Micron Document
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
| SparkN0de-git | SparkN0de |
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Node / ReticulumProjects / MeshChatX.git / commits / cbb041f


Commit cbb041f06e2edc8a074d25fde9b948c95cda3621

󰉖 Browse tree at this commit

Parents : cffabc7
Author : Ivan <ivan@quad4.io>
Signature : Signature validation error
Date : 2026-04-22T13:23:22-05:00

chore(ci): remove verify-release-attestation.sh script and update attest-release-assets.sh to exclude .cosign.bundle files

Changes

2 files changed, 1 insertions(+), 22 deletions(-)

M scripts/ci/attest-release-assets.sh +1 -1
D scripts/ci/verify-release-attestation.sh -21

Diff

diff --git a/scripts/ci/attest-release-assets.sh b/scripts/ci/attest-release-assets.sh
index 3a759474..7d63fca5 100755
--- a/scripts/ci/attest-release-assets.sh
+++ b/scripts/ci/attest-release-assets.sh
@@ -19,7 +19,7 @@ trap 'rm -f "$PRED"' EXIT INT
python3 scripts/ci/slsa-predicate.py > "$PRED"
-find "$DIR" -type f ! -name '*.sha256' ! -name '*.cosign.bundle' | while IFS= read -r f; do
+find "$DIR" -type f ! -name '*.cosign.bundle' | while IFS= read -r f; do
case "$f" in
*/.git/*) continue ;;
esac

diff --git a/scripts/ci/verify-release-attestation.sh b/scripts/ci/verify-release-attestation.sh
deleted file mode 100755
index d7f9388e..00000000
--- a/scripts/ci/verify-release-attestation.sh
+++ /dev/null
@@ -1,21 +0,0 @@
-#!/bin/sh
-# Verify a cosign SLSA bundle for a release binary using the repository public key.
-# Checks Sigstore Rekor (public log) unless COSIGN_REKOR_URL points elsewhere.
-# Usage: verify-release-attestation.sh <blob-file> <bundle-file>
-# Env: COSIGN_PUBLIC_KEY (default cosign.pub)
-set -eu
-
-BLOB="${1:?blob path}"
-BUNDLE="${2:?bundle path}"
-PUB="${COSIGN_PUBLIC_KEY:-cosign.pub}"
-
-if [ ! -f "$PUB" ]; then
- echo "Missing $PUB (generate a key pair with cosign and commit the .pub file)" >&2
- exit 1
-fi
-
-exec cosign verify-blob-attestation \
- --key "$PUB" \
- --bundle "$BUNDLE" \
- --type slsaprovenance1 \
- "$BLOB"


──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────