feat(sign): support for keyless signing and offline verification#4891
Merged
Conversation
Signed-off-by: Brandt Keller <[email protected]>
Signed-off-by: Brandt Keller <[email protected]>
Signed-off-by: Brandt Keller <[email protected]>
Signed-off-by: Brandt Keller <[email protected]>
Signed-off-by: Brandt Keller <[email protected]>
Signed-off-by: Brandt Keller <[email protected]>
Signed-off-by: Brandt Keller <[email protected]>
Signed-off-by: Brandt Keller <[email protected]>
Signed-off-by: Brandt Keller <[email protected]>
Signed-off-by: Brandt Keller <[email protected]>
Signed-off-by: Brandt Keller <[email protected]>
Signed-off-by: Brandt Keller <[email protected]>
Signed-off-by: Brandt Keller <[email protected]>
Signed-off-by: Brandt Keller <[email protected]>
Signed-off-by: Brandt Keller <[email protected]>
Signed-off-by: Brandt Keller <[email protected]>
…o 2805_keyless_signing
…tion Signed-off-by: Brandt Keller <[email protected]>
Signed-off-by: Brandt Keller <[email protected]>
✅ Deploy Preview for zarf-docs canceled.
|
Signed-off-by: Brandt Keller <[email protected]>
Signed-off-by: Brandt Keller <[email protected]>
brandtkeller
commented
May 13, 2026
| #!/usr/bin/env bash | ||
| # Refresh the embedded Sigstore TrustedRoot used for keyless verification. | ||
| # Run before each release. Commit the result. | ||
|
|
Member
Author
There was a problem hiding this comment.
Making a mental note to schedule daily checks and notify the zarf channel using this process. A lag in releasing new trusted roots won't be critical but should be nice to have.
Signed-off-by: Brandt Keller <[email protected]>
Signed-off-by: Brandt Keller <[email protected]>
Member
Author
|
Removed viper configuration in favor of additional issue / PR to track a few solutions. |
Signed-off-by: Brandt Keller <[email protected]>
Signed-off-by: Brandt Keller <[email protected]>
Signed-off-by: Brandt Keller <[email protected]>
Signed-off-by: Brandt Keller <[email protected]>
Signed-off-by: Brandt Keller <[email protected]>
Signed-off-by: Brandt Keller <[email protected]>
Signed-off-by: Brandt Keller <[email protected]>
AustinAbro321
approved these changes
May 22, 2026
Member
AustinAbro321
left a comment
AustinAbro321
left a comment
There was a problem hiding this comment.
LGTM, excited to see this in
jonnyborbs
pushed a commit
that referenced
this pull request
May 27, 2026
Signed-off-by: Brandt Keller <[email protected]> Signed-off-by: Brandt Keller <[email protected]> Co-authored-by: Austin Abro <[email protected]> Signed-off-by: Jon Schulman <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Note - Breaking Changes
cosignfunctionality undersrc/pkg/utilshas been moved to `src/pkg/signingsigning.Sign|VerifyBlobOptionshave been updated to align with cosign.This PR enables the use of connected keyless signing workflows and offline-compatible verification for a keyless signed package via an embedded trusted root.
This uses the previously implemented
zarf tools trusted-root createcommand to refresh the embedded trusted root. Think of this as a mechanism to streamline the UX of enabling offline verification of keyless-signed packages so that users are not required to bring additional verification material by default - but of which they can overwrite as required.Additionally this PR enables the bundlesignature feature by default. Note that the
VersionRequirementfor a package with a bundle signature isv0.71.0which is the version that introduced the ability to load packages with the bundle file. The feature flag gates are retained such that users who cannot use the bundle still have an opportunity to opt-out until we fully remove.One early improvement is the UX of retrieving the keyless-signed identity and issuer. These are retrieved on
package signso that we can log the entries that package creators need to provide to those who want to verify - but additionally I believe we could add azarf package inspect signature <package>command to make this discoverable. We can't place it directly in the build data because it is only accessible post-signing - whereby the zarf definition can no longer be modified without invalidating the signature.Best practices documentation to follow.
Try it Yourself
Related Issue
Fixes #2805
Fixes #4571
Relates to #
Checklist before merging