From e8c4f838ae9627fed83c0cb5bbfb68e19c6ae797 Mon Sep 17 00:00:00 2001 From: Windymelt Date: Tue, 11 Aug 2026 20:07:01 +0900 Subject: [PATCH] Add checksums and build provenance to release assets Generate a checksums.txt (sha256sum format) alongside the release binaries, and attest each binary with actions/attest-build-provenance so consumers can tie it back to the workflow run that produced it. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/release.yml | 18 ++++++++++++++++++ README.md | 16 ++++++++++++++++ 2 files changed, 34 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 0c91d50..75ecfa4 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -68,6 +68,10 @@ jobs: runs-on: ubuntu-latest permissions: contents: write + # attest-build-provenance signs with an OIDC token and writes the + # attestation to the repository. + id-token: write + attestations: write steps: - name: Extract version from tag id: version @@ -87,6 +91,20 @@ jobs: mv "$dir/comport" "release/$name" done + # sha256sum output format, so consumers can verify with + # `sha256sum --check --ignore-missing checksums.txt`. + - name: Generate checksums + run: | + cd release + sha256sum comport-* > checksums.txt + + # Proves each binary was produced by this workflow run. Consumers verify + # with `gh attestation verify --repo windymelt/comport`. + - name: Attest build provenance + uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 + with: + subject-path: release/comport-* + - name: Create GitHub Release uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2 with: diff --git a/README.md b/README.md index d615f70..af6222b 100644 --- a/README.md +++ b/README.md @@ -30,6 +30,22 @@ chmod +x comport sudo mv comport /usr/local/bin/ ``` +### Verifying a download + +Every release ships a `checksums.txt`, and each binary carries a +[build provenance attestation](https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds) +tying it to the workflow run that produced it. + +```sh +# Check the SHA-256 digest. Do this before renaming the file, since +# checksums.txt records the original comport-- names. +curl -sLO https://github.com/windymelt/comport/releases/latest/download/checksums.txt +sha256sum --check --ignore-missing checksums.txt + +# Confirm the binary came from this repository's release workflow +gh attestation verify comport-0.1.0-x86_64-linux --repo windymelt/comport +``` + ### Build from source Requires [sbt](https://www.scala-sbt.org/) (2.x), JDK 17+, and Clang/LLVM