Node / ReticulumProjects / MeshChatX.git / files / scripts / ci / verify-release-attestation.sh

Displaying Raw • Download

T8b949e#!/bin/sh

T8b949e# Verify a cosign SLSA bundle for a release binary using the repository public key.

T8b949e# Checks Sigstore Rekor (public log) unless COSIGN_REKOR_URL points elsewhere.

T8b949e# Usage: verify-release-attestation.sh <blob-file> <bundle-file>

T8b949e# Env: COSIGN_PUBLIC_KEY (default cosign.pub)

Tffa657set -eu

Te6edf3BLOBTff7b72=Ta5d6ff"Tffd700${Te6edf31Tb4b4b4:Tb4b4b4?blob pathTffd700}Ta5d6ff"

Te6edf3BUNDLETff7b72=Ta5d6ff"Tffd700${Te6edf32Tb4b4b4:Tb4b4b4?bundle pathTffd700}Ta5d6ff"

Te6edf3PUBTff7b72=Ta5d6ff"Tffd700${Te6edf3COSIGN_PUBLIC_KEYTff7b72:-Te6edf3cosignTb4b4b4.pubTffd700}Ta5d6ff"

Tff7b72if Tff7b72[ ! -f Ta5d6ff"Te6edf3$PUBTa5d6ff" Tff7b72]Tb4b4b4; Tff7b72then

Tffa657echo Ta5d6ff"Ta5d6ffMissing Te6edf3$PUBTa5d6ff (generate a key pair with cosign and commit the .pub file)Ta5d6ff" >Tb4b4b4&T79c0ff2

Tffa657exit T79c0ff1

Tff7b72fi

Tffa657exec cosign verify-blob-attestation Tffea00\

--key Ta5d6ff"Te6edf3$PUBTa5d6ff" Tffea00\

--bundle Ta5d6ff"Te6edf3$BUNDLETa5d6ff" Tffea00\

--type slsaprovenance1 Tffea00\

Ta5d6ff"Te6edf3$BLOBTa5d6ff"