Optional: publicly verifiable certificate for humanizer (one workflow file) #322

New issue

Closed

opened 2026-10-26 18:40:12 +00:00 by shawnbure · 0 comments

shawnbure commented

2026-10-26 18:40:12 +00:00

(Migrated from github.com)

Hi! I'm working on workrr trust, an open-source way to give agent skills and MCP servers a certificate anyone can verify. We ran its checks read-only across popular skills and MCP servers, and . in this repo passed cleanly at commit 8c307f3.

Would you like a certificate for humanizer? It takes one workflow file. If you're interested, reply here and I'll open a PR, or add the file yourself:

# .github/workflows/workrr.yml
name: workrr
on:
  push:
    branches: [main]
    tags: ["v*"]
jobs:
  certify:
    permissions:
      contents: read
      id-token: write
      attestations: write
    uses: workrr-trust/certify/.github/workflows/certify.yml@v0.1.3
    with:
      path: .

On each push to main, the open-source certifier hashes ., runs a baseline policy and known-pattern checks (prompt-injection phrasing, hidden Unicode, remote scripts piped to a shell and similar), and signs the result with Sigstore. The certificate is recorded in the public Rekor transparency log, so users can check that what they installed matches this repo at a given commit. Nothing is uploaded or rehosted.

About the permissions, since a workflow from an outside org deserves a close look:

id-token: write is how Sigstore keyless signing works. The certifier requests the token only for the sigstore audience (sent to Sigstore to get a short-lived signing certificate) and the workrr-certify audience (read on the runner to confirm which certifier commit is running). It isn't usable for cloud logins that expect another audience.
attestations: write attaches the signed certificate to this repo's attestations. contents: read reads the files being certified.
It runs only on pushes to your default branch and on your tags, never on pull requests, and receives no secrets.
v0.1.3 is tag object 7cf13e7228c6f2bdf01b6d3ab670edef6f77fe4b (commit 46c524bf97e8f580375edff746c847b86f4b23f9). Released tags are never moved, and Sigstore records the exact certifier commit in every certificate.

Not interested? Just close this. Nothing else will follow.

Hi! I'm working on [workrr trust](https://trust.workrr.ai), an open-source way to give agent skills and MCP servers a certificate anyone can verify. We ran its checks read-only across popular skills and MCP servers, and `.` in this repo passed cleanly at commit `8c307f3`. **Would you like a certificate for humanizer?** It takes one workflow file. If you're interested, reply here and I'll open a PR, or add the file yourself: ```yaml # .github/workflows/workrr.yml name: workrr on: push: branches: [main] tags: ["v*"] jobs: certify: permissions: contents: read id-token: write attestations: write uses: workrr-trust/certify/.github/workflows/certify.yml@v0.1.3 with: path: . ``` On each push to `main`, the [open-source certifier](https://github.com/workrr-trust/certify/tree/v0.1.3) hashes `.`, runs a baseline policy and known-pattern checks (prompt-injection phrasing, hidden Unicode, remote scripts piped to a shell and similar), and signs the result with Sigstore. The certificate is recorded in the public Rekor transparency log, so users can check that what they installed matches this repo at a given commit. Nothing is uploaded or rehosted. **About the permissions**, since a workflow from an outside org deserves a close look: - `id-token: write` is how Sigstore keyless signing works. The certifier requests the token only for the `sigstore` audience (sent to Sigstore to get a short-lived signing certificate) and the `workrr-certify` audience (read on the runner to confirm which certifier commit is running). It isn't usable for cloud logins that expect another audience. - `attestations: write` attaches the signed certificate to this repo's attestations. `contents: read` reads the files being certified. - It runs only on pushes to your default branch and on your tags, never on pull requests, and receives no secrets. - `v0.1.3` is tag object `7cf13e7228c6f2bdf01b6d3ab670edef6f77fe4b` (commit `46c524bf97e8f580375edff746c847b86f4b23f9`). Released tags are never moved, and Sigstore records the exact certifier commit in every certificate. Not interested? Just close this. Nothing else will follow.