Add SLSA build provenance attestations to release workflows by tlongwell-block · Pull Request #7097 · block/goose

tlongwell-block · 2026-02-09T20:24:39Z

Add actions/attest-build-provenance to release, canary, nightly, and Docker workflows. Every CLI binary, desktop bundle, Linux package, and container image now gets a signed provenance attestation via Sigstore.

Users can verify any artifact with:
gh attestation verify --repo block/goose

Changes:

release.yml: attestations:write permission + attestation step
canary.yml: explicit permissions block + attestation step
publish-docker.yml: id-token:write, attestations:write, capture image digest, attest with push-to-registry

Closes #5994

Add actions/attest-build-provenance to release, canary, nightly, and Docker workflows. Every CLI binary, desktop bundle, Linux package, and container image now gets a signed provenance attestation via Sigstore. Users can verify any artifact with: gh attestation verify <artifact> --repo block/goose Changes: - release.yml: attestations:write permission + attestation step - canary.yml: explicit permissions block + attestation step - nightly.yml: explicit permissions block + attestation step - publish-docker.yml: id-token:write, attestations:write, capture image digest, attest with push-to-registry Closes #5994

tlongwell-block · 2026-02-09T20:28:44Z

/goose

github-actions · 2026-02-09T20:31:29Z

PR #7097 Review: Add SLSA build provenance attestations to release workflows

Summary: This PR adds SLSA (Supply Chain Levels for Software Artifacts) build provenance attestations to all release workflows using GitHub's actions/attest-build-provenance action with Sigstore OIDC signing. This is a well-implemented security enhancement that allows users to cryptographically verify the integrity and origin of release artifacts.

✅ Highlights

Correct permission setup: All workflows correctly add both id-token: write (for Sigstore OIDC signing) and attestations: write (for storing attestations) at the appropriate scope levels.
Proper action pinning: The actions/attest-build-provenance@96278af6caaf10aea03fd8d33a09a777ca52d62f # v3.2.0 action is pinned to a specific SHA with version comment - this is security best practice for supply chain integrity.
Docker attestation done right: The Docker image attestation correctly:
- Uses the digest reference (${{ steps.docker-push.outputs.digest }}) rather than a mutable tag
- Sets push-to-registry: true to attach the attestation to the registry
- References the correct repository name
Consistent subject-path patterns: The subject-path patterns correctly match the existing artifacts patterns in each workflow:
- release.yml: includes goose-*.zip and *.flatpak
- canary.yml/nightly.yml: includes **/*.flatpak (no goose-*.zip)
These differences are pre-existing in the artifact definitions and not introduced by this PR.
Good placement: The attestation step is placed after artifact download but before the release step, ensuring all artifacts are attested before publication.

🟢 Suggestions

Consider consolidating artifact patterns (out of scope for this PR): The differences in artifact patterns between release.yml and canary.yml/nightly.yml could be worth investigating in a follow-up - e.g., why does only the versioned release include goose-*.zip? This is pre-existing technical debt, not introduced by this PR.

Overall Assessment

Approve - This is a clean, well-implemented security enhancement. The PR correctly applies the attestation action across all four release workflows with proper permissions, action pinning, and artifact patterns that match the existing release configurations.

Review generated by goose

…provenance * origin/main: (68 commits) Upgraded npm packages for latest security updates (#7183) docs: reasoning effort levels for Codex provider (#6798) Fix speech local (#7181) chore: add .gooseignore to .gitignore (#6826) Improve error message logging from electron (#7130) chore(deps): bump jsonwebtoken from 9.3.1 to 10.3.0 (#6924) docs: standalone mcp apps and apps extension (#6791) workflow: auto-update cli-commands on release (#6755) feat(apps): Integrate AppRenderer from @mcp-ui/client SDK (#7013) fix(MCP): decode resource content (#7155) feat: reasoning_content in API for reasoning models (#6322) Fix/configure add provider custom headers (#7157) fix: handle keyring fallback as success (#7177) Update process-wrap to 9.0.3 (9.0.2 is yanked) (#7176) feat: support extra field in chatcompletion tool_calls for gemini openai compat (#6184) fix: replace panic with proper error handling in get_tokenizer (#7175) Lifei/smoke test for developer (#7174) fix text editor view broken (#7167) docs: White label guide (#6857) Add PATH detection back to developer extension (#7161) ... # Conflicts: # .github/workflows/nightly.yml

