All release artifacts are signed using Cosign with keyless signing (Sigstore). To verify a release:

# Download the checksum file and its signature for the desired release version
curl -LO https://github.com/txn2/kubefwd/releases/download/{VERSION}/kubefwd_checksums.txt
curl -LO https://github.com/txn2/kubefwd/releases/download/{VERSION}/kubefwd_checksums.txt.sigstore.json

# Verify the signature
cosign verify-blob \
  --bundle kubefwd_checksums.txt.sigstore.json \
  --certificate-identity-regexp "https://github.com/txn2/kubefwd" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  kubefwd_checksums.txt

Releases include SLSA build provenance attestations generated by GitHub's attest action. This provides a verifiable record that artifacts were built from this repository using the documented build process. Verify an artifact with the GitHub CLI:

# Download a release artifact, then verify its provenance attestation
gh attestation verify kubefwd_{VERSION}_linux_amd64.tar.gz --repo txn2/kubefwd

Each release archive includes an SBOM generated by Syft in SPDX format. SBOMs list all dependencies, enabling vulnerability scanning and license compliance verification.

• CodeQL - Static analysis on every PR and push
• Dependabot - Automated dependency updates for security patches
• govulncheck - Go vulnerability database scanning
• golangci-lint - Static analysis with security-focused linters

Email security concerns to the maintainers at security@txn2.com.

Please include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact

You can expect an initial response within 72 hours.