mirror of
https://github.com/slsa-framework/slsa-verifier.git
synced 2026-08-26 09:37:19 +00:00
feat: add offline bundle signature verification (#457)
* feat: add bundle signature verification Signed-off-by: Asra Ali <asraa@google.com>
This commit is contained in:
asraa
@@ -465,15 +465,15 @@ func Test_runVerifyGHAArtifactPath(t *testing.T) {
|
||||
{
|
||||
name: "annotated tag",
|
||||
artifacts: []string{"annotated-tag"},
|
||||
source: "github.com/laurentsimon/slsa-on-github-test",
|
||||
pversiontag: pString("v5.0.1"),
|
||||
source: "github.com/asraa/slsa-on-github-test",
|
||||
pversiontag: pString("v1.5.0"),
|
||||
noversion: true,
|
||||
},
|
||||
{
|
||||
name: "no branch",
|
||||
artifacts: []string{"annotated-tag"},
|
||||
source: "github.com/laurentsimon/slsa-on-github-test",
|
||||
pversiontag: pString("v5.0.1"),
|
||||
source: "github.com/asraa/slsa-on-github-test",
|
||||
pversiontag: pString("v1.5.0"),
|
||||
pbranch: pString("main"),
|
||||
err: serrors.ErrorMismatchBranch,
|
||||
noversion: true,
|
||||
@@ -484,7 +484,7 @@ func Test_runVerifyGHAArtifactPath(t *testing.T) {
|
||||
artifacts: []string{"workflow-inputs"},
|
||||
source: "github.com/laurentsimon/slsa-on-github-test",
|
||||
inputs: map[string]string{
|
||||
"release_version": "v1.2.3",
|
||||
"release_version": "(for example, 0.1.0)",
|
||||
"some_bool": "true",
|
||||
"some_integer": "123",
|
||||
},
|
||||
@@ -495,7 +495,7 @@ func Test_runVerifyGHAArtifactPath(t *testing.T) {
|
||||
artifacts: []string{"workflow-inputs"},
|
||||
source: "github.com/laurentsimon/slsa-on-github-test",
|
||||
inputs: map[string]string{
|
||||
"release_version": "v1.2.3",
|
||||
"release_version": "(for example, 0.1.0)",
|
||||
"some_bool": "true",
|
||||
"missing_field": "123",
|
||||
},
|
||||
@@ -507,29 +507,19 @@ func Test_runVerifyGHAArtifactPath(t *testing.T) {
|
||||
artifacts: []string{"workflow-inputs"},
|
||||
source: "github.com/laurentsimon/slsa-on-github-test",
|
||||
inputs: map[string]string{
|
||||
"release_version": "v1.2.3",
|
||||
"release_version": "(for example, 0.1.0)",
|
||||
"some_bool": "true",
|
||||
"some_integer": "321",
|
||||
},
|
||||
err: serrors.ErrorMismatchWorkflowInputs,
|
||||
noversion: true,
|
||||
},
|
||||
// Regression test of sharded UUID.
|
||||
{
|
||||
name: "regression: sharded uuids",
|
||||
artifacts: []string{"binary-linux-amd64-sharded"},
|
||||
source: "github.com/slsa-framework/slsa-verifier",
|
||||
pbranch: pString("release/v1.0"),
|
||||
pBuilderID: pString("https://github.com/slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml"),
|
||||
noversion: true,
|
||||
},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
tt := tt // Re-initializing variable so it is not changed while executing the closure below
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
// Avoid rate limiting by not running the tests in parallel.
|
||||
// t.Parallel()
|
||||
|
||||
checkVersions := getBuildersAndVersions(t, "v1.2.2", tt.builders, GHA_ARTIFACT_PATH_BUILDERS)
|
||||
if tt.noversion {
|
||||
checkVersions = []string{""}
|
||||
|
||||
+1
-1
File diff suppressed because one or more lines are too long
Binary file not shown.
+1
-1
File diff suppressed because one or more lines are too long
+1
-1
File diff suppressed because one or more lines are too long
+1
-1
File diff suppressed because one or more lines are too long
Binary file not shown.
+1
-1
File diff suppressed because one or more lines are too long
+1
-1
File diff suppressed because one or more lines are too long
@@ -31,4 +31,6 @@ var (
|
||||
ErrorImageHash = errors.New("cannot retrieve sha256 of image")
|
||||
ErrorInvalidEncoding = errors.New("invalid encoding")
|
||||
ErrorInternal = errors.New("internal error")
|
||||
ErrorInvalidRekorEntry = errors.New("invalid Rekor entry")
|
||||
ErrorRekorPubKey = errors.New("error retrieving Rekor public keys")
|
||||
)
|
||||
|
||||
@@ -6,7 +6,7 @@ require (
|
||||
github.com/docker/go v1.5.1-1
|
||||
github.com/go-openapi/runtime v0.25.0
|
||||
github.com/google/go-cmp v0.5.9
|
||||
github.com/google/trillian v1.5.0 // indirect
|
||||
github.com/google/trillian v1.5.1-0.20220819043421-0a389c4bb8d9 // indirect
|
||||
github.com/in-toto/in-toto-golang v0.5.0
|
||||
github.com/secure-systems-lab/go-securesystemslib v0.4.0
|
||||
github.com/sigstore/rekor v1.0.1
|
||||
@@ -19,6 +19,7 @@ require (
|
||||
github.com/google/go-containerregistry v0.13.0
|
||||
github.com/gorilla/mux v1.8.0
|
||||
github.com/sigstore/cosign v1.13.1
|
||||
github.com/sigstore/cosign/v2 v2.0.0-rc.1
|
||||
github.com/slsa-framework/slsa-github-generator v1.4.0
|
||||
github.com/spf13/cobra v1.6.1
|
||||
github.com/transparency-dev/merkle v0.0.1
|
||||
@@ -26,6 +27,14 @@ require (
|
||||
sigs.k8s.io/release-utils v0.7.3
|
||||
)
|
||||
|
||||
require (
|
||||
filippo.io/edwards25519 v1.0.0 // indirect
|
||||
github.com/digitorus/pkcs7 v0.0.0-20221212123742-001c36b64ec3 // indirect
|
||||
github.com/digitorus/timestamp v0.0.0-20221019182153-ef3b63b79b31 // indirect
|
||||
github.com/sigstore/timestamp-authority v0.2.1 // indirect
|
||||
go.step.sm/crypto v0.23.1 // indirect
|
||||
)
|
||||
|
||||
require (
|
||||
bitbucket.org/creachadair/shell v0.0.7 // indirect
|
||||
cloud.google.com/go/compute v1.14.0 // indirect
|
||||
@@ -88,14 +97,14 @@ require (
|
||||
github.com/cyberphone/json-canonicalization v0.0.0-20210823021906-dc406ceaf94b // indirect
|
||||
github.com/davecgh/go-spew v1.1.1 // indirect
|
||||
github.com/dimchansky/utfbom v1.1.1 // indirect
|
||||
github.com/docker/cli v20.10.20+incompatible // indirect
|
||||
github.com/docker/cli v20.10.21+incompatible // indirect
|
||||
github.com/docker/distribution v2.8.1+incompatible // indirect
|
||||
github.com/docker/docker v20.10.20+incompatible // indirect
|
||||
github.com/docker/docker v20.10.21+incompatible // indirect
|
||||
github.com/docker/docker-credential-helpers v0.7.0 // indirect
|
||||
github.com/dustin/go-humanize v1.0.0 // indirect
|
||||
github.com/dustin/go-humanize v1.0.1 // indirect
|
||||
github.com/envoyproxy/go-control-plane v0.10.2-0.20220325020618-49ff273808a1 // indirect
|
||||
github.com/envoyproxy/protoc-gen-validate v0.6.2 // indirect
|
||||
github.com/fsnotify/fsnotify v1.5.4 // indirect
|
||||
github.com/fsnotify/fsnotify v1.6.0 // indirect
|
||||
github.com/fullstorydev/grpcurl v1.8.7 // indirect
|
||||
github.com/ghodss/yaml v1.0.0 // indirect
|
||||
github.com/go-chi/chi v4.1.2+incompatible // indirect
|
||||
@@ -112,7 +121,7 @@ require (
|
||||
github.com/go-playground/locales v0.14.0 // indirect
|
||||
github.com/go-playground/universal-translator v0.18.0 // indirect
|
||||
github.com/go-playground/validator/v10 v10.11.1 // indirect
|
||||
github.com/gogo/protobuf v1.3.2 // indirect
|
||||
github.com/gogo/protobuf v1.3.2
|
||||
github.com/golang-jwt/jwt v3.2.2+incompatible // indirect
|
||||
github.com/golang-jwt/jwt/v4 v4.4.2 // indirect
|
||||
github.com/golang/glog v1.0.0 // indirect
|
||||
@@ -121,7 +130,7 @@ require (
|
||||
github.com/golang/protobuf v1.5.2 // indirect
|
||||
github.com/golang/snappy v0.0.4 // indirect
|
||||
github.com/google/btree v1.1.2 // indirect
|
||||
github.com/google/certificate-transparency-go v1.1.3 // indirect
|
||||
github.com/google/certificate-transparency-go v1.1.4 // indirect
|
||||
github.com/google/go-github/v45 v45.2.0 // indirect
|
||||
github.com/google/go-querystring v1.1.0 // indirect
|
||||
github.com/google/gofuzz v1.2.0 // indirect
|
||||
@@ -145,10 +154,10 @@ require (
|
||||
github.com/klauspost/compress v1.15.11 // indirect
|
||||
github.com/leodido/go-urn v1.2.1 // indirect
|
||||
github.com/letsencrypt/boulder v0.0.0-20221109233200-85aa52084eaf // indirect
|
||||
github.com/magiconair/properties v1.8.6 // indirect
|
||||
github.com/magiconair/properties v1.8.7 // indirect
|
||||
github.com/mailru/easyjson v0.7.7 // indirect
|
||||
github.com/mattn/go-runewidth v0.0.13 // indirect
|
||||
github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 // indirect
|
||||
github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
|
||||
github.com/miekg/pkcs11 v1.1.1 // indirect
|
||||
github.com/mitchellh/go-homedir v1.1.0 // indirect
|
||||
github.com/mitchellh/mapstructure v1.5.0 // indirect
|
||||
@@ -161,10 +170,10 @@ require (
|
||||
github.com/opencontainers/image-spec v1.1.0-rc2 // indirect
|
||||
github.com/opentracing/opentracing-go v1.2.0 // indirect
|
||||
github.com/pelletier/go-toml v1.9.5 // indirect
|
||||
github.com/pelletier/go-toml/v2 v2.0.5 // indirect
|
||||
github.com/pelletier/go-toml/v2 v2.0.6 // indirect
|
||||
github.com/pkg/errors v0.9.1 // indirect
|
||||
github.com/pmezard/go-difflib v1.0.0 // indirect
|
||||
github.com/prometheus/client_golang v1.13.0 // indirect
|
||||
github.com/prometheus/client_golang v1.14.0 // indirect
|
||||
github.com/prometheus/client_model v0.3.0 // indirect
|
||||
github.com/prometheus/common v0.37.0 // indirect
|
||||
github.com/prometheus/procfs v0.8.0 // indirect
|
||||
@@ -173,27 +182,28 @@ require (
|
||||
github.com/sassoftware/relic v0.0.0-20210427151427-dfb082b79b74 // indirect
|
||||
github.com/segmentio/ksuid v1.0.4 // indirect
|
||||
github.com/shibumi/go-pathspec v1.3.0 // indirect
|
||||
github.com/sigstore/fulcio v0.6.0 // indirect
|
||||
github.com/sigstore/fulcio v1.0.0 // indirect
|
||||
github.com/sigstore/protobuf-specs v0.1.1-0.20230120212552-16541696de13
|
||||
github.com/sirupsen/logrus v1.9.0 // indirect
|
||||
github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 // indirect
|
||||
github.com/soheilhy/cmux v0.1.5 // indirect
|
||||
github.com/spf13/afero v1.8.2 // indirect
|
||||
github.com/spf13/afero v1.9.3 // indirect
|
||||
github.com/spf13/cast v1.5.0 // indirect
|
||||
github.com/spf13/jwalterweatherman v1.1.0 // indirect
|
||||
github.com/spf13/pflag v1.0.5 // indirect
|
||||
github.com/spf13/viper v1.13.0 // indirect
|
||||
github.com/spf13/viper v1.15.0 // indirect
|
||||
github.com/stretchr/testify v1.8.1 // indirect
|
||||
github.com/subosito/gotenv v1.4.1 // indirect
|
||||
github.com/subosito/gotenv v1.4.2 // indirect
|
||||
github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d // indirect
|
||||
github.com/tent/canonical-json-go v0.0.0-20130607151641-96e4ba3a7613 // indirect
|
||||
github.com/thales-e-security/pool v0.0.2 // indirect
|
||||
github.com/theupdateframework/go-tuf v0.5.2-0.20220930112810-3890c1e7ace4 // indirect
|
||||
github.com/theupdateframework/go-tuf v0.5.2 // indirect
|
||||
github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 // indirect
|
||||
github.com/tjfoc/gmsm v1.3.2 // indirect
|
||||
github.com/tmc/grpc-websocket-proxy v0.0.0-20201229170055-e5319fda7802 // indirect
|
||||
github.com/urfave/cli v1.22.7 // indirect
|
||||
github.com/vbatts/tar-split v0.11.2 // indirect
|
||||
github.com/xanzy/go-gitlab v0.73.1 // indirect
|
||||
github.com/xanzy/go-gitlab v0.79.0 // indirect
|
||||
github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2 // indirect
|
||||
go.etcd.io/bbolt v1.3.6 // indirect
|
||||
go.etcd.io/etcd/api/v3 v3.6.0-alpha.0 // indirect
|
||||
@@ -218,7 +228,7 @@ require (
|
||||
go.opentelemetry.io/proto/otlp v0.16.0 // indirect
|
||||
go.uber.org/atomic v1.10.0 // indirect
|
||||
go.uber.org/multierr v1.8.0 // indirect
|
||||
go.uber.org/zap v1.23.0 // indirect
|
||||
go.uber.org/zap v1.24.0 // indirect
|
||||
golang.org/x/crypto v0.5.0 // indirect
|
||||
golang.org/x/exp v0.0.0-20220823124025-807a23277127 // indirect
|
||||
golang.org/x/net v0.5.0 // indirect
|
||||
@@ -227,12 +237,12 @@ require (
|
||||
golang.org/x/sys v0.4.0 // indirect
|
||||
golang.org/x/term v0.4.0 // indirect
|
||||
golang.org/x/text v0.6.0 // indirect
|
||||
golang.org/x/time v0.2.0 // indirect
|
||||
golang.org/x/tools v0.1.12 // indirect
|
||||
golang.org/x/time v0.3.0 // indirect
|
||||
golang.org/x/tools v0.5.0 // indirect
|
||||
google.golang.org/appengine v1.6.7 // indirect
|
||||
google.golang.org/genproto v0.0.0-20221227171554-f9683d7f8bef // indirect
|
||||
google.golang.org/grpc v1.51.0 // indirect
|
||||
google.golang.org/protobuf v1.28.1 // indirect
