Add checksums and build provenance to release assets

.github/workflows/release.yml

@@ -68,6 +68,10 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
+      # attest-build-provenance signs with an OIDC token and writes the
+      # attestation to the repository.
+      id-token: write
+      attestations: write
     steps:
       - name: Extract version from tag
         id: version
@@ -87,6 +91,20 @@ jobs:
             mv "$dir/comport" "release/$name"
           done
 
+      # sha256sum output format, so consumers can verify with
+      # `sha256sum --check --ignore-missing checksums.txt`.
+      - name: Generate checksums
+        run: |
+          cd release
+          sha256sum comport-* > checksums.txt
+
+      # Proves each binary was produced by this workflow run. Consumers verify
+      # with `gh attestation verify <file> --repo windymelt/comport`.
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
+        with:
+          subject-path: release/comport-*
+
       - name: Create GitHub Release
         uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
         with:

README.md

@@ -30,6 +30,22 @@ chmod +x comport
 sudo mv comport /usr/local/bin/
 ```
 
+### Verifying a download
+
+Every release ships a `checksums.txt`, and each binary carries a
+[build provenance attestation](https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds)
+tying it to the workflow run that produced it.
+
+```sh
+# Check the SHA-256 digest. Do this before renaming the file, since
+# checksums.txt records the original comport-<version>-<target> names.
+curl -sLO https://github.com/windymelt/comport/releases/latest/download/checksums.txt
+sha256sum --check --ignore-missing checksums.txt
+
+# Confirm the binary came from this repository's release workflow
+gh attestation verify comport-0.1.0-x86_64-linux --repo windymelt/comport
+```
+
 ### Build from source
 
 Requires [sbt](https://www.scala-sbt.org/) (2.x), JDK 17+, and Clang/LLVM