Greptile Summary

This PR adds support for top-level cosign verification in aqua package definitions. Previously only checksum-nested cosign (checksum.cosign) was handled; now a package's cosign field at the root level is parsed, merged across version overrides, and used to verify the downloaded binary artifact (rather than a checksum file) using the existing native sigstore path.

The implementation is clean: binary_cosign_config and checksum_cosign_config helper methods clearly separate the two verification flows, cosign_already_verified is only set after confirmed successful verification (guarded by has_native_cosign at the call site), and both detect_provenance_type and verify_provenance are kept in sync.

Confidence Score: 5/5

Safe to merge — no correctness issues found; logic is consistent across lock and install paths.

All changed paths are correct: binary_cosign_config guards cosign_already_verified properly, the two cosign flows are mutually exclusive by priority, the AquaCosign merge in apply_override is consistent with existing patterns, and tests validate both lockfile provenance recording and install-time verification. No P1 or P0 findings.

No files require special attention.

Important Files Changed

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[verify_provenance] --> B{locked_provenance?}
    B -->|cosign| skip_others[skip attestations/slsa/minisign]
    B -->|other/none| run_others[run attestations → slsa → minisign]
    skip_others --> C{binary_cosign_config?}
    run_others --> C
    C -->|Some - key or bundle| D[cosign_artifact\nverify binary artifact\nrun_cosign_check target=artifact]
    C -->|None| E{checksum enabled?}
    D --> F[cosign_already_verified = true]
    F --> E
    E -->|yes| G{checksum_cosign_config\n AND NOT already_verified?}
    G -->|yes| H[cosign_checksums\nverify checksum file\nrun_cosign_check target=checksum]
    G -->|no| I[verify_checksum]
    H --> I
    E -->|no| I
    D --> record_binary[record_cosign_provenance]
    H --> record_checksum[record_cosign_provenance]

_{Reviews (8): Last reviewed commit: "refactor(backend): align aqua cosign det..." | Re-trigger Greptile}