|
||||
google.golang.org/genproto v0.0.0-20230125152338-dcaf20b6aeaa // indirect
|
||||
google.golang.org/grpc v1.52.0 // indirect
|
||||
google.golang.org/protobuf v1.28.1
|
||||
gopkg.in/cheggaaa/pb.v1 v1.0.28 // indirect
|
||||
gopkg.in/inf.v0 v0.9.1 // indirect
|
||||
gopkg.in/ini.v1 v1.67.0 // indirect
|
||||
@@ -243,7 +253,7 @@ require (
|
||||
k8s.io/api v0.23.5 // indirect
|
||||
k8s.io/apimachinery v0.23.5 // indirect
|
||||
k8s.io/client-go v0.23.5 // indirect
|
||||
k8s.io/klog/v2 v2.60.1-0.20220317184644-43cc75f9ae89 // indirect
|
||||
k8s.io/klog/v2 v2.80.1 // indirect
|
||||
k8s.io/kube-openapi v0.0.0-20220124234850-424119656bbf // indirect
|
||||
k8s.io/utils v0.0.0-20220210201930-3a6ce19ff2f9 // indirect
|
||||
sigs.k8s.io/json v0.0.0-20211208200746-9f7c6b3444d2 // indirect
|
||||
|
||||
@@ -94,6 +94,8 @@ contrib.go.opencensus.io/exporter/stackdriver v0.13.12/go.mod h1:mmxnWlrvrFdpiOH
|
||||
contrib.go.opencensus.io/integrations/ocsql v0.1.4/go.mod h1:8DsSdjz3F+APR+0z0WkU1aRorQCFfRxvqjUUPMbF3fE=
|
||||
contrib.go.opencensus.io/resource v0.1.1/go.mod h1:F361eGI91LCmW1I/Saf+rX0+OFcigGlFvXwEGEnkRLA=
|
||||
dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
|
||||
filippo.io/edwards25519 v1.0.0 h1:0wAIcmJUqRdI8IJ/3eGi5/HwXZWPujYXXlkrQogz0Ek=
|
||||
filippo.io/edwards25519 v1.0.0/go.mod h1:N1IkdkCkiLB6tki+MYJoSx2JTY9NUlxZE7eHn5EwJns=
|
||||
github.com/AliyunContainerService/ack-ram-tool/pkg/credentials/alibabacloudsdkgo/helper v0.2.0 h1:8+4G8JaejP8Xa6W46PzJEwisNgBXMvFcz78N6zG/ARw=
|
||||
github.com/AliyunContainerService/ack-ram-tool/pkg/credentials/alibabacloudsdkgo/helper v0.2.0/go.mod h1:GgeIE+1be8Ivm7Sh4RgwI42aTtC9qrcj+Y9Y6CjJhJs=
|
||||
github.com/Azure/azure-amqp-common-go/v2 v2.1.0/go.mod h1:R8rea+gJRuJR6QxTir/XuEd+YuKoUiazDC/N96FiDEU=
|
||||
@@ -443,15 +445,24 @@ github.com/depcheck-test/depcheck-test v0.0.0-20220607135614-199033aaa936 h1:foG
|
||||
github.com/devigned/tab v0.1.1/go.mod h1:XG9mPq0dFghrYvoBF3xdRrJzSTX1b7IQrvaL9mzjeJY=
|
||||
github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
|
||||
github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8PWV+bWy6jNmig1y/TA+kYO4g3RSRF0IAv0no=
|
||||
github.com/digitorus/pkcs7 v0.0.0-20221019075359-21b8b40e6bb4/go.mod h1:SKVExuS+vpu2l9IoOc0RwqE7NYnb0JlcFHFnEJkVDzc=
|
||||
github.com/digitorus/pkcs7 v0.0.0-20221212123742-001c36b64ec3 h1:rjCXeRWazGsbcBlExMcAW8H1LGdgJ9r619y7+aeKgds=
|
||||
github.com/digitorus/pkcs7 v0.0.0-20221212123742-001c36b64ec3/go.mod h1:SKVExuS+vpu2l9IoOc0RwqE7NYnb0JlcFHFnEJkVDzc=
|
||||
github.com/digitorus/timestamp v0.0.0-20221019182153-ef3b63b79b31 h1:3go0tpsBpbs9L/oysk3jDwRprlLRRkpSU7YxKlTfU+o=
|
||||
github.com/digitorus/timestamp v0.0.0-20221019182153-ef3b63b79b31/go.mod h1:6V2ND8Yf8TOJ4h+9pmUlx8kXvNLBB2QplToVVZQ3rF0=
|
||||
github.com/dimchansky/utfbom v1.1.0/go.mod h1:rO41eb7gLfo8SF1jd9F8HplJm1Fewwi4mQvIirEdv+8=
|
||||
github.com/dimchansky/utfbom v1.1.1 h1:vV6w1AhK4VMnhBno/TPVCoK9U/LP0PkLCS9tbxHdi/U=
|
||||
github.com/dimchansky/utfbom v1.1.1/go.mod h1:SxdoEBH5qIqFocHMyGOXVAybYJdr71b1Q/j0mACtrfE=
|
||||
github.com/docker/cli v20.10.20+incompatible h1:lWQbHSHUFs7KraSN2jOJK7zbMS2jNCHI4mt4xUFUVQ4=
|
||||
github.com/docker/cli v20.10.20+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
|
||||
github.com/docker/cli v20.10.21+incompatible h1:qVkgyYUnOLQ98LtXBrwd/duVqPT2X4SHndOuGsfwyhU=
|
||||
github.com/docker/cli v20.10.21+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
|
||||
github.com/docker/distribution v2.8.1+incompatible h1:Q50tZOPR6T/hjNsyc9g8/syEs6bk8XXApsHjKukMl68=
|
||||
github.com/docker/distribution v2.8.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
|
||||
github.com/docker/docker v20.10.20+incompatible h1:kH9tx6XO+359d+iAkumyKDc5Q1kOwPuAUaeri48nD6E=
|
||||
github.com/docker/docker v20.10.20+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
|
||||
github.com/docker/docker v20.10.21+incompatible h1:UTLdBmHk3bEY+w8qeO5KttOhy6OmXWsl/FEet9Uswog=
|
||||
github.com/docker/docker v20.10.21+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
|
||||
github.com/docker/docker-credential-helpers v0.6.3/go.mod h1:WRaJzqw3CTB9bk10avuGsjVBZsD05qeibJ1/TYlvc0Y=
|
||||
github.com/docker/docker-credential-helpers v0.7.0 h1:xtCHsjxogADNZcdv1pKUHXryefjlVRqWqIhk/uXJp0A=
|
||||
github.com/docker/docker-credential-helpers v0.7.0/go.mod h1:rETQfLdHNT3foU5kuNkFR1R1V12OJRRO5lzt2D1b5X0=
|
||||
@@ -462,6 +473,7 @@ github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3
|
||||
github.com/dustin/go-humanize v0.0.0-20171111073723-bb3d318650d4/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
|
||||
github.com/dustin/go-humanize v1.0.0 h1:VSnTsYCnlFHaM2/igO1h6X3HA71jcobQuxemgkq4zYo=
|
||||
github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
|
||||
github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
|
||||
github.com/eapache/go-resiliency v1.1.0/go.mod h1:kFI+JgMyC7bLPUVY133qvEBtVayf5mFgVsvEsIPBvNs=
|
||||
github.com/eapache/go-xerial-snappy v0.0.0-20180814174437-776d5712da21/go.mod h1:+020luEh2TKB4/GOp8oxxtq0Daoen/Cii55CzbTV6DU=
|
||||
github.com/eapache/queue v1.1.0/go.mod h1:6eCeP0CKFpHLu8blIFXhExK/dRa7WDZfr6jVFPTqq+I=
|
||||
@@ -505,6 +517,8 @@ github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMo
|
||||
github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
|
||||
github.com/fsnotify/fsnotify v1.5.4 h1:jRbGcIw6P2Meqdwuo0H1p6JVLbL5DHKAKlYndzMwVZI=
|
||||
github.com/fsnotify/fsnotify v1.5.4/go.mod h1:OVB6XrOHzAwXMpEM7uPOzcehqUV2UqJxmVXmkdnm1bU=
|
||||
github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY=
|
||||
github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw=
|
||||
github.com/fullstorydev/grpcurl v1.8.0/go.mod h1:Mn2jWbdMrQGJQ8UD62uNyMumT2acsZUCkZIqFxsQf1o=
|
||||
github.com/fullstorydev/grpcurl v1.8.1/go.mod h1:3BWhvHZwNO7iLXaQlojdg5NA6SxUDePli4ecpK1N7gw=
|
||||
github.com/fullstorydev/grpcurl v1.8.6/go.mod h1:WhP7fRQdhxz2TkL97u+TCb505sxfH78W1usyoB3tepw=
|
||||
@@ -695,6 +709,8 @@ github.com/google/certificate-transparency-go v1.1.2-0.20210422104406-9f33727a7a
|
||||
github.com/google/certificate-transparency-go v1.1.2-0.20210512142713-bed466244fa6/go.mod h1:aF2dp7Dh81mY8Y/zpzyXps4fQW5zQbDu2CxfpJB6NkI=
|
||||
github.com/google/certificate-transparency-go v1.1.3 h1:WEb38wcTe0EuAvg7USzgklnOjjnlMaahYO3faaqnCn8=
|
||||
github.com/google/certificate-transparency-go v1.1.3/go.mod h1:S9FT/VzOUzhOGG0iLrzDs+f5Ml/zm7IYY/w+IlHz01M=
|
||||
github.com/google/certificate-transparency-go v1.1.4 h1:hCyXHDbtqlr/lMXU0D4WgbalXL0Zk4dSWWMbPV8VrqY=
|
||||
github.com/google/certificate-transparency-go v1.1.4/go.mod h1:D6lvbfwckhNrbM9WVl1EVeMOyzC19mpIjMOI4nxBHtQ=
|
||||
github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
|
||||
github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
|
||||
github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
|
||||
@@ -760,6 +776,8 @@ github.com/google/trillian v1.3.14-0.20210511103300-67b5f349eefa/go.mod h1:s4jO3
|
||||
github.com/google/trillian v1.4.1/go.mod h1:43IVCsGXxP5mZK9yFkTQdQrMQm/wryNBV2GNEdqzVz8=
|
||||
github.com/google/trillian v1.5.0 h1:I5pIN18bKlXtlj1Tk919rQ3mWBU2BzNNR6JhLISGMB4=
|
||||
github.com/google/trillian v1.5.0/go.mod h1:2/gAIc+G1MUcErOPc+cSwHAQHZlGy+RYHjVGnhUQ3e8=
|
||||
github.com/google/trillian v1.5.1-0.20220819043421-0a389c4bb8d9 h1:GFmzYtwUMi1S2mjLxfrJ/CZ9gWDG+zeLtZByg/QEBkk=
|
||||
github.com/google/trillian v1.5.1-0.20220819043421-0a389c4bb8d9/go.mod h1:vywkS3p2SgNmPL7oAWqU5PiiknzRMp+ol3a19jfY2PQ=
|
||||
github.com/google/uuid v0.0.0-20161128191214-064e2069ce9c/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
|
||||
github.com/google/uuid v1.0.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
|
||||
github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
|
||||
@@ -977,6 +995,8 @@ github.com/magiconair/properties v1.8.4/go.mod h1:y3VJvCyxH9uVvJTWEGAELF3aiYNyPK
|
||||
github.com/magiconair/properties v1.8.5/go.mod h1:y3VJvCyxH9uVvJTWEGAELF3aiYNyPKd5NZ3oSwXrF60=
|
||||
github.com/magiconair/properties v1.8.6 h1:5ibWZ6iY0NctNGWo87LalDlEZ6R41TqbbDamhfG/Qzo=
|
||||
github.com/magiconair/properties v1.8.6/go.mod h1:y3VJvCyxH9uVvJTWEGAELF3aiYNyPKd5NZ3oSwXrF60=
|
||||
github.com/magiconair/properties v1.8.7 h1:IeQXZAiQcpL9mgcAe1Nu6cX9LLw6ExEHKjN0VQdvPDY=
|
||||
github.com/magiconair/properties v1.8.7/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
|
||||
github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
|
||||
github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
|
||||
github.com/mailru/easyjson v0.7.6/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
|
||||
@@ -1007,6 +1027,8 @@ github.com/mattn/go-zglob v0.0.1/go.mod h1:9fxibJccNxU2cnpIKLRRFA7zX7qhkJIQWBb44
|
||||
github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
|
||||
github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 h1:I0XW9+e1XWDxdcEniV4rQAIOPUGDq67JSCiRCgGCZLI=
|
||||
github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4=
|
||||
github.com/matttproud/golang_protobuf_extensions v1.0.4 h1:mmDVorXM7PCGKw94cs5zkfA9PSy5pEvNWRP0ET0TIVo=
|
||||
github.com/matttproud/golang_protobuf_extensions v1.0.4/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4=
|
||||
github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
|
||||
github.com/miekg/dns v1.0.14/go.mod h1:W1PPwlIAgtquWBMBEV9nkV9Cazfe8ScdGz/Lj7v3Nrg=
|
||||
github.com/miekg/pkcs11 v1.0.2/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
|
||||
@@ -1124,6 +1146,8 @@ github.com/pelletier/go-toml v1.9.5 h1:4yBQzkHv+7BHq2PQUZF3Mx0IYxG7LsP222s7Agd3v
|
||||
github.com/pelletier/go-toml v1.9.5/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
|
||||
github.com/pelletier/go-toml/v2 v2.0.5 h1:ipoSadvV8oGUjnUbMub59IDPPwfxF694nG/jwbMiyQg=
|
||||
github.com/pelletier/go-toml/v2 v2.0.5/go.mod h1:OMHamSCAODeSsVrwwvcJOaoN0LIUIaFVNZzmWyNfXas=
|
||||
github.com/pelletier/go-toml/v2 v2.0.6 h1:nrzqCb7j9cDFj2coyLNLaZuJTLjWjlaz6nvTvIwycIU=
|
||||
github.com/pelletier/go-toml/v2 v2.0.6/go.mod h1:eumQOmlWiOPt5WriQQqoM5y18pDHwha2N+QD+EUNTek=
|
||||
github.com/performancecopilot/speed v3.0.0+incompatible/go.mod h1:/CLtqpZ5gBg1M9iaPbIdPPGyKcA8hKdoy6hAWba7Yac=
|
||||
github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
|
||||
github.com/pierrec/lz4 v1.0.2-0.20190131084431-473cd7ce01a1/go.mod h1:3/3N9NVKO0jef7pBehbT1qWhCMrIgbYNnFAZCqQ5LRc=
|
||||
@@ -1154,6 +1178,7 @@ github.com/prometheus/client_golang v1.11.1/go.mod h1:Z6t4BnS23TR94PD6BsDNk8yVqr
|
||||
github.com/prometheus/client_golang v1.12.1/go.mod h1:3Z9XVyYiZYEO+YQWt3RD2R3jrbd179Rt297l4aS6nDY=
|
||||
github.com/prometheus/client_golang v1.13.0 h1:b71QUfeo5M8gq2+evJdTPfZhYMAU0uKPkyPJ7TPsloU=
|
||||
github.com/prometheus/client_golang v1.13.0/go.mod h1:vTeo+zgvILHsnnj/39Ou/1fPN5nJFOEMgftOUOmlvYQ=
|
||||
github.com/prometheus/client_golang v1.14.0/go.mod h1:8vpkKitgIVNcqrRBWh1C4TIUQgYNtG/XQE4E/Zae36Y=
|
||||
github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
|
||||
github.com/prometheus/client_model v0.0.0-20190115171406-56726106282f/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
|
||||
github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
|
||||
@@ -1232,8 +1257,16 @@ github.com/shibumi/go-pathspec v1.3.0/go.mod h1:Xutfslp817l2I1cZvgcfeMQJG5QnU2lh
|
||||
github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
|
||||
github.com/sigstore/cosign v1.13.1 h1:+5oF8jisEcDw2TuXxCADC1u5//HfdnJhGbpv9Isiwu4=
|
||||
github.com/sigstore/cosign v1.13.1/go.mod h1:PlfJODkovUOKsLrGI7Su57Ie/Eb/Ks7hRHw3tn5hQS4=
|
||||
github.com/sigstore/cosign/v2 v2.0.0-rc.1 h1:ppOhIqG8xFtTtNwy/Zme9Yum+PIvES14KmsRuUPfkls=
|
||||
github.com/sigstore/cosign/v2 v2.0.0-rc.1/go.mod h1:XqEFZWibYcygXD+mqXWSbj90fi1vMR9EFFoxiD8wauM=
|
||||
github.com/sigstore/fulcio v0.6.0 h1:YNfnGm9EjYPlzHiPDcIVhslYj846jkPtHQH+FTKNncw=
|
||||
github.com/sigstore/fulcio v0.6.0/go.mod h1:lwxzHDYYQ0lVVWqaj68ZQNkcP847aoF7AIa7ra9rRqA=
|
||||
github.com/sigstore/fulcio v1.0.0 h1:hBZW6qg9GXTtCX8jOg1hmyjYLrmsEKZGeMwAbW3XNEg=
|
||||
github.com/sigstore/fulcio v1.0.0/go.mod h1:j4MzLxX/Be0rHYh3JF2dgMorkWGzEMHBqIHwFU8I/Rw=
|
||||
github.com/sigstore/protobuf-specs v0.1.0 h1:X0l/E2C2c79t/rI/lmSu8WAoKWsQtMqDzAMiDdEMGr8=
