From 6e86571813f1085fd9844d3f77ad61a548b495e6 Mon Sep 17 00:00:00 2001 From: Toshihiko SHIMOKAWA Date: Sat, 4 Jul 2026 20:42:38 +0900 Subject: [PATCH 1/2] Document release signing (SHA256SUMS + cosign v3) in CLAUDE.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Reflect the current state after the supply-chain / Renovate work (smkwlab/.github#69 + Renovate 一本化). Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01JPuooHgsrboSEbfJsNf6iG --- CLAUDE.md | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/CLAUDE.md b/CLAUDE.md index 377e770..2305131 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -133,7 +133,14 @@ git push origin 0.3.0 # ← this triggers the release workflow 2. **Version guard** — fails fast if `Mix.Project.config()[:version]` ≠ pushed tag name. 3. **`MIX_ENV=prod mix release`** — produces the Bakeware binary at `_build/prod/rel/bakeware/tdig`. 4. **Rename + upload artifact** — saves as `tdig-linux-x86_64` / `tdig-macos-arm64`. -5. **Publish release** — collects both artifacts, then runs `gh release create --generate-notes `. Notes are auto-generated from PRs / commits since the previous tag. +5. **Generate `SHA256SUMS`** — checksum manifest over both binaries (round-tripped with `sha256sum -c` before publishing). +6. **Sign with cosign (keyless)** — cosign v3 (via `sigstore/cosign-installer@v4`, GitHub OIDC, no key to manage) signs `SHA256SUMS` → `SHA256SUMS.cosign.bundle`; an in-workflow `cosign verify-blob` self-check fails the release if signing is broken. +7. **Publish release** — collects binaries + `SHA256SUMS` + `.cosign.bundle`, then runs `gh release create --generate-notes `. Notes are auto-generated from PRs / commits since the previous tag. + +### Release integrity & authenticity + +- **Integrity**: `SHA256SUMS` (verify with `sha256sum --ignore-missing -c SHA256SUMS`; macOS `shasum -a 256`). +- **Authenticity**: cosign keyless signature bound to this workflow's OIDC identity. **Downstream verification needs cosign v3+** — from `0.4.2` on the bundle is the new Sigstore format that older cosign can't read. See the README "Verifying the download" section for the `cosign verify-blob` command (`--certificate-identity-regexp` + `--certificate-oidc-issuer`). ### Bumping the version From fcf4a50a620838dd9aa9e90a450a5918743ddda2 Mon Sep 17 00:00:00 2001 From: Toshihiko SHIMOKAWA Date: Sat, 4 Jul 2026 20:46:50 +0900 Subject: [PATCH 2/2] Address review: clarify 0.4.2 = tdig release version in cosign note Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01JPuooHgsrboSEbfJsNf6iG --- CLAUDE.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CLAUDE.md b/CLAUDE.md index 2305131..f835ccc 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -140,7 +140,7 @@ git push origin 0.3.0 # ← this triggers the release workflow ### Release integrity & authenticity - **Integrity**: `SHA256SUMS` (verify with `sha256sum --ignore-missing -c SHA256SUMS`; macOS `shasum -a 256`). -- **Authenticity**: cosign keyless signature bound to this workflow's OIDC identity. **Downstream verification needs cosign v3+** — from `0.4.2` on the bundle is the new Sigstore format that older cosign can't read. See the README "Verifying the download" section for the `cosign verify-blob` command (`--certificate-identity-regexp` + `--certificate-oidc-issuer`). +- **Authenticity**: cosign keyless signature bound to this workflow's OIDC identity. **Downstream verification needs cosign v3+** — from tdig release `0.4.2` on, the bundle is the new Sigstore format that older cosign (v2) can't read. See the README "Verifying the download" section for the `cosign verify-blob` command (`--certificate-identity-regexp` + `--certificate-oidc-issuer`). ### Bumping the version