From c182f63cf51412f664595eb464e59f56f691568d Mon Sep 17 00:00:00 2001 From: Carlos Panato Date: Fri, 9 Oct 2026 18:18:34 +0200 Subject: [PATCH] Document how to verify the signed images and binaries Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Carlos Panato --- README.md | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/README.md b/README.md index 142e28c..6bfc4a0 100644 --- a/README.md +++ b/README.md @@ -117,6 +117,37 @@ Port `9101` serves the metrics and port `8065` receives the GitHub webhooks. A Helm chart is available in [charts/github-exporter](./charts/github-exporter). +## Verifying the releases + +The container images and the release binaries are signed with [Cosign](https://github.com/sigstore/cosign) (keyless, through the GitHub Actions identity of the release workflow), so you can verify that they were built by this repository. Releases are also published with [SLSA](https://slsa.dev) provenance (`multiple.intoto.jsonl`). +The commands below were tested with Cosign v3 (the `.sigstore.json` bundles of the binaries require it). Releases before v0.11.0 sign the binaries with separate `.sig` and `.pem` files instead. + +Verify a container image (replace the version with the one you use): + +```bash +VERSION=v0.11.0 + +cosign verify \ + --certificate-identity "https://github.com/cpanato/github_actions_exporter/.github/workflows/release.yml@refs/tags/${VERSION}" \ + --certificate-oidc-issuer https://token.actions.githubusercontent.com \ + ghcr.io/cpanato/github_actions_exporter:${VERSION} +``` + +Verify a binary, downloaded together with its `.sigstore.json` bundle from the [release](https://github.com/cpanato/github_actions_exporter/releases): + +```bash +VERSION=v0.11.0 +BINARY=github-actions-exporter_0.11.0_linux_amd64 + +cosign verify-blob \ + --bundle ${BINARY}.sigstore.json \ + --certificate-identity "https://github.com/cpanato/github_actions_exporter/.github/workflows/release.yml@refs/tags/${VERSION}" \ + --certificate-oidc-issuer https://token.actions.githubusercontent.com \ + ${BINARY} +``` + +The same works for `checksums.txt` and its `checksums.txt.sigstore.json`. + ## Testing ### Running unit tests