Skip to content
CommonLayer
Documentation menu
On this page

ADR-0026: Signing identities are globs over the workflow path

Status: Accepted (WP-20, WP-11). Implemented in the manifest schema, crates/commonlayer-projects/src/domain/manifest.rs and crates/commonlayer-artifacts/src/domain/naming.rs.

Context

The plan's example identity named release.yml. With reusable workflows, the Fulcio certificate cosign obtains names the called workflow (sign.yml, sbom.yml, …), not the caller, so an identity naming release.yml would never match.

Decision

  • security.signing.keyless.identity in commonlayer.yaml is a glob in which * matches any run of characters at any position. The template uses https://github.com/<owner>/<repo>/.github/workflows/*@refs/tags/v*; monorepo projects use …/workflows/*@refs/tags/<project>/v*.
  • The platform converts the glob to an anchored regular expression for cosign (--certificate-identity-regexp '^…$') and re-checks the identity itself.
  • If the declared identity does not verify, cosign runs again accepting any identity, so a valid signature by somebody else yields signature.valid = pass and signature.identity = fail rather than a generic failure.

Consequences

  • Any workflow in the repository that runs on a matching tag can produce an accepted signature. Repository protections (who may push tags, which workflows exist) are part of the trust model; the verification guide says so.
  • Consumers who verify by hand should use the regular expression the platform shows in GET /api/v1/digests/{digest}/verify-instructions.