TMP_BIN}/ocm-${OS}-${ARCH} during the install
window or explicitly instruct verification after install using the installed
binary in PATH) instead of the release asset name; locate the warn strings that
contain "DIGEST=\"sha256:$(sha256sum ocm-${OS}-${ARCH}" and the two subsequent
curl/jq/hash lines and replace them accordingly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 3d2b834d-a9f8-43a1-b2ed-5c659d81aa56
📒 Files selected for processing (2)
.github/workflows/website-live-test-install-script.ymlwebsite/static/install-cli.sh
…fy instructions
- Detect sha256sum vs shasum -a 256 for macOS compatibility
- Reference ${BIN_DIR}/ocm (actual installed path) instead of
release asset name ocm-${OS}-${ARCH}
On-behalf-of: @SAP <jakob.moeller@sap.com>
Signed-off-by: Jakob Möller <contact@jakob-moeller.com>
Document three verification methods (gh attestation, cosign, manual SHA-256) in the CLI installation page using tabbed layout. All methods leverage the public GitHub attestation API. On-behalf-of: @SAP <jakob.moeller@sap.com> Signed-off-by: Jakob Möller <contact@jakob-moeller.com>
The old URL https://docs.sigstore.dev/cosign/overview/ returns 404. Updated to current path. On-behalf-of: @SAP <jakob.moeller@sap.com> Signed-off-by: Jakob Möller <contact@jakob-moeller.com>
frewilhelm
reviewed
May 11, 2026
- Add --type slsaprovenance1 to cosign command (fixes predicate type mismatch on older cosign versions) - Use gh auth login --hostname github.com to avoid ambiguity - Use heredoc for multi-line command blocks so [WARN] prefix doesn't break copy-paste On-behalf-of: @SAP <jakob.moeller@sap.com> Signed-off-by: Jakob Möller <contact@jakob-moeller.com>
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@website/content/docs/getting-started/ocm-cli-installation.md`:
- Around line 159-163: Replace the non-portable "base64 -d" in the pipeline that
decodes the DSSE payload (the line piping into base64 -d before jq '.subject[] |
"\(.digest.sha256) \(.name)"') with a portable decoding approach: use a decode
flag that works on both GNU and BSD/macOS (e.g., --decode or -D) or fall back to
openssl base64 -d when base64 -d is unsupported, so macOS users won't fail the
"Manual SHA-256" flow.
- Around line 140-143: Replace the permissive certificate identity regex
currently passed to --certificate-identity-regexp (the pattern starting with
'^https://github.com/open-component-model/open-component-model/') with a
stricter regex that pins the GitHub Actions workflow path and ref so only
attestations from the specific workflow are accepted; specifically require the
.github/workflows/cli-release.yml identity and restrict refs to heads/main or
tags matching semantic version tags (vMAJOR.MINOR.PATCH), and ensure dots are
escaped and anchors used so the identity matches exactly the expected
workflow@refs value.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: eb1e65f9-9467-4b0b-b2c3-e6460f9f88c8
📒 Files selected for processing (2)
website/content/docs/getting-started/ocm-cli-installation.mdwebsite/static/install-cli.sh
🚧 Files skipped from review as they are similar to previous changes (1)
- website/static/install-cli.sh
- Pin --certificate-identity-regexp to cli.yml workflow and expected refs (main, releases/vX.Y, tags/cli/vX.Y.Z) instead of broad repo prefix. Verified against actual attestation certificate SAN. - Replace base64 -d with base64 --decode for macOS compatibility (macOS base64 uses -D for short flag, but --decode works on both GNU and BSD implementations) On-behalf-of: @SAP <jakob.moeller@sap.com> Signed-off-by: Jakob Möller <contact@jakob-moeller.com>
frewilhelm
approved these changes
May 11, 2026
frewilhelm
left a comment
Contributor
There was a problem hiding this comment.
