Skip to content

docs(CLAUDE.md): reflect current supply-chain / Renovate state #74

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
toshi0806 merged 2 commits into from
Jul 4, 2026
Merged

docs(CLAUDE.md): reflect current supply-chain / Renovate state #74

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6e86571
Document release signing (SHA256SUMS + cosign v3) in CLAUDE.md
toshi0806 Jul 4, 2026
fcf4a50
Address review: clarify 0.4.2 = tdig release version in cosign note
toshi0806 Jul 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion CLAUDE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -133,7 +133,14 @@ git push origin 0.3.0 # ← this triggers the release workflow
2. **Version guard** — fails fast if `Mix.Project.config()[:version]` ≠ pushed tag name.
3. **`MIX_ENV=prod mix release`** — produces the Bakeware binary at `_build/prod/rel/bakeware/tdig`.
4. **Rename + upload artifact** — saves as `tdig-linux-x86_64` / `tdig-macos-arm64`.
5. **Publish release** — collects both artifacts, then runs `gh release create <tag> --generate-notes <assets>`. Notes are auto-generated from PRs / commits since the previous tag.
5. **Generate `SHA256SUMS`** — checksum manifest over both binaries (round-tripped with `sha256sum -c` before publishing).
6. **Sign with cosign (keyless)** — cosign v3 (via `sigstore/cosign-installer@v4`, GitHub OIDC, no key to manage) signs `SHA256SUMS` → `SHA256SUMS.cosign.bundle`; an in-workflow `cosign verify-blob` self-check fails the release if signing is broken.

@github-actions github-actions Bot Jul 4, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ℹ️ [LOW] cosign v3 系のバージョン指定が混在しているように見えます。本文では「cosign v3」と記載する一方でインストーラは sigstore/cosign-installer@v4 を指定しています（cosign 本体と installer のバージョン体系が異なることは理解できますが）。読者が混乱しないよう、cosign 本体のバージョンと installer アクションのバージョンの区別を一言添えると親切です。

@toshi0806 toshi0806 Jul 4, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

混在ではなく正確な関係です: cosign-installer v4（action のメジャー）が cosign 本体 v3 をインストールします。本文も「cosign v3（via sigstore/cosign-installer@v4）」と両方併記し、action 版と CLI 版を取り違えないよう意図的に明示しています。LOW のため据え置き。

@github-actions github-actions Bot Jul 4, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ℹ️ [LOW] cosign のバージョン記述に若干の不整合の可能性があります。「cosign v3（via sigstore/cosign-installer@v4）」と記載されていますが、installer のバージョン（v4）と cosign 本体のバージョン（v3）が別物である点は読者が混乱しやすいので、そのまま意図通りか確認してください。もし意図通りであれば問題ありません。

7. **Publish release** — collects binaries + `SHA256SUMS` + `.cosign.bundle`, then runs `gh release create <tag> --generate-notes <assets>`. Notes are auto-generated from PRs / commits since the previous tag.

### Release integrity & authenticity

- **Integrity**: `SHA256SUMS` (verify with `sha256sum --ignore-missing -c SHA256SUMS`; macOS `shasum -a 256`).
- **Authenticity**: cosign keyless signature bound to this workflow's OIDC identity. **Downstream verification needs cosign v3+** — from tdig release `0.4.2` on, the bundle is the new Sigstore format that older cosign (v2) can't read. See the README "Verifying the download" section for the `cosign verify-blob` command (`--certificate-identity-regexp` + `--certificate-oidc-issuer`).

### Bumping the version

Expand Down
Loading