envoyproxy.io: verified-vendor bottle (GPG-signed official binary)

[tannevaled]

What

A verified-vendor recipe for Envoy — the middle-ground @jhheider suggested in #13958 as an alternative to the ~18h-per-arch from-source build (#13046).

Instead of blindly vendoring a URL, it packages Envoy's official standalone binary only after verifying a full chain of trust:

Envoy maintainers' GPG key (pinned fingerprint 0AFCE836…F31F, embedded as base64)
  └─ gpg --verify checksums.txt.asc      (upstream's SHA256 for every release asset)
      └─ match the downloaded binary's SHA256 against the now-trusted checksum

So the bottle is provably the official release artifact, and — unlike a blind vendor — the recipe is exercised on every build (it re-verifies the chain). The key is embedded (base64), so there's no keyserver dependency at build time; the pinned fingerprint is the trust anchor.

Verified

The full chain was checked end to end:

• pinned key imported, fingerprint asserted;
• gpg --verify checksums.txt.asc → Good signature from "Envoy maintainers";
• downloaded envoy-1.39.0-linux-aarch_64 → its SHA256 matches the signed checksum byte-for-byte.

Recipe parses and is schema-valid.

Notes

• Draft: the test: (envoy --version) runs only on Linux, so it isn't exercised in my macOS check — but the binary is the verified official release, so it will run.
• This pattern generalizes to any project shipping signed release binaries/tarballs ("dealing with tgz and the like").
• Complements, not replaces, new(envoyproxy.io): Envoy — high-performance edge/service proxy (Bazel build from source) #13046 (from-source). Happy to reshape this into whatever a general "verified vendor" helper should look like in the pantry.

Closes the toolchain/measurement thread on #13958.

🤖 Generated with Claude Code