|
||||
github.com/sigstore/protobuf-specs v0.1.0/go.mod h1:5shUCxf82hGnjUEFVWiktcxwzdtn6EfeeJssxZ5Q5HE=
|
||||
github.com/sigstore/protobuf-specs v0.1.1-0.20230120212552-16541696de13 h1:8i4zt3kTZuUF06bRTOvDfSfiSb9Yo69F9XLpU53ccys=
|
||||
github.com/sigstore/protobuf-specs v0.1.1-0.20230120212552-16541696de13/go.mod h1:5shUCxf82hGnjUEFVWiktcxwzdtn6EfeeJssxZ5Q5HE=
|
||||
github.com/sigstore/rekor v1.0.0 h1:64IeShnl8n862APKu4MyDObAOjwNL//je6okig4uQw8=
|
||||
github.com/sigstore/rekor v1.0.0/go.mod h1:8FPG2wHngSA4Bo8tgOn0C/PIDDNi4iiNePhAiyJlv5Q=
|
||||
github.com/sigstore/rekor v1.0.1 h1:rcESXSNkAPRWFYZel9rarspdvneET60F2ngNkadi89c=
|
||||
@@ -1244,6 +1277,8 @@ github.com/sigstore/sigstore v1.5.0 h1:NqstQ6SwwhQsp6Ll0wgk/d9g5MlfmEppo14aquUjJ
|
||||
github.com/sigstore/sigstore v1.5.0/go.mod h1:fRAaZ9xXh7ZQ0GJqZdpmNJ3pemuHBu2PgIAngmzIFSI=
|
||||
github.com/sigstore/sigstore v1.5.1 h1:iUou0QJW8eQKMUkTXbFyof9ZOblDtfaW2Sn2+QI8Tcs=
|
||||
github.com/sigstore/sigstore v1.5.1/go.mod h1:3i6UTWVNtFwOtbgG63FZZNID4vO9KcO8AszIJlaNI8k=
|
||||
github.com/sigstore/timestamp-authority v0.2.1 h1:uqyamGxSXMEDt+e4t5XhR8JdJMeNBEj9V2Pol9BhuqY=
|
||||
github.com/sigstore/timestamp-authority v0.2.1/go.mod h1:i6zDth6bXY/ZaMzT5Hjd3ZuKtX85TW8fNoNWn8TxAc0=
|
||||
github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
|
||||
github.com/sirupsen/logrus v1.4.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
|
||||
github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMBDgk/93Q=
|
||||
@@ -1277,6 +1312,8 @@ github.com/spf13/afero v1.4.1/go.mod h1:Ai8FlHk4v/PARR026UzYexafAt9roJ7LcLMAmO6Z
|
||||
github.com/spf13/afero v1.6.0/go.mod h1:Ai8FlHk4v/PARR026UzYexafAt9roJ7LcLMAmO6Z93I=
|
||||
github.com/spf13/afero v1.8.2 h1:xehSyVa0YnHWsJ49JFljMpg1HX19V6NDZ1fkm1Xznbo=
|
||||
github.com/spf13/afero v1.8.2/go.mod h1:CtAatgMJh6bJEIs48Ay/FOnkljP3WeGUG0MC1RfAqwo=
|
||||
github.com/spf13/afero v1.9.3 h1:41FoI0fD7OR7mGcKE/aOiLkGreyf8ifIOQmJANWogMk=
|
||||
github.com/spf13/afero v1.9.3/go.mod h1:iUV7ddyEEZPO5gA3zD4fJt6iStLlL+Lg4m2cihcDf8Y=
|
||||
github.com/spf13/cast v1.3.0/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
|
||||
github.com/spf13/cast v1.3.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
|
||||
github.com/spf13/cast v1.5.0 h1:rj3WzYc11XZaIZMPKmwP96zkFEnnAmV8s6XbB2aY32w=
|
||||
@@ -1306,6 +1343,8 @@ github.com/spf13/viper v1.7.1/go.mod h1:8WkrPz2fc9jxqZNCJI/76HCieCp4Q8HaLFoCha5q
|
||||
github.com/spf13/viper v1.8.1/go.mod h1:o0Pch8wJ9BVSWGQMbra6iw0oQ5oktSIBaujf1rJH9Ns=
|
||||
github.com/spf13/viper v1.13.0 h1:BWSJ/M+f+3nmdz9bxB+bWX28kkALN2ok11D0rSo8EJU=
|
||||
github.com/spf13/viper v1.13.0/go.mod h1:Icm2xNL3/8uyh/wFuB1jI7TiTNKp8632Nwegu+zgdYw=
|
||||
github.com/spf13/viper v1.15.0 h1:js3yy885G8xwJa6iOISGFwd+qlUo5AvyXb7CiihdtiU=
|
||||
github.com/spf13/viper v1.15.0/go.mod h1:fFcTBJxvhhzSJiZy8n+PeW6t8l+KeT/uTARa0jHOQLA=
|
||||
github.com/src-d/gcfg v1.4.0/go.mod h1:p/UMsR43ujA89BJY9duynAwIpvqEujIH/jFlfL7jWoI=
|
||||
github.com/stoewer/go-strcase v1.2.0/go.mod h1:IBiWB2sKIp3wVVQ3Y035++gc+knqhUQag1KpM8ahLw8=
|
||||
github.com/streadway/amqp v0.0.0-20190404075320-75d898a42a94/go.mod h1:AZpEONHx3DKn8O/DFsRAY58/XVQiIPMTMB1SddzLXVw=
|
||||
@@ -1333,6 +1372,8 @@ github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o
|
||||
github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
|
||||
github.com/subosito/gotenv v1.4.1 h1:jyEFiXpy21Wm81FBN71l9VoMMV8H8jG+qIK3GCpY6Qs=
|
||||
github.com/subosito/gotenv v1.4.1/go.mod h1:ayKnFf/c6rvx/2iiLrJUk1e6plDbT3edrFNGqEflhK0=
|
||||
github.com/subosito/gotenv v1.4.2 h1:X1TuBLAMDFbaTAChgCBLu3DU3UPyELpnF2jjJ2cz/S8=
|
||||
github.com/subosito/gotenv v1.4.2/go.mod h1:ayKnFf/c6rvx/2iiLrJUk1e6plDbT3edrFNGqEflhK0=
|
||||
github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d h1:vfofYNRScrDdvS342BElfbETmL1Aiz3i2t0zfRj16Hs=
|
||||
github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d/go.mod h1:RRCYJbIwD5jmqPI9XoAFR0OcDxqUctll6zUj/+B4S48=
|
||||
github.com/tent/canonical-json-go v0.0.0-20130607151641-96e4ba3a7613 h1:iGnD/q9160NWqKZZ5vY4p0dMiYMRknzctfSkqA4nBDw=
|
||||
@@ -1341,6 +1382,8 @@ github.com/thales-e-security/pool v0.0.2 h1:RAPs4q2EbWsTit6tpzuvTFlgFRJ3S8Evf5gt
|
||||
github.com/thales-e-security/pool v0.0.2/go.mod h1:qtpMm2+thHtqhLzTwgDBj/OuNnMpupY8mv0Phz0gjhU=
|
||||
github.com/theupdateframework/go-tuf v0.5.2-0.20220930112810-3890c1e7ace4 h1:1i/Afw3rmaR1gF3sfVkG2X6ldkikQwA9zY380LrR5YI=
|
||||
github.com/theupdateframework/go-tuf v0.5.2-0.20220930112810-3890c1e7ace4/go.mod h1:vAqWV3zEs89byeFsAYoh/Q14vJTgJkHwnnRCWBBBINY=
|
||||
github.com/theupdateframework/go-tuf v0.5.2 h1:habfDzTmpbzBLIFGWa2ZpVhYvFBoK0C1onC3a4zuPRA=
|
||||
github.com/theupdateframework/go-tuf v0.5.2/go.mod h1:SyMV5kg5n4uEclsyxXJZI2UxPFJNDc4Y+r7wv+MlvTA=
|
||||
github.com/tidwall/pretty v1.0.0/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk=
|
||||
github.com/tidwall/pretty v1.2.0 h1:RWIZEg2iJ8/g6fDDYzMpobmaoGh5OLl4AXtGUGPcqCs=
|
||||
github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 h1:e/5i7d4oYZ+C1wj2THlRK+oAhjeS/TRQwMfkIuet3w0=
|
||||
@@ -1375,6 +1418,8 @@ github.com/vmihailenco/tagparser/v2 v2.0.0 h1:y09buUbR+b5aycVFQs/g70pqKVZNBmxwAh
|
||||
github.com/xanzy/go-gitlab v0.31.0/go.mod h1:sPLojNBn68fMUWSxIJtdVVIP8uSBYqesTfDUseX11Ug=
|
||||
github.com/xanzy/go-gitlab v0.73.1 h1:UMagqUZLJdjss1SovIC+kJCH4k2AZWXl58gJd38Y/hI=
|
||||
github.com/xanzy/go-gitlab v0.73.1/go.mod h1:d/a0vswScO7Agg1CZNz15Ic6SSvBG9vfw8egL99t4kA=
|
||||
github.com/xanzy/go-gitlab v0.79.0 h1:mIxGAHJbGkM/eWspvUXA6MgnYKYTFPDcunz2/uEJg1Y=
|
||||
github.com/xanzy/go-gitlab v0.79.0/go.mod h1:DlByVTSXhPsJMYL6+cm8e8fTJjeBmhrXdC/yvkKKt6M=
|
||||
github.com/xanzy/ssh-agent v0.2.1/go.mod h1:mLlQY/MoOhWBj+gOGMQkOeiEvkx+8pJSI+0Bx9h2kr4=
|
||||
github.com/xdg-go/pbkdf2 v1.0.0/go.mod h1:jrpuAogTd400dnrH08LKmI/xc1MbPOebTwRqcT5RDeI=
|
||||
github.com/xdg-go/scram v1.0.2/go.mod h1:1WAq6h33pAW+iRreB34OORO2Nf7qel3VV3fjBj+hCSs=
|
||||
@@ -1501,6 +1546,8 @@ go.opentelemetry.io/otel/trace v1.11.1/go.mod h1:f/Q9G7vzk5u91PhbmKbg1Qn0rzH1LJ4
|
||||
go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
|
||||
go.opentelemetry.io/proto/otlp v0.16.0 h1:WHzDWdXUvbc5bG2ObdrGfaNpQz7ft7QN9HHmJlbiB1E=
|
||||
go.opentelemetry.io/proto/otlp v0.16.0/go.mod h1:H7XAot3MsfNsj7EXtrA2q5xSNQ10UqI405h3+duxN4U=
|
||||
go.step.sm/crypto v0.23.1 h1:Yr9vlzjGqIKVi88KcpZtEcNTcpDkt1nVR7tumW4h+CU=
|
||||
go.step.sm/crypto v0.23.1/go.mod h1:djAhDYpNAuWF2LkzbCVcf0JDy1UWgrxR3eQ7pQ8EQ/w=
|
||||
go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
|
||||
go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
|
||||
go.uber.org/atomic v1.5.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
|
||||
@@ -1527,6 +1574,8 @@ go.uber.org/zap v1.17.0/go.mod h1:MXVU+bhUf/A7Xi2HNOnopQOrmycQ5Ih87HtOu4q5SSo=
|
||||
go.uber.org/zap v1.21.0/go.mod h1:wjWOCqI0f2ZZrJF/UufIOkiC8ii6tm1iqIsLo76RfJw=
|
||||
go.uber.org/zap v1.23.0 h1:OjGQ5KQDEUawVHxNwQgPpiypGHOxo2mNZsOqTak4fFY=
|
||||
go.uber.org/zap v1.23.0/go.mod h1:D+nX8jyLsMHMYrln8A0rJjFt/T/9/bGgIhAqxv5URuY=
|
||||
go.uber.org/zap v1.24.0 h1:FiJd5l1UOLj0wCgbSE0rwwXHzEdAZS6hiiSnxJN/D60=
|
||||
go.uber.org/zap v1.24.0/go.mod h1:2kMP+WWQ8aoFoedH3T2sq6iJ2yDWpHbP0f6MQbS9Gkg=
|
||||
gocloud.dev v0.19.0/go.mod h1:SmKwiR8YwIMMJvQBKLsC3fHNyMwXLw3PMDO+VVteJMI=
|
||||
golang.org/x/crypto v0.0.0-20180501155221-613d6eafa307/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
|
||||
golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
|
||||
@@ -1851,6 +1900,7 @@ golang.org/x/sys v0.0.0-20220610221304-9f5ed59c137d/go.mod h1:oPkhp1MJrh7nUepCBc
|
||||
golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.1.0 h1:kunALQeHf1/185U1i0GOB/fy1IPRDDpuoOOqRReG57U=
|
||||
golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.3.0 h1:w8ZOecv6NaNa/zC8944JTU3vz4u6Lagfk4RPQxv92NQ=
|
||||
@@ -1894,6 +1944,8 @@ golang.org/x/time v0.0.0-20220922220347-f3bd1da661af h1:Yx9k8YCG3dvF87UAn2tu2HQL
|
||||
golang.org/x/time v0.0.0-20220922220347-f3bd1da661af/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
|
||||
golang.org/x/time v0.2.0 h1:52I/1L54xyEQAYdtcSuxtiT84KGYTBGXwayxmIpNJhE=
|
||||
golang.org/x/time v0.2.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
|
||||
golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4=
|
||||
golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
|
||||
golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
|
||||
golang.org/x/tools v0.0.0-20180828015842-6cd1fcedba52/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
|
||||
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
|
||||
@@ -1975,6 +2027,7 @@ golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
|
||||
golang.org/x/tools v0.1.10/go.mod h1:Uh6Zz+xoGYZom868N8YTex3t7RhtHDBrE8Gzo9bV56E=
|
||||
golang.org/x/tools v0.1.12 h1:VveCTK38A2rkS8ZqFY25HIDFscX5X9OoEhJd3quQmXU=
|
||||
golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
|
||||
golang.org/x/tools v0.5.0/go.mod h1:N+Kgy78s5I24c24dU8OfWNEotWjutIs8SnJvn5IDq+k=
|
||||
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
@@ -2151,6 +2204,8 @@ google.golang.org/genproto v0.0.0-20221206210731-b1a01be3a5f6 h1:AGXp12e/9rItf6/
|
||||
google.golang.org/genproto v0.0.0-20221206210731-b1a01be3a5f6/go.mod h1:1dOng4TWOomJrDGhpXjfCD35wQC6jnC7HpRmOFRqEV0=
|
||||
google.golang.org/genproto v0.0.0-20221227171554-f9683d7f8bef h1:uQ2vjV/sHTsWSqdKeLqmwitzgvjMl7o4IdtHwUDXSJY=
|
||||
google.golang.org/genproto v0.0.0-20221227171554-f9683d7f8bef/go.mod h1:RGgjbofJ8xD9Sq1VVhDM1Vok1vRONV+rg+CjzG4SZKM=
|
||||
google.golang.org/genproto v0.0.0-20230125152338-dcaf20b6aeaa h1:qQPhfbPO23fwm/9lQr91L1u62Zo6cm+zI+slZT+uf+o=
|
||||
google.golang.org/genproto v0.0.0-20230125152338-dcaf20b6aeaa/go.mod h1:RGgjbofJ8xD9Sq1VVhDM1Vok1vRONV+rg+CjzG4SZKM=
|
||||
google.golang.org/grpc v1.8.0/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
|
||||
google.golang.org/grpc v1.17.0/go.mod h1:6QZJwpn2B+Zp71q/5VxRsJ6NXXVCE5NRUHRo+f3cWCs=
|
||||
google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
|
||||
@@ -2195,6 +2250,8 @@ google.golang.org/grpc v1.50.1 h1:DS/BukOZWp8s6p4Dt/tOaJaTQyPyOoCcrjroHuCeLzY=
|
||||
google.golang.org/grpc v1.50.1/go.mod h1:ZgQEeidpAuNRZ8iRrlBKXZQP1ghovWIVhdJRyCDK+GI=
|
||||
google.golang.org/grpc v1.51.0 h1:E1eGv1FTqoLIdnBCZufiSHgKjlqG6fKFf6pPWtMTh8U=
|
||||
google.golang.org/grpc v1.51.0/go.mod h1:wgNDFcnuBGmxLKI/qn4T+m5BtEBYXJPvibbUPsAIPww=
|
||||
google.golang.org/grpc v1.52.0 h1:kd48UiU7EHsV4rnLyOJRuP/Il/UHE7gdDAQ+SZI7nZk=
|
||||
google.golang.org/grpc v1.52.0/go.mod h1:pu6fVzoFb+NBYNAvQL08ic+lvB2IojljRYuun5vorUY=
|
||||
google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
|
||||
google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.2.0/go.mod h1:DNq5QpG7LJqD2AamLZ7zvKE0DEpVl2BSEVjFycAAjRY=
|
||||
google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
|
||||
@@ -2285,6 +2342,8 @@ k8s.io/klog/v2 v2.2.0/go.mod h1:Od+F08eJP+W3HUb4pSrPpgp9DGU4GzlpG/TmITuYh/Y=
|
||||
k8s.io/klog/v2 v2.30.0/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
|
||||
k8s.io/klog/v2 v2.60.1-0.20220317184644-43cc75f9ae89 h1:bUNlsw5yb353zbKMj8srOr6V2Ajhz1VkTKonP1L8r2o=
|
||||
k8s.io/klog/v2 v2.60.1-0.20220317184644-43cc75f9ae89/go.mod h1:N3kgBtsFxMb4nQ0eBDgbHEt/dtxBuTkSFQ+7K5OUoz4=
|
||||
k8s.io/klog/v2 v2.80.1 h1:atnLQ121W371wYYFawwYx1aEY2eUfs4l3J72wtgAwV4=
|
||||
k8s.io/klog/v2 v2.80.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
|
||||
k8s.io/kube-openapi v0.0.0-20211115234752-e816edb12b65/go.mod h1:sX9MT8g7NVZM5lVL/j8QyCCJe8YSMW30QvGZWaCIDIk=
|
||||
k8s.io/kube-openapi v0.0.0-20220124234850-424119656bbf h1:M9XBsiMslw2lb2ZzglC0TOkBPK5NQi0/noUrdnoFwUg=
|
||||
k8s.io/kube-openapi v0.0.0-20220124234850-424119656bbf/go.mod h1:sX9MT8g7NVZM5lVL/j8QyCCJe8YSMW30QvGZWaCIDIk=
|
||||
|
||||
@@ -17,6 +17,9 @@ var (
|
||||
trustedBuilderRepository = "slsa-framework/slsa-github-generator"
|
||||
e2eTestRepository = "slsa-framework/example-package"
|
||||
certOidcIssuer = "https://token.actions.githubusercontent.com"
|
||||
// This is used in cosign's CheckOpts for validating the certificate. We
|
||||
// do specific builder verification after this.
