From 8ed95c48dc7bff0a50383a87f903d8f795f40aa0 Mon Sep 17 00:00:00 2001
From: Konrad Heimel <konrad.heimel@gmail.com>
Date: Wed, 19 Aug 2026 00:08:43 +0200
Subject: [PATCH 1/3] :lock: fix(release): pin cosign signer identity and
 issuer in install.sh (SEC-03)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`hack/install.sh` ran `cosign verify-blob --bundle "$bundle" "$ARCHIVE"` with no
signer pin. Keyless verification without `--certificate-identity-regexp` either
errors out (cosign v2 requires the flags) or accepts ANY Fulcio certificate — so
a mirror-swapped archive shipped with its own validly signed bundle verified
clean and `--require-signature` promised a guarantee it did not deliver, while
SECURITY.md's published copy-paste instructions pinned both flags.

install.sh now carries the pair byte-identically to SECURITY.md:

    --certificate-oidc-issuer https://token.actions.githubusercontent.com
    --certificate-identity-regexp '^https://github.com/PlatformRelay/assent/'

New gate `hack/release/install_cosign_pin_test.sh`, offline (stubbed `cosign`
first on PATH, fake .sigstore.json bundles, no network, no real Fulcio):

  * REQ-AUD2-S03-01 — both flags are inside the folded cosign invocation
    (comment lines excluded, so prose cannot satisfy the assertion).
  * REQ-AUD2-S03-02 — a bundle whose certificate identity is
    github.com/evil-mirror/assent fails `install.sh --require-signature` and
    writes no binary to --dest; likewise a foreign OIDC issuer. A matching
    identity still installs (positive control), and the stub log proves both
    flags reach cosign's argv rather than merely existing in the file.
  * REQ-AUD2-S03-03 — non-vacuity in both halves: deleting either flag from a
    temp copy reddens the static assertion, AND the un-pinned copy installs the
    foreign-signed archive the fixed script rejects, so the pin is load-bearing.
  * REQ-AUD2-S03-04 — drift gate: issuer and identity regexp are extracted from
    both hack/install.sh and SECURITY.md (each must yield exactly one distinct
    value) and compared; rewriting either file alone reddens.
  * REQ-AUD2-S03-05 — wired as its own `task check` stage
    `release-install-cosign-pin-test`, with a self-pin plus the AUD-S18
    CHECK_STAGES entry so the release exit gate grades it.

Out of scope, noted for follow-up: hack/release/verify-artifacts.sh:124 runs the
same unpinned `cosign verify-blob --bundle` on the maintainer/CI verification
path.
---
 Taskfile.yml                            |  10 +
 hack/audit/exitgate_test.sh             |   1 +
 hack/install.sh                         |  10 +-
 hack/release/install_cosign_pin_test.sh | 375 ++++++++++++++++++++++++
 4 files changed, 395 insertions(+), 1 deletion(-)
 create mode 100755 hack/release/install_cosign_pin_test.sh

diff --git a/Taskfile.yml b/Taskfile.yml
index f077315a..03dd4657 100644
--- a/Taskfile.yml
+++ b/Taskfile.yml
@@ -102,6 +102,11 @@ tasks:
       # which is skipped on pull_request — without this a regression merges green and only
       # reds main afterwards. Fast and offline (stubbed `gh`); needs jq.
       - task: release-verify-tag-gate-test
+      # AUD2-S03 (SEC-03): hack/install.sh's cosign signer pin. Offline (stubbed
+      # `cosign`), and the only gate that reads hack/install.sh's verify path —
+      # without this line an unpinned `cosign verify-blob` ships silently again,
+      # and SECURITY.md's published issuer/identity pair can drift away from it.
+      - task: release-install-cosign-pin-test
       # D-124: the AUD-S06 docs truth-lag gates shipped green and invoked by nothing,
       # which is the same manual-gate defect they exist to close. Sequential (not a
       # `deps:` entry) — go-task runs deps in parallel and readme_smoke_test.sh builds
@@ -257,6 +262,11 @@ tasks:
     cmds:
       - bash hack/release/verify_tag_gate_test.sh
 
+  release-install-cosign-pin-test:
+    desc: "AUD2-S03 gate: hack/install.sh pins the cosign signer identity + OIDC issuer, no drift from SECURITY.md (REQ-AUD2-S03-01..05)"
+    cmds:
+      - bash hack/release/install_cosign_pin_test.sh
+
   audit-exitgate-test:
     desc: "AUD-S18 exit gate: 2026-08-06 audit conditions closed + gates green at the new bar (REQ-AUD-S18-01/02). NOT in `check` — it runs `task check` itself."
     cmds:
diff --git a/hack/audit/exitgate_test.sh b/hack/audit/exitgate_test.sh
index a97519b4..3bdde4b7 100644
--- a/hack/audit/exitgate_test.sh
+++ b/hack/audit/exitgate_test.sh
@@ -139,6 +139,7 @@ CHECK_STAGES=(
   changelog-verify
   release-changelog-gate-test
   release-verify-tag-gate-test
+  release-install-cosign-pin-test
   docs-gates
   lint-depguard-test
   lint-workflow-pins-test
diff --git a/hack/install.sh b/hack/install.sh
index 57073015..2ea3e636 100755
--- a/hack/install.sh
+++ b/hack/install.sh
@@ -111,7 +111,15 @@ done
 
