From 193da58e41d243ad710630aaea67ae2e4ad155c0 Mon Sep 17 00:00:00 2001 From: Patrick Hermann Date: Wed, 29 Jul 2026 12:30:00 +0000 Subject: [PATCH] fix(ansible): document the attestation verify command correctly The comment added in #125 told consumers to run gh attestation verify --repo / which fails. The signing identity in the certificate is this reusable workflow, which lives in a different repository from the artifact, so gh looks for a signer in the artifact's own repo, finds none, and reports Error: verifying with issuer "sigstore.dev" That reads like a bad artifact rather than a bad command - a consumer following the documented steps would reasonably conclude the release was not trustworthy. Verified against the published sthings-baseos-26.729.1165.tar.gz: with --signer-repo the bundle resolves to slsa provenance v1, subject digest b3a61def..., source commit eb52831, runner github-hosted. Also put the command in the release notes. The workflow comment is not where anyone looks when checking a download. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01FDecVMyhtUtixsLmT4oLwY --- .github/workflows/call-release-artifact.yaml | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/.github/workflows/call-release-artifact.yaml b/.github/workflows/call-release-artifact.yaml index e5c5ea2..ac905ea 100644 --- a/.github/workflows/call-release-artifact.yaml +++ b/.github/workflows/call-release-artifact.yaml @@ -74,7 +74,16 @@ jobs: # BINDS THE ARTIFACT TO THE WORKFLOW, REPOSITORY AND COMMIT THAT PRODUCED # IT. VERIFY WITH: - # gh attestation verify --repo / + # gh attestation verify \ + # --repo / \ + # --signer-repo stuttgart-things/github-workflow-templates + # + # --signer-repo IS NOT OPTIONAL. THE SIGNING IDENTITY IN THE CERTIFICATE + # IS THIS REUSABLE WORKFLOW, WHICH LIVES IN A DIFFERENT REPOSITORY FROM + # THE ARTIFACT. WITHOUT IT gh LOOKS FOR A SIGNER IN THE ARTIFACT'S OWN + # REPO, FINDS NONE, AND FAILS WITH A BARE + # Error: verifying with issuer "sigstore.dev" + # WHICH READS LIKE A BAD ARTIFACT RATHER THAN A BAD COMMAND - name: Attest Build Provenance uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 with: @@ -115,5 +124,5 @@ jobs: with: version: ${{ inputs.dagger-version }} verb: call - args: github-release --token=env:GH_TOKEN --group ${GITHUB_REPOSITORY%%/*} --repo ${GITHUB_REPOSITORY#*/} --notes "${{ inputs.artifact-name }} | sha256 ${{ steps.checksum.outputs.sha256 }} | commit ${{ github.sha }}" --tag ${{ inputs.tag || inputs.artifact-name }} --title "${{ inputs.tag || inputs.artifact-name }}" --files "/tmp/${{ inputs.artifact-name }}" --files "/tmp/${{ inputs.artifact-name }}.sha256" --progress plain + args: github-release --token=env:GH_TOKEN --group ${GITHUB_REPOSITORY%%/*} --repo ${GITHUB_REPOSITORY#*/} --notes "${{ inputs.artifact-name }} | sha256 ${{ steps.checksum.outputs.sha256 }} | commit ${{ github.sha }} | verify with -- gh attestation verify ${{ inputs.artifact-name }} --repo ${GITHUB_REPOSITORY} --signer-repo stuttgart-things/github-workflow-templates" --tag ${{ inputs.tag || inputs.artifact-name }} --title "${{ inputs.tag || inputs.artifact-name }}" --files "/tmp/${{ inputs.artifact-name }}" --files "/tmp/${{ inputs.artifact-name }}.sha256" --progress plain module: github.com/stuttgart-things/dagger/ansible@${{ inputs.dagger-module-version }}