mcc0nnell opened a new pull request, #6777:
URL: https://github.com/apache/camel-k/pull/6777
## Summary
This builds on the SBOM maintenance fix from #6746 / #6761 and hardens the
nightly release path so the generated SBOMs are bound to the actual artifacts
being published.
The goal is to make the nightly release verifiable end-to-end rather than
publishing a single module-level SBOM alongside several independently built
release artifacts.
## What this changes
- Pins `cyclonedx-gomod` instead of installing `@latest`
- Generates a CycloneDX SBOM for each released `kamel` binary target
- Verifies each binary’s embedded Go `vcs.revision` against the exact build
source SHA
- Records SHA-256 digests for client archives and generated SBOMs
- Resolves the pushed operator and OLM bundle to immutable OCI manifest
digests
- Generates CycloneDX SBOMs for the released container images using Syft
- Binds image SBOMs to the exact immutable image/platform digests they
describe
- Produces a deterministic `release-assurance.json` receipt tying together:
- source SHA
- release commit/tag
- client artifacts
- binary SBOMs
- operator image digests
- OLM bundle digest
- container SBOMs
- tool versions
- Adds keyless Cosign signing and attestations using the nightly workflow
OIDC identity
- Adds a verifier that emits a machine-readable `TRUST` / `REJECT` verdict
- Gates nightly tag publication on successful consumer-side verification
## Verification behavior
The verifier checks the release from the consumer side, including:
- receipt signature and SHA-256
- artifact hashes
- embedded binary source revision
- binary SBOM hashes
- image signatures
- exact receipt attestation contents
- image SBOM hashes
- exact CycloneDX attestation contents
It fails closed if the evidence is missing, mismatched, or signed for
different contents.
## Testing
The assurance scripts were exercised with hermetic fixtures covering the
supported client targets:
- linux/amd64
- linux/arm64
- darwin/amd64
- darwin/arm64
- windows/amd64
Negative tests also confirmed rejection for:
- modified receipt contents
- modified image SBOM contents
- valid signatures over the wrong attestation predicate
- mismatched embedded binary source revision
- malformed/missing image digest evidence
The remaining integration proof is the live nightly path against the real
registry and GitHub OIDC/Fulcio/Rekor services.
## Why
The existing module SBOM is useful, but it does not by itself prove which
dependencies belong to each released binary or container artifact.
This change adds that binding:
`source -> artifact -> SBOM -> digest -> attestation -> verification`
so a downstream consumer can independently determine whether a nightly
release matches the evidence published with it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