 if [[ -n "$bundle" ]]; then
   command -v cosign >/dev/null 2>&1 || die "cosign required to verify ${bundle} but not found on PATH"
-  cosign verify-blob --bundle "$bundle" "$ARCHIVE" >/dev/null \
+  # SEC-03 / REQ-AUD2-S03-01: pin the signer. Keyless verify-blob without an
+  # identity pin accepts ANY Fulcio certificate, so a mirror-swapped archive
+  # shipped with its own validly signed bundle would verify clean. The issuer and
+  # identity regexp below are byte-identical to the pair SECURITY.md publishes;
+  # hack/release/install_cosign_pin_test.sh reddens if the two ever drift apart.
+  cosign verify-blob \
+    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
+    --certificate-identity-regexp '^https://github.com/PlatformRelay/assent/' \
+    --bundle "$bundle" "$ARCHIVE" >/dev/null \
     || die "cosign verification failed for ${ARCHIVE}"
 elif [[ "$REQUIRE_SIGNATURE" -eq 1 ]]; then
   die "--require-signature set but no .sigstore.json bundle found beside ${ARCHIVE}"
diff --git a/hack/release/install_cosign_pin_test.sh b/hack/release/install_cosign_pin_test.sh
new file mode 100755
index 00000000..f7b0c826
--- /dev/null
+++ b/hack/release/install_cosign_pin_test.sh
@@ -0,0 +1,375 @@
+#!/usr/bin/env bash
+# REQ-AUD2-S03-01..05 — SEC-03: hack/install.sh pins the cosign signer identity
+# and OIDC issuer, and that pin is a real, load-bearing guarantee.
+#
+# Finding closed here (agent-context/PROJECT-AUDIT-2026-08-18.md, SEC-03):
+#   `cosign verify-blob --bundle "$bundle" "$ARCHIVE"` carried NO
+#   --certificate-identity-regexp / --certificate-oidc-issuer, while SECURITY.md
+#   publishes both in its manual copy-paste instructions. Keyless verification
+#   without an identity pin either errors out (cosign v2 requires the flags) or
+#   accepts ANY Fulcio identity — so a mirror-swapped archive shipped with its
+#   own validly signed bundle verifies clean and `--require-signature` promises
+#   something it does not deliver.
+#
+# ONE PUBLISHED TRUTH. The issuer/identity pair is published in SECURITY.md;
+# hack/install.sh copies it byte-identically. Section 3 below is a drift gate:
+# if either file is edited alone, this script reddens (REQ-AUD2-S03-04).
+#
+# ANTI-VACUITY DISCIPLINE (this repo has a documented history of gates that
+# cannot fail — D-124, AUD-S18). Every assertion here is a FUNCTION over a file
+# or a fixture, run twice: once against the real tree (must be GREEN) and once
+# against a mutant carrying the very defect it exists to catch (must be RED).
+# Every extraction is positive-controlled (non-empty, exactly one distinct
+# value) so a pattern that silently stopped matching fails loudly instead of
+# passing vacuously.
+#
+# OFFLINE. No network, no real Fulcio, no real cosign: section 4 puts a stub
+# `cosign` first on PATH that parses the flags it was handed and matches them
+# against a certificate identity carved into a fake .sigstore.json bundle. The
+# stub models the PERMISSIVE pre-fix behaviour (no --certificate-identity-regexp
+# => accept any identity), which is the dangerous branch of the finding: it lets
+# section 5c show that deleting the flag from install.sh installs a
+# foreign-signed archive, i.e. that the pin is what closes the hole.
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+cd "$ROOT"
+
+INSTALL="$ROOT/hack/install.sh"
+SECURITY="$ROOT/SECURITY.md"
+TASKFILE="$ROOT/Taskfile.yml"
+AUDIT_GATE="$ROOT/hack/audit/exitgate_test.sh"
+STAGE="release-install-cosign-pin-test"
+
+WORK="$(mktemp -d)"
+trap 'rm -rf "$WORK"' EXIT
+
+fail() {
+  echo "FAIL: $*" >&2
+  exit 1
+}
+
+# --------------------------------------------------------------- helpers --
+
+# cosign_invocation <file> — the `cosign verify-blob …` command with its
+# backslash continuations folded onto one line. Comment lines are skipped so a
+# flag mentioned only in prose can never satisfy an assertion.
+cosign_invocation() {
+  awk '
+    /^[[:space:]]*#/ { next }
+    !inv && /cosign verify-blob/ { inv = 1 }
+    inv {
+      line = $0
+      sub(/^[[:space:]]+/, "", line)
+      sub(/[[:space:]]*\\$/, "", line)
+      printf "%s ", line
+      if ($0 !~ /\\[[:space:]]*$/) { printf "\n"; inv = 0 }
+    }
+  ' "$1"
+}
+
+# extract_issuer <file> — every distinct --certificate-oidc-issuer value.
+extract_issuer() {
+  sed -nE "s/.*--certificate-oidc-issuer[[:space:]]+['\"]?([^'\"[:space:]]+)['\"]?.*/\1/p" "$1" | sort -u
+}
+
+# extract_identity <file> — every distinct --certificate-identity-regexp value.
+# The value is single-quoted in both files (a shell regexp must be); an unquoted
+# value extracts as nothing and trips the positive controls rather than passing.
+extract_identity() {
+  sed -nE "s/.*--certificate-identity-regexp[[:space:]]+'([^']*)'.*/\1/p" "$1" | sort -u
+}
+
+# one_value <file> <extractor> <label> — the extractor's single distinct value,
+# or a hard failure if it found none (missing pin, or a broken pattern that would
+# make every assertion vacuous) or several (the file disagrees with itself).
+one_value() {
+  local file="$1" extractor="$2" label="$3" out n
+  out="$("$extractor" "$file")"
+  n="$(printf '%s' "$out" | grep -c . || true)"
+  if [[ "$n" -eq 0 ]]; then
+    fail "$label: extracted NOTHING from ${file#"$ROOT"/} — the pin is missing, or the extraction pattern broke (which would make every assertion below vacuous)"
+  fi
+  if [[ "$n" -gt 1 ]]; then
+    fail "$label: ${file#"$ROOT"/} carries $n DIFFERENT values, so the file disagrees with itself: $(printf '%s' "$out" | tr '\n' '|')"
+  fi
+  printf '%s' "$out"
+}
+
+# has_flag <file> <flag> — the flag appears inside the cosign invocation.
+has_flag() {
+  cosign_invocation "$1" | grep -qF -- "$2"
+}
+
+# ------------------------------------------- 0. extraction positive controls --
+
+echo "== 0. extraction positive controls =="
+[[ -f "$INSTALL" ]] || fail "hack/install.sh missing"
+[[ -x "$INSTALL" ]] || fail "hack/install.sh is not executable"
+[[ -f "$SECURITY" ]] || fail "SECURITY.md missing"
+
+cosign_invocation "$INSTALL" >"$WORK/invocation"
+[[ -s "$WORK/invocation" ]] || fail "no 'cosign verify-blob' invocation found in hack/install.sh — extraction broke, every flag assertion would be vacuous"
+grep -qF -- '--bundle' "$WORK/invocation" || fail "the extracted cosign invocation does not contain the known-present --bundle flag — the awk fold is wrong"
+echo "OK: cosign invocation extracted from hack/install.sh ($(wc -l <"$WORK/invocation" | tr -d ' ') command(s)), anchored on --bundle"
+
+sec_issuer="$(one_value "$SECURITY" extract_issuer "SECURITY.md issuer")"
+sec_identity="$(one_value "$SECURITY" extract_identity "SECURITY.md identity regexp")"
+echo "OK: SECURITY.md publishes issuer=${sec_issuer} identity=${sec_identity}"
+
+# ------------------------------------------------- 1. REQ-AUD2-S03-01 (flags) --
+
+echo "== 1. REQ-AUD2-S03-01: hack/install.sh's cosign call carries both pins =="
+has_flag "$INSTALL" '--certificate-oidc-issuer' \
+  || fail "hack/install.sh's cosign verify-blob has no --certificate-oidc-issuer — keyless verification accepts any issuer (SEC-03, REQ-AUD2-S03-01)"
+has_flag "$INSTALL" '--certificate-identity-regexp' \
+  || fail "hack/install.sh's cosign verify-blob has no --certificate-identity-regexp — a mirror-swapped archive with its own valid bundle verifies clean (SEC-03, REQ-AUD2-S03-01)"
+echo "OK: both --certificate-oidc-issuer and --certificate-identity-regexp are in the invocation"
+
+# ------------------------------------------- 2. REQ-AUD2-S03-03 (non-vacuity) --
+
+echo "== 2. REQ-AUD2-S03-03: deleting either flag from install.sh reddens section 1 =="
+for flag in --certificate-oidc-issuer --certificate-identity-regexp; do
+  mutant="$WORK/install.no${flag}.sh"
+  grep -vF -- "$flag" "$INSTALL" >"$mutant"
+  chmod +x "$mutant"
+  if grep -qF -- "$flag" "$mutant"; then
+    fail "mutation did not land: $flag is still present in $mutant"
+  fi
+  [[ "$(wc -l <"$mutant")" -lt "$(wc -l <"$INSTALL")" ]] \
+    || fail "mutation did not land: $mutant has the same line count as hack/install.sh"
+  if has_flag "$mutant" "$flag"; then
+    fail "has_flag still reports $flag present in a script with that line deleted — the assertion is vacuous"
+  fi
+  echo "OK: deleting $flag makes the flag assertion red"
+done
+
+# --------------------------------------------- 3. REQ-AUD2-S03-04 (drift gate) --
+
+echo "== 3. REQ-AUD2-S03-04: install.sh and SECURITY.md publish ONE truth =="
+inst_issuer="$(one_value "$INSTALL" extract_issuer "hack/install.sh issuer")"
+inst_identity="$(one_value "$INSTALL" extract_identity "hack/install.sh identity regexp")"
+
+drift_free() { # <issuer-a> <identity-a> <issuer-b> <identity-b>
+  [[ "$1" == "$3" && "$2" == "$4" ]]
+}
+
+drift_free "$inst_issuer" "$inst_identity" "$sec_issuer" "$sec_identity" || fail \
+  "DRIFT: hack/install.sh pins issuer=${inst_issuer} identity=${inst_identity} but SECURITY.md publishes issuer=${sec_issuer} identity=${sec_identity} — adopters following the published instructions and adopters running install.sh would verify against different signers (REQ-AUD2-S03-04)"
+echo "OK: hack/install.sh and SECURITY.md agree byte-for-byte (issuer=${inst_issuer}, identity=${inst_identity})"
+
+echo "== 3b. the drift comparison itself can fail (mutations, both directions) =="
+sec_mutant="$WORK/SECURITY.drift.md"
+sed "s|--certificate-oidc-issuer ${sec_issuer}|--certificate-oidc-issuer https://accounts.example.invalid|g" "$SECURITY" >"$sec_mutant"
+grep -qF 'https://accounts.example.invalid' "$sec_mutant" || fail "mutation did not land: $sec_mutant has no rewritten issuer"
+mut_issuer="$(extract_issuer "$sec_mutant" | head -1)"
+if drift_free "$inst_issuer" "$inst_identity" "$mut_issuer" "$sec_identity"; then
+  fail "the drift comparison stayed green with a rewritten SECURITY.md issuer — the drift gate is vacuous"
+fi
+echo "OK: rewriting SECURITY.md's issuer alone turns the drift gate red"
+
+inst_mutant="$WORK/install.drift.sh"
+sed "s|--certificate-identity-regexp '${inst_identity}'|--certificate-identity-regexp '^https://github.com/evil-mirror/assent/'|" "$INSTALL" >"$inst_mutant"
+grep -qF 'evil-mirror' "$inst_mutant" || fail "mutation did not land: $inst_mutant has no rewritten identity regexp"
+mut_identity="$(extract_identity "$inst_mutant" | head -1)"
+if drift_free "$inst_issuer" "$mut_identity" "$sec_issuer" "$sec_identity"; then
+  fail "the drift comparison stayed green with a rewritten install.sh identity regexp — the drift gate is vacuous"
+fi
+echo "OK: rewriting hack/install.sh's identity regexp alone turns the drift gate red"
+
+# ------------------------------ 4/5. behaviour: stub cosign, both polarities --
+
+mkdir -p "$WORK/bin"
+cat >"$WORK/bin/cosign" <<'STUB'
+#!/usr/bin/env bash
+# Offline stub for `cosign verify-blob`, used by hack/release/install_cosign_pin_test.sh.
+# Models cosign keyless verification:
+#   * --certificate-identity-regexp given -> the bundle's certificate identity MUST match
+#   * --certificate-oidc-issuer given     -> the bundle's issuer MUST be equal
+#   * neither given                       -> ACCEPT ANY identity (the pre-fix hole)
