docs: 📝 openspec change — signed SBOM attestation (release-tools-image) #189

Merged

goern merged 0 commits from openspec/signed-sbom-attestation into main 2026-06-02 13:06:02 +00:00

Conversation 7 Commits - Files changed -

goern commented 2026-06-02 06:15:34 +00:00 (Migrated from codeberg.org)

Copy link

What

OpenSpec change signed-sbom-attestation — aligns the release-tools-image spec with the cosign attest migration that already landed in commit b2619fc (forgejo-mcp-aa6).

Why

The spec requirement "SBOM attached as registry artifact" still mandated the consumer contract:

cosign download sbom <image-ref>

That path is now wrong on two counts:

1. Removed — cosign attach sbom / download sbom are deprecated and gone from current cosign (sigstore/cosign#2755).
2. Unsigned — attach sbom pushed the SBOM as a bare OCI referrer with no signature (supply-chain gap).

The pipeline already moved to a signed in-toto CycloneDX attestation. This change updates the normative spec to match.

Delta (MODIFIED, 1 requirement)

openspec/specs/release-tools-image/spec.md → requirement "SBOM attached as registry artifact":

• SBOM bound via cosign attest --predicate <sbom> --type cyclonedx --key, signed with the image-signing key.
• Retrieval contract → cosign verify-attestation --type cyclonedx --key <cosign.pub> <image-ref> (or cosign download attestation).
• Forbids deprecated cosign attach sbom.

Scope

• Spec-only. The Tekton task (.tekton/release-tools/tasks/cosign-attach-sbom.yaml) and README already match — landed under b2619fc (aa6).
• No code in this PR.

Validation

openspec validate signed-sbom-attestation --strict   # → valid
openspec show signed-sbom-attestation                 # → 1 MODIFIED delta on release-tools-image

After merge

Archive the change and sync openspec/specs/release-tools-image/spec.md (tasks.md step 3.2).

---

Closes forgejo-mcp-3y1. Follow-up from forgejo-mcp-aa6.

## What OpenSpec change `signed-sbom-attestation` — aligns the `release-tools-image` spec with the cosign `attest` migration that already landed in commit `b2619fc` (forgejo-mcp-aa6). ## Why The spec requirement **"SBOM attached as registry artifact"** still mandated the consumer contract: ``` cosign download sbom <image-ref> ``` That path is now wrong on two counts: 1. **Removed** — `cosign attach sbom` / `download sbom` are deprecated and gone from current cosign (sigstore/cosign#2755). 2. **Unsigned** — `attach sbom` pushed the SBOM as a bare OCI referrer with no signature (supply-chain gap). The pipeline already moved to a **signed** in-toto CycloneDX attestation. This change updates the normative spec to match. ## Delta (MODIFIED, 1 requirement) `openspec/specs/release-tools-image/spec.md` → requirement "SBOM attached as registry artifact": - SBOM bound via `cosign attest --predicate <sbom> --type cyclonedx --key`, signed with the image-signing key. - Retrieval contract → `cosign verify-attestation --type cyclonedx --key <cosign.pub> <image-ref>` (or `cosign download attestation`). - Forbids deprecated `cosign attach sbom`. ## Scope - **Spec-only.** The Tekton task (`.tekton/release-tools/tasks/cosign-attach-sbom.yaml`) and README already match — landed under `b2619fc` (aa6). - No code in this PR. ## Validation ``` openspec validate signed-sbom-attestation --strict # → valid openspec show signed-sbom-attestation # → 1 MODIFIED delta on release-tools-image ``` ## After merge Archive the change and sync `openspec/specs/release-tools-image/spec.md` (tasks.md step 3.2). --- Closes forgejo-mcp-3y1. Follow-up from forgejo-mcp-aa6.

op1st-gitops commented 2026-06-02 06:15:42 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/forgejo-mcp-code-scans-45q9p is running.

Starting Pipelinerun forgejo-mcp-code-scans-45q9p in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines forgejo-mcp-code-scans-45q9p -f

op1st Pipelines as Code/forgejo-mcp-code-scans-45q9p is running. Starting Pipelinerun <b>[forgejo-mcp-code-scans-45q9p](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-code-scans-45q9p)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-code-scans-45q9p) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines forgejo-mcp-code-scans-45q9p -f</code>

op1st-gitops commented 2026-06-02 06:15:42 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/forgejo-mcp-openspec-validate-pr-qsghn is running.

Starting Pipelinerun forgejo-mcp-openspec-validate-pr-qsghn in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines forgejo-mcp-openspec-validate-pr-qsghn -f

op1st Pipelines as Code/forgejo-mcp-openspec-validate-pr-qsghn is running. Starting Pipelinerun <b>[forgejo-mcp-openspec-validate-pr-qsghn](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-openspec-validate-pr-qsghn)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-openspec-validate-pr-qsghn) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines forgejo-mcp-openspec-validate-pr-qsghn -f</code>

op1st-gitops commented 2026-06-02 06:15:42 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/forgejo-mcp-on-pull-request-bhtgm is running.

Starting Pipelinerun forgejo-mcp-on-pull-request-bhtgm in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines forgejo-mcp-on-pull-request-bhtgm -f

op1st Pipelines as Code/forgejo-mcp-on-pull-request-bhtgm is running. Starting Pipelinerun <b>[forgejo-mcp-on-pull-request-bhtgm](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-on-pull-request-bhtgm)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-on-pull-request-bhtgm) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines forgejo-mcp-on-pull-request-bhtgm -f</code>

op1st-gitops commented 2026-06-02 06:16:11 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/forgejo-mcp-code-scans-45q9p has successfully validated your commit.

