201-a-release-proves-itself-after-it-publishes

A release ships its attestation bundles, requires signing, and verifies what it published

Lifecycle approvedImplementation completeVerification unknownQualification unknown

Spec 019 records each archive's build-provenance attestation only in GitHub's attestation store and leaves the bundle as "a later additive refinement". This spec is that refinement and two more. Each archive's Sigstore bundle (`<archive>.intoto.jsonl`) is attached to the GitHub Release next to the archive, so an archive verifies offline. Signing is required on every `v*` tag: a build that cannot obtain the OIDC token or whose attestation step yields no bundle fails before any publish job runs. A final job in `release.yml` downloads what the release actually published and verifies it: every checksum, every attestation against both its attached bundle and the store, and the presence of every archive's SBOM and bundle. A failed check fails the release workflow.

Read the full pinned specification ↗

Relationships

depends on

Claimed units

extends

{
  "nature": "additive",
  "spec": "006-distribution",
  "unit": {
    "kind": "file",
    "path": ".github/workflows/release.yml"
  }
}

extends

{
  "nature": "additive",
  "spec": "006-distribution",
  "unit": {
    "kind": "file",
    "path": "docs/releasing.md"
  }
}

Source headings

201: A release ships its attestation bundles, requires signing, and verifies what it published
1. Purpose
2. Territory
3. Behavior
3.1 The bundle is a release asset
3.2 Signing is required
3.3 The release verifies what it published
3.4 Pinned like the rest
4. Out of scope
5. Resolved decisions
Verification

Frozen anchors

No frozen anchors declared.