|
||||
certSubjectRegexp = "https://github.com/*"
|
||||
)
|
||||
|
||||
var defaultArtifactTrustedReusableWorkflows = map[string]bool{
|
||||
|
||||
@@ -0,0 +1,187 @@
|
||||
package gha
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/x509"
|
||||
"encoding/base64"
|
||||
"encoding/hex"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
|
||||
dsselib "github.com/secure-systems-lab/go-securesystemslib/dsse"
|
||||
bundle_v1 "github.com/sigstore/protobuf-specs/gen/pb-go/bundle/v1"
|
||||
v1 "github.com/sigstore/protobuf-specs/gen/pb-go/rekor/v1"
|
||||
"github.com/sigstore/rekor/pkg/generated/models"
|
||||
"google.golang.org/protobuf/encoding/protojson"
|
||||
)
|
||||
|
||||
// Bundle specific errors.
|
||||
var (
|
||||
ErrorMismatchSignature = errors.New("bundle tlog entry does not match signature")
|
||||
ErrorUnexpectedEntryType = errors.New("unexpected tlog entry type")
|
||||
ErrorMissingCertInBundle = errors.New("missing signing certificate in bundle")
|
||||
ErrorUnexpectedBundleContent = errors.New("expected DSSE bundle content")
|
||||
)
|
||||
|
||||
// verifyRekorEntryFromBundle extracts and verifies the Rekor entry from the Sigstore
|
||||
// bundle verification material, validating the SignedEntryTimestamp.
|
||||
func verifyRekorEntryFromBundle(ctx context.Context, tlogEntry *v1.TransparencyLogEntry,
|
||||
trustedRoot *TrustedRoot) (
|
||||
*models.LogEntryAnon, error) {
|
||||
canonicalBody := tlogEntry.GetCanonicalizedBody()
|
||||
logID := hex.EncodeToString(tlogEntry.GetLogId().GetKeyId())
|
||||
rekorEntry := &models.LogEntryAnon{
|
||||
Body: canonicalBody,
|
||||
IntegratedTime: &tlogEntry.IntegratedTime,
|
||||
LogIndex: &tlogEntry.LogIndex,
|
||||
LogID: &logID,
|
||||
Verification: &models.LogEntryAnonVerification{
|
||||
SignedEntryTimestamp: tlogEntry.GetInclusionPromise().GetSignedEntryTimestamp(),
|
||||
},
|
||||
}
|
||||
|
||||
// Verify tlog entry.
|
||||
if _, err := verifyTlogEntry(ctx, *rekorEntry, false,
|
||||
trustedRoot.RekorPubKeys); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
return rekorEntry, nil
|
||||
}
|
||||
|
||||
// getEnvelopeFromBundle extracts the DSSE envelope from the Sigstore bundle.
|
||||
func getEnvelopeFromBundle(bundle *bundle_v1.Bundle) (*dsselib.Envelope, error) {
|
||||
dsseEnvelope := bundle.GetDsseEnvelope()
|
||||
if dsseEnvelope == nil {
|
||||
return nil, ErrorUnexpectedBundleContent
|
||||
}
|
||||
env := &dsselib.Envelope{
|
||||
PayloadType: dsseEnvelope.GetPayloadType(),
|
||||
Payload: base64.StdEncoding.EncodeToString(dsseEnvelope.GetPayload()),
|
||||
}
|
||||
for _, sig := range dsseEnvelope.GetSignatures() {
|
||||
env.Signatures = append(env.Signatures, dsselib.Signature{
|
||||
KeyID: sig.GetKeyid(),
|
||||
Sig: base64.StdEncoding.EncodeToString(sig.GetSig()),
|
||||
})
|
||||
}
|
||||
return env, nil
|
||||
}
|
||||
|
||||
// getLeafCertFromBundle extracts the signing cert from the Sigstore bundle.
|
||||
func getLeafCertFromBundle(bundle *bundle_v1.Bundle) (*x509.Certificate, error) {
|
||||
certChain := bundle.GetVerificationMaterial().GetX509CertificateChain().GetCertificates()
|
||||
if len(certChain) == 0 {
|
||||
return nil, ErrorMissingCertInBundle
|
||||
}
|
||||
|
||||
// The first certificate is the leaf cert: see
|
||||
// https://github.com/sigstore/protobuf-specs/blob/16541696de137c6281d66d075a4924d9bbd181ff/protos/sigstore_common.proto#L170
|
||||
certBytes := certChain[0].GetRawBytes()
|
||||
return x509.ParseCertificate(certBytes)
|
||||
}
|
||||
|
||||
// matchRekorEntryWithEnvelope ensures that the log entry references the given
|
||||
// DSSE envelope. It MUST verify that the signatures match to ensure that the
|
||||
// tlog timestamp attests to the signature creation time.
|
||||
func matchRekorEntryWithEnvelope(tlogEntry *v1.TransparencyLogEntry, env *dsselib.Envelope) error {
|
||||
kindVersion := tlogEntry.GetKindVersion()
|
||||
if kindVersion.Kind != "intoto" &&
|
||||
kindVersion.Version != "0.0.2" {
|
||||
return fmt.Errorf("%w: expected intoto:0.0.2, got %s:%s", ErrorUnexpectedEntryType,
|
||||
kindVersion.Kind, kindVersion.Version)
|
||||
}
|
||||
|
||||
canonicalBody := tlogEntry.GetCanonicalizedBody()
|
||||
var toto models.Intoto
|
||||
var intotoObj models.IntotoV002Schema
|
||||
if err := json.Unmarshal(canonicalBody, &toto); err != nil {
|
||||
return fmt.Errorf("%w: %s", ErrorUnexpectedEntryType, err)
|
||||
}
|
||||
specMarshal, err := json.Marshal(toto.Spec)
|
||||
if err != nil {
|
||||
return fmt.Errorf("%w: %s", ErrorUnexpectedEntryType, err)
|
||||
}
|
||||
if err := json.Unmarshal(specMarshal, &intotoObj); err != nil {
|
||||
return fmt.Errorf("%w: %s", ErrorUnexpectedEntryType, err)
|
||||
}
|
||||
|
||||
if len(env.Signatures) != len(intotoObj.Content.Envelope.Signatures) {
|
||||
return fmt.Errorf("expected %d sigs in canonical body, got %d",
|
||||
len(env.Signatures),
|
||||
len(intotoObj.Content.Envelope.Signatures))
|
||||
}
|
||||
|
||||
for _, sig := range env.Signatures {
|
||||
// The signature in the canonical body is double base64-encoded.
|
||||
encodedEnvSig := base64.StdEncoding.EncodeToString(
|
||||
[]byte(sig.Sig))
|
||||
var matchCanonical bool
|
||||
for _, canonicalSig := range intotoObj.Content.Envelope.Signatures {
|
||||
if canonicalSig.Sig.String() == encodedEnvSig {
|
||||
matchCanonical = true
|
||||
}
|
||||
}
|
||||
if !matchCanonical {
|
||||
return ErrorMismatchSignature
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// VerifyProvenanceBundle verifies the DSSE envelope using the offline Rekor bundle and
|
||||
// returns the verified DSSE envelope containing the provenance
|
||||
// and the signing certificate given the provenance.
|
||||
func VerifyProvenanceBundle(ctx context.Context, bundleBytes []byte,
|
||||
trustedRoot *TrustedRoot) (
|
||||
*SignedAttestation, error) {
|
||||
// Extract the SigningCert, Envelope, and RekorEntry from the bundle.
|
||||
var bundle bundle_v1.Bundle
|
||||
if err := protojson.Unmarshal(bundleBytes, &bundle); err != nil {
|
||||
return nil, fmt.Errorf("unmarshaling bundle: %w", err)
|
||||
}
|
||||
|
||||
// We only expect one TLOG entry. If this changes in the future, we must iterate
|
||||
// for a matching one.
|
||||
if bundle.GetVerificationMaterial() == nil ||
|
||||
len(bundle.GetVerificationMaterial().GetTlogEntries()) == 0 {
|
||||
return nil, fmt.Errorf("bundle missing offline tlog verification material %d", len(bundle.GetVerificationMaterial().GetTlogEntries()))
|
||||
}
|
||||
|
||||
// Verify tlog entry.
|
||||
tlogEntry := bundle.GetVerificationMaterial().GetTlogEntries()[0]
|
||||
rekorEntry, err := verifyRekorEntryFromBundle(ctx, tlogEntry, trustedRoot)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
// Extract DSSE envelope.
|
||||
env, err := getEnvelopeFromBundle(&bundle)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
// Match tlog entry signature with the envelope.
|
||||
if err := matchRekorEntryWithEnvelope(tlogEntry, env); err != nil {
|
||||
return nil, fmt.Errorf("matching bundle entry with content: %w", err)
|
||||
}
|
||||
|
||||
// Get certificate from bundle.
|
||||
cert, err := getLeafCertFromBundle(&bundle)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
proposedSignedAtt := &SignedAttestation{
|
||||
SigningCert: cert,
|
||||
Envelope: env,
|
||||
RekorEntry: rekorEntry,
|
||||
}
|
||||
|
||||
if err := verifySignedAttestation(proposedSignedAtt, trustedRoot); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
return proposedSignedAtt, nil
|
||||
}
|
||||
@@ -0,0 +1,77 @@
|
||||
package gha
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"os"
|
||||
"testing"
|
||||
|
||||
"github.com/google/go-cmp/cmp"
|
||||
serrors "github.com/slsa-framework/slsa-verifier/v2/errors"
|
||||
)
|
||||
|
||||
func Test_verifyBundle(t *testing.T) {
|
||||
t.Parallel()
|
||||
ctx := context.Background()
|
||||
|
||||
trustedRoot, err := GetTrustedRoot(ctx)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
tests := []struct {
|
||||
name string
|
||||
path string
|
||||
expected error
|
||||
}{
|
||||
{
|
||||
name: "valid bundle",
|
||||
path: "./testdata/bundle/valid.intoto.sigstore",
|
||||
},
|
||||
{
|
||||
name: "mismatch rekor entry",
|
||||
path: "./testdata/bundle/mismatch-tlog.intoto.sigstore",
|
||||
expected: ErrorMismatchSignature,
|
||||
},
|
||||
|
||||
{
|
||||
name: "invalid Rekor SET",
|
||||
path: "./testdata/bundle/invalid-set.intoto.sigstore",
|
||||
expected: serrors.ErrorInvalidRekorEntry,
|
||||
},
|
||||
/* we hit the SET error before we can hit the invalid DSSE sig
|
||||
{
|
||||
name: "invalid DSSE sig",
|
||||
path: "./testdata/bundle/invalid-dsse-sig.intoto.sigstore",
|
||||
},
|
||||
{
|
||||
name: "invalid expiry with Rekor timestamp",
|
||||
path: "./testdata/bundle/invalid-expiry-tlog.intoto.sigstore",
|
||||
},
|
||||
{
|
||||
name: "invalid no DSSE",
|
||||
path: "./testdata/bundle/invalid-no-dsse.intoto.sigstore",
|
||||
},
|
||||
{
|
||||
name: "invalid no certificate",
|
||||
path: "./testdata/bundle/invalid-no-cert.intoto.sigstore",
|
||||
},
|
||||
*/
|
||||
}
|
||||
for _, tt := range tests {
|
||||
tt := tt // Re-initializing variable so it is not changed while executing the closure below
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
content, err := os.ReadFile(tt.path)
|
||||
if err != nil {
|
||||
panic(fmt.Errorf("os.ReadFile: %w", err))
|
||||
}
|
||||
|
||||
_, err = VerifyProvenanceBundle(ctx, content, trustedRoot)
|
||||
|
||||
if !errCmp(err, tt.expected) {
|
||||
t.Errorf(cmp.Diff(err, tt.expected))
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
@@ -163,21 +163,29 @@ func verifySha256Digest(prov *intoto.ProvenanceStatement, expectedHash string) e
|
||||
|
||||
// VerifyProvenanceSignature returns the verified DSSE envelope containing the provenance
|
||||
// and the signing certificate given the provenance and artifact hash.
|
||||
func VerifyProvenanceSignature(ctx context.Context, rClient *client.Rekor,
|
||||
func VerifyProvenanceSignature(ctx context.Context, trustedRoot *TrustedRoot,
|
||||
rClient *client.Rekor,
|
||||
provenance []byte, artifactHash string) (
|
||||
*SignedAttestation, error) {
|
||||
// Collect trusted root material for verification (Rekor pubkeys, SCT pubkeys,
|
||||
// Fulcio root certificates).
|
||||
_, err := GetTrustedRoot(ctx)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
// There are two cases, either we have an embedded certificate, or we need
|
||||
// to use the Redis index for searching by artifact SHA.
|
||||
if hasCertInEnvelope(provenance) {
|
||||
// Get Rekor entries corresponding to provenance
|
||||
return GetValidSignedAttestationWithCert(rClient, provenance)
|
||||
return GetValidSignedAttestationWithCert(rClient, provenance, trustedRoot)
|
||||
}
|
||||
|
||||
// Fallback on using the redis search index to get matching UUIDs.
|
||||
fmt.Fprintf(os.Stderr, "No certificate provided, trying Redis search index to find entries by subject digest\n")
|
||||
|
||||
// Verify the provenance and return the signing certificate.
|
||||
signedAttestation, err := SearchValidSignedAttestation(ctx, artifactHash, provenance, rClient)
|
||||
signedAttestation, err := SearchValidSignedAttestation(ctx, artifactHash, provenance, rClient, trustedRoot)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
@@ -4,6 +4,7 @@ import (
|
||||
"bytes"
|
||||
"context"
|
||||
"crypto"
|
||||
"crypto/ecdsa"
|
||||
"crypto/x509"
|
||||
"encoding/base64"
|
||||
"errors"
|
||||
@@ -16,8 +17,7 @@ import (
|
||||
"github.com/go-openapi/runtime"
|
||||
"github.com/go-openapi/strfmt"
|
||||
"github.com/go-openapi/swag"
|
||||
"github.com/sigstore/cosign/cmd/cosign/cli/fulcio"
|
||||
"github.com/sigstore/cosign/pkg/cosign"
|
||||
"github.com/sigstore/cosign/v2/pkg/cosign"
|
||||
"github.com/sigstore/rekor/pkg/generated/client"
|
||||
"github.com/sigstore/rekor/pkg/generated/client/entries"
|
||||
"github.com/sigstore/rekor/pkg/generated/client/index"
|
||||
@@ -38,7 +38,8 @@ const (
|
||||
defaultRekorAddr = "https://rekor.sigstore.dev"
|
||||
)
|
||||
|
||||
func verifyTlogEntryByUUID(ctx context.Context, rekorClient *client.Rekor, entryUUID string) (
|
||||
func verifyTlogEntryByUUID(ctx context.Context, rekorClient *client.Rekor,
|
||||
entryUUID string, trustedRoot *TrustedRoot) (
|
||||
*models.LogEntryAnon, error) {
|
||||
params := entries.NewGetLogEntryByUUIDParamsWithContext(ctx)
|
||||
params.EntryUUID = entryUUID
|
||||
@@ -67,29 +68,36 @@ func verifyTlogEntryByUUID(ctx context.Context, rekorClient *client.Rekor, entry
|
||||
return nil, errors.New("expected matching UUID")
|
||||
}
|
||||
// Validate the entry response.
|
||||
return verifyTlogEntry(ctx, rekorClient, entry)
|
||||
return verifyTlogEntry(ctx, entry, true, trustedRoot.RekorPubKeys)
|
||||
}
|
||||
|
||||
return nil, serrors.ErrorRekorSearch
|
||||
}
|
||||
|
||||
func verifyTlogEntry(ctx context.Context, rekorClient *client.Rekor, e models.LogEntryAnon) (
|
||||
// verifyTlogEntry verifies a Rekor entry content against a trusted Rekor key.
|
||||
// Verification includes verifying the SignedEntryTimestamp and, if verifyInclusion
|
||||
// is true, the inclusion proof along with the signed tree head.
|
||||
func verifyTlogEntry(ctx context.Context, e models.LogEntryAnon,
|
||||
verifyInclusion bool, rekorKeys *cosign.TrustedTransparencyLogPubKeys) (
|
||||
*models.LogEntryAnon, error) {
|
||||
// Verify the root hash against the current Signed Entry Tree Head
|
||||
pubs, err := cosign.GetRekorPubs(ctx, nil)
|
||||
verifier, err := signature.LoadECDSAVerifier(rekorKeys.Keys[*e.LogID].PubKey.(*ecdsa.PublicKey),
|
||||
crypto.SHA256)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("%w: %s", err, "unable to fetch Rekor public keys from TUF repository")
|
||||
return nil, fmt.Errorf("%w: %s", serrors.ErrorRekorPubKey, err)
|
||||
}
|
||||
|
||||
verifier, err := signature.LoadECDSAVerifier(pubs[*e.LogID].PubKey, crypto.SHA256)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("%w: %s", err, "unable to load a ECDSA verifier")
|
||||
if verifyInclusion {
|
||||
// This function verifies the inclusion proof, the signature on the root hash of the
|
||||
// inclusion proof, and the SignedEntryTimestamp.
|
||||
err = rverify.VerifyLogEntry(ctx, &e, verifier)
|
||||
} else {
|
||||
// This function verifies the SignedEntryTimestamp
|
||||
err = rverify.VerifySignedEntryTimestamp(ctx, &e, verifier)
|
||||
}
|
||||
|
||||
// This function verifies the inclusion proof, the signature on the root hash of the
|
||||
// inclusion proof, and the SignedEntryTimestamp.
