Create GitHub Artifact Attestations in the release of aqua

[suzuki-shunsuke]

Feature Overview

Create GitHub Artifact Attestations in the release of aqua.

• Look into GitHub Artifact attestations #2972
• https://github.blog/changelog/2024-06-25-artifact-attestations-is-generally-available/
• https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds

Why is the feature needed?

To install aqua securely.

Workaround

We have already signed checksum files using Cosign and have generates SLSA Provenance using slsa-github-generator.

• https://github.com/slsa-framework/slsa-github-generator
• https://github.com/sigstore/cosign

e.g. https://github.com/aquaproj/aqua/releases/tag/v2.34.0

• aqua_2.34.0_checksums.txt.pem
• aqua_2.34.0_checksums.txt.sig
• multiple.intoto.jsonl

So users can install aqua securely using Cosign and slsa-verifier.

https://github.com/slsa-framework/slsa-verifier

And aqua update-aqua and aqua-installer have already used them.

https://github.com/aquaproj/aqua-installer

But GitHub Artifact Attestations still has some benefits.

• The verification command is simpler than Cosign and slsa-verifier
• You don't need to know about Cosign and slsa-verifier
• You don't need to install Cosign and slsa-verifier
• GitHub Artifact Attestations is GitHub's official feature and has the potential to spread

Example Code

No response

Note

slsa-github-generator and GoReleaser don't support GitHub Artifact Attestations natively, but they have issues about it.

• [feature] Comparison to new GitHub Artifact Attestations? slsa-framework/slsa-github-generator#3618
• Support Github Artifact Attestations goreleaser/goreleaser#4852

I think we may create GitHub Artifact Attestations using GitHub CLI in CI easily.

• https://zenn.dev/shunsuke_suzuki/scraps/4809dd473addf9

[suzuki-shunsuke]

• chore(deps): update suzuki-shunsuke/go-release-workflow action to v2 #3124

As of v2.35.0, GitHub Artifact Attestation would be created.