Releases · pulseengine/sigil

28 Mar 08:35

avrabe

v0.7.0

8d20949

v0.7.0 Latest

Latest

🎉 wsc vv0.7.0 Release

📦 Native CLI Binaries

Platform	Binary	TPM2 Support
Linux x86_64	`wsc-linux-x86_64`	❌
Linux x86_64	`wsc-linux-x86_64-tpm2`	✅
Linux aarch64	`wsc-linux-aarch64`	❌
macOS x86_64 (Intel)	`wsc-macos-x86_64`	❌
macOS aarch64 (Apple Silicon)	`wsc-macos-aarch64`	❌
Windows x86_64	`wsc-windows-x86_64.exe`	❌

📦 WebAssembly Components

Component Library (WIT Interface):

wsc-component.wasm - WebAssembly component with WIT bindings
Signed OCI artifact: ghcr.io/pulseengine/wsc:v0.7.0

CLI Tool (WASI Binary):

wsc-cli.wasm - WASI command-line tool for Wasmtime
Signed OCI artifact: ghcr.io/pulseengine/wsc:v0.7.0-cli

🔐 Security Features

✅ WASM Module Signing - Signed with wsc keyless signing (dogfooding!)
✅ OCI Artifact Signing - Signed with Cosign using GitHub OIDC (keyless)
✅ SLSA Provenance - Build attestation included
✅ SHA256 Checksums - For download verification

Keyless Signing:

Identity: GitHub Actions OIDC
Certificate: Short-lived from Fulcio (Sigstore)
Transparency: Logged in Rekor

🚀 Quick Start

# Download native CLI for your platform
TAG=v0.7.0

# Linux x86_64
curl -LO https://github.com/pulseengine/sigil/releases/download/${TAG}/wsc-linux-x86_64
chmod +x wsc-linux-x86_64
./wsc-linux-x86_64 --version

# macOS Apple Silicon
curl -LO https://github.com/pulseengine/sigil/releases/download/${TAG}/wsc-macos-aarch64
chmod +x wsc-macos-aarch64
./wsc-macos-aarch64 --version

🔍 Verify Signatures

# Verify WASM module signature
wsc verify --keyless -i wsc-component.wasm

# Verify OCI artifact signature
cosign verify \
  --certificate-identity-regexp="https://github.com/pulseengine/sigil" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/pulseengine/wsc:${TAG}

📚 Documentation

See README.md for full documentation.

