Require signed release tags for publishing

Author: eldryoth

CHANGELOG.md

@@ -48,6 +48,9 @@
   so `1.1.x` checkpoint tags consistently describe the current state as real
   non-dispatchable prototype evidence while active runtime dispatch remains
   scalar-only until a future `1.2.0` admission package.
+- Hardened the workspace publish helper so real crates.io publishing requires
+  `HEAD` to match a verified signed `v<version>` tag, and documented the
+  `git tag -v` release check.
 
 ## 1.1.0 - 2026-06-20
 

docs/RELEASE.md

@@ -219,10 +219,11 @@ evidence, SBOM generation, reproducibility checks, and the standard local gate.
 If this fails, fix the release candidate before tagging.
 
 After the full release gate passes, push the commit, wait for GitHub to become
-green, then create and push the immutable release tag:
+green, then create and push the immutable signed release tag:
 
 ```sh
 git tag -s v1.0.10 -m "base64-ng 1.0.10"
+git tag -v v1.0.10
 git push origin v1.0.10
 ```
 
@@ -236,7 +237,7 @@ scripts/release_crates.py
 
 `scripts/release_crates.py` reads `release-crates.toml`, validates workspace
 crate versions and dependency order, refuses real publishing unless `HEAD`
-matches the `v<version>` tag, runs the standard local gate and
+matches a verified signed `v<version>` tag, runs the standard local gate and
 `cargo publish --dry-run` for each selected crate, publishes `base64-ng` first,
 waits for crates.io visibility, and then publishes dependent companion crates
 such as `base64-ng-sanitization` and `base64-ng-derive`, `base64-ng-serde`,

docs/RELEASE_EVIDENCE.md

@@ -443,12 +443,13 @@ scripts/release_crates.py
 ```
 
 The helper reads `release-crates.toml`, refuses real publishing unless `HEAD`
-matches the release tag, runs the standard local gate and `cargo publish
---dry-run` for selected crates, publishes `base64-ng` first, waits for crates.io
-visibility, and then publishes dependent companion crates. The default publish
-preflight does not rerun Kani because Kani is already part of the pre-tag stable
-gate. Use `scripts/release_crates.py --full-gate` only when the release manager
-deliberately wants to rerun the expensive gate immediately before upload.
+matches a verified signed release tag, runs the standard local gate and
+`cargo publish --dry-run` for selected crates, publishes `base64-ng` first,
+waits for crates.io visibility, and then publishes dependent companion crates.
+The default publish preflight does not rerun Kani because Kani is already part
+of the pre-tag stable gate. Use `scripts/release_crates.py --full-gate` only
+when the release manager deliberately wants to rerun the expensive gate
+immediately before upload.
 
 Manual fallback for companion releases:
 

scripts/release_crates.py

@@ -217,7 +217,26 @@ def check_release_tag(version: str, *, require_tag: bool) -> None:
         print(f"Warning: {message}.", file=sys.stderr)
         return
 
-    print(f"Release tag {tag} points at HEAD.")
+    tag_signature = subprocess.run(
+        ["git", "tag", "-v", tag],
+        cwd=ROOT,
+        check=False,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        text=True,
+    )
+    if tag_signature.returncode != 0:
+        detail = (tag_signature.stderr or tag_signature.stdout).strip()
+        message = f"release tag {tag!r} is not signed or could not be verified"
+        if detail:
+            message = f"{message}: {detail}"
+        if require_tag:
+            print(f"Refusing to publish: {message}.", file=sys.stderr)
+            sys.exit(1)
+        print(f"Warning: {message}.", file=sys.stderr)
+        return
+
+    print(f"Release tag {tag} points at HEAD and has a valid signature.")
 
 
 def confirm_no_verify(args: argparse.Namespace) -> int:

scripts/test-release-crates.py

@@ -4,7 +4,9 @@
 from __future__ import annotations
 
 import copy
+import contextlib
 import importlib.util
+import io
 from pathlib import Path
 from types import SimpleNamespace
 
@@ -186,6 +188,57 @@ def test_publish_sequence_dry_runs_dependents_after_index_wait() -> None:
     ]
 
 
+def test_release_tag_check_requires_valid_signature() -> None:
+    calls: list[tuple[str, ...]] = []
+
+    original_try_capture = release_crates.try_capture
+    original_run = release_crates.subprocess.run
+    try:
+        release_crates.try_capture = lambda command: {
+            ("git", "rev-parse", "HEAD"): "abc",
+            ("git", "rev-list", "-n", "1", "v1.0.10"): "abc",
+        }.get(tuple(command))
+
+        def fake_run(command, **kwargs):
+            calls.append(tuple(command))
+            return SimpleNamespace(returncode=0, stdout="Good signature", stderr="")
+
+        release_crates.subprocess.run = fake_run
+        with contextlib.redirect_stdout(io.StringIO()):
+            release_crates.check_release_tag("1.0.10", require_tag=True)
+    finally:
+        release_crates.try_capture = original_try_capture
+        release_crates.subprocess.run = original_run
+
+    assert ("git", "tag", "-v", "v1.0.10") in calls
+
+
+def test_release_tag_check_rejects_unverified_required_tag() -> None:
+    original_try_capture = release_crates.try_capture
+    original_run = release_crates.subprocess.run
+    try:
+        release_crates.try_capture = lambda command: {
+            ("git", "rev-parse", "HEAD"): "abc",
+            ("git", "rev-list", "-n", "1", "v1.0.10"): "abc",
+        }.get(tuple(command))
+
+        def fake_run(command, **kwargs):
+            return SimpleNamespace(returncode=1, stdout="", stderr="no signature")
+
+        release_crates.subprocess.run = fake_run
+        try:
+            with contextlib.redirect_stderr(io.StringIO()):
+                release_crates.check_release_tag("1.0.10", require_tag=True)
+        except SystemExit as exc:
+            assert exc.code == 1
+            return
+    finally:
+        release_crates.try_capture = original_try_capture
+        release_crates.subprocess.run = original_run
+
+    raise AssertionError("expected release tag check to exit")
+
+
 def run_tests() -> None:
     tests = (
         test_current_plan_accepts_unchanged_crates,
@@ -194,6 +247,8 @@ def run_tests() -> None:
         test_unchanged_crates_are_not_published,
         test_publish_plan_skips_unchanged_crates,
         test_publish_sequence_dry_runs_dependents_after_index_wait,
+        test_release_tag_check_requires_valid_signature,
+        test_release_tag_check_rejects_unverified_required_tag,
     )
     for test in tests:
         test()