Sign published images with cosign

[tomj12k]

Threat: T64 (Morelitea/security, Boundary 11). Severity Medium. NIST SR-4, SR-11, SI-7.
Work item: WI-12.

Why

Nothing this organization publishes is signed, so nothing downstream can tell an image this workflow built from one someone else pushed to the same tag.

initiative_infra's PLAN.md records that signing has to start in the app repos' publish workflows before Kyverno can verify anything. The admission policy is blocked on this, not the reverse — which is why this repository is a reasonable place to start.

Keyless, deliberately

cosign exchanges the job's OIDC token for a short-lived certificate from Fulcio and records the signature in the public Rekor log.

No private key exists to hold, rotate or lose. That matters here specifically: the alternative is another long-lived secret in a repository whose threat model already notes the GitHub App private key and the encryption key living as plain environment variables. Adding a third would be a poor trade for a supply-chain control.

The certificate carries the workflow identity, so a verifier can require that this repository's release workflow produced the image — rather than merely someone with push access to the registry. That is the property a signature is actually for.

Signed by digest

A tag moves; a digest is what was built. One signature covers every tag pointing at it, so latest and the semver tags all verify without signing three times.

Verifying one, once this ships

cosign verify ghcr.io/morelitea/initiative-github@sha256:… \
  --certificate-identity-regexp '^https://github.com/Morelitea/initiative-github/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Verification

Workflow parses; the job carries id-token: write; the build step exposes its digest; the generated shell passes bash -n with the Actions expressions stubbed; and every action reference including the new one is pinned to a commit SHA.

The signing itself runs only on a tag push, so it is unexercised until the next release. That is the honest limit — the first release is the test.

A note from building this

My first attempt branched from a stale local main and reported eight unpinned actions, which looked like #6 having been reverted. It had not — origin/main carries all eight pins. Rebuilt on the real tip. Worth mentioning only because "the pinning disappeared" would have been an alarming thing to report and would have been wrong.

🤖 Generated with Claude Code

https://claude.ai/code/session_01D5xdKhPXJT4HMWwUyENiu1

[tomj12k]

Production-readiness review completed with no defect found. The publish job signs the digest-qualified image using keyless cosign after pushing, and the workflow identity permissions are scoped to the job. The remaining operational trade-off is transparency-log/OIDC availability: signing failure correctly blocks publication evidence rather than silently producing an unsigned release.

[tomj12k]

Superseded — reopened with the finding details moved to the private security repository. This repository is public. Tracked as T64.