Add Cosign keyless signing for Harbor release artifacts #22578

Aloui-Ikram · 2025-11-18T23:11:15Z

This PR added Cosign keyless signing for Harbor release artifacts to verify integrity and provenance of binaries.

Key Changes:

Integrated Cosign keyless signing using GitHub OIDC tokens
Automatic signing for offline and online installers
Updated build and release workflows to handle .bundle signature files
Added signature verification documentation
Fixed duplicate flag issue in make/pushimage.sh

Testing & Verification

I have successfully tested these changes in a fork. https://github.com/Aloui-Ikram/harbor/releases/tag/v2.15.0-test-v2

1. Successful Workflow Execution
The Publish Release workflow successfully identifies the signed bundles and processes them alongside the main packages.

2. Verified Release Assets
The final release includes the .bundle files (verifiable signatures) alongside the offline and online installers.

Issue being fixed

Fixes #22367, #21156

Please indicate you've done the following:

Well Written Title and Summary of the PR
Label the PR as needed. "release-note/infra , needs/follow-up , target/2.15.0"
Accepted the DCO. Commits without the DCO will delay acceptance.
Made sure tests are passing and test coverage is added if needed.
Considered the docs impact and opened a new docs issue or PR with docs changes if needed in website repository.

bupd

@Aloui-Ikram Thanks for your contribution, I have added suggestions for improvements.

.github/workflows/build-package.yml

bupd · 2025-11-23T18:35:24Z

I would also suggest to cleanup and squash your commits. 51 commits might be way too much for this change.

also remove redundant commits
Do a release on your forked repo. so i can verify the signed artifacts.

Thanks for picking this up. this has been sitting in my backlog for a while.

reasonerjt · 2025-11-24T08:43:29Z

@Aloui-Ikram

This was on my to-do list, but thanks for taking it over.
I'll double-check the PR. Ping me when it's ready.

bupd · 2025-11-24T15:49:26Z

@Aloui-Ikram can you remove the WIP from PR title.

@reasonerjt here is the release artifacats which you can take a look. https://github.com/Aloui-Ikram/harbor/releases/tag/v2.15.0-test-v2

Signed-off-by: dulanting <[email protected]> Signed-off-by: Aloui-Ikram <[email protected]> Add unit test for DeleteManifest method in TencentCR adapter (goharbor#22537) Added test case Signed-off-by: Anurag Ojha <[email protected]> Signed-off-by: Aloui-Ikram <[email protected]> disable land tag in the backend storage (goharbor#22507) According to the gc performance proposal, harbor will skip to write the tag file into the data storage since we already use the harbor database to manage the tag CRUD. Proposal: goharbor/community#265 fixed goharbor#22405 Signed-off-by: wang yan <[email protected]> Co-authored-by: wang yan <[email protected]> Signed-off-by: Aloui-Ikram <[email protected]>

