release.sh ships unsigned when the cosign env is absent — make signing refuse, not opt out

[VijitSingh97]

The v1.18.0 cut ran in a non-login shell without COSIGN_KEY/COSIGN_PASSWORD, and release.sh warned "Release signing OFF (#376 is opt-in)" and published anyway. Because release assets are immutable, the missing pithead.tar.gz.sig could not be attached afterwards; signed installs fail closed on the unsigned bundle, so v1.18.0 had to be withdrawn and re-cut as v1.18.1.

release-server.md already promises the stricter behaviour: "The release preflight refuses to run without cosign, COSIGN_KEY, and cosign.pub all in place" — the code just doesn't implement it.

Fix, per the doc's own contract:

• Preflight (stage 1) aborts when cosign.pub exists at the repo root and any of {cosign binary, COSIGN_KEY, COSIGN_PASSWORD} is missing. An explicit --unsigned flag can keep the old escape hatch for experiments.
• Preflight should also sanity-check the cosign version against the pinned install: the box had drifted to cosign v3.1.2, which rejects the --tlog-upload=false flags release.sh uses — a cut with signing correctly configured would still have died at stage 7 (the pinned v2.6.3 has been restored on bench-host).

Two failures, one shape: the pipeline trusts its environment instead of proving it before the irreversible stages.

🤖 Generated with Claude Code

[VijitSingh97]

Correction from continued investigation: the binding constraint was never the shell environment. release.sh's signing condition also requires cosign.pub committed at the repo root — and it never was. The #376 key pair was generated on the release box on Jul 24 but the public half never entered the repo, so signing has never engaged on any release (v1.16.0 and v1.17.0 also ship without .sig assets), and no install holds a key to verify with.

#961 commits cosign.pub and bootstraps the chain with v1.18.1 as the first signed release. This issue's fix stands, with sharper scope: with cosign.pub now committed, the missing-env case must ABORT the cut (today it warns and ships unsigned — exactly how v1.18.0 happened); the cosign version-pin check stands as written.

[VijitSingh97]

Rolled into #1108, which is the shape these three form together: signing is optional to produce and mandatory to consume, so a cut made without the signing environment publishes a bundle that every one-click upgrade in the field refuses. Fixing them separately keeps addressing the symptoms of that one mismatch. See #1108 for the end-to-end contract and the two assertions that have never existed.