Very cool - thanks a lot!
morri-son
approved these changes
May 11, 2026
ocmbot Bot
pushed a commit
that referenced
this pull request
May 11, 2026
…2484) ## Summary When `gh` is unavailable or unauthenticated, show detailed manual verification instructions instead of a terse warning. Three options: `gh attestation verify`, `cosign verify-blob-attestation`, and manual SHA-256 hash check via the public GitHub attestation API. Closes #2348 ## Test plan - [x] `bash install-cli.sh` with `gh` authenticated → attestation verified - [x] `bash install-cli.sh` without `gh` → detailed warning printed - [x] `OCM_SKIP_VERIFY=true` → no warning - [x] Option B (cosign) verified against cli/v0.5.0 and cli/v0.6.0-rc.1 - [x] CI test updated to match new warning format ##### Verification - [x] I have added/updated tests for my changes (see [Test Requirements](../CONTRIBUTING.md#test-requirements)) - [x] Tests pass locally (`task test` and `task test/integration` if applicable) - [x] My changes do not decrease test coverage - [x] I have tested the changes locally by running `ocm` --------- Signed-off-by: Jakob Möller <contact@jakob-moeller.com> Co-authored-by: Matthias Bruns <github@matthiasbruns.com> f2715fd
ocmbot2 Bot
pushed a commit
to morri-son/open-component-model
that referenced
this pull request
May 11, 2026
…pen-component-model#2484) ## Summary When `gh` is unavailable or unauthenticated, show detailed manual verification instructions instead of a terse warning. Three options: `gh attestation verify`, `cosign verify-blob-attestation`, and manual SHA-256 hash check via the public GitHub attestation API. Closes open-component-model#2348 ## Test plan - [x] `bash install-cli.sh` with `gh` authenticated → attestation verified - [x] `bash install-cli.sh` without `gh` → detailed warning printed - [x] `OCM_SKIP_VERIFY=true` → no warning - [x] Option B (cosign) verified against cli/v0.5.0 and cli/v0.6.0-rc.1 - [x] CI test updated to match new warning format ##### Verification - [x] I have added/updated tests for my changes (see [Test Requirements](../CONTRIBUTING.md#test-requirements)) - [x] Tests pass locally (`task test` and `task test/integration` if applicable) - [x] My changes do not decrease test coverage - [x] I have tested the changes locally by running `ocm` --------- Signed-off-by: Jakob Möller <contact@jakob-moeller.com> Co-authored-by: Matthias Bruns <github@matthiasbruns.com> f2715fd
piotrjanik
pushed a commit
to piotrjanik/open-component-model
that referenced
this pull request
May 11, 2026
…pen-component-model#2484) ## Summary When `gh` is unavailable or unauthenticated, show detailed manual verification instructions instead of a terse warning. Three options: `gh attestation verify`, `cosign verify-blob-attestation`, and manual SHA-256 hash check via the public GitHub attestation API. Closes open-component-model#2348 ## Test plan - [x] `bash install-cli.sh` with `gh` authenticated → attestation verified - [x] `bash install-cli.sh` without `gh` → detailed warning printed - [x] `OCM_SKIP_VERIFY=true` → no warning - [x] Option B (cosign) verified against cli/v0.5.0 and cli/v0.6.0-rc.1 - [x] CI test updated to match new warning format ##### Verification - [x] I have added/updated tests for my changes (see [Test Requirements](../CONTRIBUTING.md#test-requirements)) - [x] Tests pass locally (`task test` and `task test/integration` if applicable) - [x] My changes do not decrease test coverage - [x] I have tested the changes locally by running `ocm` --------- Signed-off-by: Jakob Möller <contact@jakob-moeller.com> Co-authored-by: Matthias Bruns <github@matthiasbruns.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
When
ghis unavailable or unauthenticated, show detailed manual verification instructions instead of a terse warning. Three options:gh attestation verify,cosign verify-blob-attestation, and manual SHA-256 hash check via the public GitHub attestation API.Closes #2348
Test plan
bash install-cli.shwithghauthenticated → attestation verifiedbash install-cli.shwithoutgh→ detailed warning printedOCM_SKIP_VERIFY=true→ no warningVerification
task testandtask test/integrationif applicable)ocm