Claude/go openstackclient review security a9k33p - #10
Merged
ftarasenko merged 2 commits intoAug 13, 2026
Merged
Conversation
cosign v3 turns the standardized bundle on by default, and that default is what broke the old signing config rather than any removed flag. Under --new-bundle-format the --output-signature/--output-certificate pair this repo passed is *silently ignored* — cosign says "deprecated when using --new-bundle-format and will be ignored" and exits fine — so the release would have published no signature at all. Worse, release.yml only runs on a v* tag, so no PR check could have caught it: the first symptom would have been a signature- less release under a tag that is immutable and cannot be re-cut. signs: now writes checksums.txt.bundle, and names --new-bundle-format explicitly even though v3 defaults to it, so a future default flip cannot repeat the same silent failure. The cosign-installer moves to v4.1.2, which installs v3; the tool version stays unpinned because the installer and the format move together. The bundle also carries the transparency-log inclusion proof, which upgrades the air-gapped procedure instead of merely preserving it. cosign v3 deprecates --offline in favour of a --trusted-root file, so SECURITY.md now documents capturing one with `cosign trusted-root create --with-default-services` on a connected host and verifying inside the enclave with no network at all. The old enclave-side command there also dropped the identity flags, verifying only that *somebody* had signed; the new one keeps them. prune-release-assets.yml keeps its assets by suffix, so its jq keep-list learns .bundle — without that the first prune would have deleted the one file the whole workflow exists to retain. Both spellings stay on the list, since releases up to v0.22.0 carry the detached pair and a v3 client still verifies those by falling back automatically. BREAKING CHANGE: the cosign signature over checksums.txt ships as checksums.txt.bundle instead of checksums.txt.sig + checksums.txt.pem. Verify with `cosign verify-blob checksums.txt --bundle checksums.txt.bundle` and the same two identity flags; this needs cosign v3+, or v2.6+ with an explicit --new-bundle-format. Releases up to v0.22.0 are unaffected and still verify with --certificate/--signature. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DRBThE7bUn5AR4KsNi78yw
Three comments drifted out of sync with their own code in the last two commits on master, each in a way that misleads rather than merely omits. The github-actions group bump moved attest-build-provenance to v4.2.2 and dependency-review-action to v5.0.0, but left the notes above them saying they were "held" on v2 and v4 pending a reviewable Dependabot PR. That PR was the bump itself, so both now describe the opposite of the pin they annotate — and a rationale that contradicts its own `uses:` line is worse than none, because the next reader cannot tell which half is stale. Each now records what the bump was checked against: v4 reduces attest-build-provenance to a wrapper over actions/attest with `subject-path` unchanged, and v5 of dependency-review-action changed only the runtime to node24, which ubuntu-latest already satisfies. The SBOM-bundle commit spliced its NOTE into the middle of an existing sentence in prune-release-assets, leaving "The always-keep list is redundant with the" to run straight into "NOTE the SBOM bundle is …", and stranding a closing paren with no opener. The block is rewritten to say the two things it was reaching for: the guard is redundant for files the suffix test never matches anyway, and the SBOM bundle is the lone exception because it genuinely ends in .tar.gz. It also now states why two spellings appear for both the SBOM and the signature — this workflow runs across releases from either era. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DRBThE7bUn5AR4KsNi78yw
ftarasenko
deleted the
claude/go-openstackclient-review-security-a9k33p
branch
August 13, 2026 09:10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.