feat(release): add artifact-bound SBOM assurance and keyless attestations

.github/actions/release-nightly/action.yml

@@ -90,6 +90,7 @@ runs:
         echo "VERSION=$V" >> $GITHUB_ENV
         echo "TAG=v$V" >> $GITHUB_ENV
         echo "UPD_DATE=$D" >> $GITHUB_ENV
+        echo "BUILD_SOURCE_SHA=$(git rev-parse HEAD)" >> $GITHUB_ENV
         IMAGE_NAME=docker.io/${TEST_DOCKER_HUB_USERNAME:-testcamelk}/camel-k
         echo "Using IMAGE_NAME=$IMAGE_NAME"
         echo "IMAGE_NAME=$IMAGE_NAME" >> $GITHUB_ENV
@@ -110,30 +111,66 @@ runs:
       run: |
         NOTEST=1 make VERSION=${{ env.VERSION }} IMAGE_NAME=${{ env.IMAGE_NAME }} BUNDLE_IMAGE_NAME=docker.io/testcamelk/camel-k-bundle bundle-push
 
-    - name: Install SBOM generator
+    - name: Install assurance tools
       shell: bash
       run: |
-        go install github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@latest
-        echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
-
-    - name: Generate SBOM
+        source script/release-assurance-tools.env
+        go install github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@${CYCLONEDX_GOMOD_REF}
+        go install github.com/anchore/syft/cmd/syft@${SYFT_REF}
+        go install github.com/sigstore/cosign/v3/cmd/cosign@${COSIGN_REF}
+        echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
+        go version -m "$(go env GOPATH)/bin/cyclonedx-gomod" | grep -F "github.com/CycloneDX/cyclonedx-gomod ${CYCLONEDX_GOMOD_VERSION}"
+        reported_syft_version=$("$(go env GOPATH)/bin/syft" --version | awk '{print $NF}')
+        test "$reported_syft_version" = "${SYFT_VERSION#v}"
+        go version -m "$(go env GOPATH)/bin/cosign" | grep -F "github.com/sigstore/cosign/v3 ${COSIGN_VERSION}"
+
+    - name: Generate module SBOM
       shell: bash
-      run: cyclonedx-gomod mod -licenses -json -output sbom.json
+      run: cyclonedx-gomod mod -licenses -json -noserial -notimestamp -output sbom.json
 
-    - name: Commit and push nightly branch
+    - name: Prepare nightly release commit
       shell: bash
       env:
         CI_USER: "github-actions[bot]"
         CI_EMAIL: "41898282+github-actions[bot]@users.noreply.github.com"
-        CI_TOKEN: ${{ inputs.secretGithubToken }}
       run: |
         git config --local user.email "$CI_EMAIL"
         git config --local user.name "$CI_USER"
         git add docs/charts/
         git commit -am 'chore(ci): ${{ env.TAG }} release updates' || echo "No nightly release updates changes to commit"
         echo "COMMIT_ID=$(git rev-parse HEAD)" >> $GITHUB_ENV
-        git tag ${{ env.TAG }} $(git rev-parse HEAD)
-        git push "https://$CI_USER:$CI_TOKEN@github.com/$GITHUB_REPOSITORY.git" tag ${{ env.TAG }} -f || echo "No nightly release updates changes to push"
+
+    - name: Generate release assurance
+      shell: bash
+      env:
+        SYFT_CHECK_FOR_APP_UPDATE: "false"
+      run: |
+        source script/release-assurance-tools.env
+        export SYFT_VERSION
+        bash script/generate_release_assurance.sh \
+          "${{ env.VERSION }}" \
+          "${{ env.TAG }}" \
+          "${{ env.BUILD_SOURCE_SHA }}" \
+          "${{ env.COMMIT_ID }}" \
+          "$CYCLONEDX_GOMOD_VERSION"
+
+    - name: Sign and attest release assurance
+      shell: bash
+      env:
+        COSIGN_YES: "true"
+      run: |
+        bash script/attest_release_assurance.sh \
+          release-assurance.json \
+          release-assurance.sigstore.json
+
+    - name: Publish nightly tag
+      shell: bash
+      env:
+        CI_USER: "github-actions[bot]"
+        CI_TOKEN: ${{ inputs.secretGithubToken }}
+      run: |
+        git tag -f "${{ env.TAG }}" "${{ env.COMMIT_ID }}"
+        git push "https://$CI_USER:$CI_TOKEN@github.com/$GITHUB_REPOSITORY.git" "refs/tags/${{ env.TAG }}" --force
 
