Verify a release

Every SkelaDB release is signed with one SkelaDB release key. Verify the files you download and the images your cluster runs before you trust them. You need cosign 2.x, or OpenSSL for the files alone.

1. The release key

The public key is published once for all releases:

curl -fsSLO https://skeladb.com/releases/cosign.pub
sha256sum cosign.pub        # macOS: shasum -a 256 cosign.pub

The SHA-256 of cosign.pub must be:

RELEASE-KEY-FINGERPRINT-NOT-YET-PUBLISHED

If the line above is not a 64-character hexadecimal fingerprint, or does not match, stop: do not install, and write to security@skeladb.com. To check the fingerprint through a second channel, ask security@skeladb.com to confirm it. Every release also publishes a copy of cosign.pub beside its files; it must be identical.

If the key is ever replaced, the new fingerprint is published here and in the release notes, and releases signed with the old key are listed.

2. The downloads

Each release lives at https://skeladb.com/releases/<version>/:

File	What it is
`skeladb-<version>.tar.gz`	Installer, manifests, `release.env`, license and notices
`release.env`, `digests.txt`, `manifest.json`	Every image by digest, also inside the tarball
`skela-<os>-<arch>`, `skela-mcp-<os>-<arch>`	CLI and agent server binaries
`<image>.<arch>.spdx.json`, `.cdx.json`, `.provenance.json`	SBOMs and build provenance per image and architecture
`LICENSE`, `THIRD-PARTY-NOTICES-*.txt`	License agreement and third-party notices
`SHA256SUMS`	SHA-256 of every file above
`SHA256SUMS.cosign.bundle`, `SHA256SUMS.sig`	Signature of the checksum list
`<file>.sig`, `<file>.cosign.bundle`	Signature of each individual file
`cosign.pub`	The release key

Verify the checksum list, then the files against it:

V=0.0.1; R=https://skeladb.com/releases/$V
for f in SHA256SUMS SHA256SUMS.cosign.bundle SHA256SUMS.sig skeladb-$V.tar.gz; do curl -fsSLO "$R/$f"; done
cosign verify-blob --key cosign.pub --bundle SHA256SUMS.cosign.bundle SHA256SUMS
sha256sum -c SHA256SUMS --ignore-missing      # macOS: shasum -a 256 -c SHA256SUMS --ignore-missing

cosign verify-blob must print Verified OK and every file you downloaded must print OK. A single file can also be checked on its own: cosign verify-blob --key cosign.pub --bundle <file>.cosign.bundle <file>.

Without cosign, OpenSSL checks the same signature:

base64 -d SHA256SUMS.sig > SHA256SUMS.sig.der
openssl dgst -sha256 -verify cosign.pub -signature SHA256SUMS.sig.der SHA256SUMS

It must print Verified OK.

After extracting the tarball, check that its release.env is identical to the verified top-level one (cmp release.env skeladb-$V/release.env).

3. The images

digests.txt lists every image as <registry>/<image>@sha256:<digest>. Each image index is signed, including its per-architecture images:

while read -r image; do
  cosign verify --key cosign.pub "$image" > /dev/null && echo "verified $image"
done < digests.txt

Each per-architecture image also carries signed attestations: an SPDX SBOM, a CycloneDX SBOM and SLSA build provenance. The per-architecture digests are in manifest.json:

jq -r '.images[] | .reference as $r | .platforms | to_entries[] | "\($r)@\(.value)"' manifest.json |
  while read -r image; do
    cosign verify-attestation --key cosign.pub --type spdxjson "$image" > /dev/null &&
    cosign verify-attestation --key cosign.pub --type cyclonedx "$image" > /dev/null &&
    cosign verify-attestation --key cosign.pub --type slsaprovenance1 "$image" > /dev/null &&
    echo "attested $image"
  done

Signatures and attestations are also recorded in the public Rekor transparency log, which cosign checks by default.

If you mirror images into your own registry, copy them by digest with their signatures (for example cosign copy), and verify the mirrored references the same way: the digests must not change.

4. Enforce it in the cluster

To admit only signed SkelaDB images, use an admission controller that checks cosign signatures, for example the Sigstore policy-controller:

apiVersion: policy.sigstore.dev/v1beta1
kind: ClusterImagePolicy
metadata:
  name: skeladb-release
spec:
  images:
    - glob: "<registry>/**"        # the registry in digests.txt, or your mirror
  authorities:
    - key:
        data: |
          <contents of cosign.pub>

Label the skela and skela-cloud namespaces for the policy-controller and test it with an unsigned image before relying on it.

5. What signing does not tell you

A valid signature proves the files and images were published by SkelaDB and not changed since. It does not replace your own vulnerability scanning; scan the SBOMs or images with your usual tools.