  Alexander PetricandClaude Fable 5
|
a2417f6fb6
|
sign release images with cosign, embed SBOMs, attach SLSA provenance (#10983)
* feat: sign release images with cosign and attach SBOM + SLSA provenance
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W8mi68bMNUFwCge7xAqyky
* fix: pin cosign-installer to exact version (no floating v4 tag exists)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W8mi68bMNUFwCge7xAqyky
* fix: embed SBOMs at build time via depot instead of rekor-bound cosign attest
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W8mi68bMNUFwCge7xAqyky
* docs: latest/main tags are only signed until the next main push
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W8mi68bMNUFwCge7xAqyky
* fix: gate signing on push events in cli/extra workflows, verify version tag
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W8mi68bMNUFwCge7xAqyky
* fix: refuse tag-targeted dispatches in publish workflows, use GITHUB_REF env
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W8mi68bMNUFwCge7xAqyky
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
|
2026-09-05 11:11:20 +00:00 |
|
Ruben FiszelandClaude Opus 4.8