Verifying Build Provenance for Signed Insomnia Binaries

Kong produces build provenance for Insomnia Application binary artifacts, which can be verified using cosign / slsa-verifier.

This guide provides steps to verify build provenance for signed Insomnia Application binary artifacts in two different ways:

• A minimal example, used to verify an binary artifacts without leveraging any annotations
• A complete example, leveraging optional annotations for increased trust

For the minimal example, you only need a compressed binary file(s) and provenance file.

For the complete example, you need the same details as the minimal example, as well as any of the optional annotations you wish to verify:

Because Kong uses GitHub Actions to build and release, Kong also uses GitHub’s OIDC identity to generate build provenance for binary artifacts, which is why many of these details are GitHub-related.

Examples

Prerequisites

For both examples, you need to:

1. Ensure slsa-verifier is installed.

2. Download Insomnia Core Application Binaries with file pattern Insomnia.Core-<version>.{snap,tar.gz,zip,rpm,dmg,deb,exe,AppImage}

3. Download Insomnia Binary Provenance Attestation with pattern insomnia-provenance.intoto.jsonl

The GitHub owner is case-sensitive (Kong/insomnia vs kong/insomnia).

Minimal example

Using slsa-verifier

Run the slsa-verifier verify-artifact... command:

slsa-verifier verify-artifact \
   --print-provenance \
   --provenance-path '<provenance-file>' \
   --source-uri 'github.com/Kong/<repo>' \
   <binary-files>

Here’s the same example using sample values instead of placeholders:

slsa-verifier verify-artifact \
   --print-provenance \
   --provenance-path 'insomnia-provenance.intoto.jsonl' \
   --source-uri 'github.com/Kong/insomnia' \
   Insomnia.Core-9.3.0-beta.4.{snap,tar.gz,zip,rpm,dmg,deb,AppImage,exe}

The command will print “Verified SLASA provenance” if successful:

...
PASSED: Verified SLSA provenance

Complete example

Using slsa-verifier

Run the slsa-verifier verify-artifact ... command:

slsa-verifier verify-artifact \
   --print-provenance \
   --provenance-path '<provenance-file>' \
   --source-uri 'github.com/Kong/<repo>' \
   --build-workflow-input 'version=9.3.0-beta.4' \
   <binary-files>

Here’s the same example using sample values instead of placeholders:

slsa-verifier verify-artifact \
   --print-provenance \
   --provenance-path 'insomnia-provenance.intoto.jsonl' \
   --source-uri 'github.com/Kong/insomnia' \
   --build-workflow-input 'version=9.3.0-beta.4' \
   Insomnia.Core-9.3.0-beta.4.{snap,tar.gz,zip,rpm,dmg,deb,AppImage,exe}