From b95eab3c050179068ab89c8385cf7a17cd706dfc Mon Sep 17 00:00:00 2001 From: Denis Drobyshev Date: Mon, 10 Aug 2026 22:26:46 +0300 Subject: [PATCH] Sign and checksum the desktop binaries Three executables are attached to every release and run directly on someone's machine. Nothing let a downloader tell whether the file they got is the file this workflow produced. The wheel already has that guarantee: gh-action-pypi-publish emits a PEP 740 attestation, and stadion-rl 0.1.0 carries a verified bundle with a Rekor entry. The artefact inside a virtualenv was verifiable and the artefact executed directly was not, which is the wrong way round. SHA256SUMS goes in the format sha256sum -c reads, and the provenance attestation covers all three binaries. id-token and attestations are scoped to the attach job, so the matrix builds that run PyInstaller over third-party dependencies keep read-only credentials. --- .github/workflows/release-app.yml | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/.github/workflows/release-app.yml b/.github/workflows/release-app.yml index 1dde82f..4086c06 100644 --- a/.github/workflows/release-app.yml +++ b/.github/workflows/release-app.yml @@ -10,6 +10,8 @@ name: Build desktop app # # The matrix jobs only upload artifacts; a single `attach` job then adds them to # the release in one call — so concurrent uploads can't race and drop an asset. +# That job also writes SHA256SUMS and signs a build-provenance attestation, so a +# downloaded executable can be checked rather than trusted. on: release: @@ -74,6 +76,13 @@ jobs: if: github.event_name == 'release' needs: build runs-on: ubuntu-latest + permissions: + contents: write + # Signing the provenance statement needs an OIDC token, and writing the + # attestation needs its own scope. Both are job-scoped rather than + # top-level so the matrix builds keep read-only credentials. + id-token: write + attestations: write steps: - name: Download all binaries uses: actions/download-artifact@v8 @@ -81,6 +90,25 @@ jobs: path: bins merge-multiple: true + # A downloader who wants to check what they got needs something to check + # against. One file, the format sha256sum -c reads directly. + - name: Checksums + working-directory: bins + run: | + sha256sum * > SHA256SUMS + cat SHA256SUMS + + # Signed provenance: which workflow, at which commit, produced these exact + # bytes. Verifiable with `gh attestation verify --repo + # DrobyshevDev/glia` without trusting this release page. + - name: Attest the binaries + uses: actions/attest-build-provenance@v3 + with: + subject-path: | + bins/glia-shell-windows.exe + bins/glia-shell-macos + bins/glia-shell-linux + - name: Attach to release uses: softprops/action-gh-release@v3 with: