Add checksums and build provenance to release assets - #9
Merged
Merged
Conversation
Generate a checksums.txt (sha256sum format) alongside the release binaries, and attest each binary with actions/attest-build-provenance so consumers can tie it back to the workflow run that produced it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
概要
v*タグでのリリースに、成果物の検証手段を 2 つ追加します。変更内容
.github/workflows/release.ymlchecksums.txtの生成: アセットを集めた後にsha256sum comport-* > checksums.txtを実行。files: release/*により Release へ自動で添付される。利用者はsha256sum --check --ignore-missing checksums.txtで検証できるactions/attest-build-provenanceを追加し、4 つのバイナリすべてを対象に attestation を生成する。鍵の管理は不要（GitHub の Sigstore インスタンスが署名する）。利用者はgh attestation verify <file> --repo windymelt/comportで、どのワークフロー実行・どのコミットから作られたかを確認できるreleaseジョブのpermissionsにid-token: writeとattestations: writeを追加v4.2.2）README.mdInstallation の下に "Verifying a download" を追加。checksums.txt の取得、
sha256sum --check、gh attestation verifyの例を記載した。checksums.txt にはリネーム前のファイル名が記録される点も注記している。補足
圧縮（tar.gz 化）は行っていない。静的リンクの単一バイナリなので、
curl1 行 +chmod +xでインストールできる形を保つ方が扱いやすいと判断した。🤖 Generated with Claude Code