Assets 19

sigil-v0.7.0-compliance-report.tar.gz

sha256:39a48587782f76a3a00fd57db000d0db76c80fd254e8172dc7a5112fc1459049

239 KB 2026-03-28T10:15:10Z
wsc-cli.wasm

sha256:a57139921f87e91282f22f788155177eadf2085e21a7f2f8ceb8d9fac1c761ef

27.2 MB 2026-03-28T10:15:10Z
wsc-cli.wasm.sha256

sha256:1e9ceb6e5d503987ddd69cc99b3a018f4c91385fcc3a9a34b3078a439f61e87a

79 Bytes 2026-03-28T10:15:10Z
wsc-component.wasm

sha256:15efa8033741c4613165ae49b002847df9afcc27af876778884c79aaea4d45b2

3.29 MB 2026-03-28T10:15:10Z
wsc-component.wasm.sha256

sha256:d1d339b3689c920d38512b481116099e065100dc97b7da31f0766066c3676a22

85 Bytes 2026-03-28T10:15:10Z
wsc-linux-aarch64

sha256:ca48e798c3a73323ed10421b8672e8fcc411dc55389aa9e6c51b4bcd18e845bf

4.13 MB 2026-03-28T10:15:10Z
wsc-linux-aarch64.sha256

sha256:e213c8e85fda473fd680d94fb80d916cb12f484e55540ba686790558239095dc

84 Bytes 2026-03-28T10:15:10Z
wsc-linux-x86_64

sha256:b670fb823563ac8b80e04fd0337813f9276e5c783239bb62afe74ed759b78897

4.79 MB 2026-03-28T10:15:10Z
wsc-linux-x86_64-tpm2

sha256:3897a81d92e1ce25fce5d965baaf37b3928fed2a993a5789a6885330ebfd7f50

4.79 MB 2026-03-28T10:15:10Z
wsc-linux-x86_64-tpm2.sha256

sha256:c3acd7cba18082477de282df33c2e725b3e2e9be0b97da227c82f56b3bc42771

88 Bytes 2026-03-28T10:15:10Z
Source code (zip)

2026-03-28T08:35:06Z
Source code (tar.gz)

2026-03-28T08:35:06Z

27 Mar 19:55

avrabe

v0.6.1

3f44a08

v0.6.1

🎉 wsc vv0.6.1 Release

📦 Native CLI Binaries

Platform	Binary	TPM2 Support
Linux x86_64	`wsc-linux-x86_64`	❌
Linux x86_64	`wsc-linux-x86_64-tpm2`	✅
Linux aarch64	`wsc-linux-aarch64`	❌
macOS x86_64 (Intel)	`wsc-macos-x86_64`	❌
macOS aarch64 (Apple Silicon)	`wsc-macos-aarch64`	❌
Windows x86_64	`wsc-windows-x86_64.exe`	❌

📦 WebAssembly Components

Component Library (WIT Interface):

wsc-component.wasm - WebAssembly component with WIT bindings
Signed OCI artifact: ghcr.io/pulseengine/wsc:v0.6.1

CLI Tool (WASI Binary):

wsc-cli.wasm - WASI command-line tool for Wasmtime
Signed OCI artifact: ghcr.io/pulseengine/wsc:v0.6.1-cli

🔐 Security Features

✅ WASM Module Signing - Signed with wsc keyless signing (dogfooding!)
✅ OCI Artifact Signing - Signed with Cosign using GitHub OIDC (keyless)
✅ SLSA Provenance - Build attestation included
✅ SHA256 Checksums - For download verification

Keyless Signing:

Identity: GitHub Actions OIDC
Certificate: Short-lived from Fulcio (Sigstore)
Transparency: Logged in Rekor

🚀 Quick Start

# Download native CLI for your platform
TAG=v0.6.1

# Linux x86_64
curl -LO https://github.com/pulseengine/sigil/releases/download/${TAG}/wsc-linux-x86_64
chmod +x wsc-linux-x86_64
./wsc-linux-x86_64 --version

# macOS Apple Silicon
curl -LO https://github.com/pulseengine/sigil/releases/download/${TAG}/wsc-macos-aarch64
chmod +x wsc-macos-aarch64
./wsc-macos-aarch64 --version

🔍 Verify Signatures

# Verify WASM module signature
wsc verify --keyless -i wsc-component.wasm

# Verify OCI artifact signature
cosign verify \
  --certificate-identity-regexp="https://github.com/pulseengine/sigil" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/pulseengine/wsc:${TAG}

📚 Documentation

See README.md for full documentation.

