From 4978ca74256347d59ff4e99d8b3040bc2f22c74d Mon Sep 17 00:00:00 2001 From: Abhijit Date: Wed, 7 Oct 2026 21:59:30 +0530 Subject: [PATCH] release: full history for the changelog, upload the signing certificate v0.3.0 shipped with an empty changelog (the release checkout was shallow, so goreleaser couldn't see v0.2.0) and with checksums.txt.sig but no certificate, so the documented cosign verify-blob couldn't succeed. - release workflow checks out full history - goreleaser uploads checksums.txt.pem next to the signature - new 'Sign release' workflow re-signs an existing tag's checksums and uploads signature + certificate (fixes v0.3.0 without re-cutting it) - release header describes the current cometcli; INSTALL.md verifies with the certificate; RELEASE.md checklist covers both Co-Authored-By: Claude Opus 5.5 --- .github/workflows/release.yml | 2 ++ .github/workflows/sign-release.yml | 36 ++++++++++++++++++++++++++++++ .goreleaser.yaml | 15 ++++++++----- docs/INSTALL.md | 20 ++++++++++++----- docs/RELEASE.md | 11 ++++++++- 5 files changed, 72 insertions(+), 12 deletions(-) create mode 100644 .github/workflows/sign-release.yml diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index de232d1..b1d216c 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -14,6 +14,8 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 + with: + fetch-depth: 0 # the changelog needs history back to the previous tag - uses: actions/setup-go@v5 with: go-version: "1.25" diff --git a/.github/workflows/sign-release.yml b/.github/workflows/sign-release.yml new file mode 100644 index 0000000..29d938c --- /dev/null +++ b/.github/workflows/sign-release.yml @@ -0,0 +1,36 @@ +name: Sign release + +# Re-sign an existing release's checksums.txt (keyless, GitHub OIDC) and +# upload the signature and its certificate — for releases published +# without the certificate (v0.3.0) or whose signature needs replacing. +on: + workflow_dispatch: + inputs: + tag: + description: "release tag, e.g. v0.3.0" + required: true + +permissions: + contents: write + id-token: write # cosign keyless + +jobs: + sign: + runs-on: ubuntu-latest + steps: + - uses: sigstore/cosign-installer@v3 + - name: sign checksums.txt + env: + GH_TOKEN: ${{ github.token }} + TAG: ${{ inputs.tag }} + run: | + gh release download "$TAG" -R "$GITHUB_REPOSITORY" -p checksums.txt + cosign sign-blob --yes \ + --output-signature checksums.txt.sig \ + --output-certificate checksums.txt.pem \ + checksums.txt + cosign verify-blob --signature checksums.txt.sig --certificate checksums.txt.pem \ + --certificate-identity-regexp "github.com/${GITHUB_REPOSITORY}" \ + --certificate-oidc-issuer https://token.actions.githubusercontent.com \ + checksums.txt + gh release upload "$TAG" -R "$GITHUB_REPOSITORY" checksums.txt.sig checksums.txt.pem --clobber diff --git a/.goreleaser.yaml b/.goreleaser.yaml index 48d4720..aaf83ae 100644 --- a/.goreleaser.yaml +++ b/.goreleaser.yaml @@ -56,6 +56,9 @@ signs: - ${artifact}.pem - ${artifact} artifacts: checksum + # upload both: a keyless signature can't be verified without its certificate + signature: "${artifact}.sig" + certificate: "${artifact}.pem" output: true release: @@ -63,13 +66,15 @@ release: header: | ## cometcli v{{ .Version }} - An agentic SRE terminal for Cosmos-EVM validators — deterministic CLI, - live TUI, optional AI agent, fleet ops, runbooks, and alerting. + An agentic SRE terminal for Cosmos SDK and Cosmos-EVM validators — talk to + your machine and nodes the way you use Claude Code; incidents worked through + to the fix, every change and transaction approved by you. - Install: - curl -fsSL https://raw.githubusercontent.com/abhijitkrm/cometcli/main/scripts/install.sh | bash + ```bash + curl -fsSL https://raw.githubusercontent.com/abhijitkrm/cometcli/main/scripts/install.sh | bash + ``` - Verify: docs/INSTALL.md (checksums + cosign keyless signature). + Verify: [docs/INSTALL.md](https://github.com/abhijitkrm/cometcli/blob/main/docs/INSTALL.md#verifying-release-signatures) (checksums + cosign keyless signature). changelog: use: git diff --git a/docs/INSTALL.md b/docs/INSTALL.md index 7ff6316..c104853 100644 --- a/docs/INSTALL.md +++ b/docs/INSTALL.md @@ -14,7 +14,7 @@ Defaults and knobs: ```bash # pick a version (default: latest release) -COMETCLI_VERSION=v0.1.0 bash install.sh +COMETCLI_VERSION=v0.3.0 bash install.sh # custom binary directory (created if missing) COMETCLI_BIN_DIR=$HOME/bin bash install.sh @@ -47,10 +47,10 @@ Grab the tarball for your platform from [Releases](https://github.com/abhijitkrm/cometcli/releases), verify, install: ```bash -curl -fLO https://github.com/abhijitkrm/cometcli/releases/download/v0.1.0/cometcli_0.1.0_darwin_arm64.tar.gz -curl -fLO https://github.com/abhijitkrm/cometcli/releases/download/v0.1.0/checksums.txt +curl -fLO https://github.com/abhijitkrm/cometcli/releases/download/v0.3.0/cometcli_0.3.0_darwin_arm64.tar.gz +curl -fLO https://github.com/abhijitkrm/cometcli/releases/download/v0.3.0/checksums.txt shasum -a 256 -c checksums.txt --ignore-missing # or: sha256sum -c on Linux -tar xzf cometcli_0.1.0_darwin_arm64.tar.gz cometcli +tar xzf cometcli_0.3.0_darwin_arm64.tar.gz cometcli install cometcli /usr/local/bin/ ``` @@ -61,13 +61,21 @@ Releases are signed with cosign (keyless, GitHub OIDC). With installed: ```bash -curl -fLO https://github.com/abhijitkrm/cometcli/releases/download/v0.1.0/checksums.txt.sig -cosign verify-blob --signature checksums.txt.sig \ +V=v0.3.0 +curl -fLO https://github.com/abhijitkrm/cometcli/releases/download/$V/checksums.txt +curl -fLO https://github.com/abhijitkrm/cometcli/releases/download/$V/checksums.txt.sig +curl -fLO https://github.com/abhijitkrm/cometcli/releases/download/$V/checksums.txt.pem +cosign verify-blob --signature checksums.txt.sig --certificate checksums.txt.pem \ --certificate-identity-regexp 'github.com/abhijitkrm/cometcli' \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ checksums.txt ``` +`Verified OK` means `checksums.txt` was signed by this repository's GitHub +Actions; then `shasum -a 256 -c checksums.txt --ignore-missing` ties your +archive to it. The certificate (`.pem`) ships from v0.3.0 on — releases before +that have only the signature. + Every release also ships a per-architecture SBOM (`*.sbom.json`, generated with syft). diff --git a/docs/RELEASE.md b/docs/RELEASE.md index 49d5179..a5464cf 100644 --- a/docs/RELEASE.md +++ b/docs/RELEASE.md @@ -28,7 +28,9 @@ SBOMs, `checksums.txt`, and cosign keyless-signs the checksum. - [ ] Release notes read well — the grouped auto-changelog covers commits; hand-edit the body for highlights on notable releases - [ ] Release page shows 4 archives + `checksums.txt` + `checksums.txt.sig` - + 4 `*.sbom.json` + + `checksums.txt.pem` + 4 `*.sbom.json` +- [ ] The changelog lists the commits since the previous tag (the release + workflow checks out full history for this) - [ ] `cosign verify-blob` passes (see docs/INSTALL.md) - [ ] `curl | bash` install of the new tag works on linux + macOS - [ ] `cometcli version` reports the tag @@ -45,6 +47,13 @@ remove that block if you skip this step, or releases will fail. **Branch protection**: `main` requires `build-test` + `lint` green and rejects force-pushes/deletions (configured via GitHub API). +## Re-signing a release + +If a release is missing `checksums.txt.pem` or its signature must be +replaced, run the **Sign release** workflow (Actions → Sign release → tag). +It signs the published `checksums.txt` keylessly, verifies the result and +uploads `checksums.txt.sig` + `checksums.txt.pem`. + ## If a release goes bad Do not delete the tag silently — publish a patch (`v0.X.1`) or mark the