…uild-package workflow Signed-off-by: Aloui-Ikram <[email protected]> feat(ci): Implement Cosign keyless signing for release artifacts (goharbor#22367) Signed-off-by: Aloui-Ikram <[email protected]> fix: Use GitHub-hosted runner for fork testing Signed-off-by: Aloui-Ikram <[email protected]> fix: Revert Makefile changes to fix build error Signed-off-by: Aloui-Ikram <[email protected]> feat(ci): Implement Cosign keyless signing for release artifacts in build-package workflow Signed-off-by: Aloui-Ikram <[email protected]> fix(ci): Debugging and fallback for Docker image tag in Build Package Signed-off-by: Aloui-Ikram <[email protected]> fix(ci): Comment out Docker image publishing for fork testing Signed-off-by: Aloui-Ikram <[email protected]> fix(ci): Correct COSIGN_REPOSITORY format for GHCR Signed-off-by: Aloui-Ikram <[email protected]> fix(ci): Hardcode COSIGN_REPOSITORY for direct GHCR path Signed-off-by: Aloui-Ikram <[email protected]> fix(ci): Hardcode COSIGN_REPOSITORY for direct GHCR path Signed-off-by: Aloui-Ikram <[email protected]> fix(ci): Hardcode COSIGN_REPOSITORY for direct GHCR path Signed-off-by: Aloui-Ikram <[email protected]> fix(ci): Hardcode COSIGN_REPOSITORY for direct GHCR path Signed-off-by: Aloui-Ikram <[email protected]> fix(ci): Change runner to ubuntu-latest for fork compatibility Signed-off-by: Aloui-Ikram <[email protected]> fix(ci): Change runner to ubuntu-latest for fork compatibility Signed-off-by: Aloui-Ikram <[email protected]> fix(ci): Change runner to ubuntu-latest for fork compatibility Signed-off-by: Aloui-Ikram <[email protected]> Fix: Uncomment AWS credentials and restore runner configuration Signed-off-by: Aloui-Ikram <[email protected]> fix(ci): Adjust Build Base Image condition for fork testing without get-changed-files Signed-off-by: Aloui-Ikram <[email protected]> fix(ci): Adjust Build Base Image condition for fork testing without get-changed-files Signed-off-by: Aloui-Ikram <[email protected]> fix(ci): Adjust Build Base Image condition for fork testing without get-changed-files Signed-off-by: Aloui-Ikram <[email protected]> fix(ci): Adjust Build Base Image condition for fork testing without get-changed-files Signed-off-by: Aloui-Ikram <[email protected]> fix(ci): Adjust Build Base Image condition for fork testing without get-changed-files Signed-off-by: Aloui-Ikram <[email protected]> fix: Prevent Docker image pushing in fork Signed-off-by: Aloui-Ikram <[email protected]> fix: Skip S3 upload and base image push for fork testing - Set BUILD_BASE=false to prevent pushing to goharbor namespace - Comment out AWS S3 uploader calls (no access to harbor-releases bucket) - Comment out publishImage (no Docker Hub push permissions) - Keep Cosign signing and GitHub artifact upload working - Use larger runner for faster builds Signed-off-by: Aloui-Ikram <[email protected]> fix: Skip S3 upload and base image push for fork testing - Set BUILD_BASE=false to prevent pushing to goharbor namespace - Comment out AWS S3 uploader calls (no access to harbor-releases bucket) - Comment out publishImage (no Docker Hub push permissions) - Keep Cosign signing and GitHub artifact upload working Signed-off-by: Aloui-Ikram <[email protected]> fix: Skip S3 upload and base image push for fork testing - Set BUILD_BASE=false to prevent pushing to goharbor namespace - Comment out AWS S3 uploader calls (no access to harbor-releases bucket) - Comment out publishImage (no Docker Hub push permissions) - Keep Cosign signing and GitHub artifact upload working Signed-off-by: Aloui-Ikram <[email protected]> fix: Complete Cosign signing implementation - Add sign_artifacts Makefile target - Update README with verification instructions - Add comprehensive signature-verification.md guide Signed-off-by: Aloui-Ikram <[email protected]> fix: Complete Cosign signing implementation - Add sign_artifacts Makefile target - Update README with verification instructions - Add comprehensive signature-verification.md guidee Signed-off-by: Aloui-Ikram <[email protected]> fix: Complete Cosign signing implementation - Add sign_artifacts Makefile target - Update README with verification instructions - Add comprehensive signature-verification.md guidee Signed-off-by: Aloui-Ikram <[email protected]> fix: Complete Cosign signing implementation - Add sign_artifacts Makefile target - Update README with verification instructions - Add comprehensive signature-verification.md guidee Signed-off-by: Aloui-Ikram <[email protected]> feat: Complete Cosign keyless signing implementation Signed-off-by: Aloui-Ikram <[email protected]> fix: Override Docker namespace in CI for fork to enable base image push Signed-off-by: Aloui-Ikram <[email protected]> fix: Override IMAGENAMESPACE and BASEIMAGENAMESPACE in CI to fix Docker Hub permissions Signed-off-by: Aloui-Ikram <[email protected]> fix: Pass explicit AWS region to S3 upload command in build_util.sh to resolve AccessDenied errors Signed-off-by: Aloui-Ikram <[email protected]> fix: Complete unfinished function block in build_util.sh to fix CI syntax error. Signed-off-by: Aloui-Ikram <[email protected]> fix: Complete unfinished function block in build_util.sh to fix CI syntax error. Signed-off-by: Aloui-Ikram <[email protected]> fix: Corrected variable assignments in build_util.sh uploader to resolve empty file path S3 error. Signed-off-by: Aloui-Ikram <[email protected]> Fix: Artifact upload to custom S3 bucket Signed-off-by: Aloui-Ikram <[email protected]> Fix: Docker image cleanup error in pushimage.sh Signed-off-by: Aloui-Ikram <[email protected]> Add bundle upload to S3 Signed-off-by: Aloui-Ikram <[email protected]> Add bundle upload to S3 Signed-off-by: Aloui-Ikram <[email protected]> update readme and Signature Verification files Signed-off-by: Aloui-Ikram <[email protected]> Add Cosign keyless signing for Harbor release artifacts - Add Cosign installation and signing steps to build workflow - Sign both offline and online installers with keyless signing - Upload signature bundles to S3 for verification - Add GitHub Actions artifacts backup - Fix bug in pushimage.sh (duplicate -f flag) - Add comprehensive verification documentation - Addresses issue goharbor#22367 Signed-off-by: Aloui-Ikram <[email protected]> Add Cosign keyless signing for Harbor release artifacts - Add Cosign installation and signing steps to build workflow - Sign both offline and online installers with keyless signing - Upload signature bundles to S3 for verification - Add GitHub Actions artifacts backup - Fix bug in pushimage.sh (duplicate -f flag) - Add comprehensive verification documentation - Addresses issue goharbor#22367 Signed-off-by: Aloui-Ikram <[email protected]> Add Cosign keyless signing for Harbor release artifacts - Add Cosign installation and signing steps to build workflow - Generate signature bundles for offline and online installers - Upload signature bundles to S3 alongside installers - Add GitHub Actions artifacts backup with 90-day retention - Fix duplicate -f flag in pushimage.sh and modernize Docker cleanup - Add comprehensive signature verification documentation - Update README with verification quick start section Addresses goharbor#22367 Signed-off-by: Aloui-Ikram <[email protected]>

