release: sign GoReleaser's tap/scoop bot commits before routing them through signed repos #434

New issue

Open

opened 2026-08-17 19:11:49 +00:00 by hexajon · 0 comments

hexajon commented

2026-08-17 19:11:49 +00:00

Owner

Problem

Each release, GoReleaser bumps the Homebrew cask and Scoop manifest as a commit in sixfold-space/homebrew-tap and sixfold-space/scoop-bucket (scripts/release.sh:67-74, docs/contributing/releasing.md:102,114-115). Those bot commits are UNSIGNED. GoReleaser authenticates with GITHUB_TOKEN and targets the GitHub distribution edge (docs/contributing/release-credentials.md:71, ADR 0032).

The sixfold-space repos on git.cheshirecube.cloud now enforce require_signed_commits on main (2026-08-17), including homebrew-tap and scoop-bucket.

Current state - no break today

The cheshirecube homebrew-tap/scoop-bucket are migrated-from-Codeberg copies with mirror=false, and GoReleaser pushes the tap/scoop to the GitHub edge, not to these. So the new require_signed on the cheshirecube copies does NOT reject the current release flow. Confirmed before enabling.

The gap

The distribution-edge tap/scoop commits are unsigned. That is a provenance gap for exactly what a user's machine fetches (brew/scoop install).
ADR 0032 makes cheshirecube the canonical source home. If release commits are ever routed through the canonical (signed) tap/bucket, GoReleaser's unsigned commits are rejected.

Fix

Give the release bot its own signing key. Same posture as #231: the private half lives only in Bitwarden SM, never on any forge, and the bot is an author, not the platform. Configure GoReleaser to sign its tap/scoop/plugin commits with it. Then require_signed safely covers wherever those commits land.

#231 - platform-gitops bootstrap bot signing (same author-signing pattern).
#413 - sigstore/cosign for release artifacts (different layer: artifact signing, not git commit signing).
#227 - org-wide branch-protection + signing enforcement.
ADR 0032 - canonical home vs GitHub distribution edge.

## Problem Each release, GoReleaser bumps the Homebrew cask and Scoop manifest as a commit in `sixfold-space/homebrew-tap` and `sixfold-space/scoop-bucket` (`scripts/release.sh:67-74`, `docs/contributing/releasing.md:102,114-115`). Those bot commits are UNSIGNED. GoReleaser authenticates with `GITHUB_TOKEN` and targets the GitHub distribution edge (`docs/contributing/release-credentials.md:71`, ADR 0032). The sixfold-space repos on git.cheshirecube.cloud now enforce `require_signed_commits` on `main` (2026-08-17), including `homebrew-tap` and `scoop-bucket`. ## Current state - no break today The cheshirecube `homebrew-tap`/`scoop-bucket` are migrated-from-Codeberg copies with `mirror=false`, and GoReleaser pushes the tap/scoop to the GitHub edge, not to these. So the new `require_signed` on the cheshirecube copies does NOT reject the current release flow. Confirmed before enabling. ## The gap 1. The distribution-edge tap/scoop commits are unsigned. That is a provenance gap for exactly what a user's machine fetches (`brew`/`scoop` install). 2. ADR 0032 makes cheshirecube the canonical source home. If release commits are ever routed through the canonical (signed) tap/bucket, GoReleaser's unsigned commits are rejected. ## Fix Give the release bot its own signing key. Same posture as #231: the private half lives only in Bitwarden SM, never on any forge, and the bot is an author, not the platform. Configure GoReleaser to sign its tap/scoop/plugin commits with it. Then `require_signed` safely covers wherever those commits land. ## Related - #231 - platform-gitops bootstrap bot signing (same author-signing pattern). - #413 - sigstore/cosign for release artifacts (different layer: artifact signing, not git commit signing). - #227 - org-wide branch-protection + signing enforcement. - ADR 0032 - canonical home vs GitHub distribution edge.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

sixfold-space/madtea#434

No description provided.

Rows
Columns