release: attest reproducible binaries with signed provenance - #91

Open

seonghobae wants to merge 13 commits into

release/reproducible-binaries-v1from

release/signed-build-provenance-v1

Commits on Sep 11, 2026

test: require signed release candidate provenance
seonghobae
committed
7517c36
release: attest reproducible binaries
seonghobae
committed
c9d333a
docs: trace signed release candidate provenance
seonghobae
committed
9dcd67b
test: apply release provenance rustfmt
seonghobae
committed
93b6b3f
fix: bind provenance signer to workflow commit
seonghobae
committed
2fa5676
test: distinguish source and signer digests
seonghobae
committed
fdcedce
docs: trace PR signer identity repair
seonghobae
committed
6ab5767
fix: bind provenance to exact certificate identity
seonghobae
committed
36f2766
test: require exact attestation certificate identity
seonghobae
committed
d26e49a
docs: bind provenance to exact workflow SAN
seonghobae
committed
b561214
fix: verify attested source against workflow commit
seonghobae
committed
15aec5d
test: model attested PR source identity correctly
seonghobae
committed
d5055c9
docs: separate checkout and attested PR source identities
seonghobae
committed
bc85547