feat: release 0.3.3 with improved bundle-based signing#49
Merged
technicalpickles merged 2 commits intomainfrom Sep 10, 2025
Merged
feat: release 0.3.3 with improved bundle-based signing#49technicalpickles merged 2 commits intomainfrom
technicalpickles merged 2 commits intomainfrom
Conversation
## Problem The 0.3.2 release failed because signature verification was too strict with certificate identity matching. The verification step was failing even though signing was working correctly. ## Root Cause - Certificate identity format in verification didn't match what GitHub Actions actually generates during keyless signing - COSIGN_EXPERIMENTAL=1 environment variable is deprecated in newer cosign versions - Bundle verification might need different parameters ## Fixes ### Enhanced Verification Script - **Multiple Identity Patterns**: Try different certificate identity formats - **Fallback Strategy**: Standard path → regexp → loose regexp matching - **Better Error Handling**: Continue trying different formats if one fails ### GitHub Actions Workflow - **Remove Deprecated Flag**: Removed COSIGN_EXPERIMENTAL=1 environment variable - **Cleaner Configuration**: Simplified environment setup ### Debug Tooling - **New Debug Script**: `debug-signature-verification.sh` for troubleshooting - **Verbose Output**: Shows exactly what certificate identities are being tried - **Release Asset Inspection**: Downloads and inspects actual signature files ## Expected Impact - Signature verification should now succeed in GitHub Actions - More robust verification that works with different cosign versions - Better debugging capabilities for future issues ## Testing This will be tested when the next release runs with these fixes.
Since the 0.3.2 release failed and was never published, we need to bump to 0.3.3 to ensure there's a clear version difference that will trigger the release workflow. This version will test the improved signature verification fixes: - Multiple certificate identity pattern matching - Removed deprecated COSIGN_EXPERIMENTAL flag - Enhanced bundle and signature verification - Debug tooling for troubleshooting Expected outcome: Successful release with both .bundle and .sig files.
Contributor
There was a problem hiding this comment.
Pull Request Overview
This PR implements a comprehensive solution for bundle-based signing by bumping the version to 0.3.3 and enhancing signature verification with multiple fallback patterns to ensure compatibility with GitHub Actions certificate identities.
- Version bump from 0.3.2 to 0.3.3 across all Cargo.toml files
- Enhanced signature verification with multiple certificate identity patterns and fallback logic
- Added debug tooling for troubleshooting signature verification issues
- Removed deprecated COSIGN_EXPERIMENTAL environment variable from CI workflow
Reviewed Changes
Copilot reviewed 6 out of 7 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| Cargo.toml | Version bump to 0.3.3 for main package |
| envsense-macros/Cargo.toml | Version bump to 0.3.3 for macros package |
| envsense-macros/envsense-macros-impl/Cargo.toml | Version bump to 0.3.3 for macros implementation |
| scripts/verify-release-signatures.sh | Enhanced verification with multiple certificate identity patterns |
| scripts/debug-signature-verification.sh | New debug script for troubleshooting signature verification |
| .github/workflows/release.yml | Removed deprecated COSIGN_EXPERIMENTAL environment variable |
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🚀 Release 0.3.3 - Bundle-Based Signing Ready!
This PR implements the final fixes for robust bundle-based signing and triggers release 0.3.3 to validate our aqua/mise distribution support.
🔐 Signature Verification Fixes
Problem Solved
The 0.3.2 release failed due to strict certificate identity matching in signature verification. This PR implements a robust fallback strategy.
Enhanced Verification Strategy
https://github.com/REPO/.github/workflows/release.yml@refs/heads/mainhttps://github.com/REPO/.*.*REPO.*.bundleand.sigformatsWorkflow Improvements
COSIGN_EXPERIMENTAL=1📊 Version Changes
Cargo.toml:0.3.1→0.3.3envsense-macros/Cargo.toml:0.3.1→0.3.3envsense-macros/envsense-macros-impl/Cargo.toml:0.3.1→0.3.3Note: Skipped 0.3.2 since that release failed and was never published
🛠️ New Debug Tooling
Debug Script:
scripts/debug-signature-verification.sh🎯 Expected Outcomes
Successful Release Process
.bundleand.sigfilesValidation Process
After this PR merges:
./scripts/monitor-and-validate-release.sh(PR feat: add release workflow monitoring and validation scripts #47)🔍 Testing Strategy
Immediate Testing
Post-Release Testing
📋 Success Criteria
.bundleand.sigfiles present🎉 Impact
This PR completes the technical implementation for aqua/mise distribution:
This is the final validation step before submitting to the aqua registry! 🚀
Once this release succeeds,
envsensewill be ready for installation via: