fix(install): make provenance check best-effort

gh attestation verify downloads Sigstore's trusted root, which since
Rekor v2 GA contains an Ed25519 (PKIX_ED25519) tlog key. gh builds
older than 2.56.0 bundle a sigstore-go that cannot parse it and error
out. The installer was fail-closed, so this aborted the whole install
even though the sha256 checksum had already matched (END-609).

Make the attestation a best-effort layer on top of the mandatory
sha256: an unusable verifier (old gh, absent, rate-limited, offline, or
no attestation published) now warns and continues with an
"upgrade gh >= 2.56.0" hint, while a genuine provenance mismatch still
fails closed. Also drop the `gh auth status` gate, since verifying a
public repo's attestation needs no login. Set
GGSHIELD_REQUIRE_ATTESTATION=1 to restore strict, fail-closed behavior.

Refs: END-609
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: benjaminrigaud-gg

changelog.d/20260624_120200_benjamin.rigaud_fix_install_attestation_failopen.md

@@ -0,0 +1,3 @@
+### Fixed
+
+- The `curl | bash` installer no longer aborts when an outdated `gh` cannot verify the build provenance attestation (for example a `gh` older than 2.56.0, which fails to parse Sigstore's Ed25519 trusted-root key). Provenance is now best-effort on top of the mandatory sha256 checksum: an unusable verifier warns and continues, while a genuine provenance mismatch still fails the install. Set `GGSHIELD_REQUIRE_ATTESTATION=1` to treat any attestation problem as fatal.

scripts/install/install.sh

@@ -153,7 +153,9 @@ asset_http_status() {
         2>/dev/null || echo 000
 }
 
-# Fail closed: a download we cannot verify is never installed.
+# The sha256 check is mandatory and fails closed: a download whose checksum we
+# cannot confirm is never installed. The provenance attestation layered on top
+# is best-effort — see verify_attestation.
 verify_download() {
     local file="$1" asset="$2" digest sum_tool
     digest=$(asset_digest "$asset")
@@ -171,14 +173,57 @@ verify_download() {
     echo "${digest#sha256:}  $file" | $sum_tool -c - >/dev/null ||
         die "checksum mismatch for $asset"
 
-    # older gh releases have no `attestation` subcommand
-    if command -v gh >/dev/null 2>&1 &&
-        gh attestation --help >/dev/null 2>&1 &&
-        gh auth status >/dev/null 2>&1; then
-        say "Verifying build provenance attestation"
-        gh attestation verify "$file" --repo "$GITHUB_REPO" >/dev/null ||
-            die "artifact attestation verification failed for $asset"
+    verify_attestation "$file" "$asset"
+}
+
+# Best-effort build-provenance check, on top of the mandatory sha256. A verifier
+# that is merely *unusable* — gh too old to parse Sigstore's trusted root
+# (END-609: "unsupported tlog public key type: PKIX_ED25519"), absent,
+# rate-limited or offline — must not block an install whose checksum already
+# matched; only a genuine provenance MISMATCH fails closed. gh has no exit code
+# for that distinction, so we classify its output. GGSHIELD_REQUIRE_ATTESTATION=1
+# makes any attestation problem fatal.
+verify_attestation() {
+    local file="$1" asset="$2" out msg rc=0
+
+    # gh, or its `attestation` subcommand, may be absent — provenance is optional.
+    if ! command -v gh >/dev/null 2>&1 || ! gh attestation --help >/dev/null 2>&1; then
+        return 0
+    fi
+
+    say "Verifying build provenance attestation"
+    # No `gh auth status` gate: verifying a PUBLIC repo's attestation needs no
+    # login (confirmed in END-609); gh uses a token when present, anonymous API
+    # otherwise. '|| rc=$?' stops `set -e` aborting us on a non-zero exit.
+    out=$(gh attestation verify "$file" --repo "$GITHUB_REPO" 2>&1) || rc=$?
+    [ "$rc" -eq 0 ] && return 0
+
+    if [ "${GGSHIELD_REQUIRE_ATTESTATION:-0}" = 1 ]; then
+        die "artifact attestation verification failed for $asset:
+$out"
     fi
+
+    msg=$(printf '%s\n' "$out" | grep -m1 -iE 'error|failed|unsupported' |
+        sed 's/^[[:space:]]*//') || true
+    case "$out" in
+    *"unsupported tlog public key type"* | *"trusted root"* | \
+        *"Public Good Sigstore verifier"* | *"unknown command"* | *"unknown flag"* | \
+        *"no attestations found"* | *"HTTP 401"* | *"HTTP 403"* | *"HTTP 404"* | \
+        *"HTTP 5"* | *"rate limit"* | *"timeout"* | \
+        *"connection refused"* | *"could not resolve"* | *"TLS"*)
+        # Verifier unusable or transient failure — fall open onto the checksum.
+        warn "could not check build provenance: ${msg:-gh attestation verify failed}"
+        warn "  the sha256 checksum already matched, so the download is intact."
+        warn "  for the provenance check too, upgrade gh to >= 2.56.0 (e.g. 'brew upgrade gh')."
+        warn "  (set GGSHIELD_REQUIRE_ATTESTATION=1 to make this fatal instead.)"
+        return 0
+        ;;
+    *)
+        # Anything else is a real provenance rejection: fail closed.
+        die "build provenance verification FAILED for $asset — does not match $GITHUB_REPO:
+$out"
+        ;;
+    esac
 }
 
 install_tarball() {