fix(release): publish keyless signing certificate #40

Merged

ochenstarik-ui merged 2 commits from hermes/release-alpha14 into main

2026-08-15 06:23:14 +00:00

ochenstarik-ui commented

2026-08-13 07:29:38 +00:00

(Migrated from github.com)

Summary

publish the keyless Cosign signing certificate beside the manifest signature
require manifest, signature and certificate in bootstrap and Desktop production consumers
pin GitHub Actions issuer and the release workflow identity while keeping the local test-key bypass isolated
preserve alpha.8 legacy compatibility and alpha.13 checksum normalization
advance immutable correction release sources to alpha.14 and document alpha.13

Evidence

bootstrap manifest suite: PASS (valid test key, tamper, missing signature, missing certificate, legacy strict/bypass)
release contract: PASS
actionlint: PASS
staged-index ShellCheck: PASS
Bash syntax and git diff --cached --check: PASS
Desktop tests: local .NET SDK unavailable; required GitHub CI must compile and run them

Sequencing

No alpha.14 tag exists. The Release pipeline will be dispatched on this branch and must pass before an immutable tag is created.

## Summary - publish the keyless Cosign signing certificate beside the manifest signature - require manifest, signature and certificate in bootstrap and Desktop production consumers - pin GitHub Actions issuer and the release workflow identity while keeping the local test-key bypass isolated - preserve alpha.8 legacy compatibility and alpha.13 checksum normalization - advance immutable correction release sources to alpha.14 and document alpha.13 ## Evidence - bootstrap manifest suite: PASS (valid test key, tamper, missing signature, missing certificate, legacy strict/bypass) - release contract: PASS - actionlint: PASS - staged-index ShellCheck: PASS - Bash syntax and `git diff --cached --check`: PASS - Desktop tests: local .NET SDK unavailable; required GitHub CI must compile and run them ## Sequencing No alpha.14 tag exists. The Release pipeline will be dispatched on this branch and must pass before an immutable tag is created.