Verify a FosterStack Cache release yourself

Each stage of a release is signed on its own, and the signatures are verified together at release. These commands check that yourself, using only cosign, gh and jq.

DRAFT for v0.3.0, not published and never merged before v0.3.0 is live. [TO-VERIFY] marks anything not yet run against a real release.

Use the image by digest for <IMAGE_REF>. There are two images; run every step for each. [TO-VERIFY] which two variants.

1. The signature and who signed it

# [TO-VERIFY] identity and issuer for the final signature
cosign verify <IMAGE_REF> \
  --certificate-identity-regexp '<IDENTITY>' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

2. The digest is the one in the release

# [TO-VERIFY] file name and layout
gh release download <TAG> --repo fosterstack/cache -p release-manifest.json
jq -r '.images[] | "\(.variant) \(.digest)"' release-manifest.json

Every statement names the image by digest, never by tag. The digest you verified should match this list.

3. How it was built

# [TO-VERIFY] signer workflow
gh attestation verify oci://<IMAGE_REF> --repo fosterstack/cache \
  --signer-workflow '<WORKFLOW>' --source-ref refs/tags/<TAG>

[TO-VERIFY] One sentence on what this record covers. No SLSA level claim here.

4. The parts list (SBOM)

# [TO-VERIFY] predicate type and what the list holds for an image with no base image
cosign verify-attestation <IMAGE_REF> --type spdxjson \
  --certificate-identity-regexp '<IDENTITY>' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  | jq -r '.payload | @base64d | fromjson | .predicate.name'

5. What the image was assembled from

# [TO-VERIFY] what "inputs" means for a customer, and the one command that checks it
cosign verify-attestation <IMAGE_REF> --type '<INPUTS_TYPE>' ... | jq '<FILTER>'

What this proves

A valid signature proves who signed these exact bytes.
Provenance proves which workflow and run produced them.
It does not prove the software has no bugs.

Extra evidence, outside these commands: records anyone who has Witness installed can check. [TO-VERIFY] where they are published.