ci: sign releases and document verification

[WilliamBerryiii]

Documentation Location

CONTRIBUTING.md, docs/releases.md, .github/workflows/

Issue Description

Background

OpenSSF Best Practices (Silver) requirement signed_releases requires that releases be signed and verification instructions be provided. This helps users verify:

1. The release came from the project maintainers
2. The release hasn't been tampered with
3. The integrity of downloaded artifacts

Current State

Component	Status
Release signing	❌ Not implemented
Verification instructions	❌ Missing
GitHub releases	⚠️ May not be used yet
Checksums	❌ Not published

Evidence

• No release signing process documented
• No checksums published with releases
• No verification instructions in documentation
• OpenSSF Silver requirement: signed_releases

Suggested Fix

1. Implement release signing with Sigstore/cosign

For modern signing without key management complexity:

# .github/workflows/release.yml
name: Release

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write
  id-token: write  # For Sigstore

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Create release archive
        run: |
          git archive --format=tar.gz --prefix=release-${{ github.ref_name }}/ -o release-${{ github.ref_name }}.tar.gz HEAD
          
      - name: Install cosign
        uses: sigstore/cosign-installer@v3
        
      - name: Sign release
        run: |
          cosign sign-blob --yes --output-signature release-${{ github.ref_name }}.tar.gz.sig \
            --output-certificate release-${{ github.ref_name }}.tar.gz.pem \
            release-${{ github.ref_name }}.tar.gz
            
      - name: Create checksums
        run: |
          sha256sum release-${{ github.ref_name }}.tar.gz > release-${{ github.ref_name }}.tar.gz.sha256
          
      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          files: |
            release-${{ github.ref_name }}.tar.gz
            release-${{ github.ref_name }}.tar.gz.sig
            release-${{ github.ref_name }}.tar.gz.pem
            release-${{ github.ref_name }}.tar.gz.sha256

2. Document verification process

Add to README.md or docs/releases.md:

## Verifying Releases

### Using Cosign (Recommended)

```bash
# Install cosign: https://docs.sigstore.dev/cosign/installation/

# Verify signature
cosign verify-blob --signature release-vX.X.X.tar.gz.sig \
  --certificate release-vX.X.X.tar.gz.pem \
  --certificate-identity-regexp "https://github.com/Azure-Samples/azure-nvidia-robotics-reference-architecture" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  release-vX.X.X.tar.gz

Using Checksums

# Verify SHA256 checksum
sha256sum -c release-vX.X.X.tar.gz.sha256

What Verification Confirms

• ✅ Release was created by GitHub Actions in this repository
• ✅ Release archive hasn't been modified
• ✅ Release corresponds to a valid git tag

### 3. Alternative: GPG signing

If Sigstore isn't preferred, use GPG:

```yaml
- name: Sign with GPG
  run: |
    echo "${{ secrets.GPG_PRIVATE_KEY }}" | gpg --import
    gpg --armor --detach-sign release-${{ github.ref_name }}.tar.gz

Document the public key in the repository.

Acceptance Criteria

• Release workflow implements signing (Sigstore cosign or GPG)
• Signatures are published with each release
• SHA256 checksums are published with each release
• Verification instructions are documented
• Instructions work for common operating systems
• Documentation explains what verification confirms

Dependencies

• GOV-01: Achieve OpenSSF Passing badge (may require releases)

Validation

1. Create a test release and verify signature workflow runs
2. Follow verification instructions as a user would
3. Verify signed artifacts are attached to GitHub release
4. Confirm documentation is accurate and complete

---

OpenSSF IDs: signed_releases

---

Migrated from Azure-Samples/azure-nvidia-robotics-reference-architecture#108

[WilliamBerryiii]

All acceptance criteria are met:

• Release signing: verify-tag-signature.yml workflow verifies Sigstore gitsign signatures on release tags
• Verification instructions: documented in docs/security/release-verification.md, README.md, and CONTRIBUTING.md
• Sigstore keyless signing: configured via gitsign with GitHub OIDC identity

No remaining gaps.