Repository navigation
docs: the signing decisions are accepted, and one of them was overstated - #224
Merged
Merged
Conversation
The roles table and CI-only signing are settled, so the policy says "accepted" rather than describing a proposal. **Corrects a claim I made in the original page.** It framed "reproducible only through the pipeline, not from a local go build" as a consequence of adopting SignPath. It is not: the release already signs SHA256SUMS with cosign keyless, whose identity is a GitHub Actions OIDC token that exists nowhere but inside a workflow run. CI has always been the only thing able to produce an official Hawser release; SignPath adds an Authenticode signature to a pipeline that was already the sole source of signed artifacts. Presenting it as a new cost overstated the decision. Adds what the roles arrangement does still guarantee with one maintainer -- no signature without a deliberate act, because signing is never automatic on a tag -- so the honest limitation is not mistaken for "the control is worthless". Records two conditions of the programme that bind the project rather than the pipeline: the certificate is issued to the project and not owned by us, and eligibility requires no commercial dual-licensing for any component, so a future paid tier would end it.
7 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The roles table and CI-only signing are confirmed, so the policy reads as settled rather than proposed.
A correction to my own page
The original framed "reproducible only through the pipeline, not from a local
go build" as a consequence of adopting SignPath. It isn't.release.ymlalready signsSHA256SUMSwith cosign keyless:That identity exists nowhere but inside a GitHub Actions run. CI has therefore always been the only thing able to produce an official Hawser release — SignPath adds an Authenticode signature to a pipeline that was already the sole source of signed artifacts. Presenting it as a new cost overstated the decision, and the page now says so.
Two additions
What the roles arrangement still guarantees with one maintainer: no signature is produced without a deliberate act, because signing is never automatic on a tag. The page was honest that one person holding all three roles is not separation of duties; it now also says what the control does do, so the limitation is not mistaken for "worthless".
What the programme constrains beyond the pipeline. The certificate is issued by the Foundation to the project, not owned by us; and eligibility requires an OSI licence with no commercial dual-licensing for any component. A future paid tier would end it. Worth recording now, while it costs nothing, rather than discovering it later.
No code changes.