From 5bb13ef508b2b8ded49f9264d7712f1316830d10 Mon Sep 17 00:00:00 2001 From: laurentsimon <64505099+laurentsimon@users.noreply.github.com> Date: Mon, 15 Aug 2022 12:38:15 -0700 Subject: [PATCH] feat: add a `-workflow-input` option (#216) * update --- cli/slsa-verifier/main.go | 42 +++++++-- cli/slsa-verifier/main_test.go | 41 ++++++++- cli/slsa-verifier/testdata/workflow-inputs | 1 + .../testdata/workflow-inputs.intoto.jsonl | 1 + errors/errors.go | 2 + options/options.go | 3 + verifiers/internal/gha/provenance.go | 55 ++++++++++++ verifiers/internal/gha/provenance_test.go | 85 +++++++++++++++++++ ...workflow-inputs-wrong-trigger.intoto.jsonl | 1 + .../dsse-workflow-inputs.intoto.jsonl | 1 + verifiers/internal/gha/verifier.go | 2 +- 11 files changed, 224 insertions(+), 10 deletions(-) create mode 100644 cli/slsa-verifier/testdata/workflow-inputs create mode 100644 cli/slsa-verifier/testdata/workflow-inputs.intoto.jsonl create mode 100644 verifiers/internal/gha/testdata/dsse-workflow-inputs-wrong-trigger.intoto.jsonl create mode 100644 verifiers/internal/gha/testdata/dsse-workflow-inputs.intoto.jsonl diff --git a/cli/slsa-verifier/main.go b/cli/slsa-verifier/main.go index cb1c87a..4b9f276 100644 --- a/cli/slsa-verifier/main.go +++ b/cli/slsa-verifier/main.go @@ -8,11 +8,17 @@ import ( "fmt" "io" "os" + "strings" + serrors "github.com/slsa-framework/slsa-verifier/errors" "github.com/slsa-framework/slsa-verifier/options" "github.com/slsa-framework/slsa-verifier/verifiers" ) +type workflowInputs struct { + kv map[string]string +} + var ( provenancePath string builderID string @@ -21,6 +27,7 @@ var ( branch string tag string versiontag string + inputs workflowInputs printProvenance bool ) @@ -28,6 +35,23 @@ func experimentalEnabled() bool { return os.Getenv("SLSA_VERIFIER_EXPERIMENTAL") == "1" } +func (i *workflowInputs) String() string { + return fmt.Sprintf("%v", i.kv) +} + +func (i *workflowInputs) Set(value string) error { + l := strings.Split(value, "=") + if len(l) != 2 { + return fmt.Errorf("%w: expected 'key=value' format, got '%s'", serrors.ErrorInvalidFormat, value) + } + i.kv[l[0]] = l[1] + return nil +} + +func (i *workflowInputs) AsMap() map[string]string { + return i.kv +} + func main() { if experimentalEnabled() { flag.StringVar(&builderID, "builder-id", "", "EXPERIMENTAL: the unique builder ID who created the provenance") @@ -42,6 +66,9 @@ func main() { "[optional] expected version the binary was compiled from. Uses semantic version to match the tag") flag.BoolVar(&printProvenance, "print-provenance", false, "print the verified provenance to std out") + inputs.kv = make(map[string]string) + flag.Var(&inputs, "workflow-input", + "[optional] a workflow input provided by a user at trigger time in the format 'key=value'. (Only for 'workflow_dispatch' events).") flag.Parse() if provenancePath == "" || artifactPath == "" || source == "" { @@ -71,7 +98,7 @@ func main() { } verifiedProvenance, _, err := runVerify(artifactPath, provenancePath, source, - pbranch, pbuilderID, ptag, pversiontag) + pbranch, pbuilderID, ptag, pversiontag, inputs.AsMap()) if err != nil { fmt.Fprintf(os.Stderr, "FAILED: SLSA verification failed: %v\n", err) os.Exit(2) @@ -95,7 +122,7 @@ func isFlagPassed(name string) bool { } func runVerify(artifactPath, provenancePath, source string, - branch, builderID, ptag, pversiontag *string, + branch, builderID, ptag, pversiontag *string, inputs map[string]string, ) ([]byte, string, error) { f, err := os.Open(artifactPath) if err != nil { @@ -115,11 +142,12 @@ func runVerify(artifactPath, provenancePath, source string, artifactHash := hex.EncodeToString(h.Sum(nil)) provenanceOpts := &options.ProvenanceOpts{ - ExpectedSourceURI: source, - ExpectedBranch: branch, - ExpectedDigest: artifactHash, - ExpectedVersionedTag: pversiontag, - ExpectedTag: ptag, + ExpectedSourceURI: source, + ExpectedBranch: branch, + ExpectedDigest: artifactHash, + ExpectedVersionedTag: pversiontag, + ExpectedTag: ptag, + ExpectedWorkflowInputs: inputs, } builderOpts := &options.BuilderOpts{ diff --git a/cli/slsa-verifier/main_test.go b/cli/slsa-verifier/main_test.go index e0c7d90..a4832f5 100644 --- a/cli/slsa-verifier/main_test.go +++ b/cli/slsa-verifier/main_test.go @@ -44,6 +44,7 @@ func Test_runVerify(t *testing.T) { pversiontag *string pbuilderID *string builderID string + inputs map[string]string err error // noversion is a special case where we are not testing all builder versions // for example, testdata for the builder at head in trusted repo workflows @@ -383,7 +384,7 @@ func Test_runVerify(t *testing.T) { err: serrors.ErrorNoValidRekorEntries, noversion: true, }, - // annotated tags. + // Annotated tags. { name: "annotated tag", artifact: "annotated-tag", @@ -400,6 +401,42 @@ func Test_runVerify(t *testing.T) { err: serrors.ErrorMismatchBranch, noversion: true, }, + // Workflow inputs. + { + name: "workflow inputs match", + artifact: "workflow-inputs", + source: "github.com/laurentsimon/slsa-on-github-test", + inputs: map[string]string{ + "release_version": "v1.2.3", + "some_bool": "true", + "some_integer": "123", + }, + noversion: true, + }, + { + name: "workflow inputs missing field", + artifact: "workflow-inputs", + source: "github.com/laurentsimon/slsa-on-github-test", + inputs: map[string]string{ + "release_version": "v1.2.3", + "some_bool": "true", + "missing_field": "123", + }, + err: serrors.ErrorMismatchWorkflowInputs, + noversion: true, + }, + { + name: "workflow inputs mismatch", + artifact: "workflow-inputs", + source: "github.com/laurentsimon/slsa-on-github-test", + inputs: map[string]string{ + "release_version": "v1.2.3", + "some_bool": "true", + "some_integer": "321", + }, + err: serrors.ErrorMismatchWorkflowInputs, + noversion: true, + }, // Regression test of sharded UUID. { name: "regression: sharded uuids", @@ -458,7 +495,7 @@ func Test_runVerify(t *testing.T) { _, builderID, err := runVerify(artifactPath, provenancePath, tt.source, tt.pbranch, tt.pbuilderID, - tt.ptag, tt.pversiontag) + tt.ptag, tt.pversiontag, tt.inputs) if !errCmp(err, tt.err) { t.Errorf(cmp.Diff(err, tt.err, cmpopts.EquateErrors())) diff --git a/cli/slsa-verifier/testdata/workflow-inputs b/cli/slsa-verifier/testdata/workflow-inputs new file mode 100644 index 0000000..a305017 --- /dev/null +++ b/cli/slsa-verifier/testdata/workflow-inputs @@ -0,0 +1 @@ +artifact1 diff --git a/cli/slsa-verifier/testdata/workflow-inputs.intoto.jsonl b/cli/slsa-verifier/testdata/workflow-inputs.intoto.jsonl new file mode 100644 index 0000000..ffa3baa --- /dev/null +++ b/cli/slsa-verifier/testdata/workflow-inputs.intoto.jsonl @@ -0,0 +1 @@ +{"payloadType":"application/vnd.in-toto+json","payload":"eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjAuMSIsInByZWRpY2F0ZVR5cGUiOiJodHRwczovL3Nsc2EuZGV2L3Byb3ZlbmFuY2UvdjAuMiIsInN1YmplY3QiOlt7Im5hbWUiOiJhcnRpZmFjdDEiLCJkaWdlc3QiOnsic2hhMjU2IjoiNDgyY2U4YzhmN2U4NjdkYTNhM2MwNWE5YWVlNjM3NzAzZTE3NDcwZWQxY2Y4ODJhOWU1YjQwNWU4ZjgyNjE5ZCJ9fSx7Im5hbWUiOiJhcnRpZmFjdDIiLCJkaWdlc3QiOnsic2hhMjU2IjoiODljZmM2OTU0ZTg4YjJmOTJhN2MyODc5ZDllYjA4NWM0MmYzYzcwNjVkMDEyYTUwNjZmNDUwZGJlNTliMmMwMCJ9fV0sInByZWRpY2F0ZSI6eyJidWlsZGVyIjp7ImlkIjoiaHR0cHM6Ly9naXRodWIuY29tL3Nsc2EtZnJhbWV3b3JrL3Nsc2EtZ2l0aHViLWdlbmVyYXRvci8uZ2l0aHViL3dvcmtmbG93cy9nZW5lcmF0b3JfZ2VuZXJpY19zbHNhMy55bWxAcmVmcy90YWdzL3YxLjIuMCJ9LCJidWlsZFR5cGUiOiJodHRwczovL2dpdGh1Yi5jb20vc2xzYS1mcmFtZXdvcmsvc2xzYS1naXRodWItZ2VuZXJhdG9yQHYxIiwiaW52b2NhdGlvbiI6eyJjb25maWdTb3VyY2UiOnsidXJpIjoiZ2l0K2h0dHBzOi8vZ2l0aHViLmNvbS9sYXVyZW50c2ltb24vc2xzYS1vbi1naXRodWItdGVzdEByZWZzL2hlYWRzL21haW4iLCJkaWdlc3QiOnsic2hhMSI6IjQ2NmMxMTNlZDNkNWFjNzU2ODE3NGQ0YjZhZDZiYjZhODBlMTUzYjIifSwiZW50cnlQb2ludCI6Ii5naXRodWIvd29ya2Zsb3dzL3Nsc2EtZ2VuZXJpYy55bWwifSwicGFyYW1ldGVycyI6eyJldmVudF9pbnB1dHMiOnsicmVsZWFzZV92ZXJzaW9uIjoidjEuMi4zIiwic29tZV9ib29sIjoidHJ1ZSIsInNvbWVfaW50ZWdlciI6IjEyMyJ9fSwiZW52aXJvbm1lbnQiOnsiZ2l0aHViX2FjdG9yIjoibGF1cmVudHNpbW9uIiwiZ2l0aHViX2FjdG9yX2lkIjoiNjQ1MDUwOTkiLCJnaXRodWJfYmFzZV9yZWYiOiIiLCJnaXRodWJfZXZlbnRfbmFtZSI6IndvcmtmbG93X2Rpc3BhdGNoIiwiZ2l0aHViX2V2ZW50X3BheWxvYWQiOnsiaW5wdXRzIjp7InJlbGVhc2VfdmVyc2lvbiI6InYxLjIuMyIsInNvbWVfYm9vbCI6InRydWUiLCJzb21lX2ludGVnZXIiOiIxMjMifSwicmVmIjoicmVmcy9oZWFkcy9tYWluIiwicmVwb3NpdG9yeSI6eyJhbGxvd19mb3JraW5nIjp0cnVlLCJhcmNoaXZlX3VybCI6Imh0dHBzOi8vYXBpLmdpdGh1Yi5jb20vcmVwb3MvbGF1cmVudHNpbW9uL3Nsc2Etb24tZ2l0aHViLXRlc3Qve2FyY2hpdmVfZm9ybWF0fXsvcmVmfSIsImFyY2hpdmVkIjpmYWxzZSwiYXNzaWduZWVzX3VybCI6Imh0dHBzOi8vYXBpLmdpdGh1Yi5jb20vcmVwb3MvbGF1cmVudHNpbW9uL3Nsc2Etb24tZ2l0aHViLXRlc3QvYXNzaWduZWVzey91c2VyfSIsImJsb2JzX3VybCI6Imh0dHBzOi8vYXBpLmdpdGh1Yi5jb20vcmVwb3MvbGF1cmVudHNpbW9uL3Nsc2Etb24tZ2l0aHViLXRlc3QvZ2l0L2Jsb2Jzey9zaGF9IiwiYnJhbmNoZXNfdXJsIjoiaHR0cHM6Ly9hcGkuZ2l0aHViLmNvbS9yZXBvcy9sYXVyZW50c2ltb24vc2xzYS1vbi1naXRodWItdGVzdC9icmFuY2hlc3svYnJhbmNofSIsImNsb25lX3VybCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9sYXVyZW50c2ltb24vc2xzYS1vbi1naXRodWItdGVzdC5naXQiLCJjb2xsYWJvcmF0b3JzX3VybCI6Imh0dHBzOi8vYXBpLmdpdGh1Yi5jb20vcmVwb3MvbGF1cmVudHNpbW9uL3Nsc2Etb24tZ2l0aHViLXRlc3QvY29sbGFib3JhdG9yc3svY29sbGFib3JhdG9yfSIsImNvbW1lbnRzX3VybCI6Imh0dHBzOi8vYXBpLmdpdGh1Yi5jb20vcmVwb3MvbGF1cmVudHNpbW9uL3Nsc2Etb24tZ2l0aHViLXRlc3QvY29tbWVudHN7L251bWJlcn0iLCJjb21taXRzX3VybCI6Imh0dHBzOi8vYXBpLmdpdGh1Yi5jb20vcmVwb3MvbGF1cmVudHNpbW9uL3Nsc2Etb24tZ2l0aHViLXRlc3QvY29tbWl0c3svc2hhfSIsImNvbXBhcmVfdXJsIjoiaHR0cHM6Ly9hcGkuZ2l0aHViLmNvbS9yZXBvcy9sYXVyZW50c2ltb24vc2xzYS1vbi1naXRodWItdGVzdC9jb21wYXJlL3tiYXNlfS4uLntoZWFkfSIsImNvbnRlbnRzX3VybCI6Imh0dHBzOi8vYXBpLmdpdGh1Yi5jb20vcmVwb3MvbGF1cmVudHNpbW9uL3Nsc2Etb24tZ2l0aHViLXRlc3QvY29udGVudHMveytwYXRofSIsImNvbnRyaWJ1dG9yc191cmwiOiJodHRwczovL2FwaS5naXRodWIuY29tL3JlcG9zL2xhdXJlbnRzaW1vbi9zbHNhLW9uLWdpdGh1Yi10ZXN0L2NvbnRyaWJ1dG9ycyIsImNyZWF0ZWRfYXQiOiIyMDIyLTAyLTA1VDAxOjEwOjQ2WiIsImRlZmF1bHRfYnJhbmNoIjoibWFpbiIsImRlcGxveW1lbnRzX3VybCI6Imh0dHBzOi8vYXBpLmdpdGh1Yi5jb20vcmVwb3MvbGF1cmVudHNpbW9uL3Nsc2Etb24tZ2l0aHViLXRlc3QvZGVwbG95bWVudHMiLCJkZXNjcmlwdGlvbiI6IlRlc3QgZm9yIFNMU0EiLCJkaXNhYmxlZCI6ZmFsc2UsImRvd25sb2Fkc191cmwiOiJodHRwczovL2FwaS5naXRodWIuY29tL3JlcG9zL2xhdXJlbnRzaW1vbi9zbHNhLW9uLWdpdGh1Yi10ZXN0L2Rvd25sb2FkcyIsImV2ZW50c191cmwiOiJodHRwczovL2FwaS5naXRodWIuY29tL3JlcG9zL2xhdXJlbnRzaW1vbi9zbHNhLW9uLWdpdGh1Yi10ZXN0L2V2ZW50cyIsImZvcmsiOmZhbHNlLCJmb3JrcyI6MSwiZm9ya3NfY291bnQiOjEsImZvcmtzX3VybCI6Imh0dHBzOi8vYXBpLmdpdGh1Yi5jb20vcmVwb3MvbGF1cmVudHNpbW9uL3Nsc2Etb24tZ2l0aHViLXRlc3QvZm9ya3MiLCJmdWxsX25hbWUiOiJsYXVyZW50c2ltb24vc2xzYS1vbi1naXRodWItdGVzdCIsImdpdF9jb21taXRzX3VybCI6Imh0dHBzOi8vYXBpLmdpdGh1Yi5jb20vcmVwb3MvbGF1cmVudHNpbW9uL3Nsc2Etb24tZ2l0aHViLXRlc3QvZ2l0L2NvbW1pdHN7L3NoYX0iLCJnaXRfcmVmc191cmwiOiJodHRwczovL2FwaS5naXRodWIuY29tL3JlcG9zL2xhdXJlbnRzaW1vbi9zbHNhLW9uLWdpdGh1Yi10ZXN0L2dpdC9yZWZzey9zaGF9IiwiZ2l0X3RhZ3NfdXJsIjoiaHR0cHM6Ly9hcGkuZ2l0aHViLmNvbS9yZXBvcy9sYXVyZW50c2ltb24vc2xzYS1vbi1naXRodWItdGVzdC9naXQvdGFnc3svc2hhfSIsImdpdF91cmwiOiJnaXQ6Ly9naXRodWIuY29tL2xhdXJlbnRzaW1vbi9zbHNhLW9uLWdpdGh1Yi10ZXN0LmdpdCIsImhhc19kb3dubG9hZHMiOnRydWUsImhhc19pc3N1ZXMiOnRydWUsImhhc19wYWdlcyI6ZmFsc2UsImhhc19wcm9qZWN0cyI6dHJ1ZSwiaGFzX3dpa2kiOnRydWUsImhvbWVwYWdlIjpudWxsLCJob29rc191cmwiOiJodHRwczovL2FwaS5naXRodWIuY29tL3JlcG9zL2xhdXJlbnRzaW1vbi9zbHNhLW9uLWdpdGh1Yi10ZXN0L2hvb2tzIiwiaHRtbF91cmwiOiJodHRwczovL2dpdGh1Yi5jb20vbGF1cmVudHNpbW9uL3Nsc2Etb24tZ2l0aHViLXRlc3QiLCJpZCI6NDU1NzQzMzk2LCJpc190ZW1wbGF0ZSI6ZmFsc2UsImlzc3VlX2NvbW1lbnRfdXJsIjoiaHR0cHM6Ly9hcGkuZ2l0aHViLmNvbS9yZXBvcy9sYXVyZW50c2ltb24vc2xzYS1vbi1naXRodWItdGVzdC9pc3N1ZXMvY29tbWVudHN7L251bWJlcn0iLCJpc3N1ZV9ldmVudHNfdXJsIjoiaHR0cHM6Ly9hcGkuZ2l0aHViLmNvbS9yZXBvcy9sYXVyZW50c2ltb24vc2xzYS1vbi1naXRodWItdGVzdC9pc3N1ZXMvZXZlbnRzey9udW1iZXJ9IiwiaXNzdWVzX3VybCI6Imh0dHBzOi8vYXBpLmdpdGh1Yi5jb20vcmVwb3MvbGF1cmVudHNpbW9uL3Nsc2Etb24tZ2l0aHViLXRlc3QvaXNzdWVzey9udW1iZXJ9Iiwia2V5c191cmwiOiJodHRwczovL2FwaS5naXRodWIuY29tL3JlcG9zL2xhdXJlbnRzaW1vbi9zbHNhLW9uLWdpdGh1Yi10ZXN0L2tleXN7L2tleV9pZH0iLCJsYWJlbHNfdXJsIjoiaHR0cHM6Ly9hcGkuZ2l0aHViLmNvbS9yZXBvcy9sYXVyZW50c2ltb24vc2xzYS1vbi1naXRodWItdGVzdC9sYWJlbHN7L25hbWV9IiwibGFuZ3VhZ2UiOiJTaGVsbCIsImxhbmd1YWdlc191cmwiOiJodHRwczovL2FwaS5naXRodWIuY29tL3JlcG9zL2xhdXJlbnRzaW1vbi9zbHNhLW9uLWdpdGh1Yi10ZXN0L2xhbmd1YWdlcyIsImxpY2Vuc2UiOnsia2V5IjoiYXBhY2hlLTIuMCIsIm5hbWUiOiJBcGFjaGUgTGljZW5zZSAyLjAiLCJub2RlX2lkIjoiTURjNlRHbGpaVzV6WlRJPSIsInNwZHhfaWQiOiJBcGFjaGUtMi4wIiwidXJsIjoiaHR0cHM6Ly9hcGkuZ2l0aHViLmNvbS9saWNlbnNlcy9hcGFjaGUtMi4wIn0sIm1lcmdlc191cmwiOiJodHRwczovL2FwaS5naXRodWIuY29tL3JlcG9zL2xhdXJlbnRzaW1vbi9zbHNhLW9uLWdpdGh1Yi10ZXN0L21lcmdlcyIsIm1pbGVzdG9uZXNfdXJsIjoiaHR0cHM6Ly9hcGkuZ2l0aHViLmNvbS9yZXBvcy9sYXVyZW50c2ltb24vc2xzYS1vbi1naXRodWItdGVzdC9taWxlc3RvbmVzey9udW1iZXJ9IiwibWlycm9yX3VybCI6bnVsbCwibmFtZSI6InNsc2Etb24tZ2l0aHViLXRlc3QiLCJub2RlX2lkIjoiUl9rZ0RPR3lvWHBBIiwibm90aWZpY2F0aW9uc191cmwiOiJodHRwczovL2FwaS5naXRodWIuY29tL3JlcG9zL2xhdXJlbnRzaW1vbi9zbHNhLW9uLWdpdGh1Yi10ZXN0L25vdGlmaWNhdGlvbnN7P3NpbmNlLGFsbCxwYXJ0aWNpcGF0aW5nfSIsIm9wZW5faXNzdWVzIjoyNCwib3Blbl9pc3N1ZXNfY291bnQiOjI0LCJvd25lciI6eyJhdmF0YXJfdXJsIjoiaHR0cHM6Ly9hdmF0YXJzLmdpdGh1YnVzZXJjb250ZW50LmNvbS91LzY0NTA1MDk5P3Y9NCIsImV2ZW50c191cmwiOiJodHRwczovL2FwaS5naXRodWIuY29tL3VzZXJzL2xhdXJlbnRzaW1vbi9ldmVudHN7L3ByaXZhY3l9IiwiZm9sbG93ZXJzX3VybCI6Imh0dHBzOi8vYXBpLmdpdGh1Yi5jb20vdXNlcnMvbGF1cmVudHNpbW9uL2ZvbGxvd2VycyIsImZvbGxvd2luZ191cmwiOiJodHRwczovL2FwaS5naXRodWIuY29tL3VzZXJzL2xhdXJlbnRzaW1vbi9mb2xsb3dpbmd7L290aGVyX3VzZXJ9IiwiZ2lzdHNfdXJsIjoiaHR0cHM6Ly9hcGkuZ2l0aHViLmNvbS91c2Vycy9sYXVyZW50c2ltb24vZ2lzdHN7L2dpc3RfaWR9IiwiZ3JhdmF0YXJfaWQiOiIiLCJodG1sX3VybCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9sYXVyZW50c2ltb24iLCJpZCI6NjQ1MDUwOTksImxvZ2luIjoibGF1cmVudHNpbW9uIiwibm9kZV9pZCI6Ik1EUTZWWE5sY2pZME5UQTFNRGs1Iiwib3JnYW5pemF0aW9uc191cmwiOiJodHRwczovL2FwaS5naXRodWIuY29tL3VzZXJzL2xhdXJlbnRzaW1vbi9vcmdzIiwicmVjZWl2ZWRfZXZlbnRzX3VybCI6Imh0dHBzOi8vYXBpLmdpdGh1Yi5jb20vdXNlcnMvbGF1cmVudHNpbW9uL3JlY2VpdmVkX2V2ZW50cyIsInJlcG9zX3VybCI6Imh0dHBzOi8vYXBpLmdpdGh1Yi5jb20vdXNlcnMvbGF1cmVudHNpbW9uL3JlcG9zIiwic2l0ZV9hZG1pbiI6ZmFsc2UsInN0YXJyZWRfdXJsIjoiaHR0cHM6Ly9hcGkuZ2l0aHViLmNvbS91c2Vycy9sYXVyZW50c2ltb24vc3RhcnJlZHsvb3duZXJ9ey9yZXBvfSIsInN1YnNjcmlwdGlvbnNfdXJsIjoiaHR0cHM6Ly9hcGkuZ2l0aHViLmNvbS91c2Vycy9sYXVyZW50c2ltb24vc3Vic2NyaXB0aW9ucyIsInR5cGUiOiJVc2VyIiwidXJsIjoiaHR0cHM6Ly9hcGkuZ2l0aHViLmNvbS91c2Vycy9sYXVyZW50c2ltb24ifSwicHJpdmF0ZSI6ZmFsc2UsInB1bGxzX3VybCI6Imh0dHBzOi8vYXBpLmdpdGh1Yi5jb20vcmVwb3MvbGF1cmVudHNpbW9uL3Nsc2Etb24tZ2l0aHViLXRlc3QvcHVsbHN7L251bWJlcn0iLCJwdXNoZWRfYXQiOiIyMDIyLTA4LTE1VDE3OjAyOjA4WiIsInJlbGVhc2VzX3VybCI6Imh0dHBzOi8vYXBpLmdpdGh1Yi5jb20vcmVwb3MvbGF1cmVudHNpbW9uL3Nsc2Etb24tZ2l0aHViLXRlc3QvcmVsZWFzZXN7L2lkfSIsInNpemUiOjY2Niwic3NoX3VybCI6ImdpdEBnaXRodWIuY29tOmxhdXJlbnRzaW1vbi9zbHNhLW9uLWdpdGh1Yi10ZXN0LmdpdCIsInN0YXJnYXplcnNfY291bnQiOjEsInN0YXJnYXplcnNfdXJsIjoiaHR0cHM6Ly9hcGkuZ2l0aHViLmNvbS9yZXBvcy9sYXVyZW50c2ltb24vc2xzYS1vbi1naXRodWItdGVzdC9zdGFyZ2F6ZXJzIiwic3RhdHVzZXNfdXJsIjoiaHR0cHM6Ly9hcGkuZ2l0aHViLmNvbS9yZXBvcy9sYXVyZW50c2ltb24vc2xzYS1vbi1naXRodWItdGVzdC9zdGF0dXNlcy97c2hhfSIsInN1YnNjcmliZXJzX3VybCI6Imh0dHBzOi8vYXBpLmdpdGh1Yi5jb20vcmVwb3MvbGF1cmVudHNpbW9uL3Nsc2Etb24tZ2l0aHViLXRlc3Qvc3Vic2NyaWJlcnMiLCJzdWJzY3JpcHRpb25fdXJsIjoiaHR0cHM6Ly9hcGkuZ2l0aHViLmNvbS9yZXBvcy9sYXVyZW50c2ltb24vc2xzYS1vbi1naXRodWItdGVzdC9zdWJzY3JpcHRpb24iLCJzdm5fdXJsIjoiaHR0cHM6Ly9naXRodWIuY29tL2xhdXJlbnRzaW1vbi9zbHNhLW9uLWdpdGh1Yi10ZXN0IiwidGFnc191cmwiOiJodHRwczovL2FwaS5naXRodWIuY29tL3JlcG9zL2xhdXJlbnRzaW1vbi9zbHNhLW9uLWdpdGh1Yi10ZXN0L3RhZ3MiLCJ0ZWFtc191cmwiOiJodHRwczovL2FwaS5naXRodWIuY29tL3JlcG9zL2xhdXJlbnRzaW1vbi9zbHNhLW9uLWdpdGh1Yi10ZXN0L3RlYW1zIiwidG9waWNzIjpbXSwidHJlZXNfdXJsIjoiaHR0cHM6Ly9hcGkuZ2l0aHViLmNvbS9yZXBvcy9sYXVyZW50c2ltb24vc2xzYS1vbi1naXRodWItdGVzdC9naXQvdHJlZXN7L3NoYX0iLCJ1cGRhdGVkX2F0IjoiMjAyMi0wNi0xM1QyMDoyOTozM1oiLCJ1cmwiOiJodHRwczovL2FwaS5naXRodWIuY29tL3JlcG9zL2xhdXJlbnRzaW1vbi9zbHNhLW9uLWdpdGh1Yi10ZXN0IiwidmlzaWJpbGl0eSI6InB1YmxpYyIsIndhdGNoZXJzIjoxLCJ3YXRjaGVyc19jb3VudCI6MSwid2ViX2NvbW1pdF9zaWdub2ZmX3JlcXVpcmVkIjpmYWxzZX0sInNlbmRlciI6eyJhdmF0YXJfdXJsIjoiaHR0cHM6Ly9hdmF0YXJzLmdpdGh1YnVzZXJjb250ZW50LmNvbS91LzY0NTA1MDk5P3Y9NCIsImV2ZW50c191cmwiOiJodHRwczovL2FwaS5naXRodWIuY29tL3VzZXJzL2xhdXJlbnRzaW1vbi9ldmVudHN7L3ByaXZhY3l9IiwiZm9sbG93ZXJzX3VybCI6Imh0dHBzOi8vYXBpLmdpdGh1Yi5jb20vdXNlcnMvbGF1cmVudHNpbW9uL2ZvbGxvd2VycyIsImZvbGxvd2luZ191cmwiOiJodHRwczovL2FwaS5naXRodWIuY29tL3VzZXJzL2xhdXJlbnRzaW1vbi9mb2xsb3dpbmd7L290aGVyX3VzZXJ9IiwiZ2lzdHNfdXJsIjoiaHR0cHM6Ly9hcGkuZ2l0aHViLmNvbS91c2Vycy9sYXVyZW50c2ltb24vZ2lzdHN7L2dpc3RfaWR9IiwiZ3JhdmF0YXJfaWQiOiIiLCJodG1sX3VybCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9sYXVyZW50c2ltb24iLCJpZCI6NjQ1MDUwOTksImxvZ2luIjoibGF1cmVudHNpbW9uIiwibm9kZV9pZCI6Ik1EUTZWWE5sY2pZME5UQTFNRGs1Iiwib3JnYW5pemF0aW9uc191cmwiOiJodHRwczovL2FwaS5naXRodWIuY29tL3VzZXJzL2xhdXJlbnRzaW1vbi9vcmdzIiwicmVjZWl2ZWRfZXZlbnRzX3VybCI6Imh0dHBzOi8vYXBpLmdpdGh1Yi5jb20vdXNlcnMvbGF1cmVudHNpbW9uL3JlY2VpdmVkX2V2ZW50cyIsInJlcG9zX3VybCI6Imh0dHBzOi8vYXBpLmdpdGh1Yi5jb20vdXNlcnMvbGF1cmVudHNpbW9uL3JlcG9zIiwic2l0ZV9hZG1pbiI6ZmFsc2UsInN0YXJyZWRfdXJsIjoiaHR0cHM6Ly9hcGkuZ2l0aHViLmNvbS91c2Vycy9sYXVyZW50c2ltb24vc3RhcnJlZHsvb3duZXJ9ey9yZXBvfSIsInN1YnNjcmlwdGlvbnNfdXJsIjoiaHR0cHM6Ly9hcGkuZ2l0aHViLmNvbS91c2Vycy9sYXVyZW50c2ltb24vc3Vic2NyaXB0aW9ucyIsInR5cGUiOiJVc2VyIiwidXJsIjoiaHR0cHM6Ly9hcGkuZ2l0aHViLmNvbS91c2Vycy9sYXVyZW50c2ltb24ifSwid29ya2Zsb3ciOiIuZ2l0aHViL3dvcmtmbG93cy9zbHNhLWdlbmVyaWMueW1sIn0sImdpdGh1Yl9oZWFkX3JlZiI6IiIsImdpdGh1Yl9yZWYiOiJyZWZzL2hlYWRzL21haW4iLCJnaXRodWJfcmVmX3R5cGUiOiJicmFuY2giLCJnaXRodWJfcmVwb3NpdG9yeV9pZCI6IjQ1NTc0MzM5NiIsImdpdGh1Yl9yZXBvc2l0b3J5X293bmVyIjoibGF1cmVudHNpbW9uIiwiZ2l0aHViX3JlcG9zaXRvcnlfb3duZXJfaWQiOiI2NDUwNTA5OSIsImdpdGh1Yl9ydW5fYXR0ZW1wdCI6IjEiLCJnaXRodWJfcnVuX2lkIjoiMjg2MjE3MTAwMyIsImdpdGh1Yl9ydW5fbnVtYmVyIjoiOCIsImdpdGh1Yl9zaGExIjoiNDY2YzExM2VkM2Q1YWM3NTY4MTc0ZDRiNmFkNmJiNmE4MGUxNTNiMiJ9fSwibWV0YWRhdGEiOnsiYnVpbGRJbnZvY2F0aW9uSUQiOiIyODYyMTcxMDAzLTEiLCJjb21wbGV0ZW5lc3MiOnsicGFyYW1ldGVycyI6dHJ1ZSwiZW52aXJvbm1lbnQiOmZhbHNlLCJtYXRlcmlhbHMiOmZhbHNlfSwicmVwcm9kdWNpYmxlIjpmYWxzZX0sIm1hdGVyaWFscyI6W3sidXJpIjoiZ2l0K2h0dHBzOi8vZ2l0aHViLmNvbS9sYXVyZW50c2ltb24vc2xzYS1vbi1naXRodWItdGVzdEByZWZzL2hlYWRzL21haW4iLCJkaWdlc3QiOnsic2hhMSI6IjQ2NmMxMTNlZDNkNWFjNzU2ODE3NGQ0YjZhZDZiYjZhODBlMTUzYjIifX1dfX0=","signatures":[{"keyid":"","sig":"MEUCIHBtbLeV5WMsyLpPrZcxFU1wuEYHFUrJnzizsg17dL4hAiEAkoTLa49Vrf/g5mSaWY6Oab99YNvqByNgR773ikJXQ5I=","cert":"-----BEGIN CERTIFICATE-----\nMIIDVDCCAtqgAwIBAgITLCk1E2/wH2/mCjCYAovMeTTHnDAKBggqhkjOPQQDAzAq\nMRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxETAPBgNVBAMTCHNpZ3N0b3JlMB4XDTIy\nMDgxNTE3MDQxMloXDTIyMDgxNTE3MTQxMVowADBZMBMGByqGSM49AgEGCCqGSM49\nAwEHA0IABCw6VO5lksfxcjt+4cEbgBnLuPB2wDgj3I9UQZh45xW4KRYKM7/oSLfD\nP8QGLfgNkv3ZDwBZUDLbBk0hNoMq0bejggIHMIICAzAOBgNVHQ8BAf8EBAMCB4Aw\nEwYDVR0lBAwwCgYIKwYBBQUHAwMwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUyxfq\nz2Pr2VR+K9FdiLbOSxqIYgQwHwYDVR0jBBgwFoAUWMAeX5FFpWapesyQoZMi0CrF\nxfowgYQGA1UdEQEB/wR6MHiGdmh0dHBzOi8vZ2l0aHViLmNvbS9zbHNhLWZyYW1l\nd29yay9zbHNhLWdpdGh1Yi1nZW5lcmF0b3IvLmdpdGh1Yi93b3JrZmxvd3MvZ2Vu\nZXJhdG9yX2dlbmVyaWNfc2xzYTMueW1sQHJlZnMvdGFncy92MS4yLjAwHwYKKwYB\nBAGDvzABAgQRd29ya2Zsb3dfZGlzcGF0Y2gwLgYKKwYBBAGDvzABBQQgbGF1cmVu\ndHNpbW9uL3Nsc2Etb24tZ2l0aHViLXRlc3QwJAYKKwYBBAGDvzABBAQWU0xTQSBn\nZW5lcmljIGdlbmVyYXRvcjAdBgorBgEEAYO/MAEGBA9yZWZzL2hlYWRzL21haW4w\nOQYKKwYBBAGDvzABAQQraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJj\nb250ZW50LmNvbTA2BgorBgEEAYO/MAEDBCg0NjZjMTEzZWQzZDVhYzc1NjgxNzRk\nNGI2YWQ2YmI2YTgwZTE1M2IyMAoGCCqGSM49BAMDA2gAMGUCMQCx4+iMpFBvnFV9\nX6goGjQfdgliPcNa4cdd2K0nmrn79cOpslyzcJLAlL/qSYsGlocCMC/P/gL2B16i\nMp6YQZUiSMwzUohrr7V3nJsMPcLgETGyiZoR3UijZG74FobZ/+3pCw==\n-----END CERTIFICATE-----\n"}]} \ No newline at end of file diff --git a/errors/errors.go b/errors/errors.go index 7e6614c..4f63d2f 100644 --- a/errors/errors.go +++ b/errors/errors.go @@ -7,6 +7,7 @@ var ( ErrorMismatchBranch = errors.New("branch used to generate the binary does not match provenance") ErrorMismatchBuilderID = errors.New("builderID does not match provenance") ErrorMismatchSource = errors.New("source used to generate the binary does not match provenance") + ErrorMismatchWorkflowInputs = errors.New("workflow input does not match") ErrorMalformedURI = errors.New("URI is malformed") ErrorMismatchTag = errors.New("tag used to generate the binary does not match provenance") ErrorMismatchVersionedTag = errors.New("tag used to generate the binary does not match provenance") @@ -18,4 +19,5 @@ var ( ErrorNoValidRekorEntries = errors.New("could not find a matching valid signature entry") ErrorVerifierNotSupported = errors.New("no verifier support the builder") ErrorNotSupported = errors.New("not supported") + ErrorInvalidFormat = errors.New("invalid format") ) diff --git a/options/options.go b/options/options.go index f06a11f..f5cd591 100644 --- a/options/options.go +++ b/options/options.go @@ -20,6 +20,9 @@ type ProvenanceOpts struct { // ExpectedBuilderID is the expected builder ID. ExpectedBuilderID string + + // ExpectedWorkflowInputs is a map of key=value inputs. + ExpectedWorkflowInputs map[string]string } // BuildOpts are the options for checking the builder. diff --git a/verifiers/internal/gha/provenance.go b/verifiers/internal/gha/provenance.go index 1cdee51..53a682d 100644 --- a/verifiers/internal/gha/provenance.go +++ b/verifiers/internal/gha/provenance.go @@ -224,6 +224,61 @@ func VerifyProvenance(env *dsselib.Envelope, provenanceOpts *options.ProvenanceO } } + // Verify the workflow inputs. + if len(provenanceOpts.ExpectedWorkflowInputs) > 0 { + if err := VerifyWorkflowInputs(prov, provenanceOpts.ExpectedWorkflowInputs); err != nil { + return err + } + } + + return nil +} + +func VerifyWorkflowInputs(prov *intoto.ProvenanceStatement, inputs map[string]string) error { + environment, ok := prov.Predicate.Invocation.Environment.