feat(selfupdate): keyless cosign signing in release + verify-on-update

[gustavobertoi]

What

Wires keyless cosign (sigstore) signing into the release pipeline and adds cosign signature verification to the self update flow — closing the "signature verification is mandatory" gap in spec 14, now that release signing exists (spec 25).

Release pipeline (signing)

• .github/workflows/release.yml: adds id-token: write permission and a sigstore/cosign-installer@v3 step. Keyless signing uses the job's GitHub OIDC token — no long-lived private key.
• .goreleaser.yaml: new signs: block runs cosign sign-blob --yes over checksums.txt (the root of the integrity chain), publishing checksums.txt.sig (signature) + checksums.txt.pem (Fulcio certificate) as release assets.

Verify-on-update (internal/selfupdate)

• New Verifier interface (verify.go) shelling cosign verify-blob, pinning --certificate-identity-regexp to the release.yml workflow identity and --certificate-oidc-issuer to https://token.actions.githubusercontent.com.
• downloadBinary now verifies the checksums.txt signature before trusting any per-archive SHA-256 line; SHA-256 remains enforced in all cases.
• --insecure-skip-verify escape hatch, default verify-on. Keeps the existing IsDevBuild + package-manager CanSelfReplace refusals.

Why

Auto-updating a binary that drives Docker, edits /etc/hosts, and installs a root CA is a supply-chain target — an altered/unsigned release must be refused, not warned-and-installed (spec 14). The signing side (spec 25) had been deferred; this connects both ends.

Default behavior (honest note)

Signature verification is ON by default and requires the cosign binary. When cosign is absent, the update aborts with a remediation (install cosign, or re-run with --insecure-skip-verify) rather than silently degrading. --insecure-skip-verify bypasses only the cosign check — SHA-256 is still enforced, so it never drops to "no integrity check".

How tested

internal/selfupdate table-driven tests (fake verifier, no network):

• signature-verify happy path (verifier handed the exact checksums.txt bytes + published .sig/.pem)
• tamper detection (bad signature aborts)
• verify-runs-before-checksum ordering
• cosign-unavailable abort (names cosign + the escape hatch)
• missing-signature-asset abort
• --insecure-skip-verify bypass (SHA-256 still fails a tampered archive)
• release.yml YAML parses and declares id-token: write + installs cosign

Gates green: CGO_ENABLED=0 go build ./..., CGO_ENABLED=1 go test ./internal/..., gofmt -l clean, go vet ./.... No internal/generate/templates/ changes, so determinism is unaffected.

🤖 Generated with Claude Code