Assets 19

23 Mar 05:17

avrabe

v0.6.0

75f2cb6

v0.6.0

What's Changed

fix: only publish crates on tag pushes by @avrabe in #43
docs: align README with PulseEngine visual identity by @avrabe in #44
docs: PulseEngine branding and terminology alignment by @avrabe in #45
fix: rotate Rekor TLS certificate pin by @avrabe in #51
feat: add Rivet STPA-Sec traceability and convert security docs by @avrabe in #50
fix: enforce fail-closed Rekor verification and close STPA-Sec coverage gaps by @avrabe in #52
feat: add OIDC issuer validation for keyless signing (UCA-12) by @avrabe in #53
fix: Phase 1 security hardening — sentinel constant, OIDC warnings, skip_rekor by @avrabe in #54
feat: add ELF and MCUboot signing support with format abstraction (Phase 2) by @avrabe in #55
feat: add fuzz targets for ELF, MCUboot, and format detection (CV-15) by @avrabe in #56
feat: add Kani proof harnesses and formal verification strategy (19 proofs) by @avrabe in #57
feat: transcoding attestation protocol, Nix flake, SLSA L3 artifacts by @avrabe in #58
feat: build environment attestation for SLSA provenance by @avrabe in #59
feat: cosign delegation and Rekor proof caching (Phase 3.1 + 4.1) by @avrabe in #60
feat: Verus formal proofs, PQC module, rules_verus integration by @avrabe in #61
feat: OCI referrers, Sigstore bundle, Lean4 proofs, CI hardening by @avrabe in #62
feat: fill Verus/Lean proofs and wire proof cache into verifier by @avrabe in #63
ci: make Kani bounded model checking a required check by @avrabe in #64
fix: target Kani proofs to wsc package with bounded unwind by @avrabe in #65
feat: SCT monitoring, checkpoint consistency, fix rivet validation by @avrabe in #66
chore: release v0.6.0 by @avrabe in #67
feat: compliance report in release pipeline by @avrabe in #68

Full Changelog: v0.5.1...v0.6.0

Contributors

avrabe

Assets 19

01 Feb 07:06

avrabe

v0.5.1

8d43305

wsc v0.5.1

🎉 wsc v0.5.1 Release

📦 Native CLI Binaries

Platform	Binary	TPM2 Support
Linux x86_64	`wsc-linux-x86_64`	❌
Linux x86_64	`wsc-linux-x86_64-tpm2`	✅
Linux aarch64	`wsc-linux-aarch64`	❌
macOS x86_64 (Intel)	`wsc-macos-x86_64`	❌
macOS aarch64 (Apple Silicon)	`wsc-macos-aarch64`	❌
Windows x86_64	`wsc-windows-x86_64.exe`	❌

📦 Rust Crates

Available on crates.io:

wsc-attestation v0.5.1
wsc v0.5.1
wsc-cli v0.5.1

✨ What's New

This release includes comprehensive cross-platform native CLI builds:

6 platform targets with pre-built binaries
TPM2 hardware security support on Linux
Keyless signing via Sigstore/Fulcio
Rekor transparency log integration
Certificate pinning with shared TLS config

Assets 14

08 Jan 17:59

avrabe

v0.4.1

1f0721d

v0.4.1 - wsc-attestation crate

🎉 wsc WebAssembly Components Release

📦 What's Included

Component Library (WIT Interface):

wsc-component.wasm - WebAssembly component library with WIT bindings
wsc-component.wasm.sha256 - SHA256 checksum
Signed OCI artifact: ghcr.io/pulseengine/wsc:v0.4.1

CLI Tool (WASI Binary):

wsc-cli.wasm - WASI command-line tool for Wasmtime
wsc-cli.wasm.sha256 - SHA256 checksum
Signed OCI artifact: ghcr.io/pulseengine/wsc:v0.4.1-cli

🔐 Security Features

✅ WASM Module Signing - Signed with wsc keyless signing (dogfooding!)
✅ OCI Artifact Signing - Signed with Cosign using GitHub OIDC (keyless)
✅ SLSA Provenance - Build attestation included
✅ SHA256 Checksums - For download verification

wsc Keyless Signing:

Identity: GitHub Actions OIDC
Certificate: Short-lived from Fulcio (Sigstore)
Transparency: Logged in Rekor transparency log

🚀 Usage

Download WASM Component

# Download and verify checksum
TAG=v0.4.1
wget https://github.com/pulseengine/wsc/releases/download/${TAG}/wsc.wasm
wget https://github.com/pulseengine/wsc/releases/download/${TAG}/wsc.wasm.sha256
sha256sum -c wsc.wasm.sha256

