chore(ci): enforce signature verification before Docker builds (#7077)
What the developer wrote
Authored by Abhijay Jain
chore(ci): enforce signature verification before Docker builds (#7077)
* chore(ci): enforce GPG signature verification before Docker builds
Signed-off-by: Abhijay007 <Abhijay007j@gmail.com>
* chore(ci): enforce commit signature verification
Signed-off-by: Abhijay007 <Abhijay007j@gmail.com>
* chore: updated the code
Signed-off-by: Abhijay007 <Abhijay007j@gmail.com>
---------
Signed-off-by: Abhijay007 <Abhijay007j@gmail.com>
What changed, and why it matters
This commit adds a CI safety check that refuses to build Docker images unless the current Git commit has a valid GPG signature. It is a hardening improvement, not a fix for an active vulnerability. There is no indication in the commit or title that it responds to a known security incident.
No immediate action required. Review the verification script for robustness (e.g., handling of 'U'/'B'/'X'/'Y'/'R'/'E' git signature statuses) and ensure CI secrets and GPG trust anchors are managed securely. Consider documenting the GPG key trust policy for release signing.
Security signals we found
GPG signature verification added to CI pipeline before Docker image build/push
Release checklist updated to require signed commits and avoid GitHub UI merges
No product code or cryptographic logic changes; purely CI/release-process hardening
Evidence from the diff
The change introduces .circleci/verify-signed-commit.sh, which runs git log -1 --format='%G?' HEAD and fails the build if the signature status is ‘N’ (no signature). The CircleCI publish-docker job now executes this script before building and pushing Docker images. The release checklist is also updated to remind maintainers to sign commits and not merge via the GitHub UI. This enforces supply-chain integrity for Docker image builds but does not patch any exploitable code path.
Changed components
.circleci/config.yml.circleci/verify-signed-commit.shRELEASE-CHECKLIST.mdInspect captured patch +14 / −0
diff --git a/.circleci/config.yml b/.circleci/config.yml
index 2c54df8..cbd84ec 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -53,6 +53,11 @@ jobs:
- setup_remote_docker
- checkout
- run:
+ name: Verify commit is signed
+ command: |
+ cd .circleci && chmod +x verify-signed-commit.sh && ./verify-signed-commit.sh
+ - run:
+ name: Build and push Docker images
command: |
LATEST_TAG=${CIRCLE_TAG:1} #trim v from tag
GIT_COMMIT=$(git rev-parse HEAD)
diff --git a/.circleci/verify-signed-commit.sh b/.circleci/verify-signed-commit.sh
new file mode 100755
index 0000000..921d47a
--- /dev/null
+++ b/.circleci/verify-signed-commit.sh
@@ -0,0 +1,8 @@
+#!/bin/sh
+set -e
+
+echo "Checking commit signature..."
+if git log -1 --format="%G?" HEAD | grep -q "^N$"; then
+ echo "ERROR: Commit is not signed"
+ exit 1
+fi
diff --git a/RELEASE-CHECKLIST.md b/RELEASE-CHECKLIST.md
index 7f6717d..f60c745 100644
--- a/RELEASE-CHECKLIST.md
+++ b/RELEASE-CHECKLIST.md
@@ -6,5 +6,6 @@ Things to think about when creating a new release:
* Run `PullTransifexTranslations` test.
* Write chanlog in CHANGELOG.md
* Bump version in `Build/Version.csproj`
+* Ensure the commit is signed with GPG (do not merge PRs via GitHub UI)
* Run `publish-docker.ps1`
* When the docker images has been built by CI, copy the changelog for the new version in the github's release
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.