Skip to content
This repository was archived by the owner on May 29, 2026. It is now read-only.

feat: Sign sentry-prevent-cli binaries with Cosign #86

Merged
thomasrockhu-codecov merged 15 commits into from
Sep 7, 2025
Merged

feat: Sign sentry-prevent-cli binaries with Cosign #86

Changes from 1 commit
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
cb1dab9
Test cosign
spalmurray Jul 31, 2025
92714ad
Test verification
spalmurray Jul 31, 2025
815c581
sign the rest of em
spalmurray Jul 31, 2025
6fd872c
Make prevent linux have x86_64 suffix
spalmurray Jul 31, 2025
0b855ca
Remove accidental flag
spalmurray Jul 31, 2025
f8394a4
Tweak craft comment
spalmurray Jul 31, 2025
8ec6cd8
Try ref name in verify
spalmurray Jul 31, 2025
e7792a7
oops
spalmurray Jul 31, 2025
d9eaef3
Remove extra verify
spalmurray Jul 31, 2025
a14dfa2
Use regex for cert identity
spalmurray Jul 31, 2025
faf4b5d
Rewrite installation section of README
spalmurray Jul 31, 2025
70193b4
Tweaks to readme
spalmurray Jul 31, 2025
5884039
Oops
spalmurray Jul 31, 2025
b547ba4
Simplify signing with for loop
spalmurray Jul 31, 2025
cbf5bcd
Address mdtro feedback
spalmurray Aug 26, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Try ref name in verify
  • Loading branch information
@spalmurray
spalmurray committed Aug 26, 2025
commit 8ec6cd81e50cb694c70c4c962bdf806cf2f2ad1c
18 changes: 8 additions & 10 deletions .github/workflows/build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -185,17 +185,15 @@ jobs:
cosign sign-blob sentry-prevent-cli_linux_arm64/sentry-prevent-cli_linux_arm64 --bundle sentry-prevent-cli_linux_arm64/sentry-prevent-cli_linux_arm64.bundle --yes
cosign sign-blob sentry-prevent-cli_linux_x86_64/sentry-prevent-cli_linux_x86_64 --bundle sentry-prevent-cli_linux_x86_64/sentry-prevent-cli_linux_x86_64.bundle --yes