Pull Signed OCI Artifact

TAG=v0.4.1

# Pull the signed OCI artifact with oras
oras pull ghcr.io/pulseengine/wsc:${TAG}

# Verify signature with Cosign
cosign verify \
  --certificate-identity-regexp="https://github.com/pulseengine/wsc" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/pulseengine/wsc:${TAG}

# Verify SLSA provenance
cosign verify-attestation \
  --type slsaprovenance \
  --certificate-identity-regexp="https://github.com/pulseengine/wsc" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/pulseengine/wsc:${TAG}

🔍 Verification

Verify WASM Module Signature (wsc)

# Verify keyless signature (offline - no network required!)
wsc verify --keyless \
  --cert-identity "https://github.com/pulseengine/wsc/.github/workflows/release.yml@refs/tags/${TAG}" \
  --cert-oidc-issuer "https://token.actions.githubusercontent.com" \
  -i wsc-component.wasm

# Or verify without identity constraints
wsc verify --keyless -i wsc-component.wasm

Verify OCI Artifact Signature (Cosign)

TAG=v0.4.1

# Verify Cosign signature
cosign verify \
  --certificate-identity-regexp="https://github.com/pulseengine/wsc" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/pulseengine/wsc:${TAG}

# Verify SLSA provenance
cosign verify-attestation \
  --type slsaprovenance \
  --certificate-identity-regexp="https://github.com/pulseengine/wsc" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/pulseengine/wsc:${TAG}

All releases are:

Built in GitHub Actions with full transparency
Signed with wsc keyless signing (WASM modules)
Signed with Cosign using keyless signing (OCI artifacts)
Attested with SLSA provenance
Checksummed with SHA256

📚 Documentation

See README.md for usage details.

Assets 6

02 Jan 16:13

avrabe

v0.4.0

21155c0

v0.4.0

🎉 wsc WebAssembly Components Release

📦 What's Included

Component Library (WIT Interface):

wsc-component.wasm - WebAssembly component library with WIT bindings
wsc-component.wasm.sha256 - SHA256 checksum
Signed OCI artifact: ghcr.io/pulseengine/wsc:v0.4.0

CLI Tool (WASI Binary):

wsc-cli.wasm - WASI command-line tool for Wasmtime
wsc-cli.wasm.sha256 - SHA256 checksum
Signed OCI artifact: ghcr.io/pulseengine/wsc:v0.4.0-cli

🔐 Security Features

✅ WASM Module Signing - Signed with wsc keyless signing (dogfooding!)
✅ OCI Artifact Signing - Signed with Cosign using GitHub OIDC (keyless)
✅ SLSA Provenance - Build attestation included
✅ SHA256 Checksums - For download verification

wsc Keyless Signing:

Identity: GitHub Actions OIDC
Certificate: Short-lived from Fulcio (Sigstore)
Transparency: Logged in Rekor transparency log

🚀 Usage

Download WASM Component

# Download and verify checksum
TAG=v0.4.0
wget https://github.com/pulseengine/wsc/releases/download/${TAG}/wsc.wasm
wget https://github.com/pulseengine/wsc/releases/download/${TAG}/wsc.wasm.sha256
sha256sum -c wsc.wasm.sha256

Pull Signed OCI Artifact

TAG=v0.4.0

# Pull the signed OCI artifact with oras
oras pull ghcr.io/pulseengine/wsc:${TAG}

# Verify signature with Cosign
cosign verify \
  --certificate-identity-regexp="https://github.com/pulseengine/wsc" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/pulseengine/wsc:${TAG}

# Verify SLSA provenance
cosign verify-attestation \
  --type slsaprovenance \
  --certificate-identity-regexp="https://github.com/pulseengine/wsc" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/pulseengine/wsc:${TAG}

🔍 Verification

Verify WASM Module Signature (wsc)

# Verify keyless signature (offline - no network required!)
wsc verify --keyless \
  --cert-identity "https://github.com/pulseengine/wsc/.github/workflows/release.yml@refs/tags/${TAG}" \
  --cert-oidc-issuer "https://token.actions.githubusercontent.com" \
  -i wsc-component.wasm