(map[string]interface{}) + if !ok { + return fmt.Errorf("%w: %s", serrors.ErrorInvalidDssePayload, "parameters type") + } + + // Verify it's a workflow_dispatch trigger. + triggerName, err := getAsString(environment, "github_event_name") + if err != nil { + return err + } + if triggerName != "workflow_dispatch" { + return fmt.Errorf("%w: expected 'workflow_dispatch' trigger, got %s", + serrors.ErrorMismatchWorkflowInputs, triggerName) + } + + // Assume no nested level. + payload, err := getEventPayload(environment) + if err != nil { + return err + } + + payloadInputs, err := getAsAny(payload, "inputs") + if err != nil { + return fmt.Errorf("%w: error retrieving 'inputs': %v", serrors.ErrorInvalidDssePayload, err) + } + + pyldInputs, ok := payloadInputs.(map[string]interface{}) + if !ok { + return fmt.Errorf("%w: %s", serrors.ErrorInvalidDssePayload, "parameters type inputs") + } + + // Verify all inputs. + for k, v := range inputs { + value, err := getAsString(pyldInputs, k) + if err != nil { + return fmt.Errorf("%w: cannot retrieve value of '%s'", serrors.ErrorMismatchWorkflowInputs, k) + } + + if v != value { + return fmt.Errorf("%w: expected '%s=%s', got '%s=%s'", + serrors.ErrorMismatchWorkflowInputs, k, v, k, value) + } + } + return nil } diff --git a/verifiers/internal/gha/provenance_test.go b/verifiers/internal/gha/provenance_test.go index 7f37e45..a0aeed0 100644 --- a/verifiers/internal/gha/provenance_test.go +++ b/verifiers/internal/gha/provenance_test.go @@ -502,6 +502,91 @@ func Test_VerifyBranch(t *testing.T) { } } +func Test_VerifyWorkflowInputs(t *testing.T) { + t.Parallel() + tests := []struct { + name string + path string + inputs map[string]string + expected error + }{ + { + name: "match all", + path: "./testdata/dsse-workflow-inputs.intoto.jsonl", + inputs: map[string]string{ + "release_version": "v1.2.3", + "some_bool": "true", + "some_integer": "123", + }, + }, + { + name: "match subset", + path: "./testdata/dsse-workflow-inputs.intoto.jsonl", + inputs: map[string]string{ + "release_version": "v1.2.3", + "some_integer": "123", + }, + }, + { + name: "missing field", + path: "./testdata/dsse-workflow-inputs.intoto.jsonl", + inputs: map[string]string{ + "release_version": "v1.2.3", + "missing_field": "123", + }, + expected: serrors.ErrorMismatchWorkflowInputs, + }, + { + name: "mismatch field release_version", + path: "./testdata/dsse-workflow-inputs.intoto.jsonl", + inputs: map[string]string{ + "release_version": "v1.2.4", + "some_integer": "123", + }, + expected: serrors.ErrorMismatchWorkflowInputs, + }, + { + name: "mismatch field some_integer", + path: "./testdata/dsse-workflow-inputs.intoto.jsonl", + inputs: map[string]string{ + "release_version": "v1.2.3", + "some_integer": "124", + }, + expected: serrors.ErrorMismatchWorkflowInputs, + }, + { + name: "not workflow_dispatch trigger", + path: "./testdata/dsse-workflow-inputs-wrong-trigger.intoto.jsonl", + inputs: map[string]string{ + "release_version": "v1.2.3", + "some_bool": "true", + "some_integer": "123", + }, + expected: serrors.ErrorInvalidDssePayload, + }, + } + for _, tt := range tests { + tt := tt // Re-initializing variable so it is not changed while executing the closure below + t.Run(tt.name, func(t *testing.T) { + t.Parallel() + + content, err := os.ReadFile(tt.path) + if err != nil { + panic(fmt.Errorf("os.ReadFile: %w", err)) + } + prov, err := provenanceFromBytes(content) + if err != nil { + panic(fmt.Errorf("provenanceFromBytes: %w", err)) + } + + err = VerifyWorkflowInputs(prov, tt.inputs) + if !errCmp(err, tt.expected) { + t.Errorf(cmp.Diff(err, tt.expected)) + } + }) + } +} + func Test_VerifyTag(t *testing.T) { t.Parallel() tests := []struct { diff --git a/verifiers/internal/gha/testdata/dsse-workflow-inputs-wrong-trigger.intoto.jsonl b/verifiers/internal/gha/testdata/dsse-workflow-inputs-wrong-trigger.intoto.jsonl new file mode 100644 index 0000000..30034ff --- /dev/null +++ b/verifiers/internal/gha/testdata/dsse-workflow-inputs-wrong-trigger.intoto.jsonl @@ -0,0 +1 @@ +{"payloadType":"application/vnd.in-toto+json","payload":"eyJwYXlsb2FkVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5pbi10b3RvK2pzb24iLCJwYXlsb2FkIjoiZXlKZmRIbHdaU0k2SW1oMGRIQnpPaTh2YVc0dGRHOTBieTVwYnk5VGRHRjBaVzFsYm5RdmRqQXVNU0lzSW5CeVpXUnBZMkYwWlZSNWNHVWlPaUpvZEhSd2N6b3ZMM05zYzJFdVpHVjJMM0J5YjNabGJtRnVZMlV2ZGpBdU1pSXNJbk4xWW1wbFkzUWlPbHQ3SW01aGJXVWlPaUpoY25ScFptRmpkREVpTENKa2FXZGxjM1FpT25zaWMyaGhNalUySWpvaU5EZ3lZMlU0WXpobU4yVTROamRrWVROaE0yTXdOV0U1WVdWbE5qTTNOekF6WlRFM05EY3daV1F4WTJZNE9ESmhPV1UxWWpRd05XVTRaamd5TmpFNVpDSjlmU3g3SW01aGJXVWlPaUpoY25ScFptRmpkRElpTENKa2FXZGxjM1FpT25zaWMyaGhNalUySWpvaU9EbGpabU0yT1RVMFpUZzRZakptT1RKaE4yTXlPRGM1WkRsbFlqQTROV00wTW1Zell6Y3dOalZrTURFeVlUVXdOalptTkRVd1pHSmxOVGxpTW1Nd01DSjlmVjBzSW5CeVpXUnBZMkYwWlNJNmV5SmlkV2xzWkdWeUlqcDdJbWxrSWpvaWFIUjBjSE02THk5bmFYUm9kV0l1WTI5dEwzTnNjMkV0Wm5KaGJXVjNiM0pyTDNOc2MyRXRaMmwwYUhWaUxXZGxibVZ5WVhSdmNpOHVaMmwwYUhWaUwzZHZjbXRtYkc5M2N5OW5aVzVsY21GMGIzSmZaMlZ1WlhKcFkxOXpiSE5oTXk1NWJXeEFjbVZtY3k5MFlXZHpMM1l4TGpJdU1DSjlMQ0ppZFdsc1pGUjVjR1VpT2lKb2RIUndjem92TDJkcGRHaDFZaTVqYjIwdmMyeHpZUzFtY21GdFpYZHZjbXN2YzJ4ellTMW5hWFJvZFdJdFoyVnVaWEpoZEc5eVFIWXhJaXdpYVc1MmIyTmhkR2x2YmlJNmV5SmpiMjVtYVdkVGIzVnlZMlVpT25zaWRYSnBJam9pWjJsMEsyaDBkSEJ6T2k4dloybDBhSFZpTG1OdmJTOXNZWFZ5Wlc1MGMybHRiMjR2YzJ4ellTMXZiaTFuYVhSb2RXSXRkR1Z6ZEVCeVpXWnpMMmhsWVdSekwyMWhhVzRpTENKa2FXZGxjM1FpT25zaWMyaGhNU0k2SWpRMk5tTXhNVE5sWkROa05XRmpOelUyT0RFM05HUTBZalpoWkRaaVlqWmhPREJsTVRVellqSWlmU3dpWlc1MGNubFFiMmx1ZENJNklpNW5hWFJvZFdJdmQyOXlhMlpzYjNkekwzTnNjMkV0WjJWdVpYSnBZeTU1Yld3aWZTd2ljR0Z5WVcxbGRHVnljeUk2ZXlKbGRtVnVkRjlwYm5CMWRITWlPbnNpY21Wc1pXRnpaVjkyWlhKemFXOXVJam9pZGpFdU1pNHpJaXdpYzI5dFpWOWliMjlzSWpvaWRISjFaU0lzSW5OdmJXVmZhVzUwWldkbGNpSTZJakV5TXlKOWZTd2laVzUyYVhKdmJtMWxiblFpT25zaVoybDBhSFZpWDJGamRHOXlJam9pYkdGMWNtVnVkSE5wYlc5dUlpd2laMmwwYUhWaVgyRmpkRzl5WDJsa0lqb2lOalExTURVd09Ua2lMQ0puYVhSb2RXSmZZbUZ6WlY5eVpXWWlPaUlpTENKbmFYUm9kV0pmWlhabGJuUmZibUZ0WlNJNkluZHZjbXRtYkc5M1gyUnBjM0JoZEdOb0lpd2laMmwwYUhWaVgyVjJaVzUwWDNCaGVXeHZZV1FpT25zaWFXNXdkWFJ6SWpwN0luSmxiR1ZoYzJWZmRtVnljMmx2YmlJNkluWXhMakl1TXlJc0luTnZiV1ZmWW05dmJDSTZJblJ5ZFdVaUxDSnpiMjFsWDJsdWRHVm5aWElpT2lJeE1qTWlmU3dpY21WbUlqb2ljbVZtY3k5b1pXRmtjeTl0WVdsdUlpd2ljbVZ3YjNOcGRHOXllU0k2ZXlKaGJHeHZkMTltYjNKcmFXNW5JanAwY25WbExDSmhjbU5vYVhabFgzVnliQ0k2SW1oMGRIQnpPaTh2WVhCcExtZHBkR2gxWWk1amIyMHZjbVZ3YjNNdmJHRjFjbVZ1ZEhOcGJXOXVMM05zYzJFdGIyNHRaMmwwYUhWaUxYUmxjM1F2ZTJGeVkyaHBkbVZmWm05eWJXRjBmWHN2Y21WbWZTSXNJbUZ5WTJocGRtVmtJanBtWVd4elpTd2lZWE56YVdkdVpXVnpYM1Z5YkNJNkltaDBkSEJ6T2k4dllYQnBMbWRwZEdoMVlpNWpiMjB2Y21Wd2IzTXZiR0YxY21WdWRITnBiVzl1TDNOc2MyRXRiMjR0WjJsMGFIVmlMWFJsYzNRdllYTnphV2R1WldWemV5OTFjMlZ5ZlNJc0ltSnNiMkp6WDNWeWJDSTZJbWgwZEhCek9pOHZZWEJwTG1kcGRHaDFZaTVqYjIwdmNtVndiM012YkdGMWNtVnVkSE5wYlc5dUwzTnNjMkV0YjI0dFoybDBhSFZpTFhSbGMzUXZaMmwwTDJKc2IySnpleTl6YUdGOUlpd2lZbkpoYm1Ob1pYTmZkWEpzSWpvaWFIUjBjSE02THk5aGNHa3VaMmwwYUhWaUxtTnZiUzl5WlhCdmN5OXNZWFZ5Wlc1MGMybHRiMjR2YzJ4ellTMXZiaTFuYVhSb2RXSXRkR1Z6ZEM5aWNtRnVZMmhsYzNzdlluSmhibU5vZlNJc0ltTnNiMjVsWDNWeWJDSTZJbWgwZEhCek9pOHZaMmwwYUhWaUxtTnZiUzlzWVhWeVpXNTBjMmx0YjI0dmMyeHpZUzF2YmkxbmFYUm9kV0l0ZEdWemRDNW5hWFFpTENKamIyeHNZV0p2Y21GMGIzSnpYM1Z5YkNJNkltaDBkSEJ6T2k4dllYQnBMbWRwZEdoMVlpNWpiMjB2Y21Wd2IzTXZiR0YxY21WdWRITnBiVzl1TDNOc2MyRXRiMjR0WjJsMGFIVmlMWFJsYzNRdlkyOXNiR0ZpYjNKaGRHOXljM3N2WTI5c2JHRmliM0poZEc5eWZTSXNJbU52YlcxbGJuUnpYM1Z5YkNJNkltaDBkSEJ6T2k4dllYQnBMbWRwZEdoMVlpNWpiMjB2Y21Wd2IzTXZiR0YxY21WdWRITnBiVzl1TDNOc2MyRXRiMjR0WjJsMGFIVmlMWFJsYzNRdlkyOXRiV1Z1ZEhON0wyNTFiV0psY24waUxDSmpiMjF0YVhSelgzVnliQ0k2SW1oMGRIQnpPaTh2WVhCcExtZHBkR2gxWWk1amIyMHZjbVZ3YjNNdmJHRjFjbVZ1ZEhOcGJXOXVMM05zYzJFdGIyNHRaMmwwYUhWaUxYUmxjM1F2WTI5dGJXbDBjM3N2YzJoaGZTSXNJbU52YlhCaGNtVmZkWEpzSWpvaWFIUjBjSE02THk5aGNHa3VaMmwwYUhWaUxtTnZiUzl5WlhCdmN5OXNZWFZ5Wlc1MGMybHRiMjR2YzJ4ellTMXZiaTFuYVhSb2RXSXRkR1Z6ZEM5amIyMXdZWEpsTDN0aVlYTmxmUzR1TG50b1pXRmtmU0lzSW1OdmJuUmxiblJ6WDNWeWJDSTZJbWgwZEhCek9pOHZZWEJwTG1kcGRHaDFZaTVqYjIwdmNtVndiM012YkdGMWNtVnVkSE5wYlc5dUwzTnNjMkV0YjI0dFoybDBhSFZpTFhSbGMzUXZZMjl1ZEdWdWRITXZleXR3WVhSb2ZTSXNJbU52Ym5SeWFXSjFkRzl5YzE5MWNtd2lPaUpvZEhSd2N6b3ZMMkZ3YVM1bmFYUm9kV0l1WTI5dEwzSmxjRzl6TDJ4aGRYSmxiblJ6YVcxdmJpOXpiSE5oTFc5dUxXZHBkR2gxWWkxMFpYTjBMMk52Ym5SeWFXSjFkRzl5Y3lJc0ltTnlaV0YwWldSZllYUWlPaUl5TURJeUxUQXlMVEExVkRBeE9qRXdPalEyV2lJc0ltUmxabUYxYkhSZlluSmhibU5vSWpvaWJXRnBiaUlzSW1SbGNHeHZlVzFsYm5SelgzVnliQ0k2SW1oMGRIQnpPaTh2WVhCcExtZHBkR2gxWWk1amIyMHZjbVZ3YjNNdmJHRjFjbVZ1ZEhOcGJXOXVMM05zYzJFdGIyNHRaMmwwYUhWaUxYUmxjM1F2WkdWd2JHOTViV1Z1ZEhNaUxDSmtaWE5qY21sd2RHbHZiaUk2SWxSbGMzUWdabTl5SUZOTVUwRWlMQ0prYVhOaFlteGxaQ0k2Wm1Gc2MyVXNJbVJ2ZDI1c2IyRmtjMTkxY213aU9pSm9kSFJ3Y3pvdkwyRndhUzVuYVhSb2RXSXVZMjl0TDNKbGNHOXpMMnhoZFhKbGJuUnphVzF2Ymk5emJITmhMVzl1TFdkcGRHaDFZaTEwWlhOMEwyUnZkMjVzYjJGa2N5SXNJbVYyWlc1MGMxOTFjbXdpT2lKb2RIUndjem92TDJGd2FTNW5hWFJvZFdJdVkyOXRMM0psY0c5ekwyeGhkWEpsYm5SemFXMXZiaTl6YkhOaExXOXVMV2RwZEdoMVlpMTBaWE4wTDJWMlpXNTBjeUlzSW1admNtc2lPbVpoYkhObExDSm1iM0pyY3lJNk1Td2labTl5YTNOZlkyOTFiblFpT2pFc0ltWnZjbXR6WDNWeWJDSTZJbWgwZEhCek9pOHZZWEJwTG1kcGRHaDFZaTVqYjIwdmNtVndiM012YkdGMWNtVnVkSE5wYlc5dUwzTnNjMkV0YjI0dFoybDBhSFZpTFhSbGMzUXZabTl5YTNNaUxDSm1kV3hzWDI1aGJXVWlPaUpzWVhWeVpXNTBjMmx0YjI0dmMyeHpZUzF2YmkxbmFYUm9kV0l0ZEdWemRDSXNJbWRwZEY5amIyMXRhWFJ6WDNWeWJDSTZJbWgwZEhCek9pOHZZWEJwTG1kcGRHaDFZaTVqYjIwdmNtVndiM012YkdGMWNtVnVkSE5wYlc5dUwzTnNjMkV0YjI0dFoybDBhSFZpTFhSbGMzUXZaMmwwTDJOdmJXMXBkSE43TDNOb1lYMGlMQ0puYVhSZmNtVm1jMTkxY213aU9pSm9kSFJ3Y3pvdkwyRndhUzVuYVhSb2RXSXVZMjl0TDNKbGNHOXpMMnhoZFhKbGJuUnphVzF2Ymk5emJITmhMVzl1TFdkcGRHaDFZaTEwWlhOMEwyZHBkQzl5WldaemV5OXphR0Y5SWl3aVoybDBYM1JoWjNOZmRYSnNJam9pYUhSMGNITTZMeTloY0drdVoybDBhSFZpTG1OdmJTOXlaWEJ2Y3k5c1lYVnlaVzUwYzJsdGIyNHZjMnh6WVMxdmJpMW5hWFJvZFdJdGRHVnpkQzluYVhRdmRHRm5jM3N2YzJoaGZTSXNJbWRwZEY5MWNtd2lPaUpuYVhRNkx5OW5hWFJvZFdJdVkyOXRMMnhoZFhKbGJuUnphVzF2Ymk5emJITmhMVzl1TFdkcGRHaDFZaTEwWlhOMExtZHBkQ0lzSW1oaGMxOWtiM2R1Ykc5aFpITWlPblJ5ZFdVc0ltaGhjMTlwYzNOMVpYTWlPblJ5ZFdVc0ltaGhjMTl3WVdkbGN5STZabUZzYzJVc0ltaGhjMTl3Y205cVpXTjBjeUk2ZEhKMVpTd2lhR0Z6WDNkcGEya2lPblJ5ZFdVc0ltaHZiV1Z3WVdkbElqcHVkV3hzTENKb2IyOXJjMTkxY213aU9pSm9kSFJ3Y3pvdkwyRndhUzVuYVhSb2RXSXVZMjl0TDNKbGNHOXpMMnhoZFhKbGJuUnphVzF2Ymk5emJITmhMVzl1TFdkcGRHaDFZaTEwWlhOMEwyaHZiMnR6SWl3aWFIUnRiRjkxY213aU9pSm9kSFJ3Y3pvdkwyZHBkR2gxWWk1amIyMHZiR0YxY21WdWRITnBiVzl1TDNOc2MyRXRiMjR0WjJsMGFIVmlMWFJsYzNRaUxDSnBaQ0k2TkRVMU56UXpNemsyTENKcGMxOTBaVzF3YkdGMFpTSTZabUZzYzJVc0ltbHpjM1ZsWDJOdmJXMWxiblJmZFhKc0lqb2lhSFIwY0hNNkx5OWhjR2t1WjJsMGFIVmlMbU52YlM5eVpYQnZjeTlzWVhWeVpXNTBjMmx0YjI0dmMyeHpZUzF2YmkxbmFYUm9kV0l0ZEdWemRDOXBjM04xWlhNdlkyOXRiV1Z1ZEhON0wyNTFiV0psY24waUxDSnBjM04xWlY5bGRtVnVkSE5mZFhKc0lqb2lhSFIwY0hNNkx5OWhjR2t1WjJsMGFIVmlMbU52YlM5eVpYQnZjeTlzWVhWeVpXNTBjMmx0YjI0dmMyeHpZUzF2YmkxbmFYUm9kV0l0ZEdWemRDOXBjM04xWlhNdlpYWmxiblJ6ZXk5dWRXMWlaWEo5SWl3aWFYTnpkV1Z6WDNWeWJDSTZJbWgwZEhCek9pOHZZWEJwTG1kcGRHaDFZaTVqYjIwdmNtVndiM012YkdGMWNtVnVkSE5wYlc5dUwzTnNjMkV0YjI0dFoybDBhSFZpTFhSbGMzUXZhWE56ZFdWemV5OXVkVzFpWlhKOUlpd2lhMlY1YzE5MWNtd2lPaUpvZEhSd2N6b3ZMMkZ3YVM1bmFYUm9kV0l1WTI5dEwzSmxjRzl6TDJ4aGRYSmxiblJ6YVcxdmJpOXpiSE5oTFc5dUxXZHBkR2gxWWkxMFpYTjBMMnRsZVhON0wydGxlVjlwWkgwaUxDSnNZV0psYkhOZmRYSnNJam9pYUhSMGNITTZMeTloY0drdVoybDBhSFZpTG1OdmJTOXlaWEJ2Y3k5c1lYVnlaVzUwYzJsdGIyNHZjMnh6WVMxdmJpMW5hWFJvZFdJdGRHVnpkQzlzWVdKbGJITjdMMjVoYldWOUlpd2liR0Z1WjNWaFoyVWlPaUpUYUdWc2JDSXNJbXhoYm1kMVlXZGxjMTkxY213aU9pSm9kSFJ3Y3pvdkwyRndhUzVuYVhSb2RXSXVZMjl0TDNKbGNHOXpMMnhoZFhKbGJuUnphVzF2Ymk5emJITmhMVzl1TFdkcGRHaDFZaTEwWlhOMEwyeGhibWQxWVdkbGN5SXNJbXhwWTJWdWMyVWlPbnNpYTJWNUlqb2lZWEJoWTJobExUSXVNQ0lzSW01aGJXVWlPaUpCY0dGamFHVWdUR2xqWlc1elpTQXlMakFpTENKdWIyUmxYMmxrSWpvaVRVUmpObFJIYkdwYVZ6VjZXbFJKUFNJc0luTndaSGhmYVdRaU9pSkJjR0ZqYUdVdE1pNHdJaXdpZFhKc0lqb2lhSFIwY0hNNkx5OWhjR2t1WjJsMGFIVmlMbU52YlM5c2FXTmxibk5sY3k5aGNHRmphR1V0TWk0d0luMHNJbTFsY21kbGMxOTFjbXdpT2lKb2RIUndjem92TDJGd2FTNW5hWFJvZFdJdVkyOXRMM0psY0c5ekwyeGhkWEpsYm5SemFXMXZiaTl6YkhOaExXOXVMV2RwZEdoMVlpMTBaWE4wTDIxbGNtZGxjeUlzSW0xcGJHVnpkRzl1WlhOZmRYSnNJam9pYUhSMGNITTZMeTloY0drdVoybDBhSFZpTG1OdmJTOXlaWEJ2Y3k5c1lYVnlaVzUwYzJsdGIyNHZjMnh6WVMxdmJpMW5hWFJvZFdJdGRHVnpkQzl0YVd4bGMzUnZibVZ6ZXk5dWRXMWlaWEo5SWl3aWJXbHljbTl5WDNWeWJDSTZiblZzYkN3aWJtRnRaU0k2SW5Oc2MyRXRiMjR0WjJsMGFIVmlMWFJsYzNRaUxDSnViMlJsWDJsa0lqb2lVbDlyWjBSUFIzbHZXSEJCSWl3aWJtOTBhV1pwWTJGMGFXOXVjMTkxY213aU9pSm9kSFJ3Y3pvdkwyRndhUzVuYVhSb2RXSXVZMjl0TDNKbGNHOXpMMnhoZFhKbGJuUnphVzF2Ymk5emJITmhMVzl1TFdkcGRHaDFZaTEwWlhOMEwyNXZkR2xtYVdOaGRHbHZibk43UDNOcGJtTmxMR0ZzYkN4d1lYSjBhV05wY0dGMGFXNW5mU0lzSW05d1pXNWZhWE56ZFdWeklqb3lOQ3dpYjNCbGJsOXBjM04xWlhOZlkyOTFiblFpT2pJMExDSnZkMjVsY2lJNmV5SmhkbUYwWVhKZmRYSnNJam9pYUhSMGNITTZMeTloZG1GMFlYSnpMbWRwZEdoMVluVnpaWEpqYjI1MFpXNTBMbU52YlM5MUx6WTBOVEExTURrNVAzWTlOQ0lzSW1WMlpXNTBjMTkxY213aU9pSm9kSFJ3Y3pvdkwyRndhUzVuYVhSb2RXSXVZMjl0TDNWelpYSnpMMnhoZFhKbGJuUnphVzF2Ymk5bGRtVnVkSE43TDNCeWFYWmhZM2w5SWl3aVptOXNiRzkzWlhKelgzVnliQ0k2SW1oMGRIQnpPaTh2WVhCcExtZHBkR2gxWWk1amIyMHZkWE5sY25NdmJHRjFjbVZ1ZEhOcGJXOXVMMlp2Ykd4dmQyVnljeUlzSW1admJHeHZkMmx1WjE5MWNtd2lPaUpvZEhSd2N6b3ZMMkZ3YVM1bmFYUm9kV0l1WTI5dEwzVnpaWEp6TDJ4aGRYSmxiblJ6YVcxdmJpOW1iMnhzYjNkcGJtZDdMMjkwYUdWeVgzVnpaWEo5SWl3aVoybHpkSE5mZFhKc0lqb2lhSFIwY0hNNkx5OWhjR2t1WjJsMGFIVmlMbU52YlM5MWMyVnljeTlzWVhWeVpXNTBjMmx0YjI0dloybHpkSE43TDJkcGMzUmZhV1I5SWl3aVozSmhkbUYwWVhKZmFXUWlPaUlpTENKb2RHMXNYM1Z5YkNJNkltaDBkSEJ6T2k4dloybDBhSFZpTG1OdmJTOXNZWFZ5Wlc1MGMybHRiMjRpTENKcFpDSTZOalExTURVd09Ua3NJbXh2WjJsdUlqb2liR0YxY21WdWRITnBiVzl1SWl3aWJtOWtaVjlwWkNJNklrMUVVVFpXV0U1c1kycFpNRTVVUVRGTlJHczFJaXdpYjNKbllXNXBlbUYwYVc5dWMxOTFjbXdpT2lKb2RIUndjem92TDJGd2FTNW5hWFJvZFdJdVkyOXRMM1Z6WlhKekwyeGhkWEpsYm5SemFXMXZiaTl2Y21keklpd2ljbVZqWldsMlpXUmZaWFpsYm5SelgzVnliQ0k2SW1oMGRIQnpPaTh2WVhCcExtZHBkR2gxWWk1amIyMHZkWE5sY25NdmJHRjFjbVZ1ZEhOcGJXOXVMM0psWTJWcGRtVmtYMlYyWlc1MGN5SXNJbkpsY0c5elgzVnliQ0k2SW1oMGRIQnpPaTh2WVhCcExtZHBkR2gxWWk1amIyMHZkWE5sY25NdmJHRjFjbVZ1ZEhOcGJXOXVMM0psY0c5eklpd2ljMmwwWlY5aFpHMXBiaUk2Wm1Gc2MyVXNJbk4wWVhKeVpXUmZkWEpzSWpvaWFIUjBjSE02THk5aGNHa3VaMmwwYUhWaUxtTnZiUzkxYzJWeWN5OXNZWFZ5Wlc1MGMybHRiMjR2YzNSaGNuSmxaSHN2YjNkdVpYSjlleTl5WlhCdmZTSXNJbk4xWW5OamNtbHdkR2x2Ym5OZmRYSnNJam9pYUhSMGNITTZMeTloY0drdVoybDBhSFZpTG1OdmJTOTFjMlZ5Y3k5c1lYVnlaVzUwYzJsdGIyNHZjM1ZpYzJOeWFYQjBhVzl1Y3lJc0luUjVjR1VpT2lKVmMyVnlJaXdpZFhKc0lqb2lhSFIwY0hNNkx5OWhjR2t1WjJsMGFIVmlMbU52YlM5MWMyVnljeTlzWVhWeVpXNTBjMmx0YjI0aWZTd2ljSEpwZG1GMFpTSTZabUZzYzJVc0luQjFiR3h6WDNWeWJDSTZJbWgwZEhCek9pOHZZWEJwTG1kcGRHaDFZaTVqYjIwdmNtVndiM012YkdGMWNtVnVkSE5wYlc5dUwzTnNjMkV0YjI0dFoybDBhSFZpTFhSbGMzUXZjSFZzYkhON0wyNTFiV0psY24waUxDSndkWE5vWldSZllYUWlPaUl5TURJeUxUQTRMVEUxVkRFM09qQXlPakE0V2lJc0luSmxiR1ZoYzJWelgzVnliQ0k2SW1oMGRIQnpPaTh2WVhCcExtZHBkR2gxWWk1amIyMHZjbVZ3YjNNdmJHRjFjbVZ1ZEhOcGJXOXVMM05zYzJFdGIyNHRaMmwwYUhWaUxYUmxjM1F2Y21Wc1pXRnpaWE43TDJsa2ZTSXNJbk5wZW1VaU9qWTJOaXdpYzNOb1gzVnliQ0k2SW1kcGRFQm5hWFJvZFdJdVkyOXRPbXhoZFhKbGJuUnphVzF2Ymk5emJITmhMVzl1TFdkcGRHaDFZaTEwWlhOMExtZHBkQ0lzSW5OMFlYSm5ZWHBsY25OZlkyOTFiblFpT2pFc0luTjBZWEpuWVhwbGNuTmZkWEpzSWpvaWFIUjBjSE02THk5aGNHa3VaMmwwYUhWaUxtTnZiUzl5WlhCdmN5OXNZWFZ5Wlc1MGMybHRiMjR2YzJ4ellTMXZiaTFuYVhSb2RXSXRkR1Z6ZEM5emRHRnlaMkY2WlhKeklpd2ljM1JoZEhWelpYTmZkWEpzSWpvaWFIUjBjSE02THk5aGNHa3VaMmwwYUhWaUxtTnZiUzl5WlhCdmN5OXNZWFZ5Wlc1MGMybHRiMjR2YzJ4ellTMXZiaTFuYVhSb2RXSXRkR1Z6ZEM5emRHRjBkWE5sY3k5N2MyaGhmU0lzSW5OMVluTmpjbWxpWlhKelgzVnliQ0k2SW1oMGRIQnpPaTh2WVhCcExtZHBkR2gxWWk1amIyMHZjbVZ3YjNNdmJHRjFjbVZ1ZEhOcGJXOXVMM05zYzJFdGIyNHRaMmwwYUhWaUxYUmxjM1F2YzNWaWMyTnlhV0psY25NaUxDSnpkV0p6WTNKcGNIUnBiMjVmZFhKc0lqb2lhSFIwY0hNNkx5OWhjR2t1WjJsMGFIVmlMbU52YlM5eVpYQnZjeTlzWVhWeVpXNTBjMmx0YjI0dmMyeHpZUzF2YmkxbmFYUm9kV0l0ZEdWemRDOXpkV0p6WTNKcGNIUnBiMjRpTENKemRtNWZkWEpzSWpvaWFIUjBjSE02THk5bmFYUm9kV0l1WTI5dEwyeGhkWEpsYm5SemFXMXZiaTl6YkhOaExXOXVMV2RwZEdoMVlpMTBaWE4wSWl3aWRHRm5jMTkxY213aU9pSm9kSFJ3Y3pvdkwyRndhUzVuYVhSb2RXSXVZMjl0TDNKbGNHOXpMMnhoZFhKbGJuUnphVzF2Ymk5emJITmhMVzl1TFdkcGRHaDFZaTEwWlhOMEwzUmhaM01pTENKMFpXRnRjMTkxY213aU9pSm9kSFJ3Y3pvdkwyRndhUzVuYVhSb2RXSXVZMjl0TDNKbGNHOXpMMnhoZFhKbGJuUnphVzF2Ymk5emJITmhMVzl1TFdkcGRHaDFZaTEwWlhOMEwzUmxZVzF6SWl3aWRHOXdhV056SWpwYlhTd2lkSEpsWlhOZmRYSnNJam9pYUhSMGNITTZMeTloY0drdVoybDBhSFZpTG1OdmJTOXlaWEJ2Y3k5c1lYVnlaVzUwYzJsdGIyNHZjMnh6WVMxdmJpMW5hWFJvZFdJdGRHVnpkQzluYVhRdmRISmxaWE43TDNOb1lYMGlMQ0oxY0dSaGRHVmtYMkYwSWpvaU1qQXlNaTB3TmkweE0xUXlNRG95T1Rvek0xb2lMQ0oxY213aU9pSm9kSFJ3Y3pvdkwyRndhUzVuYVhSb2RXSXVZMjl0TDNKbGNHOXpMMnhoZFhKbGJuUnphVzF2Ymk5emJITmhMVzl1TFdkcGRHaDFZaTEwWlhOMElpd2lkbWx6YVdKcGJHbDBlU0k2SW5CMVlteHBZeUlzSW5kaGRHTm9aWEp6SWpveExDSjNZWFJqYUdWeWMxOWpiM1Z1ZENJNk1Td2lkMlZpWDJOdmJXMXBkRjl6YVdkdWIyWm1YM0psY1hWcGNtVmtJanBtWVd4elpYMHNJbk5sYm1SbGNpSTZleUpoZG1GMFlYSmZkWEpzSWpvaWFIUjBjSE02THk5aGRtRjBZWEp6TG1kcGRHaDFZblZ6WlhKamIyNTBaVzUwTG1OdmJTOTFMelkwTlRBMU1EazVQM1k5TkNJc0ltVjJaVzUwYzE5MWNtd2lPaUpvZEhSd2N6b3ZMMkZ3YVM1bmFYUm9kV0l1WTI5dEwzVnpaWEp6TDJ4aGRYSmxiblJ6YVcxdmJpOWxkbVZ1ZEhON0wzQnlhWFpoWTNsOUlpd2labTlzYkc5M1pYSnpYM1Z5YkNJNkltaDBkSEJ6T2k4dllYQnBMbWRwZEdoMVlpNWpiMjB2ZFhObGNuTXZiR0YxY21WdWRITnBiVzl1TDJadmJHeHZkMlZ5Y3lJc0ltWnZiR3h2ZDJsdVoxOTFjbXdpT2lKb2RIUndjem92TDJGd2FTNW5hWFJvZFdJdVkyOXRMM1Z6WlhKekwyeGhkWEpsYm5SemFXMXZiaTltYjJ4c2IzZHBibWQ3TDI5MGFHVnlYM1Z6WlhKOUlpd2laMmx6ZEhOZmRYSnNJam9pYUhSMGNITTZMeTloY0drdVoybDBhSFZpTG1OdmJTOTFjMlZ5Y3k5c1lYVnlaVzUwYzJsdGIyNHZaMmx6ZEhON0wyZHBjM1JmYVdSOUlpd2laM0poZG1GMFlYSmZhV1FpT2lJaUxDSm9kRzFzWDNWeWJDSTZJbWgwZEhCek9pOHZaMmwwYUhWaUxtTnZiUzlzWVhWeVpXNTBjMmx0YjI0aUxDSnBaQ0k2TmpRMU1EVXdPVGtzSW14dloybHVJam9pYkdGMWNtVnVkSE5wYlc5dUlpd2libTlrWlY5cFpDSTZJazFFVVRaV1dFNXNZMnBaTUU1VVFURk5SR3MxSWl3aWIzSm5ZVzVwZW1GMGFXOXVjMTkxY213aU9pSm9kSFJ3Y3pvdkwyRndhUzVuYVhSb2RXSXVZMjl0TDNWelpYSnpMMnhoZFhKbGJuUnphVzF2Ymk5dmNtZHpJaXdpY21WalpXbDJaV1JmWlhabGJuUnpYM1Z5YkNJNkltaDBkSEJ6T2k4dllYQnBMbWRwZEdoMVlpNWpiMjB2ZFhObGNuTXZiR0YxY21WdWRITnBiVzl1TDNKbFkyVnBkbVZrWDJWMlpXNTBjeUlzSW5KbGNHOXpYM1Z5YkNJNkltaDBkSEJ6T2k4dllYQnBMbWRwZEdoMVlpNWpiMjB2ZFhObGNuTXZiR0YxY21WdWRITnBiVzl1TDNKbGNHOXpJaXdpYzJsMFpWOWhaRzFwYmlJNlptRnNjMlVzSW5OMFlYSnlaV1JmZFhKc0lqb2lhSFIwY0hNNkx5OWhjR2t1WjJsMGFIVmlMbU52YlM5MWMyVnljeTlzWVhWeVpXNTBjMmx0YjI0dmMzUmhjbkpsWkhzdmIzZHVaWEo5ZXk5eVpYQnZmU0lzSW5OMVluTmpjbWx3ZEdsdmJuTmZkWEpzSWpvaWFIUjBjSE02THk5aGNHa3VaMmwwYUhWaUxtTnZiUzkxYzJWeWN5OXNZWFZ5Wlc1MGMybHRiMjR2YzNWaWMyTnlhWEIwYVc5dWN5SXNJblI1Y0dVaU9pSlZjMlZ5SWl3aWRYSnNJam9pYUhSMGNITTZMeTloY0drdVoybDBhSFZpTG1OdmJTOTFjMlZ5Y3k5c1lYVnlaVzUwYzJsdGIyNGlmU3dpZDI5eWEyWnNiM2NpT2lJdVoybDBhSFZpTDNkdmNtdG1iRzkzY3k5emJITmhMV2RsYm1WeWFXTXVlVzFzSW4wc0ltZHBkR2gxWWw5b1pXRmtYM0psWmlJNklpSXNJbWRwZEdoMVlsOXlaV1lpT2lKeVpXWnpMMmhsWVdSekwyMWhhVzRpTENKbmFYUm9kV0pmY21WbVgzUjVjR1VpT2lKaWNtRnVZMmdpTENKbmFYUm9kV0pmY21Wd2IzTnBkRzl5ZVY5cFpDSTZJalExTlRjME16TTVOaUlzSW1kcGRHaDFZbDl5WlhCdmMybDBiM0o1WDI5M2JtVnlJam9pYkdGMWNtVnVkSE5wYlc5dUlpd2laMmwwYUhWaVgzSmxjRzl6YVhSdmNubGZiM2R1WlhKZmFXUWlPaUkyTkRVd05UQTVPU0lzSW1kcGRHaDFZbDl5ZFc1ZllYUjBaVzF3ZENJNklqRWlMQ0puYVhSb2RXSmZjblZ1WDJsa0lqb2lNamcyTWpFM01UQXdNeUlzSW1kcGRHaDFZbDl5ZFc1ZmJuVnRZbVZ5SWpvaU9DSXNJbWRwZEdoMVlsOXphR0V4SWpvaU5EWTJZekV4TTJWa00yUTFZV00zTlRZNE1UYzBaRFJpTm1Ga05tSmlObUU0TUdVeE5UTmlNaUo5ZlN3aWJXVjBZV1JoZEdFaU9uc2lZblZwYkdSSmJuWnZZMkYwYVc5dVNVUWlPaUl5T0RZeU1UY3hNREF6TFRFaUxDSmpiMjF3YkdWMFpXNWxjM01pT25zaWNHRnlZVzFsZEdWeWN5STZkSEoxWlN3aVpXNTJhWEp2Ym0xbGJuUWlPbVpoYkhObExDSnRZWFJsY21saGJITWlPbVpoYkhObGZTd2ljbVZ3Y205a2RXTnBZbXhsSWpwbVlXeHpaWDBzSW0xaGRHVnlhV0ZzY3lJNlczc2lkWEpwSWpvaVoybDBLMmgwZEhCek9pOHZaMmwwYUhWaUxtTnZiUzlzWVhWeVpXNTBjMmx0YjI0dmMyeHpZUzF2YmkxbmFYUm9kV0l0ZEdWemRFQnlaV1p6TDJobFlXUnpMMjFoYVc0aUxDSmthV2RsYzNRaU9uc2ljMmhoTVNJNklqUTJObU14TVRObFpETmtOV0ZqTnpVMk9ERTNOR1EwWWpaaFpEWmlZalpoT0RCbE1UVXpZaklpZlgxZGZYMD0iLCJzaWduYXR1cmVzIjpbeyJrZXlpZCI6IiIsInNpZyI6Ik1FVUNJSEJ0YkxlVjVXTXN5THBQclpjeEZVMXd1RVlIRlVySm56aXpzZzE3ZEw0aEFpRUFrb1RMYTQ5VnJmL2c1bVNhV1k2T2FiOTlZTnZxQnlOZ1I3NzNpa0pYUTVJPSIsImNlcnQiOiItLS0tLUJFR0lOIENFUlRJRklDQVRFLS0tLS1cbk1JSURWRENDQXRxZ0F3SUJBZ0lUTENrMUUyL3dIMi9tQ2pDWUFvdk1lVFRIbkRBS0JnZ3Foa2pPUFFRREF6QXFcbk1SVXdFd1lEVlFRS0V3eHphV2R6ZEc5eVpTNWtaWFl4RVRBUEJnTlZCQU1UQ0hOcFozTjBiM0psTUI0WERUSXlcbk1EZ3hOVEUzTURReE1sb1hEVEl5TURneE5URTNNVFF4TVZvd0FEQlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlcbkF3RUhBMElBQkN3NlZPNWxrc2Z4Y2p0KzRjRWJnQm5MdVBCMndEZ2ozSTlVUVpoNDV4VzRLUllLTTcvb1NMZkRcblA4UUdMZmdOa3YzWkR3QlpVRExiQmswaE5vTXEwYmVqZ2dJSE1JSUNBekFPQmdOVkhROEJBZjhFQkFNQ0I0QXdcbkV3WURWUjBsQkF3d0NnWUlLd1lCQlFVSEF3TXdEQVlEVlIwVEFRSC9CQUl3QURBZEJnTlZIUTRFRmdRVXl4ZnFcbnoyUHIyVlIrSzlGZGlMYk9TeHFJWWdRd0h3WURWUjBqQkJnd0ZvQVVXTUFlWDVGRnBXYXBlc3lRb1pNaTBDckZcbnhmb3dnWVFHQTFVZEVRRUIvd1I2TUhpR2RtaDBkSEJ6T2k4dloybDBhSFZpTG1OdmJTOXpiSE5oTFdaeVlXMWxcbmQyOXlheTl6YkhOaExXZHBkR2gxWWkxblpXNWxjbUYwYjNJdkxtZHBkR2gxWWk5M2IzSnJabXh2ZDNNdloyVnVcblpYSmhkRzl5WDJkbGJtVnlhV05mYzJ4ellUTXVlVzFzUUhKbFpuTXZkR0ZuY3k5Mk1TNHlMakF3SHdZS0t3WUJcbkJBR0R2ekFCQWdRUmQyOXlhMlpzYjNkZlpHbHpjR0YwWTJnd0xnWUtLd1lCQkFHRHZ6QUJCUVFnYkdGMWNtVnVcbmRITnBiVzl1TDNOc2MyRXRiMjR0WjJsMGFIVmlMWFJsYzNRd0pBWUtLd1lCQkFHRHZ6QUJCQVFXVTB4VFFTQm5cblpXNWxjbWxqSUdkbGJtVnlZWFJ2Y2pBZEJnb3JCZ0VFQVlPL01BRUdCQTl5WldaekwyaGxZV1J6TDIxaGFXNHdcbk9RWUtLd1lCQkFHRHZ6QUJBUVFyYUhSMGNITTZMeTkwYjJ0bGJpNWhZM1JwYjI1ekxtZHBkR2gxWW5WelpYSmpcbmIyNTBaVzUwTG1OdmJUQTJCZ29yQmdFRUFZTy9NQUVEQkNnME5qWmpNVEV6WldRelpEVmhZemMxTmpneE56Umtcbk5HSTJZV1EyWW1JMllUZ3daVEUxTTJJeU1Bb0dDQ3FHU000OUJBTURBMmdBTUdVQ01RQ3g0K2lNcEZCdm5GVjlcblg2Z29HalFmZGdsaVBjTmE0Y2RkMkswbm1ybjc5Y09wc2x5emNKTEFsTC9xU1lzR2xvY0NNQy9QL2dMMkIxNmlcbk1wNllRWlVpU013elVvaHJyN1YzbkpzTVBjTGdFVEd5aVpvUjNVaWpaRzc0Rm9iWi8rM3BDdz09XG4tLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tXG4ifV19","signatures":[{"keyid":"","sig":"MEUCIHBtbLeV5WMsyLpPrZcxFU1wuEYHFUrJnzizsg17dL4hAiEAkoTLa49Vrf/g5mSaWY6Oab99YNvqByNgR773ikJXQ5I=","cert":"-----BEGIN