- run: ls -R

- name: test verification
- name: Test verification
run: |
cosign verify-blob sentry-prevent-cli_macos/sentry-prevent-cli_macos --bundle sentry-prevent-cli_macos/sentry-prevent-cli_macos.bundle --certificate-identity=https://github.com/getsentry/prevent-cli/.github/workflows/build.yml@refs/heads/release/99.9.9 --certificate-oidc-issuer=https://token.actions.githubusercontent.com
cosign verify-blob sentry-prevent-cli_macos/sentry-prevent-cli_macos --bundle sentry-prevent-cli_macos/sentry-prevent-cli_macos.bundle --certificate-identity=https://github.com/getsentry/prevent-cli/.github/workflows/build.yml@refs/heads/release/99.9.9 --certificate-oidc-issuer=https://token.actions.githubusercontent.com
cosign verify-blob sentry-prevent-cli_windows.exe/sentry-prevent-cli_windows.exe --bundle sentry-prevent-cli_windows.exe/sentry-prevent-cli_windows.exe.bundle --certificate-identity=https://github.com/getsentry/prevent-cli/.github/workflows/build.yml@refs/heads/release/99.9.9 --certificate-oidc-issuer=https://token.actions.githubusercontent.com
cosign verify-blob sentry-prevent-cli_alpine_arm64/sentry-prevent-cli_alpine_arm64 --bundle sentry-prevent-cli_alpine_arm64/sentry-prevent-cli_alpine_arm64.bundle --certificate-identity=https://github.com/getsentry/prevent-cli/.github/workflows/build.yml@refs/heads/release/99.9.9 --certificate-oidc-issuer=https://token.actions.githubusercontent.com
cosign verify-blob sentry-prevent-cli_alpine_x86_64/sentry-prevent-cli_alpine_x86_64 --bundle sentry-prevent-cli_alpine_x86_64/sentry-prevent-cli_alpine_x86_64.bundle --certificate-identity=https://github.com/getsentry/prevent-cli/.github/workflows/build.yml@refs/heads/release/99.9.9 --certificate-oidc-issuer=https://token.actions.githubusercontent.com
cosign verify-blob sentry-prevent-cli_linux_arm64/sentry-prevent-cli_linux_arm64 --bundle sentry-prevent-cli_linux_arm64/sentry-prevent-cli_linux_arm64.bundle --certificate-identity=https://github.com/getsentry/prevent-cli/.github/workflows/build.yml@refs/heads/release/99.9.9 --certificate-oidc-issuer=https://token.actions.githubusercontent.com
cosign verify-blob sentry-prevent-cli_linux_x86_64/sentry-prevent-cli_linux_x86_64 --bundle sentry-prevent-cli_linux_x86_64/sentry-prevent-cli_linux_x86_64.bundle --certificate-identity=https://github.com/getsentry/prevent-cli/.github/workflows/build.yml@refs/heads/release/99.9.9 --certificate-oidc-issuer=https://token.actions.githubusercontent.com
cosign verify-blob sentry-prevent-cli_macos/sentry-prevent-cli_macos --bundle sentry-prevent-cli_macos/sentry-prevent-cli_macos.bundle --certificate-identity=https://github.com/getsentry/prevent-cli/.github/workflows/build.yml@refs/heads/${{ gh.ref_name }} --certificate-oidc-issuer=https://token.actions.githubusercontent.com
cosign verify-blob sentry-prevent-cli_macos/sentry-prevent-cli_macos --bundle sentry-prevent-cli_macos/sentry-prevent-cli_macos.bundle --certificate-identity=https://github.com/getsentry/prevent-cli/.github/workflows/build.yml@refs/heads/${{ gh.ref_name }} --certificate-oidc-issuer=https://token.actions.githubusercontent.com
cosign verify-blob sentry-prevent-cli_windows.exe/sentry-prevent-cli_windows.exe --bundle sentry-prevent-cli_windows.exe/sentry-prevent-cli_windows.exe.bundle --certificate-identity=https://github.com/getsentry/prevent-cli/.github/workflows/build.yml@refs/heads/${{ gh.ref_name }} --certificate-oidc-issuer=https://token.actions.githubusercontent.com
cosign verify-blob sentry-prevent-cli_alpine_arm64/sentry-prevent-cli_alpine_arm64 --bundle sentry-prevent-cli_alpine_arm64/sentry-prevent-cli_alpine_arm64.bundle --certificate-identity=https://github.com/getsentry/prevent-cli/.github/workflows/build.yml@refs/heads/${{ gh.ref_name }} --certificate-oidc-issuer=https://token.actions.githubusercontent.com
cosign verify-blob sentry-prevent-cli_alpine_x86_64/sentry-prevent-cli_alpine_x86_64 --bundle sentry-prevent-cli_alpine_x86_64/sentry-prevent-cli_alpine_x86_64.bundle --certificate-identity=https://github.com/getsentry/prevent-cli/.github/workflows/build.yml@refs/heads/${{ gh.ref_name }} --certificate-oidc-issuer=https://token.actions.githubusercontent.com
cosign verify-blob sentry-prevent-cli_linux_arm64/sentry-prevent-cli_linux_arm64 --bundle sentry-prevent-cli_linux_arm64/sentry-prevent-cli_linux_arm64.bundle --certificate-identity=https://github.com/getsentry/prevent-cli/.github/workflows/build.yml@refs/heads/${{ gh.ref_name }} --certificate-oidc-issuer=https://token.actions.githubusercontent.com
cosign verify-blob sentry-prevent-cli_linux_x86_64/sentry-prevent-cli_linux_x86_64 --bundle sentry-prevent-cli_linux_x86_64/sentry-prevent-cli_linux_x86_64.bundle --certificate-identity=https://github.com/getsentry/prevent-cli/.github/workflows/build.yml@refs/heads/${{ gh.ref_name }} --certificate-oidc-issuer=https://token.actions.githubusercontent.com

- name: Upload release artifact
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
Expand Down