Optional cosign/sigstore signature verification (verify-signature input) #4

New issue

Open

opened 2026-05-28 02:56:25 +00:00 by stephen · 0 comments

stephen commented

2026-05-28 02:56:25 +00:00

Owner

Blocked: as of sccache v0.15.0, Mozilla does not publish cosign signatures for the release assets. If/when upstream starts signing, add an opt-in verify-signature input (default off until cosign is reliably present on target runners).

Tracked in SECURITY.md under "What is not done yet".

SHA-256 verification (shipped in v1.1.0) defends against a tampered asset on the CDN/transport, but not against a compromise of the Mozilla release flow that re-signs both tarball and sidecar. Cosign/sigstore verification would close that gap. Blocked: as of sccache v0.15.0, Mozilla does not publish cosign signatures for the release assets. If/when upstream starts signing, add an opt-in `verify-signature` input (default off until `cosign` is reliably present on target runners). Tracked in SECURITY.md under "What is not done yet".

stephen added the

blocked:upstream

enhancement

security

labels

2026-05-28 02:56:45 +00:00