Signed-off-by: Aloui-Ikram <[email protected]> Remove unnecessary file changes Signed-off-by: Aloui-Ikram <[email protected]> Remove unintended file changes Signed-off-by: Aloui-Ikram <[email protected]> ci: upload signed bundle files to release assets and removed the redundant upload to GitHub artifacts step Signed-off-by: Aloui-Ikram <[email protected]>

…igning Signed-off-by: Aloui-Ikram <[email protected]>

codecov · 2025-11-26T11:24:14Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 65.85%. Comparing base (c8c11b4) to head (676e9f8).
⚠️ Report is 598 commits behind head on main.

Additional details and impacted files

@@             Coverage Diff             @@
##             main   #22578       +/-   ##
===========================================
+ Coverage   45.36%   65.85%   +20.48%     
===========================================
  Files         244     1073      +829     
  Lines       13333   116095   +102762     
  Branches     2719     2931      +212     
===========================================
+ Hits         6049    76455    +70406     
- Misses       6983    35399    +28416     
- Partials      301     4241     +3940

Flag	Coverage Δ
unittests	`65.85% <ø> (+20.48%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 987 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

…acts

Aloui-Ikram · 2025-11-28T11:03:19Z

@Aloui-Ikram

This was on my to-do list, but thanks for taking it over. I'll double-check the PR. Ping me when it's ready.
@reasonerjt Thank you. The PR is ready for your review.

bupd

@Aloui-Ikram Added a few more suggestions.

Also please do mark the comments as resolved after fixing it.

Thanks

README.md

docs/signature-verification.md

bupd · 2025-12-02T12:59:33Z

@Aloui-Ikram please add fix #21156 to the pr description so this PR tracks that issue too.