CERTIFICATE-----\nMIIDVDCCAtqgAwIBAgITLCk1E2/wH2/mCjCYAovMeTTHnDAKBggqhkjOPQQDAzAq\nMRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxETAPBgNVBAMTCHNpZ3N0b3JlMB4XDTIy\nMDgxNTE3MDQxMloXDTIyMDgxNTE3MTQxMVowADBZMBMGByqGSM49AgEGCCqGSM49\nAwEHA0IABCw6VO5lksfxcjt+4cEbgBnLuPB2wDgj3I9UQZh45xW4KRYKM7/oSLfD\nP8QGLfgNkv3ZDwBZUDLbBk0hNoMq0bejggIHMIICAzAOBgNVHQ8BAf8EBAMCB4Aw\nEwYDVR0lBAwwCgYIKwYBBQUHAwMwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUyxfq\nz2Pr2VR+K9FdiLbOSxqIYgQwHwYDVR0jBBgwFoAUWMAeX5FFpWapesyQoZMi0CrF\nxfowgYQGA1UdEQEB/wR6MHiGdmh0dHBzOi8vZ2l0aHViLmNvbS9zbHNhLWZyYW1l\nd29yay9zbHNhLWdpdGh1Yi1nZW5lcmF0b3IvLmdpdGh1Yi93b3JrZmxvd3MvZ2Vu\nZXJhdG9yX2dlbmVyaWNfc2xzYTMueW1sQHJlZnMvdGFncy92MS4yLjAwHwYKKwYB\nBAGDvzABAgQRd29ya2Zsb3dfZGlzcGF0Y2gwLgYKKwYBBAGDvzABBQQgbGF1cmVu\ndHNpbW9uL3Nsc2Etb24tZ2l0aHViLXRlc3QwJAYKKwYBBAGDvzABBAQWU0xTQSBn\nZW5lcmljIGdlbmVyYXRvcjAdBgorBgEEAYO/MAEGBA9yZWZzL2hlYWRzL21haW4w\nOQYKKwYBBAGDvzABAQQraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJj\nb250ZW50LmNvbTA2BgorBgEEAYO/MAEDBCg0NjZjMTEzZWQzZDVhYzc1NjgxNzRk\nNGI2YWQ2YmI2YTgwZTE1M2IyMAoGCCqGSM49BAMDA2gAMGUCMQCx4+iMpFBvnFV9\nX6goGjQfdgliPcNa4cdd2K0nmrn79cOpslyzcJLAlL/qSYsGlocCMC/P/gL2B16i\nMp6YQZUiSMwzUohrr7V3nJsMPcLgETGyiZoR3UijZG74FobZ/+3pCw==\n-----END CERTIFICATE-----\n"}]} \ No newline at end of file diff --git a/verifiers/internal/gha/testdata/dsse-workflow-inputs.intoto.jsonl b/verifiers/internal/gha/testdata/dsse-workflow-inputs.intoto.jsonl new file mode 100644 index 0000000..ffa3baa --- /dev/null +++ b/verifiers/internal/gha/testdata/dsse-workflow-inputs.intoto.jsonl @@ -0,0 +1 @@ +{"payloadType":"application/vnd.in-toto+json","payload":"eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjAuMSIsInByZWRpY2F0ZVR5cGUiOiJodHRwczovL3Nsc2EuZGV2L3Byb3ZlbmFuY2UvdjAuMiIsInN1YmplY3QiOlt7Im5hbWUiOiJhcnRpZmFjdDEiLCJkaWdlc3QiOnsic2hhMjU2IjoiNDgyY2U4YzhmN2U4NjdkYTNhM2MwNWE5YWVlNjM3NzAzZTE3NDcwZWQxY2Y4ODJhOWU1YjQwNWU4ZjgyNjE5ZCJ9fSx7Im5hbWUiOiJhcnRpZmFjdDIiLCJkaWdlc3QiOnsic2hhMjU2IjoiODljZmM2OTU0ZTg4YjJmOTJhN2MyODc5ZDllYjA4NWM0MmYzYzcwNjVkMDEyYTUwNjZmNDUwZGJlNTliMmMwMCJ9fV0sInByZWRpY2F0ZSI6eyJidWlsZGVyIjp7ImlkIjoiaHR0cHM6Ly9naXRodWIuY29tL3Nsc2EtZnJhbWV3b3JrL3Nsc2EtZ2l0aHViLWdlbmVyYXRvci8uZ2l0aHViL3dvcmtmbG93cy9nZW5lcmF0b3JfZ2VuZXJpY19zbHNhMy55bWxAcmVmcy90YWdzL3YxLjIuMCJ9LCJidWlsZFR5cGUiOiJodHRwczovL2dpdGh1Yi5jb20vc2xzYS1mcmFtZXdvcmsvc2xzYS1naXRodWItZ2VuZXJhdG9yQHYxIiwiaW52b2NhdGlvbiI6eyJjb25maWdTb3VyY2UiOnsidXJpIjoiZ2l0K2h0dHBzOi8vZ2l0aHViLmNvbS9sYXVyZW50c2ltb24vc2xzYS1vbi1naXRodWItdGVzdEByZWZzL2hlYWRzL21haW4iLCJkaWdlc3QiOnsic2hhMSI6IjQ2NmMxMTNlZDNkNWFjNzU2ODE3NGQ0YjZhZDZiYjZhODBlMTUzYjIifSwiZW50cnlQb2ludCI6Ii5naXRodWIvd29ya2Zsb3dzL3Nsc2EtZ2VuZXJpYy55bWwifSwicGFyYW1ldGVycyI6eyJldmVudF9pbnB1dHMiOnsicmVsZWFzZV92ZXJzaW9uIjoidjEuMi4zIiwic29tZV9ib29sIjoidHJ1ZSIsInNvbWVfaW50ZWdlciI6IjEyMyJ9fSwiZW52aXJvbm1lbnQiOnsiZ2l0aHViX2FjdG9yIjoibGF1cmVudHNpbW9uIiwiZ2l0aHViX2FjdG9yX2lkIjoiNjQ1MDUwOTkiLCJnaXRodWJfYmFzZV9yZWYiOiIiLCJnaXRodWJfZXZlbnRfbmFtZSI6IndvcmtmbG93X2Rpc3BhdGNoIiwiZ2l0aHViX2V2ZW50X3BheWxvYWQiOnsiaW5wdXRzIjp7InJlbGVhc2VfdmVyc2lvbiI6InYxLjIuMyIsInNvbWVfYm9vbCI6InRydWUiLCJzb21lX2ludGVnZXIiOiIxMjMifSwicmVmIjoicmVmcy9oZWFkcy9tYWluIiwicmVwb3NpdG9yeSI6eyJhbGxvd19mb3JraW5nIjp0cnVlLCJhcmNoaXZlX3VybCI6Imh0dHBzOi8vYXBpLmdpdGh1Yi5jb20vcmVwb3MvbGF1cmVudHNpbW9uL3Nsc2Etb24tZ2l0aHViLXRlc3Qve2FyY2hpdmVfZm9ybWF0fXsvcmVmfSIsImFyY2hpdmVkIjpmYWxzZSwiYXNzaWduZWVzX3VybCI6Imh0dHBzOi8vYXBpLmdpdGh1Yi5jb20vcmVwb3MvbGF1cmVudHNpbW9uL3Nsc2Etb24tZ2l0aHViLXRlc3QvYXNzaWduZWVzey91c2VyfSIsImJsb2JzX3VybCI6Imh0dHBzOi8vYXBpLmdpdGh1Yi5jb20vcmVwb3MvbGF1cmVudHNpbW9uL3Nsc2Etb24tZ2l0aHViLXRlc3QvZ2l0L2Jsb2Jzey9zaGF9IiwiYnJhbmNoZXNfdXJsIjoiaHR0cHM6Ly9hcGkuZ2l0aHViLmNvbS9yZXBvcy9sYXVyZW50c2ltb24vc2xzYS1vbi1naXRodWItdGVzdC9icmFuY2hlc3svYnJhbmNofSIsImNsb25lX3VybCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9sYXVyZW50c2ltb24vc2xzYS1vbi1naXRodWItdGVzdC5naXQiLCJjb2xsYWJvcmF0b3JzX3VybCI6Imh0dHBzOi8vYXBpLmdpdGh1Yi5jb20vcmVwb3MvbGF1cmVudHNpbW9uL3Nsc2Etb24tZ2l0aHViLXRlc3QvY29sbGFib3JhdG9yc3svY29sbGFib3JhdG9yfSIsImNvbW1lbnRzX3VybCI6Imh0dHBzOi8vYXBpLmdpdGh1Yi5jb20vcmVwb3MvbGF1cmVudHNpbW9uL3Nsc2Etb24tZ2l0aHViLXRlc3QvY29tbWVudHN7L251bWJlcn0iLCJjb21taXRzX3VybCI6Imh0dHBzOi8vYXBpLmdpdGh1Yi5jb20vcmVwb3MvbGF1cmVudHNpbW9uL3Nsc2Etb24tZ2l0aHViLXRlc3QvY29tbWl0c3svc2hhfSIsImNvbXBhcmVfdXJsIjoiaHR0cHM6Ly9hcGkuZ2l0aHViLmNvbS9yZXBvcy9sYXVyZW50c2ltb24vc2xzYS1vbi1naXRodWItdGVzdC9jb21wYXJlL3tiYXNlfS4uLntoZWFkfSIsImNvbnRlbnRzX3VybCI6Imh0dHBzOi8vYXBpLmdpdGh1Yi5jb20vcmVwb3MvbGF1cmVudHNpbW9uL3Nsc2Etb24tZ2l0aHViLXRlc3QvY29udGVudHMveytwYXRofSIsImNvbnRyaWJ1dG9yc191cmwiOiJodHRwczovL2FwaS5naXRodWIuY29tL3JlcG9zL2xhdXJlbnRzaW1vbi9zbHNhLW9uLWdpdGh1Yi10ZXN0L2NvbnRyaWJ1dG9ycyIsImNyZWF0ZWRfYXQiOiIyMDIyLTAyLTA1VDAxOjEwOjQ2WiIsImRlZmF1bHRfYnJhbmNoIjoibWFpbiIsImRlcGxveW1lbnRzX3VybCI6Imh0dHBzOi8vYXBpLmdpdGh1Yi5jb20vcmVwb3MvbGF1cmVudHNpbW9uL3Nsc2Etb24tZ2l0aHViLXRlc3QvZGVwbG95bWVudHMiLCJkZXNjcmlwdGlvbiI6IlRlc3QgZm9yIFNMU0EiLCJkaXNhYmxlZCI6ZmFsc2UsImRvd25sb2Fkc191cmwiOiJodHRwczovL2FwaS5naXRodWIuY29tL3JlcG9zL2xhdXJlbnRzaW1vbi9zbHNhLW9uLWdpdGh1Yi10ZXN0L2Rvd25sb2FkcyIsImV2ZW50c191cmwiOiJodHRwczovL2FwaS5naXRodWIuY29tL3JlcG9zL2xhdXJlbnRzaW1vbi9zbHNhLW9uLWdpdGh1Yi10ZXN0L2V2ZW50cyIsImZvcmsiOmZhbHNlLCJmb3JrcyI6MSwiZm9ya3NfY291bnQiOjEsImZvcmtzX3VybCI6Imh0dHBzOi8vYXBpLmdpdGh1Yi5jb20vcmVwb3MvbGF1cmVudHNpbW9uL3Nsc2Etb24tZ2l0aHViLXRlc3QvZm9ya3MiLCJmdWxsX25hbWUiOiJsYXVyZW50c2ltb24vc2xzYS1vbi1naXRodWItdGVzdCIsImdpdF9jb21taXRzX3VybCI6Imh0dHBzOi8vYXBpLmdpdGh1Yi5jb20vcmVwb3MvbGF1cmVudHNpbW9uL3Nsc2Etb24tZ2l0aHViLXRlc3QvZ2l0L2NvbW1pdHN7L3NoYX0iLCJnaXRfcmVmc191cmwiOiJodHRwczovL2FwaS5naXRodWIuY29tL3JlcG9zL2xhdXJlbnRzaW1vbi9zbHNhLW9uLWdpdGh1Yi10ZXN0L2dpdC9yZWZzey9zaGF9IiwiZ2l0X3RhZ3NfdXJsIjoiaHR0cHM6Ly9hcGkuZ2l0aHViLmNvbS9yZXBvcy9sYXVyZW50c2ltb24vc2xzYS1vbi1naXRodWItdGVzdC9naXQvdGFnc3svc2hhfSIsImdpdF91cmwiOiJnaXQ6Ly9naXRodWIuY29tL2xhdXJlbnRzaW1vbi9zbHNhLW9uLWdpdGh1Yi10ZXN0LmdpdCIsImhhc19kb3dubG9hZHMiOnRydWUsImhhc19pc3N1ZXMiOnRydWUsImhhc19wYWdlcyI6ZmFsc2UsImhhc19wcm9qZWN0cyI6dHJ1ZSwiaGFzX3dpa2kiOnRydWUsImhvbWVwYWdlIjpudWxsLCJob29rc191cmwiOiJodHRwczovL2FwaS5naXRodWIuY29tL3JlcG9zL2xhdXJlbnRzaW1vbi9zbHNhLW9uLWdpdGh1Yi10ZXN0L2hvb2tzIiwiaHRtbF91cmwiOiJodHRwczovL2dpdGh1Yi5jb20vbGF1cmVudHNpbW9uL3Nsc2Etb24tZ2l0aHViLXRlc3QiLCJpZCI6NDU1NzQzMzk2LCJpc190ZW1wbGF0ZSI6ZmFsc2UsImlzc3VlX2NvbW1lbnRfdXJsIjoiaHR0cHM6Ly9hcGkuZ2l0aHViLmNvbS9yZXBvcy9sYXVyZW50c2ltb24vc2xzYS1vbi1naXRodWItdGVzdC9pc3N1ZXMvY29tbWVudHN7L251bWJlcn0iLCJpc3N1ZV9ldmVudHNfdXJsIjoiaHR0cHM6Ly9hcGkuZ2l0aHViLmNvbS9yZXBvcy9sYXVyZW50c2ltb24vc2xzYS1vbi1naXRodWItdGVzdC9pc3N1ZXMvZXZlbnRzey9udW1iZXJ9IiwiaXNzdWVzX3VybCI6Imh0dHBzOi8vYXBpLmdpdGh1Yi5jb20vcmVwb3MvbGF1cmVudHNpbW9uL3Nsc2Etb24tZ2l0aHViLXRlc3QvaXNzdWVzey9udW1iZXJ9Iiwia2V5c191cmwiOiJodHRwczovL2FwaS5naXRodWIuY29tL3JlcG9zL2xhdXJlbnRzaW1vbi9zbHNhLW9uLWdpdGh1Yi10ZXN0L2tleXN7L2tleV9pZH0iLCJsYWJlbHNfdXJsIjoiaHR0cHM6Ly9hcGkuZ2l0aHViLmNvbS9yZXBvcy9sYXVyZW50c2ltb24vc2xzYS1vbi1naXRodWItdGVzdC9sYWJlbHN7L25hbWV9IiwibGFuZ3VhZ2UiOiJTaGVsbCIsImxhbmd1YWdlc191cmwiOiJodHRwczovL2FwaS5naXRodWIuY29tL3JlcG9zL2xhdXJlbnRzaW1vbi9zbHNhLW9uLWdpdGh1Yi10ZXN0L2xhbmd1YWdlcyIsImxpY2Vuc2UiOnsia2V5IjoiYXBhY2hlLTIuMCIsIm5hbWUiOiJBcGFjaGUgTGljZW5zZSAyLjAiLCJub2RlX2lkIjoiTURjNlRHbGpaVzV6WlRJPSIsInNwZHhfaWQiOiJBcGFjaGUtMi4wIiwidXJsIjoiaHR0cHM6Ly9hcGkuZ2l0aHViLmNvbS9saWNlbnNlcy9hcGFjaGUtMi4wIn0sIm1lcmdlc191cmwiOiJodHRwczovL2FwaS5naXRodWIuY29tL3JlcG9zL2xhdXJlbnRzaW1vbi9zbHNhLW9uLWdpdGh1Yi10ZXN0L21lcmdlcyIsIm1pbGVzdG9uZXNfdXJsIjoiaHR0cHM6Ly9hcGkuZ2l0aHViLmNvbS9yZXBvcy9sYXVyZW50c2ltb24vc2xzYS1vbi1naXRodWItdGVzdC9taWxlc3RvbmVzey9udW1iZXJ9IiwibWlycm9yX3VybCI6bnVsbCwibmFtZSI6InNsc2Etb24tZ2l0aHViLXRlc3QiLCJub2RlX2lkIjoiUl9rZ0RPR3lvWHBBIiwibm90aWZpY2F0aW9uc191cmwiOiJodHRwczovL2FwaS5naXRodWIuY29tL3JlcG9zL2xhdXJlbnRzaW1vbi9zbHNhLW9uLWdpdGh1Yi10ZXN0L25vdGlmaWNhdGlvbnN7P3NpbmNlLGFsbCxwYXJ0aWNpcGF0aW5nfSIsIm9wZW5faXNzdWVzIjoyNCwib3Blbl9