|
||||
if err := rverify.VerifyLogEntry(ctx, &e, verifier); err != nil {
|
||||
return nil, fmt.Errorf("%w: %s", err, "unable to verify a log entry")
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("%w: %s", serrors.ErrorInvalidRekorEntry, err)
|
||||
}
|
||||
|
||||
return &e, nil
|
||||
@@ -174,7 +182,8 @@ func getUUIDsByArtifactDigest(rClient *client.Rekor, artifactHash string) ([]str
|
||||
// GetValidSignedAttestationWithCert finds and validates the matching entry UUIDs with
|
||||
// the full intoto attestation.
|
||||
// The attestation generated by the slsa-github-generator libraries contain a signing certificate.
|
||||
func GetValidSignedAttestationWithCert(rClient *client.Rekor, provenance []byte) (*SignedAttestation, error) {
|
||||
func GetValidSignedAttestationWithCert(rClient *client.Rekor,
|
||||
provenance []byte, trustedRoot *TrustedRoot) (*SignedAttestation, error) {
|
||||
// Use intoto attestation to find rekor entry UUIDs.
|
||||
params := entries.NewSearchLogQueryParams()
|
||||
searchLogQuery := models.SearchLogQuery{}
|
||||
@@ -206,7 +215,8 @@ func GetValidSignedAttestationWithCert(rClient *client.Rekor, provenance []byte)
|
||||
logEntry := resp.Payload[0]
|
||||
var rekorEntry models.LogEntryAnon
|
||||
for uuid, e := range logEntry {
|
||||
if _, err := verifyTlogEntry(context.Background(), rClient, e); err != nil {
|
||||
if _, err := verifyTlogEntry(context.Background(), e, true,
|
||||
trustedRoot.RekorPubKeys); err != nil {
|
||||
return nil, fmt.Errorf("error verifying tlog entry: %w", err)
|
||||
}
|
||||
rekorEntry = e
|
||||
@@ -233,7 +243,7 @@ func GetValidSignedAttestationWithCert(rClient *client.Rekor, provenance []byte)
|
||||
RekorEntry: &rekorEntry,
|
||||
}
|
||||
|
||||
if err := verifySignedAttestation(proposedSignedAtt); err != nil {
|
||||
if err := verifySignedAttestation(proposedSignedAtt, trustedRoot); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
@@ -243,7 +253,7 @@ func GetValidSignedAttestationWithCert(rClient *client.Rekor, provenance []byte)
|
||||
// SearchValidSignedAttestation searches for a valid signing certificate using the Rekor
|
||||
// Redis search index by using the artifact digest.
|
||||
func SearchValidSignedAttestation(ctx context.Context, artifactHash string, provenance []byte,
|
||||
rClient *client.Rekor) (*SignedAttestation, error) {
|
||||
rClient *client.Rekor, trustedRoot *TrustedRoot) (*SignedAttestation, error) {
|
||||
// Get Rekor UUIDs by artifact digest.
|
||||
uuids, err := getUUIDsByArtifactDigest(rClient, artifactHash)
|
||||
if err != nil {
|
||||
@@ -263,7 +273,7 @@ func SearchValidSignedAttestation(ctx context.Context, artifactHash string, prov
|
||||
// * If all succeed, return the signing certificate.
|
||||
var errs []string
|
||||
for _, uuid := range uuids {
|
||||
entry, err := verifyTlogEntryByUUID(ctx, rClient, uuid)
|
||||
entry, err := verifyTlogEntryByUUID(ctx, rClient, uuid, trustedRoot)
|
||||
if err != nil {
|
||||
// this is unexpected, hold on to this error.
|
||||
errs = append(errs, fmt.Sprintf("%s: verifying tlog entry %s", err, uuid))
|
||||
@@ -283,7 +293,7 @@ func SearchValidSignedAttestation(ctx context.Context, artifactHash string, prov
|
||||
RekorEntry: entry,
|
||||
}
|
||||
|
||||
err = verifySignedAttestation(proposedSignedAtt)
|
||||
err = verifySignedAttestation(proposedSignedAtt, trustedRoot)
|
||||
if errors.Is(err, serrors.ErrorInternal) {
|
||||
// Return on an internal error
|
||||
return nil, err
|
||||
@@ -302,11 +312,12 @@ func SearchValidSignedAttestation(ctx context.Context, artifactHash string, prov
|
||||
}
|
||||
|
||||
// verifyAttestationSignature validates the signature on the attestation
|
||||
// given a certificate and a validated signature time.
|
||||
// given a certificate and a validated signature time from a verified
|
||||
// Rekor entry.
|
||||
// The certificate is verified up to Fulcio, the signature is validated
|
||||
// using the certificate, and the signature generation time is checked
|
||||
// to be within the certificate validity period.
|
||||
func verifySignedAttestation(signedAtt *SignedAttestation) error {
|
||||
func verifySignedAttestation(signedAtt *SignedAttestation, trustedRoot *TrustedRoot) error {
|
||||
cert := signedAtt.SigningCert
|
||||
attBytes, err := cjson.MarshalCanonical(signedAtt.Envelope)
|
||||
if err != nil {
|
||||
@@ -315,20 +326,16 @@ func verifySignedAttestation(signedAtt *SignedAttestation) error {
|
||||
signatureTimestamp := time.Unix(*signedAtt.RekorEntry.IntegratedTime, 0)
|
||||
|
||||
// 1. Verify certificate chain.
|
||||
roots, err := fulcio.GetRoots()
|
||||
if err != nil {
|
||||
// this is unexpected, hold on to this error.
|
||||
return fmt.Errorf("%w: %s", serrors.ErrorInternal, err)
|
||||
}
|
||||
intermediates, err := fulcio.GetIntermediates()
|
||||
if err != nil {
|
||||
// this is unexpected, hold on to this error.
|
||||
return fmt.Errorf("%w: %s", serrors.ErrorInternal, err)
|
||||
}
|
||||
co := &cosign.CheckOpts{
|
||||
RootCerts: roots,
|
||||
IntermediateCerts: intermediates,
|
||||
CertOidcIssuer: certOidcIssuer,
|
||||
RootCerts: trustedRoot.FulcioRoot,
|
||||
IntermediateCerts: trustedRoot.FulcioIntermediates,
|
||||
Identities: []cosign.Identity{
|
||||
{
|
||||
Issuer: certOidcIssuer,
|
||||
SubjectRegExp: certSubjectRegexp,
|
||||
},
|
||||
},
|
||||
CTLogPubKeys: trustedRoot.CTPubKeys,
|
||||
}
|
||||
verifier, err := cosign.ValidateAndUnpackCert(signedAtt.SigningCert, co)
|
||||
if err != nil {
|
||||
|
||||
File diff suppressed because one or more lines are too long
@@ -0,0 +1,45 @@
|
||||
{
|
||||
"mediaType": "application/vnd.dev.sigstore.bundle+json;version=0.1",
|
||||
"verificationMaterial": {
|
||||
"x509CertificateChain": {
|
||||
"certificates": [
|
||||
{
|
||||
"rawBytes": "MIID0TCCA1igAwIBAgIUOSG9QNL9kvs5jnrXdnivcV0/DLcwCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjMwMTI2MTcwODIxWhcNMjMwMTI2MTcxODIxWjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEKAZhjoXKP7UaAFachtVF89rjJneQEBgyNeAgm/eECqQr8qJiYUTHgzHeXr5xAaEGFk56yeS0XljwcufjB/hka6OCAncwggJzMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUMOeiGa0yJ6JrdfZLurzFpxv5DTUwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wegYDVR0RAQH/BHAwboZsaHR0cHM6Ly9naXRodWIuY29tL2xhdXJlbnRzaW1vbi9zbHNhLWRlbGVnYXRvci8uZ2l0aHViL3dvcmtmbG93cy9kZWxlZ2F0b3JfZ2VuZXJpY19zbHNhMy55bWxAcmVmcy9oZWFkcy9tYWluMDkGCisGAQQBg78wAQEEK2h0dHBzOi8vdG9rZW4uYWN0aW9ucy5naXRodWJ1c2VyY29udGVudC5jb20wHwYKKwYBBAGDvzABAgQRd29ya2Zsb3dfZGlzcGF0Y2gwNgYKKwYBBAGDvzABAwQoNDY1MTcxY2M3ZjIwOTdiODU4MmZjNjFhMjgxYzQ0Mzc1NjM2MjNlZDAnBgorBgEEAYO/MAEEBBlzbHNhIDMgZ29yZWxlYXNlciBwcm9qZWN0MCcGCisGAQQBg78wAQUEGWFzcmFhL3Nsc2Etb24tZ2l0aHViLXRlc3QwHQYKKwYBBAGDvzABBgQPcmVmcy9oZWFkcy9tYWluMIGKBgorBgEEAdZ5AgQCBHwEegB4AHYA3T0wasbHETJjGR4cmWc3AqJKXrjePK3/h4pygC8p7o4AAAGF7w1CowAABAMARzBFAiAm6227kpvmh6tzgrOov/IRFv3AJC6hfsU7HsFlkJzPrQIhAP2Xjn4wafkDkfvXsmVJUsiwlUDjwp6Eaf3J5AsdxydyMAoGCCqGSM49BAMDA2cAMGQCMCt+sy5GDwiol8bGGzv3nAaXPQRyUBItJRAjTGk/FKQzI57pvHGgj+G5oNKp32IAZAIwYbT93oBuwm7CrMEAmJXoSb/iHv10HEqJdraogW0JV7AljlcGSKgRkRh55ZVqVaKG"
|
||||
},
|
||||
{
|
||||
"rawBytes": "MIICGjCCAaGgAwIBAgIUALnViVfnU0brJasmRkHrn/UnfaQwCgYIKoZIzj0EAwMwKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTAeFw0yMjA0MTMyMDA2MTVaFw0zMTEwMDUxMzU2NThaMDcxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEeMBwGA1UEAxMVc2lnc3RvcmUtaW50ZXJtZWRpYXRlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE8RVS/ysH+NOvuDZyPIZtilgUF9NlarYpAd9HP1vBBH1U5CV77LSS7s0ZiH4nE7Hv7ptS6LvvR/STk798LVgMzLlJ4HeIfF3tHSaexLcYpSASr1kS0N/RgBJz/9jWCiXno3sweTAOBgNVHQ8BAf8EBAMCAQYwEwYDVR0lBAwwCgYIKwYBBQUHAwMwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQU39Ppz1YkEZb5qNjpKFWixi4YZD8wHwYDVR0jBBgwFoAUWMAeX5FFpWapesyQoZMi0CrFxfowCgYIKoZIzj0EAwMDZwAwZAIwPCsQK4DYiZYDPIaDi5HFKnfxXx6ASSVmERfsynYBiX2X6SJRnZU84/9DZdnFvvxmAjBOt6QpBlc4J/0DxvkTCqpclvziL6BCCPnjdlIB3Pu3BxsPmygUY7Ii2zbdCdliiow="
|
||||
},
|
||||
{
|
||||
"rawBytes": "MIIB9zCCAXygAwIBAgIUALZNAPFdxHPwjeDloDwyYChAO/4wCgYIKoZIzj0EAwMwKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTAeFw0yMTEwMDcxMzU2NTlaFw0zMTEwMDUxMzU2NThaMCoxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjERMA8GA1UEAxMIc2lnc3RvcmUwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAT7XeFT4rb3PQGwS4IajtLk3/OlnpgangaBclYpsYBr5i+4ynB07ceb3LP0OIOZdxexX69c5iVuyJRQ+Hz05yi+UF3uBWAlHpiS5sh0+H2GHE7SXrk1EC5m1Tr19L9gg92jYzBhMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRYwB5fkUWlZql6zJChkyLQKsXF+jAfBgNVHSMEGDAWgBRYwB5fkUWlZql6zJChkyLQKsXF+jAKBggqhkjOPQQDAwNpADBmAjEAj1nHeXZp+13NWBNa+EDsDP8G1WWg1tCMWP/WHPqpaVo0jhsweNFZgSs0eE7wYI4qAjEA2WB9ot98sIkoF3vZYdd3/VtWB5b9TNMea7Ix/stJ5TfcLLeABLE4BNJOsQ4vnBHJ"
|
||||
}
|
||||
]
|
||||
},
|
||||
"tlogEntries": [
|
||||
{
|
||||
"logIndex": "11999348",
|
||||
"logId": {
|
||||
"keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0="
|
||||
},
|
||||
"kindVersion": {
|
||||
"kind": "intoto",
|
||||
"version": "0.0.2"
|
||||
},
|
||||
"integratedTime": "1674752902",
|
||||
"inclusionPromise": {
|
||||
"signedEntryTimestamp": "MEQCICyaEfCk2V3ryQI7bBkmm4NoBGPXcZtHWF+NtgRoZ2s7AiAFRyNMtHZL8VXpIZEkEfrRBpO/DUt+UoCv8pGUjpnJAQ=="
|
||||
},
|
||||
