From b6d6707d2f4e1e1a825752afe381d177ef48362a Mon Sep 17 00:00:00 2001 From: Ryan Lewis Date: Tue, 25 Aug 2026 03:19:35 +0100 Subject: [PATCH] fix(release): allow Sigstore public-good endpoints for attestation attest-build-provenance on a public repo uses fulcio.sigstore.dev (plus rekor and the TUF CDN), not the fulcio.githubapp.com instance that serves private repos; the fourth v0.5.3 run published fine but failed the attestation step on the blocked connection. --- .github/workflows/release.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d8c1032..899eadb 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -31,17 +31,20 @@ jobs: codeload.github.com:443 dl.google.com:443 fulcio.githubapp.com:443 + fulcio.sigstore.dev:443 github.com:443 go.dev:443 goreleaser.com:443 objects.githubusercontent.com:443 proxy.golang.org:443 raw.githubusercontent.com:443 + rekor.sigstore.dev:443 release-assets.githubusercontent.com:443 storage.googleapis.com:443 sum.golang.org:443 timestamp.apple.com:80 timestamp.githubapp.com:443 + tuf-repo-cdn.sigstore.dev:443 uploads.github.com:443 *.actions.githubusercontent.com:443 *.s3.amazonaws.com:443