+# The permissive no-flag branch is deliberate: it is the dangerous half of SEC-03,
+# and modelling it is what lets the mutation section prove the pin is load-bearing.
+set -uo pipefail
+sub="${1:-}"
+shift || true
+[[ "$sub" == "verify-blob" ]] || { echo "stub-cosign: unsupported subcommand: ${sub}" >&2; exit 2; }
+
+issuer="" identity_re="" bundle=""
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --certificate-oidc-issuer) issuer="${2:-}"; shift 2 ;;
+    --certificate-identity-regexp) identity_re="${2:-}"; shift 2 ;;
+    --bundle) bundle="${2:-}"; shift 2 ;;
+    *) shift ;;
+  esac
+done
+
+if [[ -n "${COSIGN_STUB_LOG:-}" ]]; then
+  printf 'issuer=%s identity_re=%s bundle=%s\n' "${issuer:-<none>}" "${identity_re:-<none>}" "${bundle:-<none>}" >>"$COSIGN_STUB_LOG"
+fi
+[[ -f "$bundle" ]] || { echo "stub-cosign: bundle not found: ${bundle}" >&2; exit 2; }
+
+cert_identity="$(sed -nE 's/.*"certIdentity"[[:space:]]*:[[:space:]]*"([^"]*)".*/\1/p' "$bundle" | head -1)"
+cert_issuer="$(sed -nE 's/.*"certIssuer"[[:space:]]*:[[:space:]]*"([^"]*)".*/\1/p' "$bundle" | head -1)"
+echo "stub-cosign: bundle identity=${cert_identity} issuer=${cert_issuer}; pinned regexp=${identity_re:-<NONE>} issuer=${issuer:-<NONE>}" >&2
+
+if [[ -n "$identity_re" ]] && ! [[ "$cert_identity" =~ $identity_re ]]; then
+  echo "stub-cosign: none of the expected identities matched what was in the certificate: ${cert_identity} !~ ${identity_re}" >&2
+  exit 1
+fi
+if [[ -n "$issuer" && "$cert_issuer" != "$issuer" ]]; then
+  echo "stub-cosign: certificate issuer ${cert_issuer} != pinned ${issuer}" >&2
+  exit 1
+fi
+echo "Verified OK"
+STUB
+chmod +x "$WORK/bin/cosign"
+
+echo "== 4. stub cosign self-test (the harness must be able to say NO and YES) =="
+printf '{"certIdentity":"https://github.com/evil-mirror/assent/.github/workflows/release.yaml@refs/tags/v9.9.9","certIssuer":"%s"}\n' "$sec_issuer" >"$WORK/probe-evil.sigstore.json"
+if PATH="$WORK/bin:$PATH" cosign verify-blob --certificate-oidc-issuer "$sec_issuer" \
+    --certificate-identity-regexp "$sec_identity" --bundle "$WORK/probe-evil.sigstore.json" /dev/null >/dev/null 2>&1; then
+  fail "stub cosign ACCEPTED a foreign identity under the pinned regexp — the stub is broken and section 5 would be vacuous"
+fi
+printf '{"certIdentity":"https://github.com/PlatformRelay/assent/.github/workflows/release.yaml@refs/tags/v0.3.0","certIssuer":"%s"}\n' "$sec_issuer" >"$WORK/probe-good.sigstore.json"
+PATH="$WORK/bin:$PATH" cosign verify-blob --certificate-oidc-issuer "$sec_issuer" \
+  --certificate-identity-regexp "$sec_identity" --bundle "$WORK/probe-good.sigstore.json" /dev/null >/dev/null 2>&1 \
+  || fail "stub cosign REJECTED this project's own identity under the pinned regexp — the stub is broken and every green below would be meaningless"
+echo "OK: stub cosign rejects a foreign identity and accepts this project's own"
+
+# make_case <dir> <identity> <issuer> — archive + checksums + sigstore bundle.
+make_case() {
+  local dir="$1" identity="$2" issuer="$3"
+  mkdir -p "$dir/payload"
+  printf '#!/usr/bin/env bash\necho "assent version fixture-0.0.0"\n' >"$dir/payload/assent"
+  chmod +x "$dir/payload/assent"
+  tar -czf "$dir/assent_fixture_linux_amd64.tar.gz" -C "$dir/payload" assent
+  (
+    cd "$dir"
+    if command -v sha256sum >/dev/null 2>&1; then
+      sha256sum assent_fixture_linux_amd64.tar.gz >checksums.txt
+    else
+      shasum -a 256 assent_fixture_linux_amd64.tar.gz >checksums.txt
+    fi
+  )
+  printf '{"certIdentity":"%s","certIssuer":"%s"}\n' "$identity" "$issuer" \
+    >"$dir/assent_fixture_linux_amd64.tar.gz.sigstore.json"
+}
+
+# run_install <script> <case-dir> <dest> — install.sh with --require-signature
+# and the stub cosign first on PATH; returns the script's exit code.
+run_install() {
+  local script="$1" dir="$2" dest="$3" rc=0
+  mkdir -p "$dest"
+  set +e
+  PATH="$WORK/bin:$PATH" COSIGN_STUB_LOG="$WORK/stub.log" "$script" \
+    --archive "$dir/assent_fixture_linux_amd64.tar.gz" \
+    --checksums "$dir/checksums.txt" \
+    --dest "$dest" --require-signature >"$dir/out" 2>"$dir/err"
+  rc=$?
+  set -e
+  return "$rc"
+}
+
+GOOD_IDENTITY="https://github.com/PlatformRelay/assent/.github/workflows/release.yaml@refs/tags/v0.3.0"
+EVIL_IDENTITY="https://github.com/evil-mirror/assent/.github/workflows/release.yaml@refs/tags/v0.3.0"
+EVIL_ISSUER="https://accounts.example.invalid"
+
+echo "== 4b. positive control: this project's own signature installs =="
+make_case "$WORK/case-good" "$GOOD_IDENTITY" "$sec_issuer"
+: >"$WORK/stub.log"
+run_install "$INSTALL" "$WORK/case-good" "$WORK/dest-good" \
+  || fail "install.sh --require-signature REJECTED a bundle carrying this project's own identity — the pin is too tight or the fixture is broken: $(cat "$WORK/case-good/err")"
+[[ -x "$WORK/dest-good/assent" ]] || fail "install.sh exited 0 but wrote no binary to the destination — the fixture is broken and the negative case below would prove nothing"
+grep -qF -- "identity_re=${sec_identity}" "$WORK/stub.log" \
+  || fail "install.sh did not actually HAND cosign the identity regexp at runtime (stub log: $(cat "$WORK/stub.log")) — a flag present in the text but not in argv is not a pin"
+grep -qF -- "issuer=${sec_issuer}" "$WORK/stub.log" \
+  || fail "install.sh did not actually hand cosign the OIDC issuer at runtime (stub log: $(cat "$WORK/stub.log"))"
+echo "OK: own-identity bundle installs, and both pins reached cosign's argv"
+
+echo "== 5. REQ-AUD2-S03-02: a foreign-identity bundle fails and installs NOTHING =="
+make_case "$WORK/case-evil" "$EVIL_IDENTITY" "$sec_issuer"
+if run_install "$INSTALL" "$WORK/case-evil" "$WORK/dest-evil"; then
+  fail "install.sh --require-signature ACCEPTED a bundle signed by ${EVIL_IDENTITY} — a mirror-swapped archive installs (SEC-03, REQ-AUD2-S03-02)"
+fi
+[[ ! -e "$WORK/dest-evil/assent" ]] \
+  || fail "install.sh failed but STILL wrote a binary to the destination — fail-closed means nothing is installed (REQ-AUD2-S03-02)"
+grep -qi 'cosign verification failed' "$WORK/case-evil/err" \
+  || fail "install.sh failed for the wrong reason (expected the cosign die message): $(cat "$WORK/case-evil/err")"
+echo "OK: foreign identity -> exit non-zero, destination empty, cosign die message"
+
+echo "== 5b. a foreign ISSUER with a matching identity also fails =="
+make_case "$WORK/case-issuer" "$GOOD_IDENTITY" "$EVIL_ISSUER"
+if run_install "$INSTALL" "$WORK/case-issuer" "$WORK/dest-issuer"; then
+  fail "install.sh accepted a bundle whose OIDC issuer is ${EVIL_ISSUER} — the issuer pin is not reaching cosign (REQ-AUD2-S03-02)"
+fi
+[[ ! -e "$WORK/dest-issuer/assent" ]] || fail "issuer mismatch still installed a binary"
+echo "OK: foreign issuer -> exit non-zero, destination empty"
+
+echo "== 5c. REQ-AUD2-S03-03: with the pin deleted, the foreign bundle INSTALLS =="
+# The behavioural half of non-vacuity: the same fixture section 5 rejects is
+# accepted by a copy of install.sh with the identity pin removed. That is the
+# finding itself, reproduced — and it proves section 5's red comes from the flag
+# and not from some unrelated property of the fixture.
+mutant_id="$WORK/install.mut-identity.sh"
+grep -vF -- '--certificate-identity-regexp' "$INSTALL" >"$mutant_id"
+chmod +x "$mutant_id"
+make_case "$WORK/case-evil2" "$EVIL_IDENTITY" "$sec_issuer"
+run_install "$mutant_id" "$WORK/case-evil2" "$WORK/dest-evil2" \
+  || fail "the un-pinned mutant ALSO rejected the foreign bundle — then section 5's red is not caused by --certificate-identity-regexp and this gate proves nothing: $(cat "$WORK/case-evil2/err")"
+[[ -x "$WORK/dest-evil2/assent" ]] \
+  || fail "the un-pinned mutant exited 0 but installed nothing — the mutation demonstration is inconclusive"
+echo "OK: deleting --certificate-identity-regexp re-opens SEC-03 (foreign archive installs) — the pin is load-bearing"
+
+mutant_iss="$WORK/install.mut-issuer.sh"
+grep -vF -- '--certificate-oidc-issuer' "$INSTALL" >"$mutant_iss"
+chmod +x "$mutant_iss"
+make_case "$WORK/case-issuer2" "$GOOD_IDENTITY" "$EVIL_ISSUER"
+run_install "$mutant_iss" "$WORK/case-issuer2" "$WORK/dest-issuer2" \
+  || fail "the issuer-less mutant ALSO rejected the wrong-issuer bundle — section 5b's red is not caused by --certificate-oidc-issuer: $(cat "$WORK/case-issuer2/err")"
+[[ -x "$WORK/dest-issuer2/assent" ]] || fail "the issuer-less mutant exited 0 but installed nothing"
+echo "OK: deleting --certificate-oidc-issuer re-opens the issuer half — that pin is load-bearing too"
+
+# ----------------------------------------------- 6. REQ-AUD2-S03-05 (wiring) --
+
+echo "== 6. REQ-AUD2-S03-05: this gate is invoked by 'task check' (D-124) =="
+extract_block() { # <file> <2-space-indented key>
+  awk -v name="$2" '
+    $0 == "  " name ":" { inblk = 1; next }
+    inblk && /^  [A-Za-z0-9_.:-]+:[[:space:]]*$/ { inblk = 0 }
+    inblk { print }
+  ' "$1"
+}
+check_lists_task() { # <taskfile> <stage>
+  extract_block "$1" check | grep -qE "^[[:space:]]+- task: $2\$"
+}
+
+extract_block "$TASKFILE" check >"$WORK/check.block"
+[[ -s "$WORK/check.block" ]] || fail "Taskfile check: block extracted EMPTY — the wiring assertions would be vacuous"
+grep -qE '^[[:space:]]+- task: build$' "$WORK/check.block" \
+  || fail "Taskfile check: block does not contain the known-present '- task: build' — extraction is wrong"
+
+check_lists_task "$TASKFILE" "$STAGE" \
+  || fail "'task check' does not run '$STAGE' — a gate invoked by nothing is not a gate (D-124, REQ-AUD2-S03-05)"
+extract_block "$TASKFILE" "$STAGE" >"$WORK/def.stage"
+[[ -s "$WORK/def.stage" ]] || fail "'$STAGE' is listed in check: but not defined in Taskfile.yml"
+grep -qF 'hack/release/install_cosign_pin_test.sh' "$WORK/def.stage" \
+  || fail "the '$STAGE' task does not invoke hack/release/install_cosign_pin_test.sh"
+echo "OK: task check runs $STAGE, which invokes this script"
+
+mutant_tf="$WORK/Taskfile.no-stage.yml"
+grep -vE "^[[:space:]]+- task: ${STAGE}\$" "$TASKFILE" >"$mutant_tf"
+[[ "$(wc -l <"$mutant_tf")" -lt "$(wc -l <"$TASKFILE")" ]] || fail "mutation did not land: $mutant_tf has the same line count as Taskfile.yml"
+if check_lists_task "$mutant_tf" "$STAGE"; then
+  fail "check_lists_task reports $STAGE wired in a Taskfile with that line deleted — the wiring assertion is vacuous"
+fi
+echo "OK: deleting '- task: $STAGE' from check: turns the wiring assertion red"
+
+echo "== 6b. the AUD-S18 CHECK_STAGES pin knows about this stage =="
+# hack/audit/exitgate_test.sh grades `task check` stage-by-stage against that
+# array; a stage missing from it is a stage the release exit gate does not grade.
+grep -qE "^[[:space:]]+${STAGE}\$" "$AUDIT_GATE" \
+  || fail "'$STAGE' is not in CHECK_STAGES in hack/audit/exitgate_test.sh — the release exit gate would not grade it (AUD-S18)"
+echo "OK: $STAGE is pinned in CHECK_STAGES"
+
+echo "PASS: install_cosign_pin_test.sh — SEC-03 closed (REQ-AUD2-S03-01..05): hack/install.sh pins issuer=${inst_issuer} identity=${inst_identity}, byte-identical to SECURITY.md; a foreign-signed bundle fails closed with nothing installed; both pins proved load-bearing by mutation; the gate is wired into task check"