# Or verify without identity constraints
wsc verify --keyless -i wsc-component.wasm

Verify OCI Artifact Signature (Cosign)

TAG=v0.4.0

# Verify Cosign signature
cosign verify \
  --certificate-identity-regexp="https://github.com/pulseengine/wsc" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/pulseengine/wsc:${TAG}

# Verify SLSA provenance
cosign verify-attestation \
  --type slsaprovenance \
  --certificate-identity-regexp="https://github.com/pulseengine/wsc" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/pulseengine/wsc:${TAG}

All releases are:

Built in GitHub Actions with full transparency
Signed with wsc keyless signing (WASM modules)
Signed with Cosign using keyless signing (OCI artifacts)
Attested with SLSA provenance
Checksummed with SHA256

📚 Documentation

See README.md for usage details.

Assets 6

01 Jan 05:47

github-actions

v0.3.1

f737a0e

v0.3.1

🎉 wsc WebAssembly Components Release

📦 What's Included

Component Library (WIT Interface):

wsc-component.wasm - WebAssembly component library with WIT bindings
wsc-component.wasm.sha256 - SHA256 checksum
Signed OCI artifact: ghcr.io/pulseengine/wsc:

CLI Tool (WASI Binary):

wsc-cli.wasm - WASI command-line tool for Wasmtime
wsc-cli.wasm.sha256 - SHA256 checksum
Signed OCI artifact: ghcr.io/pulseengine/wsc:-cli

🔐 Security Features

✅ WASM Module Signing - Signed with wsc keyless signing (dogfooding!)
✅ OCI Artifact Signing - Signed with Cosign using GitHub OIDC (keyless)
✅ SLSA Provenance - Build attestation included
✅ SHA256 Checksums - For download verification

wsc Keyless Signing:

Identity: GitHub Actions OIDC
Certificate: Short-lived from Fulcio (Sigstore)
Transparency: Logged in Rekor transparency log

🚀 Usage

Download WASM Component

# Download and verify checksum
TAG=
wget https://github.com/pulseengine/wsc/releases/download/${TAG}/wsc.wasm
wget https://github.com/pulseengine/wsc/releases/download/${TAG}/wsc.wasm.sha256
sha256sum -c wsc.wasm.sha256

Pull Signed OCI Artifact

TAG=

# Pull the signed OCI artifact with oras
oras pull ghcr.io/pulseengine/wsc:${TAG}

# Verify signature with Cosign
cosign verify \
  --certificate-identity-regexp="https://github.com/pulseengine/wsc" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/pulseengine/wsc:${TAG}

# Verify SLSA provenance
cosign verify-attestation \
  --type slsaprovenance \
  --certificate-identity-regexp="https://github.com/pulseengine/wsc" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/pulseengine/wsc:${TAG}

🔍 Verification

Verify WASM Module Signature (wsc)

# Verify keyless signature (offline - no network required!)
wsc verify --keyless \
  --cert-identity "https://github.com/pulseengine/wsc/.github/workflows/release.yml@refs/tags/${TAG}" \
  --cert-oidc-issuer "https://token.actions.githubusercontent.com" \
  -i wsc-component.wasm

# Or verify without identity constraints
wsc verify --keyless -i wsc-component.wasm

Verify OCI Artifact Signature (Cosign)

TAG=

# Verify Cosign signature
cosign verify \
  --certificate-identity-regexp="https://github.com/pulseengine/wsc" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/pulseengine/wsc:${TAG}

# Verify SLSA provenance
cosign verify-attestation \
  --type slsaprovenance \
  --certificate-identity-regexp="https://github.com/pulseengine/wsc" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/pulseengine/wsc:${TAG}

All releases are:

Built in GitHub Actions with full transparency
Signed with wsc keyless signing (WASM modules)
Signed with Cosign using keyless signing (OCI artifacts)
Attested with SLSA provenance
Checksummed with SHA256

📚 Documentation

See README.md for usage details.

