OXYGENHUB

Standard exports: cosign-verifiable releases, in-toto/SLSA provenance in DSSE issue #239 closed: completed andymccall opened this · 3 comments

andymccall

Compared with Sigstore/cosign, 2026-10-16: our receipts and seals are richer but only Oxygen tools read them. Export what others verify: (1) release assets and image manifests signed so cosign verify-blob / cosign verify accept them (a cosign-compatible bundle with the signer's certificate or key); (2) Flow receipts emitted as in-toto Statements with SLSA provenance v1 predicates in DSSE envelopes, attached to releases and pushed as OCI referrers for images; (3) flow verify / oxy receipt export --format slsa. Lets Kubernetes admission controllers (policy-controller, Kyverno) and SLSA verifiers check our builds.

andymccall set labels feature ·

referenced by 3 changes on 17 Oct 2026

076c7a7c86b1 681db69eba17 97fc47fee9cf

andymccall

Where issue #239 stands (2026-10-17):

  • Flow artifacts: SLSA provenance v1 in DSSE signed by the hub key at …/artifacts/{job}/{artifact}/provenance, key at /.well-known/oxyhub-signing.pem (fd2abf20); one buildType everywhere, on oxy-core's dsse module (931aec05).
  • Release assets: link their artifact's provenance on the release page and as built_by.provenance_url (8b31d0c3, deploying 06:55).
  • oxy: oxy receipt export --format slsa (signed with the exporter's Ed25519) and oxy identity export --pem (oxygen a4847c8c).
  • Not done: a real cosign run against these (cosign is not installed on Earth or the workstation; downloading it needs Andy's OK). OCI referrers do not apply yet: the hub hosts no OCI registry (Flow's rootfs images are not OCI). Leaving it open for the cosign check.
andymccall

Checked end to end on the live hub (07:05), without cosign: the v0.4.3 asset oxy-0.4.3-linux-arm64.tar.gz links …/flow/266/artifacts/dist/oxy-linux-arm64.tar.gz/provenance; the DSSE signature over PAE verifies with /.well-known/oxyhub-signing.pem (openssl pkeyutl -verify -rawin: Signature Verified Successfully), and the statement's subject sha256 b891c44d…7eb8 is the downloaded asset's. What remains is running cosign itself.

closed by change d2c1d6a7d12e ·

andymccall

Checked with cosign itself (v2.4.1, pinned release, checksum checked, on Earth, 2026-10-17): cosign verify-blob-attestation --key oxyhub-signing.pem --type slsaprovenance1 --insecure-ignore-tlog=true --signature prov.json oxy-0.4.3-linux-arm64.tar.gz says Verified OK; the same with one byte of the asset changed fails with 'no matching subject digest found'. --insecure-ignore-tlog is needed until the hub's own transparency log (issue #238) exists; the documented commands now say so (de69b375).