DRAFT: ✨ Signed-Release: Add check for sigstore signatures

[asraa]

Signed-off-by: Asra Ali [email protected]

What kind of change does this PR introduce?

(Is it a bug fix, feature, docs update, something else?)

• PR title follows the guidelines defined in our pull request documentation

What is the current behavior?

Signed-Release checks for presence of signature file extensions

What is the new behavior (if this is a feature change)?**

Signed-Release also checks for rekor entries to detect signatures uploaded on transparency log

• Tests for the changes have been added (for bug fixes/features)
  TODO

Which issue(s) this PR fixes

#1201

Special notes for your reviewer

Does this PR introduce a user-facing change?

For user-facing changes, please add a concise, human-readable release note to
the release-note

(In particular, describe what changes users might need to make in their
application as a result of this pull request.)

RESULTS
-------
Aggregate score: 10.0 / 10

Check scores:
|---------|-----------------|--------------------------------|-----------------------------------------------------------------------|----------------------------------------------------------------------------|
|  SCORE  |      NAME       |             REASON             |                                DETAILS                                |                         DOCUMENTATION/REMEDIATION                          |
|---------|-----------------|--------------------------------|-----------------------------------------------------------------------|----------------------------------------------------------------------------|
| 10 / 10 | Signed-Releases | 5 out of 5 artifacts are       | Debug: GitHub release found: v1.7.2 Info: signed                      | https://github.com/ossf/scorecard/blob/main/docs/checks.md#signed-releases |
|         |                 | signed, 1 artifacts are        | release artifact: cosign-1.7.2.aarch64.rpm-keyless.sig:               |                                                                            |
|         |                 | sigstore signed -- score       | https://api.github.com/repos/sigstore/cosign/releases/assets/62331947 |                                                                            |
|         |                 | normalized to 10               | Debug: GitHub release found: v1.7.1 Info: signed                      |                                                                            |
|         |                 |                                | release artifact: cosign-darwin-amd64-keyless.sig:                    |                                                                            |
|         |                 |                                | https://api.github.com/repos/sigstore/cosign/releases/assets/61634977 |                                                                            |
|         |                 |                                | Debug: GitHub release found: v1.6.0 Info: signed                      |                                                                            |
|         |                 |                                | release artifact: cosign-1.6.0.aarch64.rpm-keyless.sig:               |                                                                            |
|         |                 |                                | https://api.github.com/repos/sigstore/cosign/releases/assets/58527521 |                                                                            |
|         |                 |                                | Debug: GitHub release found: v1.5.2 Info: signed                      |                                                                            |
|         |                 |                                | release artifact: cosign-darwin-amd64-keyless.sig:                    |                                                                            |
|         |                 |                                | https://api.github.com/repos/sigstore/cosign/releases/assets/57296270 |                                                                            |
|         |                 |                                | Debug: GitHub release found: v1.5.1 Info: signed                      |                                                                            |
|         |                 |                                | release artifact: cosign-darwin-amd64-keyless.sig:                    |                                                                            |
|         |                 |                                | https://api.github.com/repos/sigstore/cosign/releases/assets/55449328 |                                                                            |
|---------|-----------------|--------------------------------|-----------------------------------------------------------------------|----------------------------------------------------------------------------|

Currently I'm only checking the latest release. It seems to take a while to download the release asset in order to compute it's hash. Any suggestions?

[naveensrinivasan]

Thanks! Can you please include the unit test and e2e?

[asraa]

Thanks! Can you please include the unit test and e2e?

Yes, this is a TODO per the description (this is why it's a draft, haven't written up the check YAML yet either).

I am mostly putting this out for discussion. It makes the check fairly slow to download the release artifact.

Perhaps we guard with an env variable?

[naveensrinivasan]

Thanks! Can you please include the unit test and e2e?

Yes, this is a TODO per the description (this is why it's a draft, haven't written up the check YAML yet either).

I am mostly putting this out for discussion. It makes the check fairly slow to download the release artifact.

Perhaps we guard with an env variable?

Apologies didn't see the Draft in the title. Usually, draft PR's come as draft PR.

[github-actions]

Stale pull request message