From 699093599bbda9a9a421eeb31e722b597344f4e8 Mon Sep 17 00:00:00 2001
From: Konrad Heimel <konrad.heimel@gmail.com>
Date: Wed, 19 Aug 2026 00:22:35 +0200
Subject: [PATCH 2/3] :lock: fix(release): widen the cosign identity pin to the
 real signer casing (SEC-03)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The pin landed in b616d00 copied SECURITY.md's published value faithfully and
was still wrong. The repository was renamed PlatformRelay/assent ->
PlatformRelay/Assent between v0.1.0 and v0.2.0; the Fulcio SAN carries GitHub's
canonical casing, and cosign matches --certificate-identity-regexp
case-SENSITIVELY. Decoded from the published bundles (openssl x509 on the
bundle's certificate, X509v3 Subject Alternative Name):

  v0.3.0  https://github.com/PlatformRelay/Assent/.github/workflows/release.yaml@refs/tags/v0.3.0
  v0.2.0  https://github.com/PlatformRelay/Assent/.github/workflows/release.yaml@refs/tags/v0.2.0
  v0.1.0  https://github.com/PlatformRelay/assent/.github/workflows/release.yaml@refs/heads/main

So the lowercase-only pin verified v0.1.0 and REJECTED the current releases:
`install.sh --require-signature` would have failed closed against this project's
own artifacts, and SECURITY.md's copy-paste instructions were already broken the
same way. Both files now publish, byte-identically (one truth, REQ-AUD2-S03-04):

    --certificate-identity-regexp '^https://github\.com/PlatformRelay/[Aa]ssent/'

The dots are escaped in the same edit — they were regexp metacharacters matching
any character, so `github.com` also matched e.g. `githubXcom`. The pin is not
widened beyond the org/repo: the `^` anchor stays, there is no `.*`, and another
owner, an `assent-mirror` typosquat or another forge still fail.

Gate changes (hack/release/install_cosign_pin_test.sh):

  * REQ-AUD2-S03-01/02 — new section 4c: the SANs above are committed as
    FIXTURES (public certificate contents) and every one is checked twice — as a
    regexp match and end-to-end through install.sh with the stub cosign. Six
    negative fixtures cover another owner, a typosquat, another org, another
    forge, a lost anchor and an unescaped-dot host. Section 4d re-runs the accept
    table against the pre-fix lowercase pin and requires it to reject at least
    two, so the fixture check is proved capable of catching this exact bug.
  * REQ-AUD2-S03-04 — the drift mutations no longer interpolate the pinned value
    into a sed pattern (it is itself a regexp now, which would have matched
    nothing and silently stopped mutating); the rewrites are flag-relative.
  * The stub self-test (section 4) now uses synthetic values instead of the
    project's pin, so a wrong pin reddens in 4b/4c naming the casing rather than
    in 4 blaming the stub. It also asserts the stub is permissive when unpinned,
    which is what makes 5c's "the pin is load-bearing" demonstration valid.