"canonicalizedBody": "ewogICJhcGlWZXJzaW9uIjogIjAuMC4yIiwKICAia2luZCI6ICJpbnRvdG8iLAogICJzcGVjIjogewogICAgImNvbnRlbnQiOiB7CiAgICAgICJlbnZlbG9wZSI6IHsKICAgICAgICAicGF5bG9hZFR5cGUiOiAiYXBwbGljYXRpb24vdm5kLmluLXRvdG8ranNvbiIsCiAgICAgICAgInNpZ25hdHVyZXMiOiBbCiAgICAgICAgICB7CiAgICAgICAgICAgICJwdWJsaWNLZXkiOiAiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVUXdWRU5EUVRGcFowRjNTVUpCWjBsVlQxTkhPVkZPVERscmRuTTFhbTV5V0dSdWFYWmpWakF2UkV4amQwTm5XVWxMYjFwSmVtb3dSVUYzVFhjS1RucEZWazFDVFVkQk1WVkZRMmhOVFdNeWJHNWpNMUoyWTIxVmRWcEhWakpOVWpSM1NFRlpSRlpSVVVSRmVGWjZZVmRrZW1SSE9YbGFVekZ3WW01U2JBcGpiVEZzV2tkc2FHUkhWWGRJYUdOT1RXcE5kMDFVU1RKTlZHTjNUMFJKZUZkb1kwNU5hazEzVFZSSk1rMVVZM2hQUkVsNFYycEJRVTFHYTNkRmQxbElDa3R2V2tsNmFqQkRRVkZaU1V0dldrbDZhakJFUVZGalJGRm5RVVZMUVZwb2FtOVlTMUEzVldGQlJtRmphSFJXUmpnNWNtcEtibVZSUlVKbmVVNWxRV2NLYlM5bFJVTnhVWEk0Y1VwcFdWVlVTR2Q2U0dWWWNqVjRRV0ZGUjBack5UWjVaVk13V0d4cWQyTjFabXBDTDJocllUWlBRMEZ1WTNkblowcDZUVUUwUndwQk1WVmtSSGRGUWk5M1VVVkJkMGxJWjBSQlZFSm5UbFpJVTFWRlJFUkJTMEpuWjNKQ1owVkdRbEZqUkVGNlFXUkNaMDVXU0ZFMFJVWm5VVlZOVDJWcENrZGhNSGxLTmtweVpHWmFUSFZ5ZWtad2VIWTFSRlJWZDBoM1dVUldVakJxUWtKbmQwWnZRVlV6T1ZCd2VqRlphMFZhWWpWeFRtcHdTMFpYYVhocE5Ga0tXa1E0ZDJWbldVUldVakJTUVZGSUwwSklRWGRpYjFwellVaFNNR05JVFRaTWVUbHVZVmhTYjJSWFNYVlpNamwwVERKNGFHUllTbXhpYmxKNllWY3hkZ3BpYVRsNllraE9hRXhYVW14aVIxWnVXVmhTZG1OcE9IVmFNbXd3WVVoV2FVd3paSFpqYlhSdFlrYzVNMk41T1d0YVYzaHNXakpHTUdJelNtWmFNbFoxQ2xwWVNuQlpNVGw2WWtoT2FFMTVOVFZpVjNoQlkyMVdiV041T1c5YVYwWnJZM2s1ZEZsWGJIVk5SR3RIUTJselIwRlJVVUpuTnpoM1FWRkZSVXN5YURBS1pFaENlazlwT0haa1J6bHlXbGMwZFZsWFRqQmhWemwxWTNrMWJtRllVbTlrVjBveFl6SldlVmt5T1hWa1IxWjFaRU0xYW1JeU1IZElkMWxMUzNkWlFncENRVWRFZG5wQlFrRm5VVkprTWpsNVlUSmFjMkl6WkdaYVIyeDZZMGRHTUZreVozZE9aMWxMUzNkWlFrSkJSMFIyZWtGQ1FYZFJiMDVFV1RGTlZHTjRDbGt5VFROYWFrbDNUMVJrYVU5RVZUUk5iVnBxVG1wR2FFMXFaM2haZWxFd1RYcGpNVTVxVFRKTmFrNXNXa1JCYmtKbmIzSkNaMFZGUVZsUEwwMUJSVVVLUWtKc2VtSklUbWhKUkUxbldqSTVlVnBYZUd4WldFNXNZMmxDZDJOdE9YRmFWMDR3VFVOalIwTnBjMGRCVVZGQ1p6YzRkMEZSVlVWSFYwWjZZMjFHYUFwTU0wNXpZekpGZEdJeU5IUmFNbXd3WVVoV2FVeFlVbXhqTTFGM1NGRlpTMHQzV1VKQ1FVZEVkbnBCUWtKblVWQmpiVlp0WTNrNWIxcFhSbXRqZVRsMENsbFhiSFZOU1VkTFFtZHZja0puUlVWQlpGbzFRV2RSUTBKSWQwVmxaMEkwUVVoWlFUTlVNSGRoYzJKSVJWUktha2RTTkdOdFYyTXpRWEZLUzFoeWFtVUtVRXN6TDJnMGNIbG5Remh3TjI4MFFVRkJSMFkzZHpGRGIzZEJRVUpCVFVGU2VrSkdRV2xCYlRZeU1qZHJjSFp0YURaMGVtZHlUMjkyTDBsU1JuWXpRUXBLUXpab1puTlZOMGh6Um14clNucFFjbEZKYUVGUU1saHFialIzWVdaclJHdG1kbGh6YlZaS1ZYTnBkMnhWUkdwM2NEWkZZV1l6U2pWQmMyUjRlV1I1Q2sxQmIwZERRM0ZIVTAwME9VSkJUVVJCTW1OQlRVZFJRMDFEZEN0emVUVkhSSGRwYjJ3NFlrZEhlbll6YmtGaFdGQlJVbmxWUWtsMFNsSkJhbFJIYXk4S1JrdFJla2sxTjNCMlNFZG5haXRITlc5T1MzQXpNa2xCV2tGSmQxbGlWRGt6YjBKMWQyMDNRM0pOUlVGdFNsaHZVMkl2YVVoMk1UQklSWEZLWkhKaGJ3cG5WekJLVmpkQmJHcHNZMGRUUzJkU2ExSm9OVFZhVm5GV1lVdEhDaTB0TFMwdFJVNUVJRU5GVWxSSlJrbERRVlJGTFMwdExTMEsiLAogICAgICAgICAgICAic2lnIjogIlRVVlZRMGxSUTJaU1preHdkM0UwZG1nclJHcFdlVlpDVFRadWNGZEJUMG94THl0VE5tOWlOVVJpYkc5VGVrWktPVkZKWjBjM1drMXVabXRDTm1sUldXcG9OVGxyZWt4b2RGaEVWVGhQTjBkcVoxQkhhREEzTVVsU05YSk9LMEk5Q2c9PSIKICAgICAgICAgIH0KICAgICAgICBdCiAgICAgIH0sCiAgICAgICJoYXNoIjogewogICAgICAgICJhbGdvcml0aG0iOiAic2hhMjU2IiwKICAgICAgICAidmFsdWUiOiAiNDM3ZTYyNDY4ZTM0MWU0MTczMmZkOWM2ODMwNzEzMDFlNTJjZmE0YzVhNDdhYjMzNDAzNzg1MTMxOWQ1ZWI0OSIKICAgICAgfSwKICAgICAgInBheWxvYWRIYXNoIjogewogICAgICAgICJhbGdvcml0aG0iOiAic2hhMjU2IiwKICAgICAgICAidmFsdWUiOiAiNDcyYTVjZWU2Mjg0NTUzMzExYzYyZjdlM2YxZDM0N2JkNGI3NGM0YzdlYmNmNDBhNjdmMDhhMGZmMGNhNWM5MSIKICAgICAgfQogICAgfQogIH0KfQo="
|
||||
}
|
||||
]
|
||||
},
|
||||
"dsseEnvelope": {
|
||||
"payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjAuMSIsInN1YmplY3QiOlt7Im5hbWUiOiJleGFtcGxlLWxpbnV4LWFtZDY0IiwiZGlnZXN0Ijp7InNoYTI1NiI6IjA5MmIyMjA2ODhlZTczN2M2Njg4MmE3NGFlOGJmZTNlMmIzNWRmNjBiOTI0MDRiNTUyZWJlOTA1YTJkNjMzY2UifX1dLCJwcmVkaWNhdGVUeXBlIjoiaHR0cHM6Ly9zbHNhLmRldi9wcm92ZW5hbmNlL3YxLjA/ZHJhZnQiLCJwcmVkaWNhdGUiOnsiYnVpbGREZWZpbml0aW9uIjp7ImJ1aWxkVHlwZSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9zbHNhLWZyYW1ld29yay9zbHNhLWdpdGh1Yi1nZW5lcmF0b3IvZGVsZWdhdG9yLWdlbmVyaWNAdjAiLCJleHRlcm5hbFBhcmFtZXRlcnMiOnsid29ya2Zsb3dQYXRoIjp7InZhbHVlIjoiLmdpdGh1Yi93b3JrZmxvd3MvcmVsZWFzZS55bWwifSwic291cmNlIjp7ImFydGlmYWN0Ijp7InVyaSI6ImdpdCtodHRwczovL2dpdGh1Yi5jb20vYXNyYWEvc2xzYS1vbi1naXRodWItdGVzdEByZWZzL2hlYWRzL21haW4iLCJkaWdlc3QiOnsic2hhMSI6IjQ2NTE3MWNjN2YyMDk3Yjg1ODJmYzYxYTI4MWM0NDM3NTYzNjIzZWQifX19LCJpbnB1dF9yZWxlYXNlLXRhZyI6eyJ2YWx1ZSI6InYxIn19LCJzeXN0ZW1QYXJhbWV0ZXJzIjp7IkdJVEhVQl9FVkVOVF9OQU1FIjp7InZhbHVlIjoid29ya2Zsb3dfZGlzcGF0Y2gifSwiR0lUSFVCX0pPQiI6eyJ2YWx1ZSI6InZlcmlmeS10b2tlbiJ9LCJHSVRIVUJfUkVGIjp7InZhbHVlIjoicmVmcy9oZWFkcy9tYWluIn0sIkdJVEhVQl9SRUZfVFlQRSI6eyJ2YWx1ZSI6ImJyYW5jaCJ9LCJHSVRIVUJfUkVQT1NJVE9SWSI6eyJ2YWx1ZSI6ImFzcmFhL3Nsc2Etb24tZ2l0aHViLXRlc3QifSwiR0lUSFVCX1JVTl9BVFRFTVBUIjp7InZhbHVlIjoiMSJ9LCJHSVRIVUJfUlVOX0lEIjp7InZhbHVlIjoiNDAxNzQzNDgwOCJ9LCJHSVRIVUJfUlVOX05VTUJFUiI6eyJ2YWx1ZSI6IjUifSwiR0lUSFVCX1NIQSI6eyJ2YWx1ZSI6IjQ2NTE3MWNjN2YyMDk3Yjg1ODJmYzYxYTI4MWM0NDM3NTYzNjIzZWQifSwiR0lUSFVCX1dPUktGTE9XIjp7InZhbHVlIjoic2xzYSAzIGdvcmVsZWFzZXIgcHJvamVjdCJ9LCJHSVRIVUJfQUNUT1JfSUQiOnsidmFsdWUiOiI1MTk0NTY5In0sIkdJVEhVQl9SRVBPU0lUT1JZX0lEIjp7InZhbHVlIjoiNTAxMzk1MjQyIn0sIkdJVEhVQl9SRVBTSVRPUllfT1dORVJfSUQiOnsidmFsdWUiOiI1MTk0NTY5In0sIkdJVEhVQl9XT1JLRkxPV19SRUYiOnsidmFsdWUiOiJhc3JhYS9zbHNhLW9uLWdpdGh1Yi10ZXN0Ly5naXRodWIvd29ya2Zsb3dzL3JlbGVhc2UueW1sQHJlZnMvaGVhZHMvbWFpbiJ9LCJHSVRIVUJfV09SS0ZMT1dfU0hBIjp7InZhbHVlIjoiNDY1MTcxY2M3ZjIwOTdiODU4MmZjNjFhMjgxYzQ0Mzc1NjM2MjNlZCJ9LCJJTUFHRV9PUyI6eyJ2YWx1ZSI6InVidW50dTIyIn0sIklNQUdFX1ZFUlNJT04iOnsidmFsdWUiOiIyMDIzMDEyMi4xIn0sIlJVTk5FUl9BUkNIIjp7InZhbHVlIjoiWDY0In0sIlJVTk5FUl9OQU1FIjp7InZhbHVlIjoiSG9zdGVkIEFnZW50In0sIlJVTk5FUl9PUyI6eyJ2YWx1ZSI6IkxpbnV4In19fSwicnVuRGV0YWlscyI6eyJidWlsZGVyIjp7ImlkIjoiaHR0cHM6Ly9naXRodWIuY29tL2FzcmFhL3Nsc2Etb24tZ2l0aHViLy5naXRodWIvd29ya2Zsb3dzL2dvcmVsZWFzZXJfc2xzYTMueW1sQHJlZnMvaGVhZHMvbWFpbiJ9LCJtZXRhZGF0YSI6eyJpbnZvY2F0aW9uSWQiOiJodHRwczovL2dpdGh1Yi5jb20vYXNyYWEvc2xzYS1vbi1naXRodWItdGVzdC9hY3Rpb25zL3J1bnMvNDAxNzQzNDgwOC9hdHRlbXB0cy8xIn19fX0=",
|
||||
"payloadType": "application/vnd.in-toto+json",
|
||||
"signatures": [
|
||||
{
|
||||
"sig": "MEUCIQCfRfLpwq4vh+DjVyVBM6npWAOJ1/+S6ob5DbloSzFJ9QIgG7ZMnfkB6iQYjh59kzLhtXDU8O7GjgPGh071IR5rN+B=",
|
||||
"keyid": ""
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,45 @@
|
||||
{
|
||||
"mediaType": "application/vnd.dev.sigstore.bundle+json;version=0.1",
|
||||
"verificationMaterial": {
|
||||
"x509CertificateChain": {
|
||||
"certificates": [
|
||||
{
|
||||
"rawBytes": "MIID0TCCA1igAwIBAgIUOSG9QNL9kvs5jnrXdnivcV0/DLcwCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjMwMTI2MTcwODIxWhcNMjMwMTI2MTcxODIxWjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEKAZhjoXKP7UaAFachtVF89rjJneQEBgyNeAgm/eECqQr8qJiYUTHgzHeXr5xAaEGFk56yeS0XljwcufjB/hka6OCAncwggJzMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUMOeiGa0yJ6JrdfZLurzFpxv5DTUwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wegYDVR0RAQH/BHAwboZsaHR0cHM6Ly9naXRodWIuY29tL2xhdXJlbnRzaW1vbi9zbHNhLWRlbGVnYXRvci8uZ2l0aHViL3dvcmtmbG93cy9kZWxlZ2F0b3JfZ2VuZXJpY19zbHNhMy55bWxAcmVmcy9oZWFkcy9tYWluMDkGCisGAQQBg78wAQEEK2h0dHBzOi8vdG9rZW4uYWN0aW9ucy5naXRodWJ1c2VyY29udGVudC5jb20wHwYKKwYBBAGDvzABAgQRd29ya2Zsb3dfZGlzcGF0Y2gwNgYKKwYBBAGDvzABAwQoNDY1MTcxY2M3ZjIwOTdiODU4MmZjNjFhMjgxYzQ0Mzc1NjM2MjNlZDAnBgorBgEEAYO/MAEEBBlzbHNhIDMgZ29yZWxlYXNlciBwcm9qZWN0MCcGCisGAQQBg78wAQUEGWFzcmFhL3Nsc2Etb24tZ2l0aHViLXRlc3QwHQYKKwYBBAGDvzABBgQPcmVmcy9oZWFkcy9tYWluMIGKBgorBgEEAdZ5AgQCBHwEegB4AHYA3T0wasbHETJjGR4cmWc3AqJKXrjePK3/h4pygC8p7o4AAAGF7w1CowAABAMARzBFAiAm6227kpvmh6tzgrOov/IRFv3AJC6hfsU7HsFlkJzPrQIhAP2Xjn4wafkDkfvXsmVJUsiwlUDjwp6Eaf3J5AsdxydyMAoGCCqGSM49BAMDA2cAMGQCMCt+sy5GDwiol8bGGzv3nAaXPQRyUBItJRAjTGk/FKQzI57pvHGgj+G5oNKp32IAZAIwYbT93oBuwm7CrMEAmJXoSb/iHv10HEqJdraogW0JV7AljlcGSKgRkRh55ZVqVaKG"
|
||||
},
|
||||
{
|
||||
"rawBytes": "MIICGjCCAaGgAwIBAgIUALnViVfnU0brJasmRkHrn/UnfaQwCgYIKoZIzj0EAwMwKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTAeFw0yMjA0MTMyMDA2MTVaFw0zMTEwMDUxMzU2NThaMDcxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEeMBwGA1UEAxMVc2lnc3RvcmUtaW50ZXJtZWRpYXRlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE8RVS/ysH+NOvuDZyPIZtilgUF9NlarYpAd9HP1vBBH1U5CV77LSS7s0ZiH4nE7Hv7ptS6LvvR/STk798LVgMzLlJ4HeIfF3tHSaexLcYpSASr1kS0N/RgBJz/9jWCiXno3sweTAOBgNVHQ8BAf8EBAMCAQYwEwYDVR0lBAwwCgYIKwYBBQUHAwMwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQU39Ppz1YkEZb5qNjpKFWixi4YZD8wHwYDVR0jBBgwFoAUWMAeX5FFpWapesyQoZMi0CrFxfowCgYIKoZIzj0EAwMDZwAwZAIwPCsQK4DYiZYDPIaDi5HFKnfxXx6ASSVmERfsynYBiX2X6SJRnZU84/9DZdnFvvxmAjBOt6QpBlc4J/0DxvkTCqpclvziL6BCCPnjdlIB3Pu3BxsPmygUY7Ii2zbdCdliiow="
|
||||
},
|
||||
{
|
||||
"rawBytes": "MIIB9zCCAXygAwIBAgIUALZNAPFdxHPwjeDloDwyYChAO/4wCgYIKoZIzj0EAwMwKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTAeFw0yMTEwMDcxMzU2NTlaFw0zMTEwMDUxMzU2NThaMCoxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjERMA8GA1UEAxMIc2lnc3RvcmUwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAT7XeFT4rb3PQGwS4IajtLk3/OlnpgangaBclYpsYBr5i+4ynB07ceb3LP0OIOZdxexX69c5iVuyJRQ+Hz05yi+UF3uBWAlHpiS5sh0+H2GHE7SXrk1EC5m1Tr19L9gg92jYzBhMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRYwB5fkUWlZql6zJChkyLQKsXF+jAfBgNVHSMEGDAWgBRYwB5fkUWlZql6zJChkyLQKsXF+jAKBggqhkjOPQQDAwNpADBmAjEAj1nHeXZp+13NWBNa+EDsDP8G1WWg1tCMWP/WHPqpaVo0jhsweNFZgSs0eE7wYI4qAjEA2WB9ot98sIkoF3vZYdd3/VtWB5b9TNMea7Ix/stJ5TfcLLeABLE4BNJOsQ4vnBHJ"
|
||||
}
|
||||
]
|
||||
},
|
||||
"tlogEntries": [
|
||||
{
|
||||
"logIndex": "11999348",
|
||||
"logId": {
|
||||
"keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0="
