Verify a release

OBLITERATUS ships offensive modules, so the artifacts will trip SmartScreen and Defender no matter what. This page is about the guarantees that can be made cryptographically, and the one that cannot be made yet.

What the pipeline produces

.github/workflows/release.yml runs on every v* tag and emits, per release:

Artifact	What it proves
obliteratus_<ver>_windows_<arch>.zip	The binaries plus README, SECURITY.md and LICENSE
checksums.txt	SHA-256 of every archive
checksums.txt.sig	cosign keyless signature over `checksums.txt`
checksums.txt.pem	The short-lived certificate binding that signature to the workflow run
*.sbom.json	SPDX SBOM (syft) — full dependency inventory per archive

There is no long-lived signing key in this repository. The keyless signature is bound to the GitHub Actions OIDC identity of the workflow run and recorded in the Sigstore Rekor transparency log, so it cannot be forged without compromising GitHub's OIDC issuer — and any use of that identity is publicly logged.

Verify a download

Install cosign — docs.sigstore.dev

Checksum integrity.

sha256sum -c checksums.txt
# PowerShell: Get-FileHash -Algorithm SHA256 .\obliteratus_2.0.2_windows_amd64.zip

Signature, pinned to the exact workflow identity.

cosign verify-blob \
  --certificate checksums.txt.pem \
  --signature   checksums.txt.sig \
  --certificate-identity-regexp "^https://github.com/DevCop95/pullgoscript/" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  checksums.txt
# → "Verified OK"

Transparency log entry — proves it was logged, not merely signed.
```
rekor-cli get --artifact checksums.txt
```

The identity flag is the crux. A bare Verified OK only says someone signed the file. Pinning the identity to DevCop95/pullgoscript is what stops a signature from any other repository being accepted. For v2.0.2 the certificate subject is exactly:

https://github.com/DevCop95/pullgoscript/.github/workflows/release.yml@refs/tags/v2.0.2

Use --certificate-identity (singular, exact match) to pin one tag instead of the repository. Note that the subject embeds the repository name at the time of the release, so a later rename invalidates an exact pin — which is why the release workflow builds its self-check from ${GITHUB_REPOSITORY} and the command above uses the repo-prefix regexp.

cosign v3 prints Flag --certificate has been deprecated… for the two flags above. That is expected: the release ships the detached .sig + .pem pair and the warning refers to the newer single-file --bundle form. The verification result is unaffected.

Reviewing the dependency inventory

syft convert obliteratus_2.0.2_windows_amd64.sbom.json -o table
# or grep for the modules you actually care about

Authenticode: not applied

The .exe files are not Authenticode-signed. Concretely:

Get-AuthenticodeSignature .\obliteratus.exe → Status: NotSigned
SmartScreen shows "Windows protected your PC"; Defender may quarantine on sight of the injection / credential-collection strings

This is expected for an unsigned offensive tool and is not a build failure. A signature Windows actually trusts needs an EV certificate or an Azure Trusted Signing account — a paid, identity-verified credential that must live in a secret. No placeholder certificate is checked into CI, because a placeholder would prove nothing while looking like it did.

Until that credential exists, the cosign signature is the honest guarantee: this binary came from this repository's release workflow, even though Windows will not validate it natively. The gap is tracked publicly in issue #5.

If you hold a certificate

You can sign a locally built binary today with a cert in CurrentUser\My:

# $cert = (Get-ChildItem Cert:\CurrentUser\My -CodeSigningCert)[0]
signtool sign `
  /fd SHA256 `
  /tr http://timestamp.digicert.com /td SHA256 `
  /n "Your Company Name" `
  .\obliteratus.exe .\oblpack.exe

Get-AuthenticodeSignature .\obliteratus.exe   # → Valid

Timestamping with /tr is not optional: without it the signature dies the moment the certificate expires.

Supply-chain status
Step	State
cosign keyless signature over `checksums.txt`	live · v2.0.2 verified
SPDX SBOM per archive	live
SHA-256 checksums	live
Authenticode on the `.exe` files	blocked on a certificate

What provenance is not

The cosign guarantee is about provenance — which repository and workflow built this — not about safety. OBLITERATUS is dual-use by design. Provenance, a readable SBOM and a pinned toolchain are the whole point; reading the code you are about to run is still the stronger move, and building from source is documented on the front page.