Thread by @MohammedSahaf

Whoa, what happened here?! How did @caddyserver release assets count go from 28 to 134?

Well, @projectsigstore happened! Buckle up 🏎️

https://twitter.com/caddyserver/status/1571300548900687872

Since the initial days of v2 and before v2 being GA, we worked on having #ReproducibleBuilds. Much of this was easy thanks to @GoReleaser (go sponsor @caarlos0!) and @golang tooling!

blog.goreleaser.com/reproducible-b…

The tooling allows having byte-for-byte match between two binaries if build your own from scratch using tools. In other words, cloning the repo and building v2.x.x using @GoReleaser on your own machines should give you 0-diff binary compared to the ones produced by our CI/CD.

Sweet! We still have a missing piece of the puzzle: signing the artifacts. This was me after wrestling with gpg on the same day of setting up our CI/CD flows. We have hashes, but who says the artifacts and the hashes were not MitM-ed? 🫤

https://twitter.com/MohammedSahaf/status/1242242478046162944

Signing proves the integrity of the artifact and the identity of the person putting their John Hancock on it. We had an incident in late 2020 where CI/CD executed the release workflow on due to tag pushed on a fork. How do we know the tag is approved?

https://twitter.com/caddyserver/status/1338324879917993984

Our fix to that issue was by including a step in our workflow to reject tags not signed by @mholt6, the BDFL of @caddyserver, plain and simple. I admit, this was a band-aid.

github.com/caddyserver/ca…

Binaries are still not signed, though. How do we publicly prove the integrity of the binaries, proving the identity of the subject behind the signing key, prove the validity of the signature and the keys, and prove all is in order?

Enter @projectsigstore
redhat.com/en/blog/sigsto…

.@projectsigstore is an initiative to create an ecosystem to generate code-signing certs, publicly publish cert transparency logs (tlog), the signatures, and everything in between by utilizing the identity information embedded in CI/CD envs.

security.googleblog.com/2021/03/introd…

You can read about the design of @projectsigstore here:

docs.google.com/document/d/146…

Yet again, with the help of @GoReleaser, it was easy to add not only keyless signatures with @projectsigstore, but also SBOMs for all binaries attached to releases. Moreover, all artifacts are signed, be it archives, SBOM, or checksum file!

Sign all the things!

In sum: @caddyserver git tags are signed, SBOMs are provided and signed, builds are reproducible and checksumed and signed, and signatures are publicly published. Are we still trusting trust of the supply chain?

We'll publish instructions on how to verify the signatures 📑

We're probably too late to the party, @lorenc_dan, but the answer is: Yes, as of v2.6.0-beta*

https://twitter.com/lorenc_dan/status/1571441444480552960

Huge shout out to @GoReleaser

blog.goreleaser.com/goreleaser-and…