|
||||
},
|
||||
"kindVersion": {
|
||||
"kind": "intoto",
|
||||
"version": "0.0.2"
|
||||
},
|
||||
"integratedTime": "1674752902",
|
||||
"inclusionPromise": {
|
||||
"signedEntryTimestamp": "MEQCICyaEfCk2V3ryQI7bBkmm4NoBGPXcZtHWF+NtgRoZ2s7AiAFRyNMtHZL8VXpIZEkEfrRBpO/DUt+UoCv8pGUjpnJAp=="
|
||||
},
|
||||
"canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjIiLCJraW5kIjoiaW50b3RvIiwic3BlYyI6eyJjb250ZW50Ijp7ImVudmVsb3BlIjp7InBheWxvYWRUeXBlIjoiYXBwbGljYXRpb24vdm5kLmluLXRvdG8ranNvbiIsInNpZ25hdHVyZXMiOlt7InB1YmxpY0tleSI6IkxTMHRMUzFDUlVkSlRpQkRSVkpVU1VaSlEwRlVSUzB0TFMwdENrMUpTVVF3VkVORFFURnBaMEYzU1VKQlowbFZUMU5IT1ZGT1REbHJkbk0xYW01eVdHUnVhWFpqVmpBdlJFeGpkME5uV1VsTGIxcEplbW93UlVGM1RYY0tUbnBGVmsxQ1RVZEJNVlZGUTJoTlRXTXliRzVqTTFKMlkyMVZkVnBIVmpKTlVqUjNTRUZaUkZaUlVVUkZlRlo2WVZka2VtUkhPWGxhVXpGd1ltNVNiQXBqYlRGc1drZHNhR1JIVlhkSWFHTk9UV3BOZDAxVVNUSk5WR04zVDBSSmVGZG9ZMDVOYWsxM1RWUkpNazFVWTNoUFJFbDRWMnBCUVUxR2EzZEZkMWxJQ2t0dldrbDZhakJEUVZGWlNVdHZXa2w2YWpCRVFWRmpSRkZuUVVWTFFWcG9hbTlZUzFBM1ZXRkJSbUZqYUhSV1JqZzVjbXBLYm1WUlJVSm5lVTVsUVdjS2JTOWxSVU54VVhJNGNVcHBXVlZVU0dkNlNHVlljalY0UVdGRlIwWnJOVFo1WlZNd1dHeHFkMk4xWm1wQ0wyaHJZVFpQUTBGdVkzZG5aMHA2VFVFMFJ3cEJNVlZrUkhkRlFpOTNVVVZCZDBsSVowUkJWRUpuVGxaSVUxVkZSRVJCUzBKblozSkNaMFZHUWxGalJFRjZRV1JDWjA1V1NGRTBSVVpuVVZWTlQyVnBDa2RoTUhsS05rcHlaR1phVEhWeWVrWndlSFkxUkZSVmQwaDNXVVJXVWpCcVFrSm5kMFp2UVZVek9WQndlakZaYTBWYVlqVnhUbXB3UzBaWGFYaHBORmtLV2tRNGQyVm5XVVJXVWpCU1FWRklMMEpJUVhkaWIxcHpZVWhTTUdOSVRUWk1lVGx1WVZoU2IyUlhTWFZaTWpsMFRESjRhR1JZU214aWJsSjZZVmN4ZGdwaWFUbDZZa2hPYUV4WFVteGlSMVp1V1ZoU2RtTnBPSFZhTW13d1lVaFdhVXd6WkhaamJYUnRZa2M1TTJONU9XdGFWM2hzV2pKR01HSXpTbVphTWxaMUNscFlTbkJaTVRsNllraE9hRTE1TlRWaVYzaEJZMjFXYldONU9XOWFWMFpyWTNrNWRGbFhiSFZOUkd0SFEybHpSMEZSVVVKbk56aDNRVkZGUlVzeWFEQUtaRWhDZWs5cE9IWmtSemx5V2xjMGRWbFhUakJoVnpsMVkzazFibUZZVW05a1Ywb3hZekpXZVZreU9YVmtSMVoxWkVNMWFtSXlNSGRJZDFsTFMzZFpRZ3BDUVVkRWRucEJRa0ZuVVZKa01qbDVZVEphYzJJelpHWmFSMng2WTBkR01Ga3laM2RPWjFsTFMzZFpRa0pCUjBSMmVrRkNRWGRSYjA1RVdURk5WR040Q2xreVRUTmFha2wzVDFSa2FVOUVWVFJOYlZwcVRtcEdhRTFxWjNoWmVsRXdUWHBqTVU1cVRUSk5hazVzV2tSQmJrSm5iM0pDWjBWRlFWbFBMMDFCUlVVS1FrSnNlbUpJVG1oSlJFMW5Xakk1ZVZwWGVHeFpXRTVzWTJsQ2QyTnRPWEZhVjA0d1RVTmpSME5wYzBkQlVWRkNaemM0ZDBGUlZVVkhWMFo2WTIxR2FBcE1NMDV6WXpKRmRHSXlOSFJhTW13d1lVaFdhVXhZVW14ak0xRjNTRkZaUzB0M1dVSkNRVWRFZG5wQlFrSm5VVkJqYlZadFkzazViMXBYUm10amVUbDBDbGxYYkhWTlNVZExRbWR2Y2tKblJVVkJaRm8xUVdkUlEwSklkMFZsWjBJMFFVaFpRVE5VTUhkaGMySklSVlJLYWtkU05HTnRWMk16UVhGS1MxaHlhbVVLVUVzekwyZzBjSGxuUXpod04yODBRVUZCUjBZM2R6RkRiM2RCUVVKQlRVRlNla0pHUVdsQmJUWXlNamRyY0hadGFEWjBlbWR5VDI5MkwwbFNSbll6UVFwS1F6Wm9abk5WTjBoelJteHJTbnBRY2xGSmFFRlFNbGhxYmpSM1lXWnJSR3RtZGxoemJWWktWWE5wZDJ4VlJHcDNjRFpGWVdZelNqVkJjMlI0ZVdSNUNrMUJiMGREUTNGSFUwMDBPVUpCVFVSQk1tTkJUVWRSUTAxRGRDdHplVFZIUkhkcGIydzRZa2RIZW5ZemJrRmhXRkJSVW5sVlFrbDBTbEpCYWxSSGF5OEtSa3RSZWtrMU4zQjJTRWRuYWl0SE5XOU9TM0F6TWtsQldrRkpkMWxpVkRremIwSjFkMjAzUTNKTlJVRnRTbGh2VTJJdmFVaDJNVEJJUlhGS1pISmhid3BuVnpCS1ZqZEJiR3BzWTBkVFMyZFNhMUpvTlRWYVZuRldZVXRIQ2kwdExTMHRSVTVFSUVORlVsUkpSa2xEUVZSRkxTMHRMUzBLIiwic2lnIjoiVFVWVlEwbFJRMlpTWmt4d2QzRTBkbWdyUkdwV2VWWkNUVFp1Y0ZkQlQwb3hMeXRUTm05aU5VUmliRzlUZWtaS09WRkpaMGMzV2sxdVptdENObWxSV1dwb05UbHJla3hvZEZoRVZUaFBOMGRxWjFCSGFEQTNNVWxTTlhKT0swRTkifV19LCJoYXNoIjp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiNDM3ZTYyNDY4ZTM0MWU0MTczMmZkOWM2ODMwNzEzMDFlNTJjZmE0YzVhNDdhYjMzNDAzNzg1MTMxOWQ1ZWI0OSJ9LCJwYXlsb2FkSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjQ3MmE1Y2VlNjI4NDU1MzMxMWM2MmY3ZTNmMWQzNDdiZDRiNzRjNGM3ZWJjZjQwYTY3ZjA4YTBmZjBjYTVjOTEifX19fQ=="
|
||||
}
|
||||
]
|
||||
},
|
||||
"dsseEnvelope": {
|
||||
"payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjAuMSIsInN1YmplY3QiOlt7Im5hbWUiOiJleGFtcGxlLWxpbnV4LWFtZDY0IiwiZGlnZXN0Ijp7InNoYTI1NiI6IjA5MmIyMjA2ODhlZTczN2M2Njg4MmE3NGFlOGJmZTNlMmIzNWRmNjBiOTI0MDRiNTUyZWJlOTA1YTJkNjMzY2UifX1dLCJwcmVkaWNhdGVUeXBlIjoiaHR0cHM6Ly9zbHNhLmRldi9wcm92ZW5hbmNlL3YxLjA/ZHJhZnQiLCJwcmVkaWNhdGUiOnsiYnVpbGREZWZpbml0aW9uIjp7ImJ1aWxkVHlwZSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9zbHNhLWZyYW1ld29yay9zbHNhLWdpdGh1Yi1nZW5lcmF0b3IvZGVsZWdhdG9yLWdlbmVyaWNAdjAiLCJleHRlcm5hbFBhcmFtZXRlcnMiOnsid29ya2Zsb3dQYXRoIjp7InZhbHVlIjoiLmdpdGh1Yi93b3JrZmxvd3MvcmVsZWFzZS55bWwifSwic291cmNlIjp7ImFydGlmYWN0Ijp7InVyaSI6ImdpdCtodHRwczovL2dpdGh1Yi5jb20vYXNyYWEvc2xzYS1vbi1naXRodWItdGVzdEByZWZzL2hlYWRzL21haW4iLCJkaWdlc3QiOnsic2hhMSI6IjQ2NTE3MWNjN2YyMDk3Yjg1ODJmYzYxYTI4MWM0NDM3NTYzNjIzZWQifX19LCJpbnB1dF9yZWxlYXNlLXRhZyI6eyJ2YWx1ZSI6InYxIn19LCJzeXN0ZW1QYXJhbWV0ZXJzIjp7IkdJVEhVQl9FVkVOVF9OQU1FIjp7InZhbHVlIjoid29ya2Zsb3dfZGlzcGF0Y2gifSwiR0lUSFVCX0pPQiI6eyJ2YWx1ZSI6InZlcmlmeS10b2tlbiJ9LCJHSVRIVUJfUkVGIjp7InZhbHVlIjoicmVmcy9oZWFkcy9tYWluIn0sIkdJVEhVQl9SRUZfVFlQRSI6eyJ2YWx1ZSI6ImJyYW5jaCJ9LCJHSVRIVUJfUkVQT1NJVE9SWSI6eyJ2YWx1ZSI6ImFzcmFhL3Nsc2Etb24tZ2l0aHViLXRlc3QifSwiR0lUSFVCX1JVTl9BVFRFTVBUIjp7InZhbHVlIjoiMSJ9LCJHSVRIVUJfUlVOX0lEIjp7InZhbHVlIjoiNDAxNzQzNDgwOCJ9LCJHSVRIVUJfUlVOX05VTUJFUiI6eyJ2YWx1ZSI6IjUifSwiR0lUSFVCX1NIQSI6eyJ2YWx1ZSI6IjQ2NTE3MWNjN2YyMDk3Yjg1ODJmYzYxYTI4MWM0NDM3NTYzNjIzZWQifSwiR0lUSFVCX1dPUktGTE9XIjp7InZhbHVlIjoic2xzYSAzIGdvcmVsZWFzZXIgcHJvamVjdCJ9LCJHSVRIVUJfQUNUT1JfSUQiOnsidmFsdWUiOiI1MTk0NTY5In0sIkdJVEhVQl9SRVBPU0lUT1JZX0lEIjp7InZhbHVlIjoiNTAxMzk1MjQyIn0sIkdJVEhVQl9SRVBTSVRPUllfT1dORVJfSUQiOnsidmFsdWUiOiI1MTk0NTY5In0sIkdJVEhVQl9XT1JLRkxPV19SRUYiOnsidmFsdWUiOiJhc3JhYS9zbHNhLW9uLWdpdGh1Yi10ZXN0Ly5naXRodWIvd29ya2Zsb3dzL3JlbGVhc2UueW1sQHJlZnMvaGVhZHMvbWFpbiJ9LCJHSVRIVUJfV09SS0ZMT1dfU0hBIjp7InZhbHVlIjoiNDY1MTcxY2M3ZjIwOTdiODU4MmZjNjFhMjgxYzQ0Mzc1NjM2MjNlZCJ9LCJJTUFHRV9PUyI6eyJ2YWx1ZSI6InVidW50dTIyIn0sIklNQUdFX1ZFUlNJT04iOnsidmFsdWUiOiIyMDIzMDEyMi4xIn0sIlJVTk5FUl9BUkNIIjp7InZhbHVlIjoiWDY0In0sIlJVTk5FUl9OQU1FIjp7InZhbHVlIjoiSG9zdGVkIEFnZW50In0sIlJVTk5FUl9PUyI6eyJ2YWx1ZSI6IkxpbnV4In19fSwicnVuRGV0YWlscyI6eyJidWlsZGVyIjp7ImlkIjoiaHR0cHM6Ly9naXRodWIuY29tL2FzcmFhL3Nsc2Etb24tZ2l0aHViLy5naXRodWIvd29ya2Zsb3dzL2dvcmVsZWFzZXJfc2xzYTMueW1sQHJlZnMvaGVhZHMvbWFpbiJ9LCJtZXRhZGF0YSI6eyJpbnZvY2F0aW9uSWQiOiJodHRwczovL2dpdGh1Yi5jb20vYXNyYWEvc2xzYS1vbi1naXRodWItdGVzdC9hY3Rpb25zL3J1bnMvNDAxNzQzNDgwOC9hdHRlbXB0cy8xIn19fX0=",
|
||||
"payloadType": "application/vnd.in-toto+json",
|
||||
"signatures": [
|
||||
{
|
||||
"sig": "MEUCIQCfRfLpwq4vh+DjVyVBM6npWAOJ1/+S6ob5DbloSzFJ9QIgG7ZMnfkB6iQYjh59kzLhtXDU8O7GjgPGh071IR5rN+A=",
|
||||
"keyid": ""
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,45 @@
|
||||
{
|
||||
"mediaType": "application/vnd.dev.sigstore.bundle+json;version=0.1",
|
||||
"verificationMaterial": {
|
||||
"x509CertificateChain": {
|
||||
"certificates": [
|
||||
{
|
||||
"rawBytes": "MIID0jCCA1egAwIBAgIUYYhl4c++rHa/smWBcs2Y637MiyowCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjMwMTI3MjIxOTAzWhcNMjMwMTI3MjIyOTAzWjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEcc4awjVjw8rpaStSKEgqO8XjFZcMq9wxUEC4OREHZXf9B/cotW0tOU9YbYv8RLnIokA4gxRiGvdv608x3MBO86OCAnYwggJyMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUQKFo6kBIcgWBtHFuNhOvP9b+TdwwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wegYDVR0RAQH/BHAwboZsaHR0cHM6Ly9naXRodWIuY29tL2xhdXJlbnRzaW1vbi9zbHNhLWRlbGVnYXRvci8uZ2l0aHViL3dvcmtmbG93cy9kZWxlZ2F0b3JfZ2VuZXJpY19zbHNhMy55bWxAcmVmcy9oZWFkcy9tYWluMDkGCisGAQQBg78wAQEEK2h0dHBzOi8vdG9rZW4uYWN0aW9ucy5naXRodWJ1c2VyY29udGVudC5jb20wHwYKKwYBBAGDvzABAgQRd29ya2Zsb3dfZGlzcGF0Y2gwNgYKKwYBBAGDvzABAwQoNDY1MTcxY2M3ZjIwOTdiODU4MmZjNjFhMjgxYzQ0Mzc1NjM2MjNlZDAnBgorBgEEAYO/MAEEBBlzbHNhIDMgZ29yZWxlYXNlciBwcm9qZWN0MCcGCisGAQQBg78wAQUEGWFzcmFhL3Nsc2Etb24tZ2l0aHViLXRlc3QwHQYKKwYBBAGDvzABBgQPcmVmcy9oZWFkcy9tYWluMIGJBgorBgEEAdZ5AgQCBHsEeQB3AHUA3T0wasbHETJjGR4cmWc3AqJKXrjePK3/h4pygC8p7o4AAAGF9VARkQAABAMARjBEAiBrmPM4EVCnsw5yVG/LGPGDzPDFE3UegJ5SjFq4mmE/uwIgFF0RclWskrlKgGH1aR7M+hzit4yCXotS8o/eDcQ0Zj8wCgYIKoZIzj0EAwMDaQAwZgIxAMGz1mkq7E0rpcROY1qmAWNjWD39FGK1kH/1rNkzM5un9RuHS9ajMxTVsaeazcQZHgIxALN3wo6ZbLTU/nzlkAD+/XGwRQOYoaRUziRBTTlD+KJlLBfDzlK9JBYo0Bik1VwHFA=="
|
||||
},
|
||||
{
|
||||
"rawBytes": "MIICGjCCAaGgAwIBAgIUALnViVfnU0brJasmRkHrn/UnfaQwCgYIKoZIzj0EAwMwKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTAeFw0yMjA0MTMyMDA2MTVaFw0zMTEwMDUxMzU2NThaMDcxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEeMBwGA1UEAxMVc2lnc3RvcmUtaW50ZXJtZWRpYXRlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE8RVS/ysH+NOvuDZyPIZtilgUF9NlarYpAd9HP1vBBH1U5CV77LSS7s0ZiH4nE7Hv7ptS6LvvR/STk798LVgMzLlJ4HeIfF3tHSaexLcYpSASr1kS0N/RgBJz/9jWCiXno3sweTAOBgNVHQ8BAf8EBAMCAQYwEwYDVR0lBAwwCgYIKwYBBQUHAwMwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQU39Ppz1YkEZb5qNjpKFWixi4YZD8wHwYDVR0jBBgwFoAUWMAeX5FFpWapesyQoZMi0CrFxfowCgYIKoZIzj0EAwMDZwAwZAIwPCsQK4DYiZYDPIaDi5HFKnfxXx6ASSVmERfsynYBiX2X6SJRnZU84/9DZdnFvvxmAjBOt6QpBlc4J/0DxvkTCqpclvziL6BCCPnjdlIB3Pu3BxsPmygUY7Ii2zbdCdliiow="
|
||||
},
|
||||
{
|
||||
"rawBytes": "MIIB9zCCAXygAwIBAgIUALZNAPFdxHPwjeDloDwyYChAO/4wCgYIKoZIzj0EAwMwKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTAeFw0yMTEwMDcxMzU2NTlaFw0zMTEwMDUxMzU2NThaMCoxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjERMA8GA1UEAxMIc2lnc3RvcmUwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAT7XeFT4rb3PQGwS4IajtLk3/OlnpgangaBclYpsYBr5i+4ynB07ceb3LP0OIOZdxexX69c5iVuyJRQ+Hz05yi+UF3uBWAlHpiS5sh0+H2GHE7SXrk1EC5m1Tr19L9gg92jYzBhMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRYwB5fkUWlZql6zJChkyLQKsXF+jAfBgNVHSMEGDAWgBRYwB5fkUWlZql6zJChkyLQKsXF+jAKBggqhkjOPQQDAwNpADBmAjEAj1nHeXZp+13NWBNa+EDsDP8G1WWg1tCMWP/WHPqpaVo0jhsweNFZgSs0eE7wYI4qAjEA2WB9ot98sIkoF3vZYdd3/VtWB5b9TNMea7Ix/stJ5TfcLLeABLE4BNJOsQ4vnBHJ"
