CLI binary size optimization: reduce from 118MB to ~85MB

[migmartri]

Problem

The Chainloop CLI binary is 118 MB (stripped, release build) / 151 MB (local, unstripped). This affects download times, CI/CD pipeline performance, and container image sizes.

[waveywaves]

I investigated this and want to share concrete numbers. The short version: there's no easy path to 85 MB. The heavy dependencies are all load-bearing.

Setup

All measurements: current main (v1.93.x), CGO_ENABLED=0, darwin/arm64, stripped with -ldflags="-s -w" (matching goreleaser config).

Baseline

The issue cites 118 MB, but the current stripped binary is 106.1 MB — Go linker improvements and dep cleanup since filing account for the ~12 MB drop. No code change needed for that.

What I measured

Experiment	Size	Delta	% of baseline
Stripped baseline (current goreleaser)	106.1 MB	—	—
+ `-trimpath -buildvcs=false`	105.8 MB	-0.3 MB	-0.3% (negligible)
Remove 4 sigstore KMS blank imports	97.4 MB	-8.7 MB	-8.2%
Remove Regal lint deps from `policydevel`	103.0 MB	-3.1 MB	-2.9%
Both KMS + Regal removed	~94 MB (est.)	~-12 MB	~-11%

Target from issue: 106 → 85 MB = -21 MB (-20%). Best achievable with safe changes: ~-12 MB (-11%). That's roughly half the target.

Why the heavy deps can't be removed

1. Sigstore KMS providers (main.go:27-30, ~9 MB): 4 blank imports register AWS/Azure/GCP/HashiVault KMS providers into cosign's registry. Used transitively by cosign.SignerFromKeyRef() in pkg/attestation/signer/cosign/signer.go:63 when users sign with --key awskms://.... Not dead code — removing breaks cloud-KMS signing.

2. OPA + Extism WASM (core policy engine): Required by the attestation push flow (pkg/policies/engine/rego/, pkg/policies/engine/wasm/). Can't remove without gutting policy evaluation.

3. Regal (policydevel/lint.go, ~3 MB): Only used by chainloop policy develop lint. Removable via build tag, but 3 MB is a 2.9% savings — hard to justify the complexity.

4. Cosign v3 + sigstore-go (verification, signing): Core to the attestation signing and bundle verification flow.

5. Protobuf/gRPC: Core transport. Non-negotiable.

What would actually move the needle

These all require architectural decisions, not code fixes:

• Split into separate binaries (e.g., chainloop core vs chainloop-policy dev tools) — removes Regal + potentially OPA from the main binary
• Move signing entirely server-side — drops cosign + all KMS deps from the CLI
• Replace cosign's SignerFromKeyRef with direct sigstore calls that don't use the KMS plugin registry — deep signer package surgery, unclear savings

My take

The binary is 106 MB because it genuinely does a lot: sign with cosign, verify with sigstore, evaluate OPA/WASM policies, parse 30+ material formats, talk gRPC. The easy optimizations (-trimpath, build flags) are already applied or negligible. The remaining wins require product-level decisions about what the CLI should and shouldn't do.

Happy to implement whatever direction you choose — just wanted to lay out the data first so expectations are calibrated.

@migmartri @jiparis