Change **/*.flatpak to *.flatpak to match the release step's glob pattern and be consistent with release.yml attestation.

tlongwell-block · 2026-02-12T19:13:29Z

/goose

github-actions · 2026-02-12T19:16:55Z

Summary: This PR correctly adds SLSA build provenance attestations to the release, canary, and Docker workflows using the actions/attest-build-provenance action. The implementation is well-structured with properly pinned actions and minimal permission additions. One minor documentation issue in the PR description.

🟡 Warnings

PR description inaccuracy - The PR body mentions modifying nightly.yml, but this file doesn't exist and no such changes are in the diff:

"nightly.yml: explicit permissions block + attestation step"

Recommend updating the PR description to remove the nightly.yml reference to avoid confusion.

🟢 Suggestions

Consider attestation for install script (.github/workflows/canary.yml, .github/workflows/release.yml) - The download_cli.sh script is included in subject-path. While not harmful, shell scripts are typically lower-value attestation targets since users often pipe them directly (curl | sh). Consider whether this adds meaningful security value or could be omitted for simplicity.

✅ Highlights

Properly pinned action with verified SHA - The actions/attest-build-provenance action is correctly pinned to commit SHA 96278af6caaf10aea03fd8d33a09a777ca52d62f with a version comment (# v3.2.0). I verified this SHA matches the v3.2.0 tag.
Minimal permission scope - Permissions are added at the appropriate level:
- id-token: write for Sigstore OIDC signing
- attestations: write for creating attestations
- Job-level permissions in release.yml keep the blast radius minimal
Consistent artifact patterns - The subject-path patterns in each workflow correctly match the existing artifacts: patterns in the release actions. For example, release.yml includes goose-*.zip for Windows CLI builds while canary.yml doesn't (matching their respective existing artifact lists).
Docker attestation done correctly - The Docker workflow properly:
- Adds an id: docker-push to capture the build output
- Uses subject-digest: ${{ steps.docker-push.outputs.digest }} to reference the exact image
- Sets push-to-registry: true to push attestations to the registry

Review generated by goose

* origin/main: (21 commits) nit: show dir in title, and less... jank (#7138) feat(gemini-cli): use stream-json output and re-use session (#7118) chore(deps): bump qs from 6.14.1 to 6.14.2 in /documentation (#7191) Switch jsonwebtoken to use aws-lc-rs (already used by rustls) (#7189) chore(deps): bump qs from 6.14.1 to 6.14.2 in /evals/open-model-gym/mcp-harness (#7184) Add SLSA build provenance attestations to release workflows (#7097) fix save and run recipe not working (#7186) Upgraded npm packages for latest security updates (#7183) docs: reasoning effort levels for Codex provider (#6798) Fix speech local (#7181) chore: add .gooseignore to .gitignore (#6826) Improve error message logging from electron (#7130) chore(deps): bump jsonwebtoken from 9.3.1 to 10.3.0 (#6924) docs: standalone mcp apps and apps extension (#6791) workflow: auto-update cli-commands on release (#6755) feat(apps): Integrate AppRenderer from @mcp-ui/client SDK (#7013) fix(MCP): decode resource content (#7155) feat: reasoning_content in API for reasoning models (#6322) Fix/configure add provider custom headers (#7157) fix: handle keyring fallback as success (#7177) ...

…ntext * 'main' of github.com:block/goose: feat: add onFallbackRequest handler to McpAppRenderer (#7208) feat: add streaming support for Claude Code CLI provider (#6833) fix: The detected filetype is PLAIN_TEXT, but the provided filetype was HTML (#6885) Add prompts (#7212) Add testing instructions for speech to text (#7185) Diagnostic files copying (#7209) fix: allow concurrent tool execution within the same MCP extension (#7202) fix: handle missing arguments in MCP tool calls to prevent GUI crash (#7143) Filter Apps page to only show standalone Goose Apps (#6811) opt: use static for Regex (#7205) nit: show dir in title, and less... jank (#7138) feat(gemini-cli): use stream-json output and re-use session (#7118) chore(deps): bump qs from 6.14.1 to 6.14.2 in /documentation (#7191) Switch jsonwebtoken to use aws-lc-rs (already used by rustls) (#7189) chore(deps): bump qs from 6.14.1 to 6.14.2 in /evals/open-model-gym/mcp-harness (#7184) Add SLSA build provenance attestations to release workflows (#7097) fix save and run recipe not working (#7186) Upgraded npm packages for latest security updates (#7183) docs: reasoning effort levels for Codex provider (#6798)