• Namespace: op1st-pipelines
• PipelineRun: forgejo-mcp-code-scans-45q9p

---

Task Statuses:

Status	Duration	Name
Succeeded	15 seconds	fetch-source
Succeeded	9 seconds	gitleaks-version
Succeeded	13 seconds	gitleaks

op1st Pipelines as Code/forgejo-mcp-code-scans-45q9p has <b>successfully</b> validated your commit. <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-code-scans-45q9p">forgejo-mcp-code-scans-45q9p</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>15 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-code-scans-45q9p/logs/fetch-source) </td></tr> <tr> <td>Succeeded</td> <td>9 seconds</td><td> [gitleaks-version](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-code-scans-45q9p/logs/gitleaks-version) </td></tr> <tr> <td>Succeeded</td> <td>13 seconds</td><td> [gitleaks](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-code-scans-45q9p/logs/gitleaks) </td></tr> </table>

op1st-gitops commented 2026-06-02 06:16:13 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/forgejo-mcp-openspec-validate-pr-qsghn has successfully validated your commit.

• Namespace: op1st-pipelines
• PipelineRun: forgejo-mcp-openspec-validate-pr-qsghn

---

Task Statuses:

Status	Duration	Name
Succeeded	15 seconds	fetch-source
Succeeded	15 seconds	validate

op1st Pipelines as Code/forgejo-mcp-openspec-validate-pr-qsghn has <b>successfully</b> validated your commit. <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-openspec-validate-pr-qsghn">forgejo-mcp-openspec-validate-pr-qsghn</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>15 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-openspec-validate-pr-qsghn/logs/fetch-source) </td></tr> <tr> <td>Succeeded</td> <td>15 seconds</td><td> [validate](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-openspec-validate-pr-qsghn/logs/validate) </td></tr> </table>

op1st-gitops commented 2026-06-02 06:18:10 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/forgejo-mcp-on-pull-request-bhtgm has successfully validated your commit.

• Namespace: op1st-pipelines
• PipelineRun: forgejo-mcp-on-pull-request-bhtgm

---

Task Statuses:

Status	Duration	Name
Succeeded	12 seconds	fetch-source
Succeeded	2 minutes	build-and-test
Succeeded	15 seconds	commit-title-check

op1st Pipelines as Code/forgejo-mcp-on-pull-request-bhtgm has <b>successfully</b> validated your commit. <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-on-pull-request-bhtgm">forgejo-mcp-on-pull-request-bhtgm</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>12 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-on-pull-request-bhtgm/logs/fetch-source) </td></tr> <tr> <td>Succeeded</td> <td>2 minutes</td><td> [build-and-test](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-on-pull-request-bhtgm/logs/build-and-test) </td></tr> <tr> <td>Succeeded</td> <td>15 seconds</td><td> [commit-title-check](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-on-pull-request-bhtgm/logs/commit-title-check) </td></tr> </table>

goern commented 2026-06-02 12:51:56 +00:00 (Migrated from codeberg.org)

Copy link

This PR delivers the OpenSpec change only — proposal, design, specs, and tasks. It does not implement any code and does not close any issues. Implementation and issue closure happen in follow-up PRs.

This PR **delivers the OpenSpec change only** — proposal, design, specs, and tasks. It does **not** implement any code and does **not** close any issues. Implementation and issue closure happen in follow-up PRs.

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

Compat/Breaking

Breaking change that won't be backward compatible

  

Kind/Bug

Something is not working

  

Kind/Documentation

Documentation changes

  

Kind/Enhancement

Improve existing functionality

  

Kind/Feature

New functionality

  

Kind/OpenSpec

OpenSpec change proposal / spec-driven work

  

Kind/Security

This is security issue

  

Kind/Testing

Issue or pull request related to testing

  

Priority/Critical

The priority is critical

  

Priority/High

The priority is high

  

Priority/Low

The priority is low

  

Priority/Medium

The priority is medium

  

RFC - Request For Comments

Request For Comments — design/spec open for feedback before implementation

  

Reviewed/Confirmed

Issue has been confirmed

  

Reviewed/Duplicate

This issue or pull request already exists

  

Reviewed/Invalid

Invalid issue

  

Reviewed/Won't Fix

This issue won't be fixed

  

Status/Abandoned

Somebody has started to work on this but abandoned work

  

Status/Blocked

Something is blocking this issue or pull request

  

Status/Need More Info

Feedback is required to reproduce issue or to continue work

  

hermes-attempted

Hermes attempted but produced no changes

  

hermes-needs-clarification

Quality gate flagged, needs human input

  

hermes-ready

Ready for hermes to process

  

hermes-review

Hermes PR awaiting review

  

hermes-wip

Hermes is working on this

  

human-required

Hermes gave up after 3 attempts

No labels

Compat/Breaking

Kind/Bug

Kind/Documentation

Kind/Enhancement

Kind/Feature

Kind/OpenSpec

Kind/Security

Kind/Testing

Priority/Critical

Priority/High

Priority/Low

Priority/Medium

RFC - Request For Comments

Reviewed/Confirmed

Reviewed/Duplicate

Reviewed/Invalid

Reviewed/Won't Fix

Status/Abandoned

Status/Blocked

Status/Need More Info

hermes-attempted

hermes-needs-clarification

hermes-ready

hermes-review

hermes-wip

human-required

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

agentic-forges/forgejo-mcp!189

No description provided.