checkId: check.verification.signature plugin: stellaops.doctor.verification severity: fail tags: [verification, signatures, dsse, rekor]

Signature Verification

Doctor check that confirms Stella Ops can verify artifact signatures along the expected supply-chain path. It is part of the artifact verification pipeline that release operators and DevOps engineers run before promoting a build.

What It Checks

Requires the verification plugin plus a test artifact. In online mode it checks Sigstore:Enabled and performs a real reachability probe of the Rekor transparency-log endpoint. In offline mode it inspects the verification bundle for DSSE-style signature markers — but it does not cryptographically verify any signature against trust roots; that requires the runtime attestor service.

Per ADR-026 D7 a check may never report a fabricated Pass: where the previous version Passed on the mere presence of a signature marker in the offline bundle (implying signatures were verified when only presence was string-matched), the check now returns an honest Skip (“not verified”) naming the unverified capability.

ConditionResult
Offline bundle missing, or Rekor unreachable in online modeFail
Online, Sigstore enabled and Rekor reachable (real probe)Pass
Sigstore disabledInfo
Offline bundle contains no signature markersWarn
Offline bundle contains signature markers (present but not cryptographically verified)Skip — “not verified; requires the runtime attestor service”

Cryptographic signature verification is performed by the runtime attestor service (or stella verification bundle verify), not by Doctor’s out-of-process check.

Why It Matters

Signature verification is the minimum control that proves the artifact under review was signed by the expected supply-chain path.

Common Causes

How to Fix

Docker Compose

services:
  doctor-web:
    environment:
      Sigstore__Enabled: "true"
      Sigstore__RekorUrl: https://rekor.sigstore.dev

docker compose -f devops/compose/docker-compose.stella-ops.yml exec doctor-web curl -fsS https://rekor.sigstore.dev/api/v1/log

For offline verification:

stella verification bundle export --include-signatures --output /var/lib/stella/verification/offline-bundle.json

Bare Metal / systemd

Ensure the Doctor host trusts the CA chain used by the Rekor endpoint or use the approved internal Rekor deployment.

Kubernetes / Helm

Prefer an internal Rekor service URL in disconnected or regulated clusters.

Verification

stella doctor run --check check.verification.signature