Assets 6

31 Dec 20:13

github-actions

v0.3.0

fbd4911

v0.3.0

🎉 wsc WebAssembly Components Release

📦 What's Included

Component Library (WIT Interface):

wsc-component.wasm - WebAssembly component library with WIT bindings
wsc-component.wasm.sha256 - SHA256 checksum
Signed OCI artifact: ghcr.io/pulseengine/wsc:

CLI Tool (WASI Binary):

wsc-cli.wasm - WASI command-line tool for Wasmtime
wsc-cli.wasm.sha256 - SHA256 checksum
Signed OCI artifact: ghcr.io/pulseengine/wsc:-cli

🔐 Security Features

✅ WASM Module Signing - Signed with wsc keyless signing (dogfooding!)
✅ OCI Artifact Signing - Signed with Cosign using GitHub OIDC (keyless)
✅ SLSA Provenance - Build attestation included
✅ SHA256 Checksums - For download verification

wsc Keyless Signing:

Identity: GitHub Actions OIDC
Certificate: Short-lived from Fulcio (Sigstore)
Transparency: Logged in Rekor transparency log

🚀 Usage

Download WASM Component

# Download and verify checksum
TAG=
wget https://github.com/pulseengine/wsc/releases/download/${TAG}/wsc.wasm
wget https://github.com/pulseengine/wsc/releases/download/${TAG}/wsc.wasm.sha256
sha256sum -c wsc.wasm.sha256

Pull Signed OCI Artifact

TAG=

# Pull the signed OCI artifact with oras
oras pull ghcr.io/pulseengine/wsc:${TAG}

# Verify signature with Cosign
cosign verify \
  --certificate-identity-regexp="https://github.com/pulseengine/wsc" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/pulseengine/wsc:${TAG}

# Verify SLSA provenance
cosign verify-attestation \
  --type slsaprovenance \
  --certificate-identity-regexp="https://github.com/pulseengine/wsc" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/pulseengine/wsc:${TAG}

🔍 Verification

Verify WASM Module Signature (wsc)

# Verify keyless signature (offline - no network required!)
wsc verify --keyless \
  --cert-identity "https://github.com/pulseengine/wsc/.github/workflows/release.yml@refs/tags/${TAG}" \
  --cert-oidc-issuer "https://token.actions.githubusercontent.com" \
  -i wsc-component.wasm

# Or verify without identity constraints
wsc verify --keyless -i wsc-component.wasm

Verify OCI Artifact Signature (Cosign)

TAG=

# Verify Cosign signature
cosign verify \
  --certificate-identity-regexp="https://github.com/pulseengine/wsc" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/pulseengine/wsc:${TAG}

# Verify SLSA provenance
cosign verify-attestation \
  --type slsaprovenance \
  --certificate-identity-regexp="https://github.com/pulseengine/wsc" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/pulseengine/wsc:${TAG}

All releases are:

Built in GitHub Actions with full transparency
Signed with wsc keyless signing (WASM modules)
Signed with Cosign using keyless signing (OCI artifacts)
Attested with SLSA provenance
Checksummed with SHA256

📚 Documentation

See README.md for usage details.

Assets 6

15 Nov 15:14

avrabe

v0.2.7-rc3

b7a616b

v0.2.7-rc3 Pre-release

Pre-release

🎉 wsc WebAssembly Components Release

📦 What's Included

Component Library (WIT Interface):

wsc-component.wasm - WebAssembly component library with WIT bindings
wsc-component.wasm.sha256 - SHA256 checksum
Signed OCI artifact: ghcr.io/pulseengine/wsc:v0.2.7-rc3

CLI Tool (WASI Binary):

wsc-cli.wasm - WASI command-line tool for Wasmtime
wsc-cli.wasm.sha256 - SHA256 checksum
Signed OCI artifact: ghcr.io/pulseengine/wsc:v0.2.7-rc3-cli