Replace custom SHA-256 checksum approach with Sigstore provenance verification using the sigstore-verification crate. Leverages the SLSA attestations from actions/attest-build-provenance added in block#7097 and builds on the native Rust self-update foundation from block#7148. Changes: - Add verify_provenance() that fetches and verifies GitHub attestation bundles via the sigstore-verification crate (Sigstore signature chain, Rekor transparency log, artifact digest match) - Harden tar.bz2 extraction against tar-slip (reject absolute paths and .. components, create parent dirs per-entry) - Harden zip extraction against zip-slip (use enclosed_name() sanitization, iterate entries individually) - Add sha256_hex() helper for archive digest computation and display - Remove all .sha256 file download/verify logic and CI workflow changes - 16 unit tests covering SHA-256 digests, path validation (safe paths, absolute path rejection, traversal rejection, nested traversal), tar extraction round-trip, binary location, binary replacement, and provenance verification graceful degradation Signed-off-by: fre$h <[email protected]> Signed-off-by: fre <[email protected]>

tlongwell-block marked this pull request as ready for review February 9, 2026 21:29

tlongwell-block requested a review from alexhancock February 10, 2026 16:08

DOsinga approved these changes Feb 12, 2026

View reviewed changes

tlongwell-block added 2 commits February 12, 2026 14:00

fix: normalize flatpak glob in canary attestation step

40c05c3

Change **/*.flatpak to *.flatpak to match the release step's glob pattern and be consistent with release.yml attestation.

alexhancock approved these changes Feb 12, 2026

View reviewed changes

jh-block merged commit 60e782c into main Feb 12, 2026
18 of 22 checks passed

jh-block deleted the tlongwell/slsa-build-provenance branch February 12, 2026 19:54

BrewTestBot mentioned this pull request Feb 12, 2026

block-goose-cli 1.24.0 Homebrew/homebrew-core#267289

Merged

github-actions bot mentioned this pull request Feb 13, 2026

chore(release): release version 1.24.0 (minor) #7102

Closed

github-actions bot mentioned this pull request Feb 17, 2026

chore(release): release version 1.25.0 (minor) #7263

Merged

suzuki-shunsuke mentioned this pull request Feb 26, 2026

feat(block/goose): GitHub artifact attestations config aquaproj/aqua-registry#49418

Merged

5 tasks

jamadeo mentioned this pull request Mar 11, 2026

fix: add checksum verification and harden archive extraction in CLI self-update #7575

Closed

5 tasks

fresh3nough mentioned this pull request Mar 11, 2026

feat(cli): add Sigstore/SLSA provenance verification to Rust self-update #7818

Merged

3 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add SLSA build provenance attestations to release workflows#7097

Add SLSA build provenance attestations to release workflows#7097
jh-block merged 3 commits intomainfrom
tlongwell/slsa-build-provenance

tlongwell-block commented Feb 9, 2026 •

edited

Loading

Uh oh!

tlongwell-block commented Feb 9, 2026

Uh oh!

github-actions bot commented Feb 9, 2026

Uh oh!

tlongwell-block commented Feb 12, 2026

Uh oh!

github-actions bot commented Feb 12, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

tlongwell-block commented Feb 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tlongwell-block commented Feb 9, 2026

Uh oh!

github-actions bot commented Feb 9, 2026

PR #7097 Review: Add SLSA build provenance attestations to release workflows

✅ Highlights

🟢 Suggestions

Overall Assessment

Uh oh!

tlongwell-block commented Feb 12, 2026

Uh oh!

github-actions bot commented Feb 12, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

tlongwell-block commented Feb 9, 2026 •

edited

Loading