fix: support cosign v3 negative verification for alpha.18 #56

Merged

ochenstarik-ui merged 1 commit from codex/release-alpha18-cosign-negative-test into main

2026-08-17 17:39:46 +00:00

ochenstarik-ui commented

2026-08-17 17:26:06 +00:00

(Migrated from github.com)

Summary

select cosign v3's explicit detached-output mode in the wrong-identity negative test
retain the production detached signature/certificate verification contract
burn immutable alpha.17 in release history and prepare alpha.18

Evidence

Alpha.17 automatic Release Verification completed the clean-host positive Hub and Node installation. Negative tests 1-3 passed; test 4 failed while constructing its fixture because cosign v3 requires either --bundle or explicit legacy detached mode. The harness now uses --use-signing-config=false --new-bundle-format=false with the pinned cosign v3.1.3.

Verification

git diff --check passed
shell execution is delegated to Linux CI because local Git Bash is blocked by a Windows CreateFileMapping access-denied error

Physical multi-server verification remains outside CI scope.

## Summary - select cosign v3's explicit detached-output mode in the wrong-identity negative test - retain the production detached signature/certificate verification contract - burn immutable alpha.17 in release history and prepare alpha.18 ## Evidence Alpha.17 automatic Release Verification completed the clean-host positive Hub and Node installation. Negative tests 1-3 passed; test 4 failed while constructing its fixture because cosign v3 requires either `--bundle` or explicit legacy detached mode. The harness now uses `--use-signing-config=false --new-bundle-format=false` with the pinned cosign v3.1.3. ## Verification - `git diff --check` passed - shell execution is delegated to Linux CI because local Git Bash is blocked by a Windows CreateFileMapping access-denied error Physical multi-server verification remains outside CI scope.