Fix runtime distribution signing environment

2026-08-03 17:09:50 +02:00
parent a0f161041d
commit a5a0731d20
3 changed files with 18 additions and 2 deletions
@@ -145,7 +145,9 @@ installation. Separate amd64/arm64 API and WebUI images are joined into OCI
 indexes and run as non-root identities. The release assets include CycloneDX
 application SBOMs, SLSA-style provenance, exact composition evidence, the
 single-file deployer, its detached Ed25519 signature, and a signed, expiring
-distribution manifest.
+distribution manifest. Evidence generation and signing run through the
+workflow's isolated release Python environment so their cryptographic tooling
+is explicit and independent of packages preinstalled in the Actions runner.

 The manifest contract is
 [`runtime-distribution-manifest.schema.json`](runtime-distribution-manifest.schema.json),