Reported, deliberately NOT fixed here (not an owned path):
hack/release/verify-artifacts.sh:124 runs the same unpinned
`cosign verify-blob --bundle` on the maintainer/CI path.
---
 SECURITY.md                             |   8 +-
 hack/install.sh                         |  10 +-
 hack/release/install_cosign_pin_test.sh | 117 +++++++++++++++++++++---
 3 files changed, 119 insertions(+), 16 deletions(-)

diff --git a/SECURITY.md b/SECURITY.md
index 2d0d8d69..0598a461 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -78,17 +78,21 @@ cd dist-verify
 sha256sum -c checksums.txt
 
 # 2) Cosign — per-archive bundles (keyless, GitHub Actions OIDC issuer)
+#    The identity pin is a REGEXP matched case-sensitively: the repository was
+#    renamed to PlatformRelay/Assent between v0.1.0 and v0.2.0, so v0.1.0's
+#    certificate says `assent` and v0.2.0+ say `Assent`. `[Aa]` covers both; the
+#    dots are escaped and the org/repo stays anchored, so a mirror still fails.
 ARCHIVE=assent_X.Y.Z_linux_amd64.tar.gz   # adjust OS/arch
 cosign verify-blob \
   --certificate-oidc-issuer https://token.actions.githubusercontent.com \
-  --certificate-identity-regexp '^https://github.com/PlatformRelay/assent/' \
+  --certificate-identity-regexp '^https://github\.com/PlatformRelay/[Aa]ssent/' \
   --bundle "${ARCHIVE}.sigstore.json" \
   "${ARCHIVE}"
 
 # Cosign — checksum manifest (covers archives + SBOMs listed inside)
 cosign verify-blob \
   --certificate-oidc-issuer https://token.actions.githubusercontent.com \
-  --certificate-identity-regexp '^https://github.com/PlatformRelay/assent/' \
+  --certificate-identity-regexp '^https://github\.com/PlatformRelay/[Aa]ssent/' \
   --bundle checksums.txt.sigstore.json \
   checksums.txt
 
diff --git a/hack/install.sh b/hack/install.sh
index 2ea3e636..7927cf1d 100755
--- a/hack/install.sh
+++ b/hack/install.sh
@@ -116,9 +116,17 @@ if [[ -n "$bundle" ]]; then
   # shipped with its own validly signed bundle would verify clean. The issuer and
   # identity regexp below are byte-identical to the pair SECURITY.md publishes;
   # hack/release/install_cosign_pin_test.sh reddens if the two ever drift apart.
+  #
+  # The [Aa] class is not cosmetic: the repository was renamed to PlatformRelay/
+  # Assent between v0.1.0 and v0.2.0, and the Fulcio SAN carries GitHub's
+  # canonical casing — v0.1.0's certificate says `assent`, v0.2.0/v0.3.0's say
+  # `Assent`. cosign matches this regexp case-SENSITIVELY, so a lowercase-only
+  # pin rejects the project's own current releases. The dots are escaped because
+  # this is a regexp, not a literal. The pin is still anchored at the org/repo:
+  # any other owner, or an `assent-mirror`-style typosquat, fails.
   cosign verify-blob \
     --certificate-oidc-issuer https://token.actions.githubusercontent.com \
-    --certificate-identity-regexp '^https://github.com/PlatformRelay/assent/' \
+    --certificate-identity-regexp '^https://github\.com/PlatformRelay/[Aa]ssent/' \
     --bundle "$bundle" "$ARCHIVE" >/dev/null \
     || die "cosign verification failed for ${ARCHIVE}"
 elif [[ "$REQUIRE_SIGNATURE" -eq 1 ]]; then
diff --git a/hack/release/install_cosign_pin_test.sh b/hack/release/install_cosign_pin_test.sh
index f7b0c826..c142e00a 100755
--- a/hack/release/install_cosign_pin_test.sh
+++ b/hack/release/install_cosign_pin_test.sh
@@ -15,6 +15,15 @@
 # hack/install.sh copies it byte-identically. Section 3 below is a drift gate:
 # if either file is edited alone, this script reddens (REQ-AUD2-S03-04).
 #
+# REAL-IDENTITY FIXTURES (section 4c) — the assertion that matters most. The
+# first version of this pin copied SECURITY.md's published value faithfully and
+# was still WRONG: the repo was renamed PlatformRelay/assent -> PlatformRelay/
+# Assent between v0.1.0 and v0.2.0, cosign matches the identity regexp
+# case-sensitively, and so the published lowercase pin rejected the project's
+# own v0.2.0/v0.3.0 artifacts. Self-made fixtures cannot catch that, so the SANs
+# decoded from the REAL published bundles are committed here as test data and
+# every one of them must verify.
+#
 # ANTI-VACUITY DISCIPLINE (this repo has a documented history of gates that
 # cannot fail — D-124, AUD-S18). Every assertion here is a FUNCTION over a file
 # or a fixture, run twice: once against the real tree (must be GREEN) and once
@@ -160,7 +169,10 @@ echo "OK: hack/install.sh and SECURITY.md agree byte-for-byte (issuer=${inst_iss
 
 echo "== 3b. the drift comparison itself can fail (mutations, both directions) =="
 sec_mutant="$WORK/SECURITY.drift.md"
-sed "s|--certificate-oidc-issuer ${sec_issuer}|--certificate-oidc-issuer https://accounts.example.invalid|g" "$SECURITY" >"$sec_mutant"
+# The rewrite is flag-relative, never a sed pattern built from the pinned value:
+# the identity pin is itself a regexp ([Aa], escaped dots), so interpolating it
+# into a pattern would silently match nothing and the mutation would not land.
+sed -E "s|(--certificate-oidc-issuer )[^[:space:]]+|\\1https://accounts.example.invalid|g" "$SECURITY" >"$sec_mutant"
 grep -qF 'https://accounts.example.invalid' "$sec_mutant" || fail "mutation did not land: $sec_mutant has no rewritten issuer"
 mut_issuer="$(extract_issuer "$sec_mutant" | head -1)"
 if drift_free "$inst_issuer" "$inst_identity" "$mut_issuer" "$sec_identity"; then
@@ -169,7 +181,7 @@ fi
 echo "OK: rewriting SECURITY.md's issuer alone turns the drift gate red"
 
 inst_mutant="$WORK/install.drift.sh"
-sed "s|--certificate-identity-regexp '${inst_identity}'|--certificate-identity-regexp '^https://github.com/evil-mirror/assent/'|" "$INSTALL" >"$inst_mutant"
+sed -E "s|(--certificate-identity-regexp )'[^']*'|\\1'^https://github\\.com/evil-mirror/assent/'|" "$INSTALL" >"$inst_mutant"
 grep -qF 'evil-mirror' "$inst_mutant" || fail "mutation did not land: $inst_mutant has no rewritten identity regexp"
 mut_identity="$(extract_identity "$inst_mutant" | head -1)"
 if drift_free "$inst_issuer" "$mut_identity" "$sec_issuer" "$sec_identity"; then
@@ -226,16 +238,23 @@ STUB
 chmod +x "$WORK/bin/cosign"
 
 echo "== 4. stub cosign self-test (the harness must be able to say NO and YES) =="
-printf '{"certIdentity":"https://github.com/evil-mirror/assent/.github/workflows/release.yaml@refs/tags/v9.9.9","certIssuer":"%s"}\n' "$sec_issuer" >"$WORK/probe-evil.sigstore.json"
-if PATH="$WORK/bin:$PATH" cosign verify-blob --certificate-oidc-issuer "$sec_issuer" \
-    --certificate-identity-regexp "$sec_identity" --bundle "$WORK/probe-evil.sigstore.json" /dev/null >/dev/null 2>&1; then
-  fail "stub cosign ACCEPTED a foreign identity under the pinned regexp — the stub is broken and section 5 would be vacuous"
+# Deliberately SYNTHETIC values, not the project's pin: this section grades the
+# STUB. Driving it with the real pin would make a wrong pin surface here as
+# "the stub is broken", hiding the actual defect 4b/4c exist to name.
+probe_re='^https://example\.test/owner/repo/'
+probe_issuer='https://issuer.example.test'
+printf '{"certIdentity":"https://example.test/other/repo/wf.yaml@refs/tags/v1","certIssuer":"%s"}\n' "$probe_issuer" >"$WORK/probe-evil.sigstore.json"
+if PATH="$WORK/bin:$PATH" cosign verify-blob --certificate-oidc-issuer "$probe_issuer" \
+    --certificate-identity-regexp "$probe_re" --bundle "$WORK/probe-evil.sigstore.json" /dev/null >/dev/null 2>&1; then
+  fail "stub cosign ACCEPTED an identity outside the regexp it was handed — the stub is broken and every negative case below would be vacuous"
 fi
-printf '{"certIdentity":"https://github.com/PlatformRelay/assent/.github/workflows/release.yaml@refs/tags/v0.3.0","certIssuer":"%s"}\n' "$sec_issuer" >"$WORK/probe-good.sigstore.json"
-PATH="$WORK/bin:$PATH" cosign verify-blob --certificate-oidc-issuer "$sec_issuer" \
-  --certificate-identity-regexp "$sec_identity" --bundle "$WORK/probe-good.sigstore.json" /dev/null >/dev/null 2>&1 \
-  || fail "stub cosign REJECTED this project's own identity under the pinned regexp — the stub is broken and every green below would be meaningless"
-echo "OK: stub cosign rejects a foreign identity and accepts this project's own"
+printf '{"certIdentity":"https://example.test/owner/repo/wf.yaml@refs/tags/v1","certIssuer":"%s"}\n' "$probe_issuer" >"$WORK/probe-good.sigstore.json"
+PATH="$WORK/bin:$PATH" cosign verify-blob --certificate-oidc-issuer "$probe_issuer" \
+  --certificate-identity-regexp "$probe_re" --bundle "$WORK/probe-good.sigstore.json" /dev/null >/dev/null 2>&1 \
+  || fail "stub cosign REJECTED an identity that matches the regexp it was handed — the stub is broken and every green below would be meaningless"
+PATH="$WORK/bin:$PATH" cosign verify-blob --bundle "$WORK/probe-evil.sigstore.json" /dev/null >/dev/null 2>&1 \
+  || fail "stub cosign rejected an UNPINNED verification — it must model the permissive pre-fix branch, or section 5c proves nothing"
+echo "OK: stub cosign rejects a non-matching identity, accepts a matching one, and is permissive when unpinned"
 