Co-authored-by: Prasanth Baskar <[email protected]> Signed-off-by: Ikram ALOUI <[email protected]>

Updated version numbers in signature verification documentation from v2.14.0 to v2.15.0. Signed-off-by: Ikram ALOUI <[email protected]>

Signed-off-by: Ikram ALOUI <[email protected]>

bupd

/lgtm

Aloui-Ikram requested a review from a team as a code owner November 18, 2025 23:11

github-actions bot assigned MinerYang, stonezdj and Vad1mo Nov 18, 2025

Aloui-Ikram force-pushed the feature/cosign-keyless-signing-release-artifacts branch 8 times, most recently from 71af39b to 0b5f8ad Compare November 19, 2025 18:56

bupd suggested changes Nov 23, 2025

View reviewed changes

.github/workflows/build-package.yml Outdated Show resolved Hide resolved

reasonerjt self-assigned this Nov 24, 2025

reasonerjt added the needs/follow-up label Nov 24, 2025

dulanting and others added 4 commits November 24, 2025 20:32

fix release permissions and ensure latest installers uploaded after s…

fe4d074

…igning Signed-off-by: Aloui-Ikram <[email protected]>

Aloui-Ikram force-pushed the feature/cosign-keyless-signing-release-artifacts branch from c02d520 to fe4d074 Compare November 24, 2025 19:39

Aloui-Ikram changed the title ~~[WIP] Add Cosign keyless signing for Harbor release artifacts~~ Add Cosign keyless signing for Harbor release artifacts Nov 25, 2025

wy65701436 added release-note/infra Infra related changes e.g. release, test, ship etc... target/2.15.0 labels Nov 26, 2025

Merge branch 'main' into feature/cosign-keyless-signing-release-artif…

f773191

…acts

bupd suggested changes Dec 2, 2025

View reviewed changes

README.md Outdated Show resolved Hide resolved

docs/signature-verification.md Outdated Show resolved Hide resolved

bupd mentioned this pull request Dec 2, 2025

No .asc files with release v2.12.0 #21156

Open

Aloui-Ikram and others added 2 commits December 2, 2025 14:13

Update README.md

9777195

Co-authored-by: Prasanth Baskar <[email protected]> Signed-off-by: Ikram ALOUI <[email protected]>

Update docs/signature-verification.md

676e9f8

Co-authored-by: Prasanth Baskar <[email protected]> Signed-off-by: Ikram ALOUI <[email protected]>

OrlinVasilev mentioned this pull request Dec 2, 2025

Missing .asc signature files in latest release assets #22367

Open

Vad1mo approved these changes Dec 2, 2025

View reviewed changes

Aloui-Ikram added 2 commits December 3, 2025 08:47

Update signature verification documentation for v2.15.0

8818b1e

Updated version numbers in signature verification documentation from v2.14.0 to v2.15.0. Signed-off-by: Ikram ALOUI <[email protected]>

update Verifying Release Signatures

0f52dff

Signed-off-by: Ikram ALOUI <[email protected]>

bupd approved these changes Dec 5, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add Cosign keyless signing for Harbor release artifacts #22578

Add Cosign keyless signing for Harbor release artifacts #22578

Uh oh!

Aloui-Ikram commented Nov 18, 2025 •

edited

Loading

Uh oh!

bupd left a comment

Uh oh!

Uh oh!

bupd commented Nov 23, 2025

Uh oh!

reasonerjt commented Nov 24, 2025

Uh oh!

bupd commented Nov 24, 2025

Uh oh!

codecov bot commented Nov 26, 2025 •

edited

Loading

Uh oh!

Aloui-Ikram commented Nov 28, 2025

Uh oh!

bupd left a comment

Uh oh!

Uh oh!

Uh oh!

bupd commented Dec 2, 2025

Uh oh!

bupd left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

Add Cosign keyless signing for Harbor release artifacts #22578

Are you sure you want to change the base?

Add Cosign keyless signing for Harbor release artifacts #22578

Uh oh!

Conversation

Aloui-Ikram commented Nov 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Testing & Verification

Issue being fixed

Uh oh!

bupd left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

bupd commented Nov 23, 2025

Uh oh!

reasonerjt commented Nov 24, 2025

Uh oh!

bupd commented Nov 24, 2025

Uh oh!

codecov bot commented Nov 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Aloui-Ikram commented Nov 28, 2025

Uh oh!

bupd left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

bupd commented Dec 2, 2025

Uh oh!

bupd left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

Aloui-Ikram commented Nov 18, 2025 •

edited

Loading

codecov bot commented Nov 26, 2025 •

edited

Loading