ci: temporarily hold release signing to unblock artifacts - #71
Merged
Merged
Conversation
The first release run (v0.3.0) built binaries, SBOMs, checksums, and the image fine but failed at cosign signing: cosign >= 2.5.0 changed sign-blob to the new bundle format, which ignores the --output-signature/--output-certificate flags and aborts. So v0.3.0 published a tag/release but no assets. Comment out the `signs` and `docker_signs` blocks so the release job goes green and starts publishing binaries + image + SBOMs + checksums (unsigned). Signing is additive hardening and shouldn't block getting downloadable artifacts out. Signing will be restored as a follow-up via one of: - pin cosign to 2.4.x with the existing config (PR #70), or - roll forward to the `--bundle` format and keep cosign current, validated with a CI dry-run before it gates a real release. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016RJcNXwJdwhtEgsfLfYKtv
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Comment out the
signsanddocker_signsblocks in.goreleaser.yamlso the release job goes green and starts publishing artifacts. This decouples "does the pipeline deliver?" from "is signing configured exactly right?" — the former is essentially proven, the latter is the fiddly part.Why
On the first real release (
v0.3.0), GoReleaser built the binaries, SBOMs, checksums, and image successfully, then aborted at cosign:cosign ≥ 2.5.0 made
sign-blobdefault to the new Sigstore bundle format, which ignores the--output-signature/--output-certificateflags and fails. Sov0.3.0got a tag + release + changelog but no assets.Effect
Next release publishes the full set — multi-platform binaries, archives, SBOMs,
checksums.txt, and the multi-arch image atghcr.io/mpv/kir— just unsigned. For a 0.x tool bootstrapping releases, shipping SBOM'd + checksummed artifacts now with signatures as a fast follow is a reasonable trade; signing is additive hardening, not a blocker.The
Install cosignstep andid-token: writepermission are left in place, and the signing config is commented (not deleted) with aTODO, so restoring it is a one-block uncomment.Restoring signing (follow-up, pick one)
--bundleformat and keep cosign current.Either way, validated with a
workflow_dispatchdry-run (goreleaser release --skip=publish) in CI before it gates a real release.Typed
ci:— release tooling, non-releasing.🤖 Generated with Claude Code
https://claude.ai/code/session_016RJcNXwJdwhtEgsfLfYKtv
Generated by Claude Code