[Gorka Gonzalo (d0ubl3g)]

Refs #152, which closes when this reaches main. It implements the criteria as changed on 2026-10-12. Monitoring the log for every entry made with the identity is #158.

What it checks

.github/scripts/release-integrity.py uses only the Python standard library and reads only public data and the run history. It checks, in both directions:

• Runs ↔ releases.
  • Every tag run of release.yml, and every run of container-image.yml, must be for a published release at its tag's commit. Manual release.yml runs are dry runs and are skipped.
  • Every published release must have a successful release.yml run at that commit, and from 0.4.0 a successful image run.
• Files. Every asset must match its SHA256SUMS line. Besides the listed files, only bundles and provenance may be attached.
• Rekor, by hash. Every file with a .sigstore.json bundle is looked up in Rekor by its SHA-256, and the Fulcio certificate is parsed with a small DER reader.
  • At least one entry must name release.yml@refs/tags/<tag>, the GitHub Actions issuer, the tag's commit (OID …1.3) and a successful run of that tag (OID …1.21).
  • An entry with this repository's identity that no published release made is a mismatch.
  • A file that two releases ship unchanged, such as install.sh in 0.3.0 and 0.3.1, is signed by both, and that is accepted.
• Images. Every version tag of the image must be a published release, and every release from 0.4.0 must have one. cosign verify runs on its digest against container-image.yml@refs/tags/<tag> with trigger release.

Anything that cannot be read fails, never passes. ACCEPTED_RUNS holds known exceptions with reasons, and is empty.

The workflow

.github/workflows/release-integrity.yml runs weekly, on demand, and on pull requests that change it.

• Permissions: contents: read, actions: read and issues: write. Issues are not touched on a pull request.
• cosign: v3.1.3 through the pinned cosign-installer.
• Steps: it runs the unit tests, then the check. A failure opens or comments on an issue labelled release-integrity, and a pass closes it. It also reports a gap since the previous run, as repo-freshness does.

Docs

• docs/release-signing.md:
  • a new section, "Weekly release integrity check": what is compared, what the check cannot see (Watch the transparency log for every signature made with the release identities #158, deleted runs, drafts) and what to do when it alerts;
  • step 2 of the workflow-identity compromise points to its report;
  • a fix from Record who controls the Azure signing access, and its known gaps #156: the "Sigstore and SLSA" item is back under "Who may change them". It had ended up under "Known gaps".
• CONTRIBUTING.md (security testing table) and docs/risk-assessment.md (T9) list the check.

Checks run

• release-integrity-test.py: 12 tests pass. The certificate fixture is the public Rekor entry of 0.4.1's SHA256SUMS.
• The live check against this repository passes:
  • 7 published releases, 16 release.yml runs and 2 image runs;
  • every signed file of every release, 0.1.0 to 0.4.1, is tied to its tag, commit and run in Rekor;
  • the 0.4.0 and 0.4.1 images verify;
  • result: "Everything matches."
• It takes about 5 minutes, mostly the Rekor lookups.
• actionlint 1.7.12 and zizmor 1.30.1 (pedantic) report no findings.