Release assets link their SLSA provenance, so cosign checks them 97fc47fee9cf
An asset built by a job with a kept signed receipt now links the
provenance of its artifact (the same bytes, matched by BLAKE3): on the
release page and as built_by.provenance_url in the API. cosign
verify-blob-attestation --key oxyhub-signing.pem --type slsaprovenance1
--signature PROVENANCE ASSET checks a downloaded asset. Spec 6.x says so;
the release test checks both the unsigned and signed cases.
Refs #239
/// A release's trust report (hub spec §9.1): a signed tag, an asset built
…
90 unchanged lines
modifieddocs/spec.md+1−1
…
402 unchanged lines
403
403
A hand-uploaded asset, an unsigned tag or an unsigned change is a warning. A signature or receipt that does not verify, or a revoked key, is a failure.
404
404
- **Export:** `?format=json` downloads the report, and `GET /api/v1/repos/{owner}/{name}/releases/trust/{tag}` returns the same. The JSON carries each signed receipt as hex, so an auditor can check it offline with `oxy receipt verify`.
405
405
406
-
**Built by.** A release asset links to the build that produced it: the passed OxygenFlow job of this repository with an artifact of the same BLAKE3 (hub spec §13.2). A job with a kept signed receipt comes first, then the newest run. The release page shows the run, the job and the signed receipt with its signer, and the API gives the same as `built_by` on each asset. On a run page, a writer can attach an artifact to a release; it becomes an asset named after the artifact's path, so the link follows by content. A file uploaded by hand links the same way when its bytes match.
406
+
**Built by.** A release asset links to the build that produced it: the passed OxygenFlow job of this repository with an artifact of the same BLAKE3 (hub spec §13.2). A job with a kept signed receipt comes first, then the newest run. The release page shows the run, the job and the signed receipt with its signer, and the API gives the same as `built_by` on each asset. With a signed receipt it also links the asset's SLSA provenance (`provenance_url`, §13.2's provenance of that artifact, which states the same bytes), so a release asset is checked with `cosign verify-blob-attestation --key oxyhub-signing.pem --type slsaprovenance1 --signature PROVENANCE ASSET` (oxygenhub#239). On a run page, a writer can attach an artifact to a release; it becomes an asset named after the artifact's path, so the link follows by content. A file uploaded by hand links the same way when its bytes match.
407
407
408
408
## 10. Notifications
409
409
…
207 unchanged lines
modifiedtemplates/releases.html+1−1
…
17 unchanged lines
18
18
{% if !v.r.notes.is_empty() %}<article class="doc">{{ v.notes_html|safe }}</article>{% endif %}
19
19
<h3>Assets</h3>
20
20
<ul class="plain">
21
-
{% for a in v.assets %}<li><a href="{{ repo.url }}/asset/{{ a.id }}/{{ a.name }}">{{ a.name }}</a> <span class="small mute">{{ a.size|bytes }} · blake3 <code title="{{ a.hash }}">{{ a.hash|short }}</code> · {{ a.downloads }} downloads</span>{% if let Some(p) = v.built_by(a.id) %} <span class="small" data-built>· built by <a href="{{ repo.url }}/flow/{{ p.run_number }}">run #{{ p.run_number }}</a> {{ p.job }}{% if p.receipt_attest.is_empty() %} <span class="mute">(unsigned receipt)</span>{% else %} · <a href="{{ repo.url }}/receipts/{{ p.receipt_attest }}" title="Check it with oxy receipt verify">signed receipt</a> by {{ p.receipt_signer }}{% endif %}</span>{% endif %}
21
+
{% for a in v.assets %}<li><a href="{{ repo.url }}/asset/{{ a.id }}/{{ a.name }}">{{ a.name }}</a> <span class="small mute">{{ a.size|bytes }} · blake3 <code title="{{ a.hash }}">{{ a.hash|short }}</code> · {{ a.downloads }} downloads</span>{% if let Some(p) = v.built_by(a.id) %} <span class="small" data-built>· built by <a href="{{ repo.url }}/flow/{{ p.run_number }}">run #{{ p.run_number }}</a> {{ p.job }}{% if p.receipt_attest.is_empty() %} <span class="mute">(unsigned receipt)</span>{% else %} · <a href="{{ repo.url }}/receipts/{{ p.receipt_attest }}" title="Check it with oxy receipt verify">signed receipt</a> by {{ p.receipt_signer }} · <a href="{{ repo.url }}/flow/{{ p.run_number }}/artifacts/{{ p.job|urlencode }}/{{ p.name|urlencode }}/provenance" title="SLSA provenance signed by this hub: cosign verify-blob-attestation --key /.well-known/oxyhub-signing.pem --type slsaprovenance1">provenance</a>{% endif %}</span>{% endif %}
Claude Code <[email protected]> · delegate for changes, until 2026-11-13 19:00Z · key ea5f78160088