Repository: ossf/scorecard (2025-07-29T03:56:04Z)

Issue:
Signed-Releases check ignores .sigstore.json signatures produced by sigstore/gh-action-sigstore-python
**Describe the bug**
The `Signed-Releases` check currently checks for:
> ...the following filenames in the project's last five release assets: *.minisig, *.asc (pgp), *.sig, *.sign, *.sigstore, *.intoto.jsonl.

For Python packages, the easiest way to create sigstore signatures is with the [sigstore/gh-action-sigstore-python](https://github.com/sigstore/gh-action-sigstore-python) GitHub Action. The GitHub Action's implementation when signing blobs produces a `.sigstore.json` file.

Since `.sigstore.json` does not match any of the file patterns in the `Signed-Releases` check, Python projects using this GitHub Action show up as failing the check when they do have valid sigstore signatures for their releases.

**Reproduction steps**
Steps to reproduce the behavior:
1. Run `scorecard --repo https://github.com/mark-adams/python-test-groups`
2. Observe that the `Signed-Releases` check has a score of 0.
3. Visit https://github.com/mark-adams/pytest-test-groups/releases/tag/1.2.1 (the latest release)
4. Observe that `.sigstore.json` files are present for all *.tar.gz and *.whl artifacts.

**Expected behavior**
Since these sigstore signatures are produced with the official sigstore GitHub Action, I would expect that the `Signed-Releases` check should have a score of 8 since sigstore signatures are present for the artifacts in each release.



Discussion:
We used to detect files produced by `sigstore/gh-action-sigstore-python`, but it seems they changed the default file extension.
https://github.com/sigstore/gh-action-sigstore-python/blob/main/CHANGELOG.md#300



Patch:
diff --git a/docs/checks.md b/docs/checks.md
index 6d77d5df8c0..1885542805b 100644
--- a/docs/checks.md
+++ b/docs/checks.md
@@ -628,7 +628,7 @@ Signed releases attest to the provenance of the artifact.
 This check looks for the following filenames in the project's last five
 [release assets](https://docs.github.com/en/repositories/releasing-projects-on-github/about-releases):
 [*.minisig](https://github.com/jedisct1/minisign), *.asc (pgp),
-*.sig, *.sign, *.sigstore, [*.intoto.jsonl](https://slsa.dev).
+*.sig, *.sign, *.sigstore, *.sigstore.json, [*.intoto.jsonl](https://slsa.dev).
 
 If a signature is found in the assets for each release, a score of 8 is given.
 If a [SLSA provenance file](https://slsa.dev/spec/v0.1/index) is found in the assets for each release (*.intoto.jsonl), the maximum score of 10 is given.
diff --git a/docs/checks/internal/checks.yaml b/docs/checks/internal/checks.yaml
index e770895a368..fb81ee37f97 100644
--- a/docs/checks/internal/checks.yaml
+++ b/docs/checks/internal/checks.yaml
@@ -667,7 +667,7 @@ checks:
       This check looks for the following filenames in the project's last five
       [release assets](https://docs.github.com/en/repositories/releasing-projects-on-github/about-releases):
       [*.minisig](https://github.com/jedisct1/minisign), *.asc (pgp),
-      *.sig, *.sign, *.sigstore, [*.intoto.jsonl](https://slsa.dev).
+      *.sig, *.sign, *.sigstore, *.sigstore.json, [*.intoto.jsonl](https://slsa.dev).
 
       If a signature is found in the assets for each release, a score of 8 is given.
       If a [SLSA provenance file](https://slsa.dev/spec/v0.1/index) is found in the assets for each release (*.intoto.jsonl), the maximum score of 10 is given.
diff --git a/probes/releasesAreSigned/impl.go b/probes/releasesAreSigned/impl.go
index 66efdbaec4e..3737df58796 100644
--- a/probes/releasesAreSigned/impl.go
+++ b/probes/releasesAreSigned/impl.go
@@ -41,7 +41,7 @@ const (
 	releaseLookBack = 5
 )
 
-var signatureExtensions = []string{".asc", ".minisig", ".sig", ".sign", ".sigstore"}
+var signatureExtensions = []string{".asc", ".minisig", ".sig", ".sign", ".sigstore", ".sigstore.json"}
 
 func Run(raw *checker.RawResults) ([]finding.Finding, string, error) {
 	if raw == nil {


Test patch:
diff --git a/checks/signed_releases_test.go b/checks/signed_releases_test.go
index 45691358626..80c1718f921 100644
--- a/checks/signed_releases_test.go
+++ b/checks/signed_releases_test.go
@@ -190,6 +190,25 @@ func TestSignedRelease(t *testing.T) {
 				Score: 8,
 			},
 		},
+		{
+			name: "Releases with assets with signed artifacts-sigstore-json",
+			releases: []clients.Release{
+				{
+					TagName:         "v1.0.0",
+					URL:             "http://foo.com/v1.0.0",
+					TargetCommitish: "master",
+					Assets: []clients.ReleaseAsset{
+						{
+							Name: "foo.sigstore.json",
+							URL:  "http://foo.com/v1.0.0/foo.sigstore.json",
+						},
+					},
+				},
+			},
+			expected: checker.CheckResult{
+				Score: 8,
+			},
+		},
 		{
 			name: "Releases with assets with signed and unsigned artifacts",
 			releases: []clients.Release{