Enable sigstore-go and offline Rekor mode by default - #849
Draft
wlynch wants to merge 2 commits into
Draft
Conversation
Flip gitsign.enableSigstoreGo to default true so users get the sigstore-go code paths (via the CMS<->bundle compat layer) without opting in. The previous hard error requiring rekorMode=offline whenever enableSigstoreGo was set would have broken every default (online-mode) user, so it's removed. That constraint only ever mattered for the *signing* path, and the code already degrades gracefully: - Verification uses sigstore-go in all Rekor modes; legacy online signatures with no embedded Rekor entry fall back to the legacy verifier. - Signing uses sigstore-go only in offline mode (the bundle path is skipped when opts.Rekor is nil); online/legacy signing stays on the existing CMS path. The on-disk CMS signature format is unchanged either way. Also scope the "sigstore-go signing enabled" notice to offline mode, so it isn't printed misleadingly on every online-mode commit, and update the README and docs/bundle-cms.md to describe the new default and the per-mode behavior. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Flip the default Rekor storage mode from online to offline (resolving the long-standing TODO). New signatures now embed the Rekor entry for offline verification, and combined with sigstore-go defaulting on, the bundle signing path is exercised by default. Existing online-mode users are unaffected: verification still handles legacy online signatures (falling back to the legacy verifier when no Rekor entry is embedded), and users can still opt back in with gitsign.rekorMode=online / GITSIGN_REKOR_MODE=online. Update the README env-var default and verification-flow docs to match. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
wlynch
marked this pull request as draft
July 29, 2026 16:48
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Opt all users into the sigstore-go code paths and offline Rekor mode by default.
gitsign.enableSigstoreGonow defaults totrue(wasfalse).gitsign.rekorModenow defaults tooffline(wasonline), resolving the long-standing TODO.Both remain overridable via git config / env var (
GITSIGN_ENABLE_SIGSTORE_GO,GITSIGN_REKOR_MODE).Why
The sigstore-go path (via the CMS↔bundle compatibility layer) is ready to be the default. The on-disk CMS signature format is unchanged either way, so this is a behind-the-scenes implementation switch for most users, plus a move to offline-verifiable signatures by default.
Notable details
enableSigstoreGo requires rekorMode=offlinestartup error. With sigstore-go now on by default, that check would have broken any user who explicitly setsrekorMode=onlineon upgrade. The code already degrades gracefully:opts.Rekor == nil); online/legacy signing stays on the existing CMS path."sigstore-go signing enabled"notice is now scoped to offline mode, so it isn't printed misleadingly on every online-mode commit.rekorMode=online.Docs / tests
README.md(config + env-var tables, verification-flow section) anddocs/bundle-cms.mdto describe the new defaults and per-mode behavior.TestGetfor the new defaults and replacedTestEnableSigstoreGoRequiresOfflinewithTestEnableSigstoreGo, which asserts the default-on behavior and that it can be disabled via git config and env var.🤖 Generated with Claude Code