🔐 Security Features

✅ WASM Module Signing - Signed with wsc keyless signing (dogfooding!)
✅ OCI Artifact Signing - Signed with Cosign using GitHub OIDC (keyless)
✅ SLSA Provenance - Build attestation included
✅ SHA256 Checksums - For download verification

wsc Keyless Signing:

Identity: GitHub Actions OIDC
Certificate: Short-lived from Fulcio (Sigstore)
Transparency: Logged in Rekor transparency log

🚀 Usage

Download WASM Component

# Download and verify checksum
TAG=v0.2.7-rc3
wget https://github.com/pulseengine/wsc/releases/download/${TAG}/wsc.wasm
wget https://github.com/pulseengine/wsc/releases/download/${TAG}/wsc.wasm.sha256
sha256sum -c wsc.wasm.sha256

Pull Signed OCI Artifact

TAG=v0.2.7-rc3

# Pull the signed OCI artifact with oras
oras pull ghcr.io/pulseengine/wsc:${TAG}

# Verify signature with Cosign
cosign verify \
  --certificate-identity-regexp="https://github.com/pulseengine/wsc" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/pulseengine/wsc:${TAG}

# Verify SLSA provenance
cosign verify-attestation \
  --type slsaprovenance \
  --certificate-identity-regexp="https://github.com/pulseengine/wsc" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/pulseengine/wsc:${TAG}

🔍 Verification

Verify WASM Module Signature (wsc)

# Download a release (once wsc verification is implemented)
# wsc verify --keyless \
#   --identity "https://github.com/pulseengine/wsc" \
#   --issuer "https://token.actions.githubusercontent.com" \
#   --input-file wsc-component.wasm

# For now, signatures are embedded but verification is pending implementation

Verify OCI Artifact Signature (Cosign)

TAG=v0.2.7-rc3

# Verify Cosign signature
cosign verify \
  --certificate-identity-regexp="https://github.com/pulseengine/wsc" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/pulseengine/wsc:${TAG}

# Verify SLSA provenance
cosign verify-attestation \
  --type slsaprovenance \
  --certificate-identity-regexp="https://github.com/pulseengine/wsc" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/pulseengine/wsc:${TAG}

All releases are:

Built in GitHub Actions with full transparency
Signed with wsc keyless signing (WASM modules)
Signed with Cosign using keyless signing (OCI artifacts)
Attested with SLSA provenance
Checksummed with SHA256

📚 Documentation

See README.md for usage details.

Assets 6

11 Nov 06:06

github-actions

v0.2.7-rc.1

6b9ca17

v0.2.7-rc.1 Pre-release

Pre-release

🎉 wsc WebAssembly Components Release

📦 What's Included

Component Library (WIT Interface):

wsc-component.wasm - WebAssembly component library with WIT bindings
wsc-component.wasm.sha256 - SHA256 checksum
Signed OCI artifact: ghcr.io/pulseengine/wsc:

CLI Tool (WASI Binary):

wsc-cli.wasm - WASI command-line tool for Wasmtime
wsc-cli.wasm.sha256 - SHA256 checksum
Signed OCI artifact: ghcr.io/pulseengine/wsc:-cli

🔐 Security Features

✅ WASM Module Signing - Signed with wsc keyless signing (dogfooding!)
✅ OCI Artifact Signing - Signed with Cosign using GitHub OIDC (keyless)
✅ SLSA Provenance - Build attestation included
✅ SHA256 Checksums - For download verification

wsc Keyless Signing:

Identity: GitHub Actions OIDC
Certificate: Short-lived from Fulcio (Sigstore)
Transparency: Logged in Rekor transparency log

🚀 Usage

Download WASM Component

# Download and verify checksum
TAG=
wget https://github.com/pulseengine/wsc/releases/download/${TAG}/wsc.wasm
wget https://github.com/pulseengine/wsc/releases/download/${TAG}/wsc.wasm.sha256
sha256sum -c wsc.wasm.sha256

