[Infra] Pin cosign.pub verification to initial commit hash

[yuneng-berri]

Summary

Issue

An external security reviewer pointed out that fetching the cosign public key from the release tag or main branch is vulnerable — an attacker with push access could replace the key and re-sign tampered images.

Fix

Pin all cosign.pub references to the immutable commit hash (0112e53046018d726492c814b3644b7d376029d0) that first introduced the key. All docs now present two verification methods:

1. Commit hash (recommended) — cryptographically immutable, no trust assumptions needed
2. Release tag (convenience) — easier to read, relies on tag protection rules

Testing

• Verified all 6 files referencing cosign.pub are updated
• No other docs/workflows reference cosign.pub

Type

🚄 Infrastructure
📖 Documentation

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
litellm	Ready	Preview, Comment	Apr 7, 2026 5:28pm

[codspeed-hq]

Merging this PR will not alter performance

✅ 16 untouched benchmarks

---

_{Comparing litellm_pin_cosign_pub_to_commit (ce75fde) with main (730ba0f)}

[CLAassistant]

All committers have signed the CLA.

[greptile-apps]

Greptile Summary

This PR hardens cosign image verification by pinning the public key URL to an immutable commit hash (0112e53) across all 6 files that document the verification workflow. Previously, users were directed to fetch cosign.pub from a mutable tag or branch — an approach vulnerable to key replacement by anyone with push access. The fix introduces a recommended verification path using the cryptographically immutable raw GitHub URL, while retaining the tag-based URL as a labeled convenience option with an explicit trust caveat.

• All 6 cosign documentation references updated consistently with the same commit hash (0112e53046018d726492c814b3644b7d376029d0)
• Each location now presents two verification methods: pinned commit (recommended) and release tag (convenience)
• The .github/workflows/create-release.yml release notes generator is also updated so future release notes include both methods automatically
• No functional code changes — this is a pure docs/infra security hardening

Confidence Score: 5/5

Safe to merge — documentation-only security improvement with no functional code changes

All 6 files are updated consistently with the same immutable commit hash. No logic errors, security regressions, or breaking changes. The commit hash is correct and uniform across all locations. The workflow JS template literals are properly scoped. This is a clean, security-positive change.

No files require special attention — all changes are straightforward documentation updates

Important Files Changed

Filename	Overview
.github/workflows/create-release.yml	Release notes generator updated to include both pinned-hash (recommended) and tag-based (convenience) cosign verification blocks; JS template literals correctly use ${tag}
README.md	New 'Verify Docker Image Signatures' section added with both cosign verification methods and consistent commit hash pinning
docs/my-website/blog/ci_cd_v2_improvements/index.md	Blog post cosign section updated with pinned commit hash method and labeled tag-based convenience option
docs/my-website/blog/security_townhall_updates/index.md	Security townhall blog updated with both cosign verification methods and explicit trust caveat on tag-based approach
docs/my-website/blog/security_update_march_2026/index.md	March 2026 security update blog updated with both cosign verification methods, consistent with other docs
docs/my-website/docs/proxy/deploy.md	Deployment docs cosign verification section updated with pinned-hash recommended method and tag-based convenience option

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[User wants to verify\nLiteLLM Docker image] --> B{Choose verification method}
    B --> C[Pinned commit hash\nRecommended]
    B --> D[Release tag\nConvenience]
    C --> E[--key .../0112e53.../cosign.pub]
    D --> F[--key .../<release-tag>/cosign.pub]
    E --> G[Cryptographically immutable\nNo trust assumptions needed]
    F --> H[Relies on tag\nprotection rules]
    G --> I[cosign verify image ✓]
    H --> I

Loading

_{Reviews (2): Last reviewed commit: "Merge remote main into litellm_pin_cosig..." | Re-trigger Greptile}

[ishaan-berri]

lgtm