public/runner-image
Watch
4
0
Fork
You've already forked runner-image
 0
Code Issues Pull requests Projects Packages 1 Activity Actions

Bake the Tilo OS release signer into the runner image #2

Merged
qwolff merged 1 commit from tilo-release-signer into main 2026-09-25 00:26:38 +00:00
Conversation 0 Commits 1 Files changed 8 +722
qwolff commented 2026-09-25 00:26:30 +00:00
Owner
Copy link

Adds a checksum-pinned AWS CLI v2 (2.37.2, AWS-signed archives verified against key FB5DB77FD5C118B80511ADA8A6310ACC4672475C) and the root-owned Tilo OS release signer at /usr/local/libexec/tilo-release-signer/tilo-release-signer.

The signer implements the qos/qos TILO_PCR_PREDICTION_SIGNER contract used by os/dev/sign-target-prediction.sh:

  • sign-sha256-rsa-pkcs1: aws kms sign --message-type DIGEST --signing-algorithm RSASSA_PKCS1_V1_5_SHA_256 with alias/tilo-pcr-prediction
  • sign-efi: deterministic Authenticode (no timestamp), byte-identical to tilo-crypto sign-efi, signed by alias/tilo-efi-signing
  • export-efi-cert: the Tilo OS release EFI certificate (self-signed through KMS)

Credentials come from the job's Forgejo OIDC token (audience tilo-release-signing) exchanged for TiloForgejoReleaseSigner in a clean environment, the same way os/dev/configure-cosign-kms.sh configures Cosign. Key ARNs and public identities are root-owned image files, and every KMS signature is verified against them before it is written.

Verified locally: real KMS signatures verify with tilo-crypto verify-efi / verify-rsa-sha256, repeated EFI signing is byte-identical, and the envelope check verify-authenticode-envelope.py passes. The offline test suite runs during the image build.

🤖 Generated with Claude Code

Adds a checksum-pinned AWS CLI v2 (2.37.2, AWS-signed archives verified against key FB5DB77FD5C118B80511ADA8A6310ACC4672475C) and the root-owned Tilo OS release signer at `/usr/local/libexec/tilo-release-signer/tilo-release-signer`. The signer implements the qos/qos `TILO_PCR_PREDICTION_SIGNER` contract used by `os/dev/sign-target-prediction.sh`: - `sign-sha256-rsa-pkcs1`: `aws kms sign --message-type DIGEST --signing-algorithm RSASSA_PKCS1_V1_5_SHA_256` with `alias/tilo-pcr-prediction` - `sign-efi`: deterministic Authenticode (no timestamp), byte-identical to `tilo-crypto sign-efi`, signed by `alias/tilo-efi-signing` - `export-efi-cert`: the Tilo OS release EFI certificate (self-signed through KMS) Credentials come from the job's Forgejo OIDC token (audience `tilo-release-signing`) exchanged for `TiloForgejoReleaseSigner` in a clean environment, the same way `os/dev/configure-cosign-kms.sh` configures Cosign. Key ARNs and public identities are root-owned image files, and every KMS signature is verified against them before it is written. Verified locally: real KMS signatures verify with `tilo-crypto verify-efi` / `verify-rsa-sha256`, repeated EFI signing is byte-identical, and the envelope check `verify-authenticode-envelope.py` passes. The offline test suite runs during the image build. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
Add a checksum-pinned AWS CLI v2 and a root-owned signer at
/usr/local/libexec/tilo-release-signer implementing the qos/qos
TILO_PCR_PREDICTION_SIGNER contract (export-efi-cert, sign-efi,
sign-sha256-rsa-pkcs1). Private keys stay in AWS KMS; credentials come
from the job's Forgejo OIDC token, and key ARNs and public identities
are fixed image files a job cannot redirect. EFI signatures are
deterministic Authenticode without a timestamp. Offline tests with a
local KMS stand-in run during the image build.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
qwolff merged commit 8c037078d9 into main 2026-09-25 00:26:38 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
public/runner-image!2
No description provided.