Pull Signed OCI Artifact

TAG=

# Pull the signed OCI artifact with oras
oras pull ghcr.io/pulseengine/wsc:${TAG}

# Verify signature with Cosign
cosign verify \
  --certificate-identity-regexp="https://github.com/pulseengine/wsc" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/pulseengine/wsc:${TAG}

# Verify SLSA provenance
cosign verify-attestation \
  --type slsaprovenance \
  --certificate-identity-regexp="https://github.com/pulseengine/wsc" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/pulseengine/wsc:${TAG}

🔍 Verification

Verify WASM Module Signature (wsc)

# Download a release (once wsc verification is implemented)
# wsc verify --keyless \
#   --identity "https://github.com/pulseengine/wsc" \
#   --issuer "https://token.actions.githubusercontent.com" \
#   --input-file wsc-component.wasm

# For now, signatures are embedded but verification is pending implementation

Verify OCI Artifact Signature (Cosign)

TAG=

# Verify Cosign signature
cosign verify \
  --certificate-identity-regexp="https://github.com/pulseengine/wsc" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/pulseengine/wsc:${TAG}

# Verify SLSA provenance
cosign verify-attestation \
  --type slsaprovenance \
  --certificate-identity-regexp="https://github.com/pulseengine/wsc" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/pulseengine/wsc:${TAG}

All releases are:

Built in GitHub Actions with full transparency
Signed with wsc keyless signing (WASM modules)
Signed with Cosign using keyless signing (OCI artifacts)
Attested with SLSA provenance
Checksummed with SHA256

📚 Documentation

See README.md for usage details.

Assets 6

Releases: pulseengine/sigil

v0.7.0

🎉 wsc vv0.7.0 Release

📦 Native CLI Binaries

📦 WebAssembly Components

🔐 Security Features

🚀 Quick Start

🔍 Verify Signatures

📚 Documentation

Uh oh!

v0.6.1

🎉 wsc vv0.6.1 Release

📦 Native CLI Binaries

📦 WebAssembly Components

🔐 Security Features

🚀 Quick Start

🔍 Verify Signatures

📚 Documentation

Uh oh!

v0.6.0

What's Changed

Contributors

Uh oh!

wsc v0.5.1

🎉 wsc v0.5.1 Release

📦 Native CLI Binaries

📦 Rust Crates

✨ What's New

Uh oh!

v0.4.1 - wsc-attestation crate

🎉 wsc WebAssembly Components Release

📦 What's Included

🔐 Security Features

🚀 Usage

Download WASM Component

Pull Signed OCI Artifact

🔍 Verification

Verify WASM Module Signature (wsc)

Verify OCI Artifact Signature (Cosign)

📚 Documentation

Uh oh!

v0.4.0

🎉 wsc WebAssembly Components Release

📦 What's Included

🔐 Security Features

🚀 Usage

Download WASM Component

Pull Signed OCI Artifact

🔍 Verification

Verify WASM Module Signature (wsc)

Verify OCI Artifact Signature (Cosign)

📚 Documentation

Uh oh!

v0.3.1

🎉 wsc WebAssembly Components Release

📦 What's Included

🔐 Security Features

🚀 Usage

Download WASM Component

Pull Signed OCI Artifact

🔍 Verification

Verify WASM Module Signature (wsc)

Verify OCI Artifact Signature (Cosign)

📚 Documentation

Uh oh!

v0.3.0

🎉 wsc WebAssembly Components Release

📦 What's Included

🔐 Security Features

🚀 Usage

Download WASM Component

Pull Signed OCI Artifact

🔍 Verification

Verify WASM Module Signature (wsc)

Verify OCI Artifact Signature (Cosign)

📚 Documentation

Uh oh!

v0.2.7-rc3

🎉 wsc WebAssembly Components Release

📦 What's Included