|
||||
}
|
||||
]
|
||||
},
|
||||
"tlogEntries": [
|
||||
{
|
||||
"logIndex": "11999348",
|
||||
"logId": {
|
||||
"keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0="
|
||||
},
|
||||
"kindVersion": {
|
||||
"kind": "intoto",
|
||||
"version": "0.0.2"
|
||||
},
|
||||
"integratedTime": "1674752902",
|
||||
"inclusionPromise": {
|
||||
"signedEntryTimestamp": "MEQCICyaEfCk2V3ryQI7bBkmm4NoBGPXcZtHWF+NtgRoZ2s7AiAFRyNMtHZL8VXpIZEkEfrRBpO/DUt+UoCv8pGUjpnJAQ=="
|
||||
},
|
||||
"canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjIiLCJraW5kIjoiaW50b3RvIiwic3BlYyI6eyJjb250ZW50Ijp7ImVudmVsb3BlIjp7InBheWxvYWRUeXBlIjoiYXBwbGljYXRpb24vdm5kLmluLXRvdG8ranNvbiIsInNpZ25hdHVyZXMiOlt7InB1YmxpY0tleSI6IkxTMHRMUzFDUlVkSlRpQkRSVkpVU1VaSlEwRlVSUzB0TFMwdENrMUpTVVF3VkVORFFURnBaMEYzU1VKQlowbFZUMU5IT1ZGT1REbHJkbk0xYW01eVdHUnVhWFpqVmpBdlJFeGpkME5uV1VsTGIxcEplbW93UlVGM1RYY0tUbnBGVmsxQ1RVZEJNVlZGUTJoTlRXTXliRzVqTTFKMlkyMVZkVnBIVmpKTlVqUjNTRUZaUkZaUlVVUkZlRlo2WVZka2VtUkhPWGxhVXpGd1ltNVNiQXBqYlRGc1drZHNhR1JIVlhkSWFHTk9UV3BOZDAxVVNUSk5WR04zVDBSSmVGZG9ZMDVOYWsxM1RWUkpNazFVWTNoUFJFbDRWMnBCUVUxR2EzZEZkMWxJQ2t0dldrbDZhakJEUVZGWlNVdHZXa2w2YWpCRVFWRmpSRkZuUVVWTFFWcG9hbTlZUzFBM1ZXRkJSbUZqYUhSV1JqZzVjbXBLYm1WUlJVSm5lVTVsUVdjS2JTOWxSVU54VVhJNGNVcHBXVlZVU0dkNlNHVlljalY0UVdGRlIwWnJOVFo1WlZNd1dHeHFkMk4xWm1wQ0wyaHJZVFpQUTBGdVkzZG5aMHA2VFVFMFJ3cEJNVlZrUkhkRlFpOTNVVVZCZDBsSVowUkJWRUpuVGxaSVUxVkZSRVJCUzBKblozSkNaMFZHUWxGalJFRjZRV1JDWjA1V1NGRTBSVVpuVVZWTlQyVnBDa2RoTUhsS05rcHlaR1phVEhWeWVrWndlSFkxUkZSVmQwaDNXVVJXVWpCcVFrSm5kMFp2UVZVek9WQndlakZaYTBWYVlqVnhUbXB3UzBaWGFYaHBORmtLV2tRNGQyVm5XVVJXVWpCU1FWRklMMEpJUVhkaWIxcHpZVWhTTUdOSVRUWk1lVGx1WVZoU2IyUlhTWFZaTWpsMFRESjRhR1JZU214aWJsSjZZVmN4ZGdwaWFUbDZZa2hPYUV4WFVteGlSMVp1V1ZoU2RtTnBPSFZhTW13d1lVaFdhVXd6WkhaamJYUnRZa2M1TTJONU9XdGFWM2hzV2pKR01HSXpTbVphTWxaMUNscFlTbkJaTVRsNllraE9hRTE1TlRWaVYzaEJZMjFXYldONU9XOWFWMFpyWTNrNWRGbFhiSFZOUkd0SFEybHpSMEZSVVVKbk56aDNRVkZGUlVzeWFEQUtaRWhDZWs5cE9IWmtSemx5V2xjMGRWbFhUakJoVnpsMVkzazFibUZZVW05a1Ywb3hZekpXZVZreU9YVmtSMVoxWkVNMWFtSXlNSGRJZDFsTFMzZFpRZ3BDUVVkRWRucEJRa0ZuVVZKa01qbDVZVEphYzJJelpHWmFSMng2WTBkR01Ga3laM2RPWjFsTFMzZFpRa0pCUjBSMmVrRkNRWGRSYjA1RVdURk5WR040Q2xreVRUTmFha2wzVDFSa2FVOUVWVFJOYlZwcVRtcEdhRTFxWjNoWmVsRXdUWHBqTVU1cVRUSk5hazVzV2tSQmJrSm5iM0pDWjBWRlFWbFBMMDFCUlVVS1FrSnNlbUpJVG1oSlJFMW5Xakk1ZVZwWGVHeFpXRTVzWTJsQ2QyTnRPWEZhVjA0d1RVTmpSME5wYzBkQlVWRkNaemM0ZDBGUlZVVkhWMFo2WTIxR2FBcE1NMDV6WXpKRmRHSXlOSFJhTW13d1lVaFdhVXhZVW14ak0xRjNTRkZaUzB0M1dVSkNRVWRFZG5wQlFrSm5VVkJqYlZadFkzazViMXBYUm10amVUbDBDbGxYYkhWTlNVZExRbWR2Y2tKblJVVkJaRm8xUVdkUlEwSklkMFZsWjBJMFFVaFpRVE5VTUhkaGMySklSVlJLYWtkU05HTnRWMk16UVhGS1MxaHlhbVVLVUVzekwyZzBjSGxuUXpod04yODBRVUZCUjBZM2R6RkRiM2RCUVVKQlRVRlNla0pHUVdsQmJUWXlNamRyY0hadGFEWjBlbWR5VDI5MkwwbFNSbll6UVFwS1F6Wm9abk5WTjBoelJteHJTbnBRY2xGSmFFRlFNbGhxYmpSM1lXWnJSR3RtZGxoemJWWktWWE5wZDJ4VlJHcDNjRFpGWVdZelNqVkJjMlI0ZVdSNUNrMUJiMGREUTNGSFUwMDBPVUpCVFVSQk1tTkJUVWRSUTAxRGRDdHplVFZIUkhkcGIydzRZa2RIZW5ZemJrRmhXRkJSVW5sVlFrbDBTbEpCYWxSSGF5OEtSa3RSZWtrMU4zQjJTRWRuYWl0SE5XOU9TM0F6TWtsQldrRkpkMWxpVkRremIwSjFkMjAzUTNKTlJVRnRTbGh2VTJJdmFVaDJNVEJJUlhGS1pISmhid3BuVnpCS1ZqZEJiR3BzWTBkVFMyZFNhMUpvTlRWYVZuRldZVXRIQ2kwdExTMHRSVTVFSUVORlVsUkpSa2xEUVZSRkxTMHRMUzBLIiwic2lnIjoiVFVWVlEwbFJRMlpTWmt4d2QzRTBkbWdyUkdwV2VWWkNUVFp1Y0ZkQlQwb3hMeXRUTm05aU5VUmliRzlUZWtaS09WRkpaMGMzV2sxdVptdENObWxSV1dwb05UbHJla3hvZEZoRVZUaFBOMGRxWjFCSGFEQTNNVWxTTlhKT0swRTkifV19LCJoYXNoIjp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiNDM3ZTYyNDY4ZTM0MWU0MTczMmZkOWM2ODMwNzEzMDFlNTJjZmE0YzVhNDdhYjMzNDAzNzg1MTMxOWQ1ZWI0OSJ9LCJwYXlsb2FkSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjQ3MmE1Y2VlNjI4NDU1MzMxMWM2MmY3ZTNmMWQzNDdiZDRiNzRjNGM3ZWJjZjQwYTY3ZjA4YTBmZjBjYTVjOTEifX19fQ=="
|
||||
}
|
||||
]
|
||||
},
|
||||
"dsseEnvelope": {
|
||||
"payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjAuMSIsInN1YmplY3QiOlt7Im5hbWUiOiJleGFtcGxlLWxpbnV4LWFtZDY0IiwiZGlnZXN0Ijp7InNoYTI1NiI6IjJlMzhiOTUyNTIzNTc2MDU3ZjVjYThjZjZkMTc5YWQ2YjY2ZjZkMDIyMWI5YTBlYjYyMWNhZjM1MDc3NzNjNzEifX1dLCJwcmVkaWNhdGVUeXBlIjoiaHR0cHM6Ly9zbHNhLmRldi9wcm92ZW5hbmNlL3YxLjA/ZHJhZnQiLCJwcmVkaWNhdGUiOnsiYnVpbGREZWZpbml0aW9uIjp7ImJ1aWxkVHlwZSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9zbHNhLWZyYW1ld29yay9zbHNhLWdpdGh1Yi1nZW5lcmF0b3IvZGVsZWdhdG9yLWdlbmVyaWNAdjAiLCJleHRlcm5hbFBhcmFtZXRlcnMiOnsid29ya2Zsb3dQYXRoIjp7InZhbHVlIjoiLmdpdGh1Yi93b3JrZmxvd3MvcmVsZWFzZS55bWwifSwic291cmNlIjp7ImFydGlmYWN0Ijp7InVyaSI6ImdpdCtodHRwczovL2dpdGh1Yi5jb20vYXNyYWEvc2xzYS1vbi1naXRodWItdGVzdEByZWZzL2hlYWRzL21haW4iLCJkaWdlc3QiOnsic2hhMSI6IjQ2NTE3MWNjN2YyMDk3Yjg1ODJmYzYxYTI4MWM0NDM3NTYzNjIzZWQifX19LCJpbnB1dF9yZWxlYXNlLXRhZyI6eyJ2YWx1ZSI6InYxIn19LCJzeXN0ZW1QYXJhbWV0ZXJzIjp7IkdJVEhVQl9FVkVOVF9OQU1FIjp7InZhbHVlIjoid29ya2Zsb3dfZGlzcGF0Y2gifSwiR0lUSFVCX0pPQiI6eyJ2YWx1ZSI6InZlcmlmeS10b2tlbiJ9LCJHSVRIVUJfUkVGIjp7InZhbHVlIjoicmVmcy9oZWFkcy9tYWluIn0sIkdJVEhVQl9SRUZfVFlQRSI6eyJ2YWx1ZSI6ImJyYW5jaCJ9LCJHSVRIVUJfUkVQT1NJVE9SWSI6eyJ2YWx1ZSI6ImFzcmFhL3Nsc2Etb24tZ2l0aHViLXRlc3QifSwiR0lUSFVCX1JVTl9BVFRFTVBUIjp7InZhbHVlIjoiMSJ9LCJHSVRIVUJfUlVOX0lEIjp7InZhbHVlIjoiNDAyODYwNTY3MyJ9LCJHSVRIVUJfUlVOX05VTUJFUiI6eyJ2YWx1ZSI6IjYifSwiR0lUSFVCX1NIQSI6eyJ2YWx1ZSI6IjQ2NTE3MWNjN2YyMDk3Yjg1ODJmYzYxYTI4MWM0NDM3NTYzNjIzZWQifSwiR0lUSFVCX1dPUktGTE9XIjp7InZhbHVlIjoic2xzYSAzIGdvcmVsZWFzZXIgcHJvamVjdCJ9LCJHSVRIVUJfQUNUT1JfSUQiOnsidmFsdWUiOiI1MTk0NTY5In0sIkdJVEhVQl9SRVBPU0lUT1JZX0lEIjp7InZhbHVlIjoiNTAxMzk1MjQyIn0sIkdJVEhVQl9SRVBTSVRPUllfT1dORVJfSUQiOnsidmFsdWUiOiI1MTk0NTY5In0sIkdJVEhVQl9XT1JLRkxPV19SRUYiOnsidmFsdWUiOiJhc3JhYS9zbHNhLW9uLWdpdGh1Yi10ZXN0Ly5naXRodWIvd29ya2Zsb3dzL3JlbGVhc2UueW1sQHJlZnMvaGVhZHMvbWFpbiJ9LCJHSVRIVUJfV09SS0ZMT1dfU0hBIjp7InZhbHVlIjoiNDY1MTcxY2M3ZjIwOTdiODU4MmZjNjFhMjgxYzQ0Mzc1NjM2MjNlZCJ9LCJJTUFHRV9PUyI6eyJ2YWx1ZSI6InVidW50dTIyIn0sIklNQUdFX1ZFUlNJT04iOnsidmFsdWUiOiIyMDIzMDEyMi4xIn0sIlJVTk5FUl9BUkNIIjp7InZhbHVlIjoiWDY0In0sIlJVTk5FUl9OQU1FIjp7InZhbHVlIjoiSG9zdGVkIEFnZW50In0sIlJVTk5FUl9PUyI6eyJ2YWx1ZSI6IkxpbnV4In19fSwicnVuRGV0YWlscyI6eyJidWlsZGVyIjp7ImlkIjoiaHR0cHM6Ly9naXRodWIuY29tL2FzcmFhL3Nsc2Etb24tZ2l0aHViLy5naXRodWIvd29ya2Zsb3dzL2dvcmVsZWFzZXJfc2xzYTMueW1sQHJlZnMvaGVhZHMvbWFpbiJ9LCJtZXRhZGF0YSI6eyJpbnZvY2F0aW9uSWQiOiJodHRwczovL2dpdGh1Yi5jb20vYXNyYWEvc2xzYS1vbi1naXRodWItdGVzdC9hY3Rpb25zL3J1bnMvNDAyODYwNTY3My9hdHRlbXB0cy8xIn19fX0=",
|
||||
"payloadType": "application/vnd.in-toto+json",
|
||||
"signatures": [
|
||||
{
|
||||
"sig": "MEUCIQCMtkNdfffkJ83+qYIi9qm2AbJS5e5KY4FgYKvO+MQw/AIgSKUAh7nAOgUIE1juMfC/QJvIQ3z+MpmYNe+Bk4QVGMc=",
|
||||
"keyid": ""
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
File diff suppressed because one or more lines are too long
@@ -0,0 +1,58 @@
|
||||
package gha
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/x509"
|
||||
"fmt"
|
||||
|
||||
"github.com/sigstore/cosign/v2/cmd/cosign/cli/fulcio"
|
||||
"github.com/sigstore/cosign/v2/pkg/cosign"
|
||||
serrors "github.com/slsa-framework/slsa-verifier/v2/errors"
|
||||
)
|
||||
|
||||
// TrustedRoot struct that holds the verification material necessary
|
||||
// to validate items. MUST be populated out of band.
|
||||
type TrustedRoot struct {
|
||||
// RekorPubKeys is a map from log ID to public keys containing metadata.
|
||||
RekorPubKeys *cosign.TrustedTransparencyLogPubKeys
|
||||
|
||||
// SctPubKeys is a map from log ID to public keys for the SCT.
|
||||
CTPubKeys *cosign.TrustedTransparencyLogPubKeys
|
||||
|
||||
// Certificate pool for Fulcio roots.
|
||||
FulcioRoot *x509.CertPool
|
||||
|
||||
// Certificate pool for Fulcio intermediates
|
||||
FulcioIntermediates *x509.CertPool
|
||||
}
|
||||
|
||||
func GetTrustedRoot(ctx context.Context) (*TrustedRoot, error) {
|
||||
rekorPubKeys, err := cosign.GetRekorPubs(ctx)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("%w: %s", serrors.ErrorRekorPubKey, err)
|
||||
}
|
||||
|
||||
ctPubKeys, err := cosign.GetCTLogPubs(ctx)
|
||||
if err != nil {
|
||||
// this is unexpected, hold on to this error.
|
||||
return nil, fmt.Errorf("%w: %s", serrors.ErrorInternal, err)
|
||||
}
|
||||
|
||||
roots, err := fulcio.GetRoots()
|
||||
if err != nil {
|
||||
// this is unexpected, hold on to this error.
|
||||
return nil, fmt.Errorf("%w: %s", serrors.ErrorInternal, err)
|
||||
}
|
||||
intermediates, err := fulcio.GetIntermediates()
|
||||
if err != nil {
|
||||
// this is unexpected, hold on to this error.
|
||||
return nil, fmt.Errorf("%w: %s", serrors.ErrorInternal, err)
|
||||
}
|
||||
|
||||
return &TrustedRoot{
|
||||
FulcioRoot: roots,
|
||||
FulcioIntermediates: intermediates,
|
||||
RekorPubKeys: rekorPubKeys,
|
||||
CTPubKeys: ctPubKeys,
|
||||
}, nil
|
||||
}
|
||||
@@ -91,10 +91,16 @@ func (v *GHAVerifier) VerifyArtifact(ctx context.Context,
|
||||
return nil, nil, err
|
||||
}
|
||||
|
||||
trustedRoot, err := GetTrustedRoot(ctx)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
|
||||
/* Verify signature on the intoto attestation. */
|
||||
// TODO(https://github.com/slsa-framework/slsa-github-generator/issues/716):
|
||||
// We will also need to support bundles when those are complete.
|
||||
signedAtt, err := VerifyProvenanceSignature(ctx, rClient, provenance, artifactHash)
|
||||
signedAtt, err := VerifyProvenanceSignature(ctx, trustedRoot, rClient,
|
||||
provenance, artifactHash)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user