Repository navigation
Conversation
The ramdisk SBOMs are signed release files, but nothing binds an SBOM to the digest of the ramdisk it describes. A consumer that mirrors only the OCI initramfs artifact gets no SBOM at all. A new sbom-attest matrix job (one job per released ramdisk archive, split parts included) runs after build. It re-checks the checksums and creates a CycloneDX and an SPDX attestation with actions/attest v4.2.2 (pinned by SHA; attest-sbom is deprecated in favour of it), with the archive as the subject. The release waits for it. The OCI initramfs publish loop now adds a keyless cosign CycloneDX attestation to each artifact. The README shows how to verify both. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Security scan reportCommit: Security findings are advisory, not merge blockers. Build, test and licensing checks remain blocking. A successful job is not proof of a clean scan; findings and scanner errors are called out below.
Go Vulnerability Check: Standard library govulncheck finding GO-2026-6809 (Distrust compromised intermediate certificates in crypto/x509). Fixed in Go v1.27.3. This does not fail the check, because only a Go toolchain bump clears it. See the linked logs for complete findings and any scanner setup failures. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Third of three supply-chain PRs, stacked on #903 (ramdisk SBOMs), which is stacked on #902 (reproducible initramfs). Retarget each one once the PR below it merges.
Signatures and build provenance on all release files and the multi-arch images exist already (#890, cosign
sign-blob). This PR binds each ramdisk SBOM to the ramdisk it describes:New
sbom-attestmatrix job. It runs one job per released ramdisk archive:default,gobgp,slim,micro,split-baseandsplit-frr, for amd64 and arm64. Each job:.sha256of the archive and both SBOMs;actions/attestv4.2.2, pinned by SHA1e69f48a…, with the archive as the subject.actions/attest-sbomis deprecated in favour ofactions/attest.The action takes one SBOM per call, so the work is split into one job per archive. The
releasejob waits for these jobs, so a release can't be published without the attestations.OCI initramfs artifacts (
ghcr.io/<repo>/initramfs:<ver>-<flavor>-<arch>): the publish loop re-checks the SBOM checksum and adds a keylesscosign attest --type cyclonedx. A mirror of the OCI artifact then keeps its SBOM. This follows the nightly image, which already usescosign attest.The README shows how to verify both:
gh attestation verify --predicate-type https://cyclonedx.org/bom(orhttps://spdx.dev/Document/v2.3) andcosign verify-attestation --type cyclonedx. The proposal status is updated.Guard / impact
This changes only the release workflow, so it runs only on
v*tags. Release files and OCI refs are unchanged; attestations are added on top.Verification
releasedependency and the OCI attestation.go test .andgolangci-lint v2.14.0pass (0 issues), and actionlint is clean forrelease-v2.yml.oras attachadds, signed by digest.Follow-ups (not here)
snapshot.debian.orgso rebuilds stay reproducible after the mirrors move.scanjob at the CycloneDX SBOMs, so it sees the Debian packages.🤖 Generated with Claude Code