From d7779f22e7c23285b5901c638ce5c12453942460 Mon Sep 17 00:00:00 2001 From: Tom Wieland Date: Wed, 21 Oct 2026 15:11:37 +0200 Subject: [PATCH] ci(release): read the provenance subjects from the Sigstore bundle The v0.12.0 verify job failed before checking a crate: slsa-github-generator v2.1.0 writes a Sigstore bundle, whose DSSE payload is under .dsseEnvelope, so `jq .payload` gave "null" and the subject list did not parse. Read .dsseEnvelope.payload, falling back to a bare envelope's .payload. Checked against the v0.12.0 provenance: 66 subjects, and all 33 crates on crates.io match their attested sha256. Signed-off-by: Tom Wieland Co-Authored-By: Claude Opus 5.5 --- .github/workflows/publish.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index c52fb496..ef7ee27c 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -376,8 +376,10 @@ jobs: # A dry run publishes nothing, so it checks the built files the same way. run: | set -euo pipefail - # The subjects the signed provenance attests (DSSE payload -> in-toto statement). - jq -r '.payload' "$PROVENANCE" | base64 -d | jq -r '.subject[] | "\(.digest.sha256) \(.name)"' > attested.sha256 + # The subjects the signed provenance attests (DSSE payload -> in-toto statement). The + # generator writes a Sigstore bundle (payload under .dsseEnvelope); a bare DSSE envelope + # has it at the top level. + jq -r '.dsseEnvelope.payload // .payload' "$PROVENANCE" | base64 -d | jq -r '.subject[] | "\(.digest.sha256) \(.name)"' > attested.sha256 cat attested.sha256 source_args=(--source-uri "github.com/$GITHUB_REPOSITORY") if [ -n "$TAG" ]; then