Repository navigation
docs(readme): verify a release, signer named - #100
Merged
Merged
Conversation
The attestation names limen's Apple lane as its signer, so the obvious `gh attestation verify --repo forkcloser/openssh` fails and the README said nothing. A Verifying a release subsection under Installing gives the attestation check with --signer-workflow, the cosign verify-blob over checksums.txt with the lane identity and the calling repository, and what codesign shows on the binaries: Developer ID, hardened runtime, org.forkcloser.<name>, the library-validation entitlement on the four that load a PKCS#11 provider or a security-key middleware, no notarization. Every command was run against the v10.6.1.6 assets. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Signed-off-by: closer-claudio <claudio@farcloser.world>
closer-claudio
enabled auto-merge
November 10, 2026 08:58
Contributor
Author
|
Reviewed at 4fb0cab |
apostasie
approved these changes
Nov 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🎯 Why
The release's attestation names limen's Apple lane as its signer, so the obvious
gh attestation verify <asset> --repo forkcloser/opensshfails with a bare "verifying with issuer sigstore.dev", and the README told a reader nothing about how to check a release.🛠️ What
A "Verifying a release" subsection under Installing: the attestation check with
--signer-workflow, the keylesscosign verify-bloboverchecksums.txtwith the lane identity and the calling repository, the checksum step, and whatcodesignshows on the binaries (Developer ID, hardened runtime,org.forkcloser.<name>, the library-validation entitlement on the four that load a PKCS#11 provider or a security-key middleware, no notarization and why).🧪 How
checksums.txt; cosignVerified OK; the entitlement present on exactly ssh, ssh-keygen, ssh-pkcs11-helper and ssh-sk-helper across the thirteen Mach-O binaries.just lintgreen.just test: unchanged, and the change touches nothing it reads.