Complete release signature evidence for the remaining 3 projects

[kriptoburak]

Goal

Provide project-controlled cryptographic release evidence for the remaining public projects.

See the release verification guide.

Remaining Projects

• C#: attest a downloadable .nupkg and document consumer verification.
• Go: attest a canonical released artifact and document consumer verification.
• PHP: attest a canonical Composer release artifact and verification steps.

Verified During This Audit

• Ruby: verify the exact published gem against its RubyGems Sigstore bundle.
• Java: verify all 15 Maven files against the project OpenPGP key.
• Kotlin: verify all 15 Maven files against the project OpenPGP key.

The Ruby x-twitter-scraper-0.5.5.gem bundle verifies this workflow identity:

https://github.com/Xquik-dev/x-twitter-scraper-ruby/.github/workflows/publish-gem.yml@refs/tags/v0.5.5

The verified Ruby SHA-256 digest is:

6dfdcabd408a330d80ef87f4e650aca0004ba8a0eb8b49cb92e06a97a7cf5502

Java and Kotlin use this OpenPGP fingerprint:

6965 E561 C0AC EE32 060A B961 D203 7E41 57E6 2A59

The verified root JAR SHA-256 digests are:

• Java 0.6.0: 17aaf5366ab6ad65869e5fb4f92acb2351bb08e0a12a0d4fcab6de8875193916
• Kotlin 0.5.2: 912278aac18d6e78b0f56e790eb3cdb387d1bf30e7b188086bc86095b9201734

Consumer-side CI passed for both SDKs:

• Java verification
• Kotlin verification

Acceptance Criteria

• The signed subject is the exact artifact users can download.
• Verification checks the Xquik-dev repository or approved signing identity.
• Public instructions include one reproducible verification command.
• Signing authority stays separate from the distribution path.
• CI verifies one published artifact from the consumer side.
• Failed verification blocks the release.
• No long-lived signing secret is added when keyless signing works.
• Existing package names and release contracts remain unchanged.

Evidence Rules

• A checksum alone is not a cryptographic signature.
• A registry signature alone may not prove project identity.
• An attestation does not make an unsigned Git tag signed.
• Keep OpenSSF answers Unmet until evidence reaches the default branch.

This issue coordinates the missing release controls. It does not itself satisfy Silver.

[kriptoburak]

C# implementation is now ready in Xquik-dev/x-twitter-scraper-csharp#19 at f5accbc. The workflow attests the exact normalized .nupkg, isolates repository write authority, and publishes the package plus Sigstore bundle as release assets. The checklist remains open until independent review, merge, and a consumer-side verification of the next public release.

[kriptoburak]

Go implementation is ready in Xquik-dev/x-twitter-scraper-go#14 at 79ed7f3. It creates a reproducible source archive, keyless SLSA provenance, and matching release assets with isolated write authority and no release cache. The checklist remains open until independent review, merge, and consumer verification of a post-merge release.

[kriptoburak]

PHP implementation is ready in Xquik-dev/x-twitter-scraper-php#12 at 7bd82a3. It adds reproducible Composer release archives, keyless SLSA provenance, and isolated release attachment. The audit also removed .git pointer, formatter cache, environment file, and Composer auth leakage from archives. The checklist remains open until independent review, merge, and a verified post-merge release.

[kriptoburak]

Java and Kotlin release-integrity acceptance is complete. Maven Central exposes all 30 project artifact files and their detached OpenPGP signatures. Consumer-side CI verified the public root JARs in Java run 30076440647 and Kotlin run 30076440671. Issue scope is now C#, Go, and PHP. Their branch implementations remain ready, but trusted tag-origin evidence requires independent review, merge, and a post-merge release.

[kriptoburak]

All 3 remaining project-controlled artifacts now pass consumer-side verification.

• C# v0.5.4: 7bef1ec1688b472424d7e92738342a446abfa6a9b1d314c4cd66fff919b5f34f
• Go v0.7.0: a59bd116af5ff6cc911c38b2fd515559d5f97b3eeb489d1a6148fd13fb459fb0
• PHP v0.6.0: 31fdf66d8cb1d0d8aeacbb8748189029eafc8b178b905057fd35540f5a01589b

Each attestation binds its artifact to the expected Xquik-dev workflow. Each verification rejects self-hosted provenance.

The shared scheduled consumer check remains in .github #7. Keep this issue open until that workflow reaches main and passes there.

[kriptoburak]

Ruby release evidence advanced to 0.5.5.

• Publish workflow completed successfully.
• RubyGems reports version 0.5.5.
• The public Sigstore bundle verifies the exact publish-gem.yml@refs/tags/v0.5.5 identity.
• Consumer SHA-256: 6dfdcabd408a330d80ef87f4e650aca0004ba8a0eb8b49cb92e06a97a7cf5502

The issue body and shared release guide now reference the current artifact.

[kriptoburak]

Terraform release verification found a latest-release regression.

• v0.3.2 publish run failed.
• The release became immutable before GoReleaser uploaded assets.
• GitHub rejected every upload with HTTP 422.
• The immutable v0.3.2 release has no downloadable provider assets.
• Its title and notes now warn consumers.
• Verified v0.3.1 is the repository's Latest release again.
• Remediation PR #17 is at exact head 7911bd0c281f200d8d99af4a7b5e197b122fd992.

Do not use v0.3.2 as release-signing evidence. Keep the prior verified release evidence until a post-remediation patch release passes consumer verification.