releasesig

package

v1.0.0 Latest Latest Go to latest Published: Oct 20, 2026 License: AGPL-3.0 Imports: 8 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/osshield/fallbck

Links

Open Source Insights

Documentation ¶

Overview ¶

Package releasesig verifies that a release's checksums file carries a valid Sigstore (cosign keyless) signature from this project's GitHub release workflow, and looks artifacts up in that signed file. The server checks it before mirroring an agent release; agents check it before replacing their own binary, so a compromised server cannot push them a binary GitHub never built.

Index ¶

Constants
func ChecksumFor(checksums []byte, name string) (string, error)
func ReadAll(r io.Reader, limit int64) ([]byte, error)
func Verify(bundleJSON, checksums []byte) error

Constants ¶

View Source

const (
	// Issuer is GitHub Actions' OIDC issuer
	Issuer = "https://token.actions.githubusercontent.com"
	// SANRegex pins the signing identity to this repository's release workflow on a
	// version tag
	SANRegex = `^https://github\.com/osshield/fallbck/\.github/workflows/release\.yml@refs/tags/v[0-9]+\.[0-9]+\.[0-9]+.*$`
)

Variables ¶

This section is empty.

Functions ¶

func ChecksumFor ¶

func ChecksumFor(checksums []byte, name string) (string, error)

ChecksumFor finds name in a goreleaser checksums file ("<sha256> <name>" lines)

func ReadAll ¶

func ReadAll(r io.Reader, limit int64) ([]byte, error)

ReadAll reads at most limit bytes (checksums and bundles are small)

func Verify ¶

func Verify(bundleJSON, checksums []byte) error

Verify checks that bundleJSON (cosign --new-bundle-format) signs checksums and was issued to the release workflow identity.

Types ¶

This section is empty.

Source Files ¶

View all Source files

releasesig.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL