Publish Linux `auto-review` binaries with full provenance #121

New issue

Closed

opened 2026-05-06 11:57:45 -07:00 by jwilger · 0 comments

jwilger commented

2026-05-06 11:57:45 -07:00

Owner

Follow-up implementation slice from #115.

Decision context

Each release should include bare downloadable Linux binaries in addition to the Docker image. The first supported targets are Linux x86_64 and aarch64, and releases must include full provenance.

Scope

Add release artifacts for auto-review on Linux x86_64 and Linux aarch64.
Keep publishing the Docker image for production deployment.
Attach binary archives to Forgejo Releases.
Publish SHA-256 checksums.
Sign the checksum file or artifacts using the release signing key or a dedicated artifact-signing key.
Publish SBOM/provenance metadata and verification instructions.
Use Forgejo/tea/Forgejo API tooling, not GitHub-only release tooling.

Acceptance criteria

Forgejo Releases contain Docker image information plus both Linux binary downloads.
Checksums, signatures, SBOM/provenance metadata, and verification instructions are present.
Release publish token scope and threat-model documentation account for binary assets.
Release workflow refuses unexpected token-bearing changes while allowing intentional binary-release workflow/script changes.

Required tests

Release-tooling contract tests for artifact names, checksums, signatures, and provenance files.
Workflow validation for allowed changed files and release notes.
Verification instructions tested against generated artifacts where feasible.

Follow-up implementation slice from #115. ## Decision context Each release should include bare downloadable Linux binaries in addition to the Docker image. The first supported targets are Linux `x86_64` and `aarch64`, and releases must include full provenance. ## Scope - Add release artifacts for `auto-review` on Linux `x86_64` and Linux `aarch64`. - Keep publishing the Docker image for production deployment. - Attach binary archives to Forgejo Releases. - Publish SHA-256 checksums. - Sign the checksum file or artifacts using the release signing key or a dedicated artifact-signing key. - Publish SBOM/provenance metadata and verification instructions. - Use Forgejo/`tea`/Forgejo API tooling, not GitHub-only release tooling. ## Acceptance criteria - Forgejo Releases contain Docker image information plus both Linux binary downloads. - Checksums, signatures, SBOM/provenance metadata, and verification instructions are present. - Release publish token scope and threat-model documentation account for binary assets. - Release workflow refuses unexpected token-bearing changes while allowing intentional binary-release workflow/script changes. ## Required tests - Release-tooling contract tests for artifact names, checksums, signatures, and provenance files. - Workflow validation for allowed changed files and release notes. - Verification instructions tested against generated artifacts where feasible.

jwilger added a new dependency

2026-05-06 12:14:08 -07:00

#120 Update docs, threat model, and red-team tests for single-binary OCI rollout

jwilger added this to the 1.0 milestone

2026-05-06 12:17:51 -07:00

jwilger referenced this issue

2026-05-07 11:04:41 -07:00

docs: document single-binary rollout #133

jwilger referenced this issue from a commit

2026-05-07 11:51:57 -07:00

docs: document single-binary rollout (#133)

jwilger referenced this issue from a pull request that will close it,