     - name: Create release first time
       shell: bash
@@ -236,7 +273,7 @@ runs:
       shell: bash
       run: |
         RELEASE_ID=${{ env.RELEASE_ID }}
-        FILES="./camel-k-client*.tar.gz sbom.json"
+        FILES="./camel-k-client*.tar.gz sbom.json ./camel-k-client*.sbom.cdx.json ./camel-k-image-*.sbom.cdx.json release-assurance.json release-assurance.json.sha256 release-assurance.sigstore.json"
 
         for FILE in $FILES; do
           if [ -f "$FILE" ]; then

.github/workflows/nightly-release.yml

@@ -30,6 +30,8 @@ env:
 
 permissions:
   contents: write
+  # Required by Cosign keyless signing to mint the GitHub Actions OIDC token.
+  id-token: write
 
 on:
   schedule:

script/attest_release_assurance.sh

@@ -0,0 +1,122 @@
+#!/usr/bin/env bash
+
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -euo pipefail
+
+receipt=${1:-release-assurance.json}
+bundle=${2:-release-assurance.sigstore.json}
+issuer=${COSIGN_CERTIFICATE_OIDC_ISSUER:-https://token.actions.githubusercontent.com}
+
+for command in cosign jq; do
+    command -v "$command" >/dev/null 2>&1 || {
+        echo "required command not found: $command" >&2
+        exit 1
+    }
+done
+
+if [[ ! -f "$receipt" ]]; then
+    echo "release assurance receipt not found: $receipt" >&2
+    exit 1
+fi
+
+identity=${COSIGN_CERTIFICATE_IDENTITY:-}
+if [[ -z "$identity" ]]; then
+    if [[ -z "${GITHUB_WORKFLOW_REF:-}" ]]; then
+        echo "GITHUB_WORKFLOW_REF or COSIGN_CERTIFICATE_IDENTITY is required for keyless verification" >&2
+        exit 2
+    fi
+    identity="https://github.com/${GITHUB_WORKFLOW_REF}"
+fi
+
+repository_without_tag() {
+    local ref=${1%@*}
+    local tail=${ref##*/}
+
+    if [[ "$tail" == *:* ]]; then
+        ref=${ref%:*}
+    fi
+
+    printf '%s\n' "$ref"
+}
+
+verify_identity_args=(
+    --certificate-identity "$identity"
+    --certificate-oidc-issuer "$issuer"
+)
+
+export COSIGN_YES=true
+
+# The local bundle makes the downloadable receipt independently verifiable,
+# while OCI signatures and attestations make the registry artifacts discoverable.
+cosign sign-blob --yes --bundle "$bundle" "$receipt"
+cosign verify-blob \
+    --bundle "$bundle" \
+    "${verify_identity_args[@]}" \
+    "$receipt" >/dev/null
+
+while IFS= read -r image; do
+    tag_ref=$(jq -r '.ref' <<<"$image")
+    digest=$(jq -r '.digest' <<<"$image")
+    repository=$(repository_without_tag "$tag_ref")
+    subject="${repository}@${digest}"
+
+    if [[ ! "$digest" =~ ^sha256:[0-9a-f]{64}$ ]]; then
+        echo "invalid image digest in receipt: $digest" >&2
+        exit 1
+    fi
+
+    cosign sign --yes "$subject"
+    cosign verify "${verify_identity_args[@]}" "$subject" >/dev/null
+
+    cosign attest --yes --type custom --predicate "$receipt" "$subject"
+    cosign verify-attestation \
+        --type custom \
+        "${verify_identity_args[@]}" \
+        "$subject" >/dev/null
+
+    while IFS= read -r sbom; do
+        sbom_name=$(jq -r '.name' <<<"$sbom")
+        sbom_source=$(jq -r '.source' <<<"$sbom")
+        sbom_digest=$(jq -r '.imageDigest' <<<"$sbom")
+
+        if [[ ! -f "$sbom_name" ]]; then
+            echo "image SBOM not found: $sbom_name" >&2
+            exit 1
+        fi
+        if [[ "$sbom_source" != *@"$sbom_digest" ]]; then
+            echo "image SBOM source/digest binding mismatch: $sbom_name" >&2
+            exit 1
+        fi
+
+        cosign attest --yes --type cyclonedx --predicate "$sbom_name" "$sbom_source"
+        cosign verify-attestation \
+            --type cyclonedx \
+            "${verify_identity_args[@]}" \
+            "$sbom_source" >/dev/null
+    done < <(jq -c '.sboms[]?' <<<"$image")
+done < <(jq -c '.images[]' "$receipt")
+
+# Re-run the entire release contract from the consumer side. Strict mode requires
+# every local release asset, recomputes hashes, re-reads embedded Go VCS metadata,
+# and requires the verified OCI predicates to match the exact local JSON files.
+ASSURANCE_REQUIRE_LOCAL_ASSETS=true \
+COSIGN_CERTIFICATE_IDENTITY="$identity" \
+COSIGN_CERTIFICATE_OIDC_ISSUER="$issuer" \
+bash "$(dirname "$0")/verify_release_assurance.sh" \
+    "$receipt" \
+    "$bundle" \
+    release-assurance.verdict.json