Node / ReticulumProjects / MeshChatX.git / files / scripts / ci / attest-release-assets.sh

Displaying Raw • Download

T8b949e#!/bin/sh

T8b949e# Create SLSA v1 cosign bundle attestations next to each release binary under DIR.

T8b949e# Requires: cosign on PATH; COSIGN_KEY_PATH to cosign private key PEM; COSIGN_PASSWORD

T8b949e# if the key is encrypted. Run from repository root so scripts/ci/slsa-predicate.py resolves.

T8b949e# Cosign v3+: uses cosign-signing-config-no-rekor.json (no Rekor upload); verify with

T8b949e# cosign verify-blob-attestation --insecure-ignore-tlog=true when using the repo public key.

T8b949e#

T8b949e# Usage: attest-release-assets.sh <directory>

Tffa657set -eu

Te6edf3DIRTff7b72=Ta5d6ff"Tffd700${Te6edf31Tb4b4b4:Tb4b4b4?directoryTffd700}Ta5d6ff"

Te6edf3KEYTff7b72=Ta5d6ff"Tffd700${Te6edf3COSIGN_KEY_PATHTb4b4b4:Tb4b4b4?set COSIGN_KEY_PATHTffd700}Ta5d6ff"

Te6edf3SCI_DIRTff7b72=Ta5d6ff"Tff7b72$(Te6edf3CDPATHTff7b72= Tffa657cd -- Ta5d6ff"Tff7b72$(dirname Ta5d6ff"Te6edf3$0Ta5d6ff"Tff7b72)Ta5d6ff" Tff7b72&& Tffa657pwdTff7b72)Ta5d6ff"

Te6edf3SIGNCFGTff7b72=Ta5d6ff"Tffd700${Te6edf3SCI_DIRTffd700}Ta5d6ff/cosign-signing-config-no-rekor.jsonTa5d6ff"

Tff7b72if Tff7b72[ ! -f Ta5d6ff"Te6edf3$KEYTa5d6ff" Tff7b72]Tb4b4b4; Tff7b72then

Tffa657echo Ta5d6ff"Ta5d6ffattest-release-assets.sh: missing key file Te6edf3$KEYTa5d6ff" >Tb4b4b4&T79c0ff2

Tffa657exit T79c0ff1

Tff7b72fi

Tff7b72if Tff7b72[ ! -f Ta5d6ff"Te6edf3$SIGNCFGTa5d6ff" Tff7b72]Tb4b4b4; Tff7b72then

Tffa657echo Ta5d6ff"Ta5d6ffattest-release-assets.sh: missing signing config Te6edf3$SIGNCFGTa5d6ff" >Tb4b4b4&T79c0ff2

Tffa657exit T79c0ff1

Tff7b72fi

Te6edf3PREDTff7b72=Ta5d6ff"Tff7b72$(mktemp Ta5d6ff"Tffd700${Te6edf3TMPDIRTff7b72:-Tb4b4b4/tmpTffd700}Ta5d6ff/slsa-pred.XXXXXXTa5d6ff"Tff7b72)Ta5d6ff"

Tffa657trap Ta5d6ff'rm -f "$PRED"' EXIT INT

python3 scripts/ci/slsa-predicate.py > Ta5d6ff"Te6edf3$PREDTa5d6ff"

find Ta5d6ff"Te6edf3$DIRTa5d6ff" -type f ! -name Ta5d6ff'*.cosign.bundle' ! -name Ta5d6ff'*.sha256' ! -name Ta5d6ff'*.intoto.jsonl' Tffea00\

! -name Ta5d6ff'builder-debug.yml' Tffea00\

! -path Ta5d6ff'*/win-unpacked/*' Tffea00\

! -path Ta5d6ff'*/linux-unpacked/*' Tffea00\

! -path Ta5d6ff'*/mac-universal/*' Tffea00\

! -path Ta5d6ff'*/mac-arm64/*' Tffea00\

! -path Ta5d6ff'*/mac-x64/*' Tffea00\

! -path Ta5d6ff'*/mac/*.app/*' Tffea00\

! -path Ta5d6ff'*/mac/*.app' Tffea00\

Tb4b4b4| Tff7b72while Te6edf3IFSTff7b72= Tffa657read -r fTb4b4b4; Tff7b72do

Tff7b72case Ta5d6ff"Te6edf3$fTa5d6ff" Tff7b72in

*/.git/*Tff7b72) Tff7b72continue Tb4b4b4;Tb4b4b4;

Tff7b72esac

Tffa657echo Ta5d6ff"Ta5d6ffattest: Te6edf3$fTa5d6ff"

cosign attest-blob --yes Tffea00\

--key Ta5d6ff"Te6edf3$KEYTa5d6ff" Tffea00\

--signing-config Ta5d6ff"Te6edf3$SIGNCFGTa5d6ff" Tffea00\

--predicate Ta5d6ff"Te6edf3$PREDTa5d6ff" Tffea00\

--type slsaprovenance1 Tffea00\

--bundle Ta5d6ff"Tffd700${Te6edf3fTffd700}Ta5d6ff.cosign.bundleTa5d6ff" Tffea00\

Ta5d6ff"Te6edf3$fTa5d6ff" >/dev/null

Tff7b72done

Tffa657echo Ta5d6ff"attest-release-assets.sh: done"