docs: pin and verify mcp-publisher in the GitHub Actions publishing workflow - #1624
Open
UgaTheDev wants to merge 1 commit into
Open
docs: pin and verify mcp-publisher in the GitHub Actions publishing workflow#1624UgaTheDev wants to merge 1 commit into
UgaTheDev wants to merge 1 commit into
Conversation
…orkflow Fixes modelcontextprotocol#1505 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Qnxf2u2kSBxRM1AT7kD8BD Signed-off-by: Kush Zingade <kush.zingade@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #1505
Problem
The GitHub Actions publishing guide has three copies (OIDC, PAT, DNS variants) of the same install step, which downloads
mcp-publisherfromreleases/latestand pipes it straight intotar, inside the job that holds the publishing credential. As the issue lays out:latestis mutable, so two runs of an unchanged workflow either side of a release execute different bytes; the repository already signs every release asset (goreleasersigns:in.goreleaser.yamlrunscosign sign-blob --bundle), but the guide never checks the signature; and the unverified binary runs with the credential.Change
All three variants now:
MCP_PUBLISHER_VERSIONenv var (currentlyv1.8.1), with a sentence above the first snippet on why and where to find the current release;.sigstore.jsonbundle to disk;cosign verify-blobbefore extracting, using the same SHA-pinnedsigstore/cosign-installerthe release workflow itself uses;The identity check is:
I derived it from the actual v1.8.1 bundle rather than from the workflow file alone: decoding the certificate in
mcp-publisher_linux_amd64.tar.gz.sigstore.jsongives the SANhttps://github.com/modelcontextprotocol/registry/.github/workflows/release.yml@refs/tags/v1.8.1and the GitHub Actions OIDC issuer. The regexp is anchored torelease.ymlon a tag ref, so a bundle signed by any other workflow or branch in this repository is rejected.docs/modelcontextprotocol-io/quickstart.mdx(one-off local install) is left as-is; the threat model there is different and the issue is about the credential-holding CI job.Validation
The three workflow blocks parse as YAML and each contains the new
Install Cosignand pinned install steps. I have not run the workflow end to end.🤖 Generated with Claude Code
https://claude.ai/code/session_01Qnxf2u2kSBxRM1AT7kD8BD