 # make_case <dir> <identity> <issuer> — archive + checksums + sigstore bundle.
 make_case() {
@@ -271,7 +290,8 @@ run_install() {
   return "$rc"
 }
 
-GOOD_IDENTITY="https://github.com/PlatformRelay/assent/.github/workflows/release.yaml@refs/tags/v0.3.0"
+# The REAL v0.3.0 signer identity, decoded from the published bundle (see 4c).
+GOOD_IDENTITY="https://github.com/PlatformRelay/Assent/.github/workflows/release.yaml@refs/tags/v0.3.0"
 EVIL_IDENTITY="https://github.com/evil-mirror/assent/.github/workflows/release.yaml@refs/tags/v0.3.0"
 EVIL_ISSUER="https://accounts.example.invalid"
 
@@ -279,7 +299,7 @@ echo "== 4b. positive control: this project's own signature installs =="
 make_case "$WORK/case-good" "$GOOD_IDENTITY" "$sec_issuer"
 : >"$WORK/stub.log"
 run_install "$INSTALL" "$WORK/case-good" "$WORK/dest-good" \
-  || fail "install.sh --require-signature REJECTED a bundle carrying this project's own identity — the pin is too tight or the fixture is broken: $(cat "$WORK/case-good/err")"
+  || fail "install.sh --require-signature REJECTED a bundle carrying this project's REAL v0.3.0 signer identity (${GOOD_IDENTITY}) — the pinned regexp does not match the project's own releases; check the repo-name casing, the Fulcio SAN says PlatformRelay/Assent: $(cat "$WORK/case-good/err")"
 [[ -x "$WORK/dest-good/assent" ]] || fail "install.sh exited 0 but wrote no binary to the destination — the fixture is broken and the negative case below would prove nothing"
 grep -qF -- "identity_re=${sec_identity}" "$WORK/stub.log" \
   || fail "install.sh did not actually HAND cosign the identity regexp at runtime (stub log: $(cat "$WORK/stub.log")) — a flag present in the text but not in argv is not a pin"
@@ -287,6 +307,77 @@ grep -qF -- "issuer=${sec_issuer}" "$WORK/stub.log" \
   || fail "install.sh did not actually hand cosign the OIDC issuer at runtime (stub log: $(cat "$WORK/stub.log"))"
 echo "OK: own-identity bundle installs, and both pins reached cosign's argv"
 
+echo "== 4c. REAL published-release identities (the assertion that would have caught the casing bug) =="
+# Public certificate contents, decoded from the .sigstore.json bundles GitHub
+# serves for each tag (`openssl x509 -inform DER -text` on the bundle's cert,
+# X509v3 Subject Alternative Name). Committed as FIXTURES on purpose: this gate
+# must stay offline, and a pin that is never matched against a real signer
+# identity can be confidently, greenly wrong — the lowercase-only value
+# SECURITY.md published until now verified v0.1.0 and REJECTED v0.2.0/v0.3.0,
+# because the repository was renamed PlatformRelay/assent -> PlatformRelay/Assent
+# and cosign matches --certificate-identity-regexp case-sensitively.
+#
+# Each fixture is checked twice: as a regexp match (bash ERE, which agrees with
+# cosign's Go RE2 on the anchors, escaped dots and character class used here)
+# AND end-to-end through the real install.sh with the stub cosign, which is what
+# actually proves the flag as install.sh spells it accepts/rejects the identity.
+REAL_SANS_ACCEPT=(
+  "https://github.com/PlatformRelay/Assent/.github/workflows/release.yaml@refs/tags/v0.3.0"
+  "https://github.com/PlatformRelay/Assent/.github/workflows/release.yaml@refs/tags/v0.2.0"
+  "https://github.com/PlatformRelay/assent/.github/workflows/release.yaml@refs/heads/main"
+)
+# Must NOT match: other owners, typosquats, another forge, a lost anchor, and an
+# unescaped-dot host (githubXcom matches only if the `.` was left un-escaped).
+REAL_SANS_REJECT=(
+  "https://github.com/evil-mirror/Assent/.github/workflows/release.yaml@refs/tags/v0.3.0"
+  "https://github.com/PlatformRelay/assent-mirror/.github/workflows/release.yaml@refs/tags/v0.3.0"
+  "https://github.com/PlatformRelayEvil/Assent/.github/workflows/release.yaml@refs/tags/v0.3.0"
+  "https://gitlab.com/PlatformRelay/Assent/.gitlab-ci.yml@refs/tags/v0.3.0"
+  "https://evil.example/https://github.com/PlatformRelay/Assent/.github/workflows/release.yaml@refs/tags/v0.3.0"
+  "https://githubXcom/PlatformRelay/Assent/.github/workflows/release.yaml@refs/tags/v0.3.0"
+)
+
+[[ "${#REAL_SANS_ACCEPT[@]}" -ge 3 && "${#REAL_SANS_REJECT[@]}" -ge 6 ]] \
+  || fail "the real-identity fixture tables were emptied — this is the assertion that catches signer-identity drift"
+
+i=0
+for san in "${REAL_SANS_ACCEPT[@]}"; do
+  i=$((i + 1))
+  [[ "$san" =~ $inst_identity ]] \
+    || fail "the pinned regexp ${inst_identity} REJECTS a REAL published release identity: ${san} — 'install.sh --require-signature' would fail closed against this project's own artifacts (the SEC-03 casing defect)"
+  make_case "$WORK/real-ok-$i" "$san" "$sec_issuer"
+  run_install "$INSTALL" "$WORK/real-ok-$i" "$WORK/dest-real-ok-$i" \
+    || fail "install.sh rejected the REAL release identity ${san} end-to-end: $(cat "$WORK/real-ok-$i/err")"
+  [[ -x "$WORK/dest-real-ok-$i/assent" ]] || fail "install.sh exited 0 for ${san} but installed nothing"
+  echo "OK: accepts real published identity ${san}"
+done
+
+i=0
+for san in "${REAL_SANS_REJECT[@]}"; do
+  i=$((i + 1))
+  if [[ "$san" =~ $inst_identity ]]; then
+    fail "the pinned regexp ${inst_identity} ACCEPTS ${san} — the pin is wider than the org/repo it is supposed to anchor"
+  fi
+  make_case "$WORK/real-no-$i" "$san" "$sec_issuer"
+  if run_install "$INSTALL" "$WORK/real-no-$i" "$WORK/dest-real-no-$i"; then
+    fail "install.sh --require-signature ACCEPTED ${san} end-to-end — a mirror installs"
+  fi
+  [[ ! -e "$WORK/dest-real-no-$i/assent" ]] || fail "install.sh failed for ${san} but still wrote a binary"
+  echo "OK: rejects ${san}"
+done
+
+echo "== 4d. the real-identity fixture check itself can fail (mutation) =="
+# Re-run the accept table against the OLD lowercase-only pin: it must reject the
+# v0.2.0/v0.3.0 identities. If it does not, this section proves nothing.
+old_pin='^https://github.com/PlatformRelay/assent/'
+rejected=0
+for san in "${REAL_SANS_ACCEPT[@]}"; do
+  [[ "$san" =~ $old_pin ]] || rejected=$((rejected + 1))
+done
+[[ "$rejected" -ge 2 ]] \
+  || fail "the pre-fix lowercase pin '${old_pin}' still matched every real identity — then this section could not have caught the casing bug and is decorative"
+echo "OK: the pre-fix lowercase pin rejects ${rejected} of ${#REAL_SANS_ACCEPT[@]} real published identities (that is the bug this section exists to catch)"
+
 echo "== 5. REQ-AUD2-S03-02: a foreign-identity bundle fails and installs NOTHING =="
 make_case "$WORK/case-evil" "$EVIL_IDENTITY" "$sec_issuer"
 if run_install "$INSTALL" "$WORK/case-evil" "$WORK/dest-evil"; then

From 79ff306814a2fa2f6b8cece7fc1da7ea6c403dec Mon Sep 17 00:00:00 2001
From: Konrad Heimel <konrad.heimel@gmail.com>
Date: Wed, 19 Aug 2026 00:47:17 +0200
Subject: [PATCH 3/3] :memo: docs(openspec): amend AUD2-S03 to the shipped pin
 and log D-153 (SEC-03)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Doc round for AUD2-S03. No code change — hack/install.sh, SECURITY.md and
hack/release/install_cosign_pin_test.sh are untouched here.