pc3N1ZXNfY291bnQiOjI0LCJvd25lciI6eyJhdmF0YXJfdXJsIjoiaHR0cHM6Ly9hdmF0YXJzLmdpdGh1YnVzZXJjb250ZW50LmNvbS91LzY0NTA1MDk5P3Y9NCIsImV2ZW50c191cmwiOiJodHRwczovL2FwaS5naXRodWIuY29tL3VzZXJzL2xhdXJlbnRzaW1vbi9ldmVudHN7L3ByaXZhY3l9IiwiZm9sbG93ZXJzX3VybCI6Imh0dHBzOi8vYXBpLmdpdGh1Yi5jb20vdXNlcnMvbGF1cmVudHNpbW9uL2ZvbGxvd2VycyIsImZvbGxvd2luZ191cmwiOiJodHRwczovL2FwaS5naXRodWIuY29tL3VzZXJzL2xhdXJlbnRzaW1vbi9mb2xsb3dpbmd7L290aGVyX3VzZXJ9IiwiZ2lzdHNfdXJsIjoiaHR0cHM6Ly9hcGkuZ2l0aHViLmNvbS91c2Vycy9sYXVyZW50c2ltb24vZ2lzdHN7L2dpc3RfaWR9IiwiZ3JhdmF0YXJfaWQiOiIiLCJodG1sX3VybCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9sYXVyZW50c2ltb24iLCJpZCI6NjQ1MDUwOTksImxvZ2luIjoibGF1cmVudHNpbW9uIiwibm9kZV9pZCI6Ik1EUTZWWE5sY2pZME5UQTFNRGs1Iiwib3JnYW5pemF0aW9uc191cmwiOiJodHRwczovL2FwaS5naXRodWIuY29tL3VzZXJzL2xhdXJlbnRzaW1vbi9vcmdzIiwicmVjZWl2ZWRfZXZlbnRzX3VybCI6Imh0dHBzOi8vYXBpLmdpdGh1Yi5jb20vdXNlcnMvbGF1cmVudHNpbW9uL3JlY2VpdmVkX2V2ZW50cyIsInJlcG9zX3VybCI6Imh0dHBzOi8vYXBpLmdpdGh1Yi5jb20vdXNlcnMvbGF1cmVudHNpbW9uL3JlcG9zIiwic2l0ZV9hZG1pbiI6ZmFsc2UsInN0YXJyZWRfdXJsIjoiaHR0cHM6Ly9hcGkuZ2l0aHViLmNvbS91c2Vycy9sYXVyZW50c2ltb24vc3RhcnJlZHsvb3duZXJ9ey9yZXBvfSIsInN1YnNjcmlwdGlvbnNfdXJsIjoiaHR0cHM6Ly9hcGkuZ2l0aHViLmNvbS91c2Vycy9sYXVyZW50c2ltb24vc3Vic2NyaXB0aW9ucyIsInR5cGUiOiJVc2VyIiwidXJsIjoiaHR0cHM6Ly9hcGkuZ2l0aHViLmNvbS91c2Vycy9sYXVyZW50c2ltb24ifSwicHJpdmF0ZSI6ZmFsc2UsInB1bGxzX3VybCI6Imh0dHBzOi8vYXBpLmdpdGh1Yi5jb20vcmVwb3MvbGF1cmVudHNpbW9uL3Nsc2Etb24tZ2l0aHViLXRlc3QvcHVsbHN7L251bWJlcn0iLCJwdXNoZWRfYXQiOiIyMDIyLTA4LTE1VDE3OjAyOjA4WiIsInJlbGVhc2VzX3VybCI6Imh0dHBzOi8vYXBpLmdpdGh1Yi5jb20vcmVwb3MvbGF1cmVudHNpbW9uL3Nsc2Etb24tZ2l0aHViLXRlc3QvcmVsZWFzZXN7L2lkfSIsInNpemUiOjY2Niwic3NoX3VybCI6ImdpdEBnaXRodWIuY29tOmxhdXJlbnRzaW1vbi9zbHNhLW9uLWdpdGh1Yi10ZXN0LmdpdCIsInN0YXJnYXplcnNfY291bnQiOjEsInN0YXJnYXplcnNfdXJsIjoiaHR0cHM6Ly9hcGkuZ2l0aHViLmNvbS9yZXBvcy9sYXVyZW50c2ltb24vc2xzYS1vbi1naXRodWItdGVzdC9zdGFyZ2F6ZXJzIiwic3RhdHVzZXNfdXJsIjoiaHR0cHM6Ly9hcGkuZ2l0aHViLmNvbS9yZXBvcy9sYXVyZW50c2ltb24vc2xzYS1vbi1naXRodWItdGVzdC9zdGF0dXNlcy97c2hhfSIsInN1YnNjcmliZXJzX3VybCI6Imh0dHBzOi8vYXBpLmdpdGh1Yi5jb20vcmVwb3MvbGF1cmVudHNpbW9uL3Nsc2Etb24tZ2l0aHViLXRlc3Qvc3Vic2NyaWJlcnMiLCJzdWJzY3JpcHRpb25fdXJsIjoiaHR0cHM6Ly9hcGkuZ2l0aHViLmNvbS9yZXBvcy9sYXVyZW50c2ltb24vc2xzYS1vbi1naXRodWItdGVzdC9zdWJzY3JpcHRpb24iLCJzdm5fdXJsIjoiaHR0cHM6Ly9naXRodWIuY29tL2xhdXJlbnRzaW1vbi9zbHNhLW9uLWdpdGh1Yi10ZXN0IiwidGFnc191cmwiOiJodHRwczovL2FwaS5naXRodWIuY29tL3JlcG9zL2xhdXJlbnRzaW1vbi9zbHNhLW9uLWdpdGh1Yi10ZXN0L3RhZ3MiLCJ0ZWFtc191cmwiOiJodHRwczovL2FwaS5naXRodWIuY29tL3JlcG9zL2xhdXJlbnRzaW1vbi9zbHNhLW9uLWdpdGh1Yi10ZXN0L3RlYW1zIiwidG9waWNzIjpbXSwidHJlZXNfdXJsIjoiaHR0cHM6Ly9hcGkuZ2l0aHViLmNvbS9yZXBvcy9sYXVyZW50c2ltb24vc2xzYS1vbi1naXRodWItdGVzdC9naXQvdHJlZXN7L3NoYX0iLCJ1cGRhdGVkX2F0IjoiMjAyMi0wNi0xM1QyMDoyOTozM1oiLCJ1cmwiOiJodHRwczovL2FwaS5naXRodWIuY29tL3JlcG9zL2xhdXJlbnRzaW1vbi9zbHNhLW9uLWdpdGh1Yi10ZXN0IiwidmlzaWJpbGl0eSI6InB1YmxpYyIsIndhdGNoZXJzIjoxLCJ3YXRjaGVyc19jb3VudCI6MSwid2ViX2NvbW1pdF9zaWdub2ZmX3JlcXVpcmVkIjpmYWxzZX0sInNlbmRlciI6eyJhdmF0YXJfdXJsIjoiaHR0cHM6Ly9hdmF0YXJzLmdpdGh1YnVzZXJjb250ZW50LmNvbS91LzY0NTA1MDk5P3Y9NCIsImV2ZW50c191cmwiOiJodHRwczovL2FwaS5naXRodWIuY29tL3VzZXJzL2xhdXJlbnRzaW1vbi9ldmVudHN7L3ByaXZhY3l9IiwiZm9sbG93ZXJzX3VybCI6Imh0dHBzOi8vYXBpLmdpdGh1Yi5jb20vdXNlcnMvbGF1cmVudHNpbW9uL2ZvbGxvd2VycyIsImZvbGxvd2luZ191cmwiOiJodHRwczovL2FwaS5naXRodWIuY29tL3VzZXJzL2xhdXJlbnRzaW1vbi9mb2xsb3dpbmd7L290aGVyX3VzZXJ9IiwiZ2lzdHNfdXJsIjoiaHR0cHM6Ly9hcGkuZ2l0aHViLmNvbS91c2Vycy9sYXVyZW50c2ltb24vZ2lzdHN7L2dpc3RfaWR9IiwiZ3JhdmF0YXJfaWQiOiIiLCJodG1sX3VybCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9sYXVyZW50c2ltb24iLCJpZCI6NjQ1MDUwOTksImxvZ2luIjoibGF1cmVudHNpbW9uIiwibm9kZV9pZCI6Ik1EUTZWWE5sY2pZME5UQTFNRGs1Iiwib3JnYW5pemF0aW9uc191cmwiOiJodHRwczovL2FwaS5naXRodWIuY29tL3VzZXJzL2xhdXJlbnRzaW1vbi9vcmdzIiwicmVjZWl2ZWRfZXZlbnRzX3VybCI6Imh0dHBzOi8vYXBpLmdpdGh1Yi5jb20vdXNlcnMvbGF1cmVudHNpbW9uL3JlY2VpdmVkX2V2ZW50cyIsInJlcG9zX3VybCI6Imh0dHBzOi8vYXBpLmdpdGh1Yi5jb20vdXNlcnMvbGF1cmVudHNpbW9uL3JlcG9zIiwic2l0ZV9hZG1pbiI6ZmFsc2UsInN0YXJyZWRfdXJsIjoiaHR0cHM6Ly9hcGkuZ2l0aHViLmNvbS91c2Vycy9sYXVyZW50c2ltb24vc3RhcnJlZHsvb3duZXJ9ey9yZXBvfSIsInN1YnNjcmlwdGlvbnNfdXJsIjoiaHR0cHM6Ly9hcGkuZ2l0aHViLmNvbS91c2Vycy9sYXVyZW50c2ltb24vc3Vic2NyaXB0aW9ucyIsInR5cGUiOiJVc2VyIiwidXJsIjoiaHR0cHM6Ly9hcGkuZ2l0aHViLmNvbS91c2Vycy9sYXVyZW50c2ltb24ifSwid29ya2Zsb3ciOiIuZ2l0aHViL3dvcmtmbG93cy9zbHNhLWdlbmVyaWMueW1sIn0sImdpdGh1Yl9oZWFkX3JlZiI6IiIsImdpdGh1Yl9yZWYiOiJyZWZzL2hlYWRzL21haW4iLCJnaXRodWJfcmVmX3R5cGUiOiJicmFuY2giLCJnaXRodWJfcmVwb3NpdG9yeV9pZCI6IjQ1NTc0MzM5NiIsImdpdGh1Yl9yZXBvc2l0b3J5X293bmVyIjoibGF1cmVudHNpbW9uIiwiZ2l0aHViX3JlcG9zaXRvcnlfb3duZXJfaWQiOiI2NDUwNTA5OSIsImdpdGh1Yl9ydW5fYXR0ZW1wdCI6IjEiLCJnaXRodWJfcnVuX2lkIjoiMjg2MjE3MTAwMyIsImdpdGh1Yl9ydW5fbnVtYmVyIjoiOCIsImdpdGh1Yl9zaGExIjoiNDY2YzExM2VkM2Q1YWM3NTY4MTc0ZDRiNmFkNmJiNmE4MGUxNTNiMiJ9fSwibWV0YWRhdGEiOnsiYnVpbGRJbnZvY2F0aW9uSUQiOiIyODYyMTcxMDAzLTEiLCJjb21wbGV0ZW5lc3MiOnsicGFyYW1ldGVycyI6dHJ1ZSwiZW52aXJvbm1lbnQiOmZhbHNlLCJtYXRlcmlhbHMiOmZhbHNlfSwicmVwcm9kdWNpYmxlIjpmYWxzZX0sIm1hdGVyaWFscyI6W3sidXJpIjoiZ2l0K2h0dHBzOi8vZ2l0aHViLmNvbS9sYXVyZW50c2ltb24vc2xzYS1vbi1naXRodWItdGVzdEByZWZzL2hlYWRzL21haW4iLCJkaWdlc3QiOnsic2hhMSI6IjQ2NmMxMTNlZDNkNWFjNzU2ODE3NGQ0YjZhZDZiYjZhODBlMTUzYjIifX1dfX0=","signatures":[{"keyid":"","sig":"MEUCIHBtbLeV5WMsyLpPrZcxFU1wuEYHFUrJnzizsg17dL4hAiEAkoTLa49Vrf/g5mSaWY6Oab99YNvqByNgR773ikJXQ5I=","cert":"-----BEGIN CERTIFICATE-----\nMIIDVDCCAtqgAwIBAgITLCk1E2/wH2/mCjCYAovMeTTHnDAKBggqhkjOPQQDAzAq\nMRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxETAPBgNVBAMTCHNpZ3N0b3JlMB4XDTIy\nMDgxNTE3MDQxMloXDTIyMDgxNTE3MTQxMVowADBZMBMGByqGSM49AgEGCCqGSM49\nAwEHA0IABCw6VO5lksfxcjt+4cEbgBnLuPB2wDgj3I9UQZh45xW4KRYKM7/oSLfD\nP8QGLfgNkv3ZDwBZUDLbBk0hNoMq0bejggIHMIICAzAOBgNVHQ8BAf8EBAMCB4Aw\nEwYDVR0lBAwwCgYIKwYBBQUHAwMwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUyxfq\nz2Pr2VR+K9FdiLbOSxqIYgQwHwYDVR0jBBgwFoAUWMAeX5FFpWapesyQoZMi0CrF\nxfowgYQGA1UdEQEB/wR6MHiGdmh0dHBzOi8vZ2l0aHViLmNvbS9zbHNhLWZyYW1l\nd29yay9zbHNhLWdpdGh1Yi1nZW5lcmF0b3IvLmdpdGh1Yi93b3JrZmxvd3MvZ2Vu\nZXJhdG9yX2dlbmVyaWNfc2xzYTMueW1sQHJlZnMvdGFncy92MS4yLjAwHwYKKwYB\nBAGDvzABAgQRd29ya2Zsb3dfZGlzcGF0Y2gwLgYKKwYBBAGDvzABBQQgbGF1cmVu\ndHNpbW9uL3Nsc2Etb24tZ2l0aHViLXRlc3QwJAYKKwYBBAGDvzABBAQWU0xTQSBn\nZW5lcmljIGdlbmVyYXRvcjAdBgorBgEEAYO/MAEGBA9yZWZzL2hlYWRzL21haW4w\nOQYKKwYBBAGDvzABAQQraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJj\nb250ZW50LmNvbTA2BgorBgEEAYO/MAEDBCg0NjZjMTEzZWQzZDVhYzc1NjgxNzRk\nNGI2YWQ2YmI2YTgwZTE1M2IyMAoGCCqGSM49BAMDA2gAMGUCMQCx4+iMpFBvnFV9\nX6goGjQfdgliPcNa4cdd2K0nmrn79cOpslyzcJLAlL/qSYsGlocCMC/P/gL2B16i\nMp6YQZUiSMwzUohrr7V3nJsMPcLgETGyiZoR3UijZG74FobZ/+3pCw==\n-----END CERTIFICATE-----\n"}]} \ No newline at end of file diff --git a/verifiers/internal/gha/verifier.go b/verifiers/internal/gha/verifier.go index ee51453..b0fcfb9 100644 --- a/verifiers/internal/gha/verifier.go +++ b/verifiers/internal/gha/verifier.go @@ -65,7 +65,7 @@ func (v *GHAVerifier) VerifyArtifact(ctx context.Context, return nil, "", err } - /* Verify properties of the SLSA provenance. */ + // Verify properties of the SLSA provenance. // Unpack and verify info in the provenance, including the Subject Digest. provenanceOpts.ExpectedBuilderID = builderID if err := VerifyProvenance(env, provenanceOpts); err != nil {