Repository navigation
Sign the final release provenance - #4550
Merged
kubernetes-prow[bot] merged 1 commit intoOct 30, 2026
Merged
Conversation
kubernetes-prow
Bot
added
do-not-merge/work-in-progress
kubernetes-prow
Bot
added
area/release-eng
This was referenced Oct 7, 2026
Closed
saschagrunert
force-pushed
the
sign-final-provenance
branch
2 times, most recently
from
October 7, 2026 07:14
6fa8e31 to
15844dc
Compare
kubernetes-prow
Bot
added
size/XL
saschagrunert
force-pushed
the
sign-final-provenance
branch
from
October 7, 2026 07:14
15844dc to
fb78017
Compare
saschagrunert
force-pushed
the
sign-final-provenance
branch
2 times, most recently
from
October 8, 2026 10:13
e0dc4ba to
6268957
Compare
kubernetes-prow
Bot
added
the
needs-rebase
saschagrunert
force-pushed
the
sign-final-provenance
branch
from
October 13, 2026 06:32
6268957 to
3428cff
Compare
kubernetes-prow
Bot
removed
the
needs-rebase
saschagrunert
force-pushed
the
sign-final-provenance
branch
from
October 13, 2026 11:11
3428cff to
8ae7669
Compare
kubernetes-prow
Bot
added
size/L
saschagrunert
force-pushed
the
sign-final-provenance
branch
from
October 13, 2026 11:15
8ae7669 to
06ab7ce
Compare
saschagrunert
changed the title
kubernetes-prow
Bot
removed
the
do-not-merge/work-in-progress
This was referenced Oct 13, 2026
Member
Author
|
@kubernetes/release-engineering PTAL |
Member
Author
|
@kubernetes/release-engineering PTAL |
krel release generated the final provenance attestations and published them unsigned, since the release job signs the artifacts before krel release writes them. They are now signed in place like the stage run signs its provenance, as the account named by GOOGLE_SERVICE_ACCOUNT_NAME, which the release job impersonates to sign the artifacts, before anything of the release is published, so that a signing failure stops it. Without that account the release fails instead of signing with other credentials. A version without a final attestation fails official releases, mock releases skip it with a warning, like they only warn about a stage provenance that doesn't check. The published provenance.json becomes a sigstore bundle. The in-place signing of the krel sign attestation command moves into the attestation package, so that both use it. Signed-off-by: Sascha Grunert <sgrunert@redhat.com>
saschagrunert
force-pushed
the
sign-final-provenance
branch
from
October 30, 2026 16:52
06ab7ce to
062aa6f
Compare
xmudrii
approved these changes
Oct 30, 2026
| // warning, like mock releases only warn when the stage provenance doesn't | ||
| // check. | ||
| func (d *defaultReleaseImpl) SignProvenance(versions []string, required bool) error { | ||
| account := os.Getenv("GOOGLE_SERVICE_ACCOUNT_NAME") |
Member
There was a problem hiding this comment.
nit: SignProvenance reads GOOGLE_SERVICE_ACCOUNT_NAME directly, while everything else in the impl comes from d.options. No other Go code in the repo reads this variable; it only appears in the krel release help text. Could we add it to ReleaseOptions (for example as a --signing-account flag that defaults to the env var)? Then the account would be visible in the options and easier to set in tests. Fine as a follow-up.
kubernetes-prow
Bot
added
the
lgtm
Contributor
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: saschagrunert, xmudrii The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
This was referenced Oct 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What type of PR is this?
/kind feature
What this PR does / why we need it:
Signs the final release provenance in place, like the stage run signs its provenance since #4507.
krel releasegeneratesprovenance-<version>.jsonper version and copies it to the release bucket, but the release build runskrel sign blobsbefore that step, so the publishedprovenance.jsonhas never been signed.PushArtifactsnow signs the final attestations first, as the account named byGOOGLE_SERVICE_ACCOUNT_NAME(krel-staging, which the release step already sets for the image and blob signatures), so a signing failure stops the release before anything is published. Without that variable the release fails instead of signing with other credentials, which the documented verify command would reject. Signing inside krel rather than in a later Cloud Build step keeps the plain statement from ever being public, and krel knows the versions of a release. A version without a final attestation fails official releases (--nomock), so that they never publish without provenance; mock releases skip it with a warning.krel sign attestation --in-placeand this share the newSigner.SignFilesInPlaceandSigner.WriteBundleFile, and thekrel releasehelp says that local runs needGOOGLE_SERVICE_ACCOUNT_NAMEtoo.https://dl.k8s.io/release/<version>/provenance.jsonbecomes a sigstore bundle instead of the plain statement of v1.37.0 and older. It verifies with:Which issue(s) this PR fixes:
Part of #2616
Special notes for your reviewer:
fake_release_impl.gois regenerated with counterfeiter v6.12.2, the version of the other fakes, so it only changes the signing method. A signer factory ondefaultReleaseImpllets the unit test cover the success path, the paths passed and the signing account.The verify command was checked against a staged bundle signed as
krel-staging. The "Verify Signed Kubernetes Artifacts" page on kubernetes.io should get it once this ships.Tested end to end with a mock stage (Cloud Build fc5b9edb in k8s-release) and a mock release (f2b2aac0) of master, with krel built from a branch that combines #4555, #4550 and #4551: the stage attached the signed image provenance to 54 mock images (cosign verify-attestation passes) and signed
provenance.jsonin place; the release verified that stage provenance and all 451 staged artifacts, signed the final provenance in place before publishing, and the publishedprovenance.jsonverifies against the releasedkubectlwithcosign verify-blob-attestation.Does this PR introduce a user-facing change?