openspec/specs/p5-aud2-audit-remediation/spec.md — the spec as written forbade
what shipped, so it is amended in place (precedent: 1ac5692, b08be34 — spec-first
still means the spec tracks what was measured):
  * "Reuse, explicitly" said SECURITY.md's flag pair was frozen and "the script
    must not invent a different issuer or identity pattern". The published pair
    was itself wrong, so mirroring it could not stay literal. The intent is kept,
    restated: the pin is verified against committed real-SAN fixtures, never
    chosen freely.
  * The AUD2-S03 Goal still quoted '^https://github.com/PlatformRelay/assent/',
    the value real cosign rejects. It now quotes the shipped
    '^https://github\.com/PlatformRelay/[Aa]ssent/' and carries an Amendment
    paragraph naming the cause: the Fulcio SAN carries the repo's post-rename
    casing (PlatformRelay/Assent from v0.2.0 on), cosign matches the regexp
    case-sensitively via Go RE2, so the lowercase value rejected every release
    from v0.2.0 on.
  * DoD gains the fixture clause; the stale `SECURITY.md:82–93` reference is
    refreshed to `SECURITY.md:80–98` at both sites (finding list and Reuse).

docs/decisions/decisions.md — D-153 records the substantive fact that until now
lived only in a commit body: SECURITY.md's published verification instructions
were BROKEN for every release since v0.2.0. An adopter following them on v0.2.0
or v0.3.0 got a verification failure on a genuine artifact, whose natural reading
is "this release was tampered with". Cause, the three decoded SANs, the rejected
alternatives ((?i), ship-broken-and-follow-up), the one-truth enforcement, and a
Revert line that states the revert re-breaks v0.2.0+.

openspec/specs/backlog.md — AUD2-F01 tracks SEC-03's twin,
hack/release/verify-artifacts.sh:124, with sizing and three traps. Recorded as a
found-in-flight follow-up OUTSIDE the AUD2 story table on purpose: D-152 records
AUD2 as five stories and AUD2-S05's exit gate dispositions S01–S04, so a sixth
row there would move that claim.

Not done, deliberately: the reviewer's optional suggestion to extend the pin with
the workflow path (`.../[Aa]ssent/\.github/workflows/release\.yaml@`). It is
hardening rather than a hole (exploiting the looseness needs repo write access),
and it is a code + fixture change in a round the review scoped to documentation.
Deferred to AUD2-F01, which touches the same pin.
---
 CHANGELOG.md                                  |  3 ++
 docs/decisions/decisions.md                   |  1 +
 openspec/specs/backlog.md                     | 20 +++++++++
 .../specs/p5-aud2-audit-remediation/spec.md   | 45 ++++++++++++++-----
 4 files changed, 59 insertions(+), 10 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1b73165e..254ac13d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -84,12 +84,15 @@ repository still gets a decision, never by following the link; no release carrie
 - :memo: docs(changelog): stamp the v0.3.0 section after tagging
 - :memo: docs(spec): decompose the 2026-08-18 audit Next wave as epic P5-AUD2 (D-152)
 - :memo: docs(spec): AUD2-S02 names resolveRunFacts, not the nonexistent loadProviderHosts
+- :memo: docs(openspec): amend AUD2-S03 to the shipped pin and log D-153 (SEC-03)
 
 ### Fixes
 - :bug: docs(decisions): reference the AUD2 spec as a path, not an mkdocs link
 
 ### Security
 - :lock: fix(cmd): discriminate absent provider declaration from forge failure (REL-03)
+- :lock: fix(release): pin cosign signer identity and issuer in install.sh (SEC-03)
+- :lock: fix(release): widen the cosign identity pin to the real signer casing (SEC-03)
 
 ### Testing
 - :white_check_mark: test(cmd): assert the REL-03 error wrap as one contiguous substring
diff --git a/docs/decisions/decisions.md b/docs/decisions/decisions.md
index d7d381eb..b1d7e715 100644
--- a/docs/decisions/decisions.md
+++ b/docs/decisions/decisions.md
@@ -157,3 +157,4 @@ project/process decisions.
 | D-150 | 2026-08-16 | **SONAR-GO-CX-TEST is RESOLVED: adopt a checked-in `sonar-project.properties` excluding `**/*_test.go` from the S3776 cognitive-complexity rule, accepting the loss of SonarCloud Automatic Analysis.** 66 CODE_SMELL issues, concentrated in 34 table-driven Go test files, against a Quality Gate that is otherwise OK (0 bugs/vulns/hotspots) — high cognitive complexity is the idiom in table-driven Go tests, not a defect. Chosen over the UI-only Won't-Fix route (keeps Automatic Analysis, but the suppression is not reviewable in-tree and does not survive a project re-import) and over refactoring the 34 files (churn on passing tests for a non-gating metric). Accepted cost: a scanner step must be added to CI and maintained going forward — Automatic Analysis stops once a `sonar-project.properties` is present. Revert: delete the properties file to restore Automatic Analysis; the 66 smells return. |
 | D-151 | 2026-08-16 | **OpenSSF Best Practices project creation is RESOLVED: (a) — the operator will create the `bestpractices.dev` project for `PlatformRelay/assent`.** Unblocks SEC-SC-S02 (evidence page + README badge, once *passing*); SEC-SC-S01 (fuzzing) is not blocked by this and can proceed independently. Operator action only — requires a personal account at bestpractices.dev, not automatable in-tree. Current CII score is 0, which drags the OpenSSF Scorecard (~7); the repo already satisfies most criteria (pinned CodeQL, Dependabot, secret scanning, signed releases, SLSA provenance). Revert: leave CII at 0 indefinitely — SEC-SC-S01 is unaffected either way. |
 | D-152 | 2026-08-18 | **The 2026-08-18 audit's "Next (risk reduction)" wave is decomposed as its own epic P5-AUD2 (`openspec/specs/p5-aud2-audit-remediation/spec.md`), five stories, spec-first.** Context: `agent-context/PROJECT-AUDIT-2026-08-18.md` closed both P1 conditions the same day and v0.3.0 shipped, leaving a named but untracked wave — exec-transport trio (REL-01/02/07), REL-03 `ErrNotFound` discrimination, SEC-03 cosign identity pin, TEST-02 mutant. Options considered: **(a)** hand-fix them as loose commits (rejected — AGENTS.md rule 4 is spec-first, and REL-01 is now byte-identical across *three* audits precisely because nothing ever tracked it); **(b)** append them to the existing P5-AUD epic (rejected — that epic's exit gate is CLOSED and reopening it would make "AUD complete" a moving claim); **(c)** a new AUD2 epic keyed to this audit **(chosen)**. Three consequences recorded here so they are not re-litigated: **(1)** AUD2 has **no release-condition story** — the audit had exactly two P1s and both are already closed; **(2)** **WG-S01 is deliberately excluded** — it carries the LGTM governance marker, and GOVERNANCE says such stories are surfaced to the maintainer, which an autonomous loop's decide-and-log does not override; **(3)** AUD2's exit gate is a **`task check` stage**, not a `release-exitgate` step, because that job is `pull_request`-skipped (RELSE-08) and wiring the gate there is how AUD-S18's own stale `CHECK_STAGES` pin survived four merges. A 2026-08-10-keyed AUD2 draft exists only in the local stash `leave-aud2-not-this-epic`, was never committed, and is superseded; its still-open items (F3/F5/F7) stay Later-wave. Revert: delete the spec + backlog section; the four findings return to the audit report untracked. |
+| D-153 | 2026-08-19 | **The cosign signer-identity pin published in `SECURITY.md` was WRONG, not merely missing from `hack/install.sh`: the identity regexp is widened to `^https://github\.com/PlatformRelay/[Aa]ssent/` in both files (AUD2-S03 / SEC-03).** Substance first: `SECURITY.md`'s "Verify a tagged release" instructions pinned `--certificate-identity-regexp '^https://github.com/PlatformRelay/assent/'`, and an adopter who followed them on **v0.2.0 or v0.3.0 got a verification FAILURE on a genuine, correctly signed artifact** — the published recipe has been broken for every release since v0.2.0, and the natural reading of that failure is "this release was tampered with". Cause: the repository was renamed `PlatformRelay/assent` → `PlatformRelay/Assent` between v0.1.0 and v0.2.0; the keyless signing certificate's Subject Alternative Name carries GitHub's canonical casing; cosign compiles `--certificate-identity-regexp` as a Go RE2 pattern and matches it **case-sensitively**. Decoded from the published bundles: v0.3.0 and v0.2.0 sign as `https://github.com/PlatformRelay/Assent/.github/workflows/release.yaml@refs/tags/vX.Y.Z`, v0.1.0 as `https://github.com/PlatformRelay/assent/.github/workflows/release.yaml@refs/heads/main`. All three verify under the new value; independently re-confirmed with real cosign against the real v0.3.0 artifact (`Verified OK` under the new pin, exit 1 "expected SAN value to match regex" under the old). Options considered: **(a)** ship the pin byte-identical to the published-but-broken value and file the breakage as a follow-up (rejected — it would land a green gate asserting a guarantee that fails closed on this project's own releases, D-124's defect one level up); **(b)** case-insensitive `(?i)` (rejected — wider than the defect and it silently accepts casings GitHub never issues); **(c)** an explicit `[Aa]` class in both files, dots escaped (chosen). Not widened otherwise: the `^` anchor and the owner/repo scope stand, so another owner, an `assent-mirror` typosquat, another forge and an unescaped-dot host all still fail. Enforcement, per D-128: **one** published truth — `hack/release/install_cosign_pin_test.sh` extracts the pair from `hack/install.sh` and `SECURITY.md`, requires exactly one distinct value per file, reddens on drift, and (this is the assertion that would have caught the defect) matches the pin against the three **real** SANs above, committed as offline fixtures, plus six negatives. Extends D-110 (bundles beside archives) and D-109; the maintainer-path twin at `hack/release/verify-artifacts.sh:124` is still unpinned and is tracked in the backlog, not fixed here. Revert: restore `'^https://github.com/PlatformRelay/assent/'` in both files — which re-breaks verification of v0.2.0 and every later release, so revert only together with a repo rename back to lowercase. |
diff --git a/openspec/specs/backlog.md b/openspec/specs/backlog.md
index 82b81fac..fea23590 100644
--- a/openspec/specs/backlog.md
+++ b/openspec/specs/backlog.md
@@ -734,6 +734,26 @@ Integrator-owned, not implementer-owned**: the changelog is regenerated *after*
 > (INBOX 2026-08-16). AUD2's gate is a `task check` stage, and the **same commit** adds it to
 > `CHECK_STAGES`.
 
