ci+docs: R21 Task A — sigstore/cosign attestation for crates publishes#479
Merged
Conversation
…shes
Adds SLSA Build Provenance v1 attestation to every crate
published from .github/workflows/crates-publish.yml. Each of
the 9 crates is packaged + attested + Rekor-recorded before
the cargo publish step.
What changed in the workflow
============================
1. New top-level `permissions:` block:
- id-token: write (OIDC for Sigstore Fulcio)
- attestations: write (registers the bundle on the run)
- contents: read (existing checkout perms)
2. For each of the 9 crates, the new sequence is:
- cargo package -p <crate> --allow-dirty
(creates target/package/<crate>-<version>.crate)
- actions/attest-build-provenance@v2 with subject-path
(signs + pushes to Rekor)
- cargo publish -p <crate> --no-verify
(publishes the SAME .crate file we just attested;
--no-verify prevents server-side rebuild that could drift
from the attested artifact)
- sleep 30 (existing index-propagation gate)
3. Final step: actions/upload-artifact@v4 bundles all 9 .crate
files as a workflow artifact `sbo3l-crates-<version>-attested`,
90-day retention.
Forward-only posture
====================
Existing 1.2.0 publishes shipped pre-attestation. Cargo refuses
to re-publish an existing version (registry immutability), so
backfilling 1.2.0 isn't possible. 1.3.0+ ships attested from
first publish onward.
Verification (consumer side, three options)
============================================
Documented in docs/security/supply-chain.md:
Option A — gh attestation verify (simplest, GH CLI 2.49+)
Option B — cosign verify-blob (no GH CLI needed)
Option C — rekor-cli direct lookup by .crate digest
Each path proves: this .crate file was built by the canonical
B2JK-Industry workflow at a release tag, not by an attacker
who hijacked the registry credential.
Why this matters
================
For agentic-platform consumers (KH/ENS/Uniswap eval teams
scanning supply chain), this is the enterprise-grade trust
signal they look for in Cargo.toml deps before importing
the crate.
No new credentials, no new repo secrets — Sigstore uses GitHub
OIDC + public Fulcio CA + public Rekor log. Backwards-compatible
(unverified consumers get the same .crate file as before).
Cross-track context: pairs with ENSIP-26 (verifiable agent
identity) + UR per-command pattern (signed swap receipts) + KH
IP-1 envelope (signed workflow submits) for the end-to-end
"every link in the agent → adapter → registry chain is signed"
narrative.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
B2JK-Industry
added a commit
that referenced
this pull request
May 3, 2026
…hecks (#490) R22 cascade landed 7 PRs in 21 seconds. Per-PR TASK B verification per Daniel's continuous-watch brief: ✅ #477 ElizaOS-KH plugin (Dev 2 PR1 of 4 KH-adapter set): merged on main; npm publish pending; structural checks PASS. ✅ #481 AutoGen-KH plugin (Dev 2 PR2 of 4 KH-adapter set): merged on main; npm publish pending; structural checks PASS. ✅ #479 sigstore/cosign attestation for crates publishes: - .github/workflows/crates-publish.yml has attest-build-provenance step + correct permissions block - docs/security/supply-chain.md ships 3 verification paths (gh attestation verify, cosign verify-blob, rekor-cli search) - Live cosign verify-blob test deferred per documented backfill posture: "1.2.0 unattested; 1.3.0+ attested forward-only" ✅ #485 backup demo video automation: - 10 demo assets present at apps/marketing/public/demo-assets/ (title-card, end-card, lower-third-template, 3 QR codes, 4 sponsor inserts) - Video URL itself is Daniel-side; Round 3 fires on URL paste ✅ #484 R21 Task B nudge runbook (operational; structural merge OK) ✅ #486 R21 Task C anvil-fork sim (operational; structural merge OK) ✅ #472 Codex fixes on R20 PRs #461+#470 (structural) Outstanding R22 PRs at batch 3 close (auto-merge will resolve): #476 KH-fleet 5 real capsules — CI cycling #478 Vercel-AI-KH — DIRTY #480 0G TS SDK — DIRTY #483 CrewAI-KH — CI pending #487 i18n SK+KO+JA — CI cycling When #478 + #483 land, Dev 2's full 4-KH-adapter set will be at 4/4 structural; npm publish verification fires when packages land at 1.2.0 on registry. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Every SBO3L crate published to crates.io from this workflow now ships SLSA Build Provenance v1 attestation, signed via GitHub OIDC + Sigstore Fulcio, and recorded on the public Rekor transparency log.
What changed
.github/workflows/crates-publish.ymlcargo package+actions/attest-build-provenance@v2+cargo publish --no-verifyfor all 9 crates. Newpermissions:block (id-token: write,attestations: write). Finalupload-artifactbundles all 9 .crate files.docs/security/supply-chain.mdVerification (consumer-side, three options)
Operational impact
Cross-track context
Pairs with ENSIP-26 + UR per-command pattern + KH IP-1 envelope for the end-to-end "every link is signed" narrative.
🤖 Generated with Claude Code