From 0ec2ae8bc01c3c1d6535183d1a8234c852ac87e0 Mon Sep 17 00:00:00 2001 From: A Tobey Date: Wed, 2 Sep 2026 19:55:50 -0400 Subject: [PATCH] docs(readme): the cosign floor was 3; a release verifies from 2.5 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The README told operators they need cosign >= 3 to verify a kaibo release. They do not, and the wrong floor turns away a working install — the failure mode is someone concluding they cannot check a signature they can in fact check. Measured against v0.3.0's real signed `checksums.txt` rather than reasoned about, because "which version can read this bundle" is not a question to answer from memory: 2.4.0 FAILS — bundle does not contain cert for verification 2.5.0 Verified OK 2.6.0 Verified OK 2.6.4 Verified OK So the floor is 2.5, and 2.4's message is quoted in the README because that is what an operator on an older cosign actually sees — it names the bundle format, not the version, so it is not self-explaining. Each "Verified OK" carries negative controls: a tampered `checksums.txt` fails the signature check and a wrong tag identity fails the SAN match, on both 2.5.0 and 2.6.4. Without those, "verified" only proves the command ran. Carried since the v0.3.0 release check on 2026-08-13, where 2.6.4 verified fine and contradicted the floor. This closes it with the floor measured rather than merely lowered. Co-Authored-By: Claude Opus 5 --- CHANGELOG.md | 2 ++ README.md | 8 +++++--- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 6e4a491..6a41a08 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -129,6 +129,8 @@ record. Each later release appends a new section at the top. ### Fixed +- **The README's cosign floor said 3, and 2.5 verifies a release** — the old floor turned + away working installs. - **Bump `kaish-kernel` to 0.14.1** — the explorer's shell no longer drops piped or buffered stdin across `read`/`grep`/`cat`, and a loop or `if` that exits early keeps what it already printed. diff --git a/README.md b/README.md index 3a6b2e6..362479d 100644 --- a/README.md +++ b/README.md @@ -143,10 +143,12 @@ against any file from the release: gh attestation verify kaibo-v0.2.0-x86_64-unknown-linux-musl.tar.gz -R tobert/kaibo ``` -With [cosign](https://docs.sigstore.dev/cosign/system_config/installation/) ≥ 3 +With [cosign](https://docs.sigstore.dev/cosign/system_config/installation/) ≥ 2.5 (no GitHub tooling needed), verify the signed checksum manifest once and it -covers every file it lists. Grab `checksums.txt` and `checksums.txt.sigstore.json` -from the release, substituting the tag you downloaded in the identity: +covers every file it lists. 2.4 and older cannot read the bundle format and +answer `bundle does not contain cert for verification`. Grab `checksums.txt` and +`checksums.txt.sigstore.json` from the release, substituting the tag you +downloaded in the identity: ```sh cosign verify-blob \