+**Found in flight, NOT an AUD2 story** (kept out of the table above on purpose: D-152 records
+AUD2 as five stories and AUD2-S05's exit gate dispositions S01–S04, so a sixth row would move
+that claim).
+
+| ID | Follow-up | Execution | Depends on | Why it is separate |
+| --- | --- | --- | --- | --- |
+| AUD2-F01 | SEC-03's twin: `hack/release/verify-artifacts.sh:124` runs the same **unpinned** `cosign verify-blob --bundle` on the maintainer/CI path | **[autonomous]** | AUD2-S03 (D-153's value) | found *by* S03, deliberately left alone there — not an owned path, and out of that story's stated scope |
+
+Sizing, from the S03 implementer's reading of the call site: `verify_cosign()`
+(`hack/release/verify-artifacts.sh:118–125`) has the byte-identical unpinned
+`cosign verify-blob --bundle "$bundle" "$archive"` shape, so the **same two flags with the same
+D-153 value** close it — one call site, no bundle-discovery change (`find_sigstore_bundle`
+already mirrors install.sh's candidate list). Three traps: **(1)** it runs via `task
+release-verify` inside `hack/release/exitgate_test.sh`, i.e. on the **push-only**
+`release-exitgate` job (RELSE-08), so the test needs the same offline **stubbed-cosign**
+treatment rather than a real cosign; **(2)** the snapshot path ships no bundles, so the cosign
+branch is skipped there and a naive test would be vacuous; **(3)** it must extend
+`hack/release/install_cosign_pin_test.sh`'s drift comparison as a **third file** (~10 lines)
+rather than start a second published truth (D-128).
+
 **AUD2 status: SPECIFIED.**
 
 ## Phases 3–5
diff --git a/openspec/specs/p5-aud2-audit-remediation/spec.md b/openspec/specs/p5-aud2-audit-remediation/spec.md
index 7f1b6ade..7376b96f 100644
--- a/openspec/specs/p5-aud2-audit-remediation/spec.md
+++ b/openspec/specs/p5-aud2-audit-remediation/spec.md
@@ -48,7 +48,7 @@ Four defects survive on `main` at `b4f5054`, each confirmed by reading the code:
   `./internal/compare/...` **and** the comparison-corpus dogfood green. A regression that stops
   classifying challenge-effect deltas as stricter interventions merges through every wired gate.
 - **SEC-03 (P2, NEW)** — `hack/install.sh:114` runs `cosign verify-blob --bundle` with **no**
-  `--certificate-identity-regexp` / `--certificate-oidc-issuer`, while `SECURITY.md:82–93` pins
+  `--certificate-identity-regexp` / `--certificate-oidc-issuer`, while `SECURITY.md:80–98` pins
   both in its manual instructions. On cosign v2+ the flags are mandatory (the path errors out —
   so `--require-signature` is a *broken* promise) or, where it succeeds, **any** Fulcio identity
   is accepted and a mirror-swapped archive+bundle pair verifies clean.
@@ -98,8 +98,18 @@ invoked by nothing is not a gate).
 - `forge.ErrNotFound` + `errors.Is` discrimination as written in `loadResourceOwnerRegistry`
   (`cmd/assent/provider_host.go:281–285`) and `fileAtRefOrAbsent` (`cmd/assent/run.go:465–474`)
   — S02 mirrors one of them rather than authoring a third idiom.
-- `SECURITY.md:82–93`'s exact cosign flag pair — S03 mirrors it; the script must not invent a
-  different issuer or identity pattern.
+- `SECURITY.md:80–98`'s cosign flag pair (the `### Verify a tagged release` block) — S03
+  mirrors it rather than starting a second published truth, and a drift gate holds the two
+  byte-identical. **Amendment (implementation, AUD2-S03):** the published pair was itself wrong
+  when this epic was written, so "mirror it" could not stay literal. The Fulcio SAN carries the
+  repository's post-rename casing (`PlatformRelay/Assent` from v0.2.0 on; v0.1.0 signed as
+  `assent`) and cosign matches `--certificate-identity-regexp` case-sensitively (Go RE2), so the
+  published lowercase value rejected every release from v0.2.0 on — verified with real cosign
+  against the real v0.3.0 artifact. Both files now publish
+  `--certificate-identity-regexp '^https://github\.com/PlatformRelay/[Aa]ssent/'` (dots escaped:
+  they were metacharacters). The "must not invent a pattern" intent stands, restated: the pin is
+  **verified against committed real-SAN fixtures** decoded from the published bundles
+  (`hack/release/install_cosign_pin_test.sh` §4c/4d), never chosen freely.
 - `examples/comparison/promotion-gates/` suite + `cases/` + `records/` layout — S04's corpus entry.
 
 ---
@@ -328,19 +338,34 @@ installed.
 
 **Goal:** `hack/install.sh:114`'s `cosign verify-blob --bundle` gains
 `--certificate-oidc-issuer https://token.actions.githubusercontent.com` and
-`--certificate-identity-regexp '^https://github.com/PlatformRelay/assent/'` — byte-identical to
-the pair `SECURITY.md:82–93` already publishes — plus a gate that fails if the script and
-`SECURITY.md` ever drift apart.
-
-**Operator input:** none. The issuer and identity pattern are already published; this story
-copies them, it does not choose them.
+`--certificate-identity-regexp '^https://github\.com/PlatformRelay/[Aa]ssent/'` — published
+identically in `SECURITY.md:80–98` — plus a gate that fails if the script and `SECURITY.md`
+ever drift apart.
+
+**Amendment (implementation):** this Goal originally quoted
+`'^https://github.com/PlatformRelay/assent/'`, the value `SECURITY.md` published at the time, on
+the assumption that copying it was sufficient. It was not: the repository was renamed
+`PlatformRelay/assent` → `PlatformRelay/Assent` between v0.1.0 and v0.2.0, the keyless signing
+certificate's SAN carries GitHub's canonical casing, and cosign matches the identity regexp
+case-sensitively (Go RE2). The lowercase value therefore **rejected the project's own v0.2.0 and
+v0.3.0 artifacts** — `--require-signature` would have failed closed on genuine releases, and
+`SECURITY.md`'s copy-paste instructions were broken for adopters the same way (see D-153). The
+shipped value widens the casing and escapes the dots, and nothing else: the `^` anchor and the
+owner/repo scope are unchanged, so another owner, an `assent-mirror` typosquat, another forge and
+an unescaped-dot host (`githubXcom`) all still fail.
+
+**Operator input:** none. The issuer and identity pattern are published, not chosen — but
+"published" is not "correct": the pin is checked against the real Subject Alternative Names
+decoded from the v0.1.0/v0.2.0/v0.3.0 bundles, committed as offline fixtures.
 
 **Dependencies:** none.
 
 **Definition of done:** the script's cosign invocation carries both flags; a bundle signed by
 any other identity fails verification (proved with a stubbed `cosign` on `PATH` that asserts on
 the flags it receives, or a locally generated mismatching bundle — whichever the implementer
-demonstrates actually reddens); deleting either flag from the script reddens the drift gate.
+demonstrates actually reddens); deleting either flag from the script reddens the drift gate; and
+(amendment) the pinned regexp accepts every **real** published release identity, proved against
+committed SAN fixtures rather than self-made ones.
 
 **Not in scope:** changing the release workflow's signing identity; the checksum-manifest
 verification path in `SECURITY.md`; SEC-05 (PAT rotation, operator-only); adding cosign to any