github/slsa-verifier
1
0
Fork 0
mirror of https://github.com/slsa-framework/slsa-verifier.git synced 2026-05-14 04:26:41 +00:00
Code Issues Packages Projects Releases Wiki Activity

builder name (#37)

Browse Source
This commit is contained in:
laurentsimon
2022-04-25 09:23:54 -07:00
committed by GitHub
parent 2400fc0838
commit 8e3c3a760c
1 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
pkg/provenance.go
View File

@@ -42,10 +42,14 @@ import (
const (
defaultRekorAddr = "https://rekor.sigstore.dev"
certOidcIssuer = "https://token.actions.githubusercontent.com"
// TODO: Make this into a list.
trustedReusableWorkflow = "slsa-framework/slsa-github-generator-go/.github/workflows/builder.yml"
)
// TODO: remove builder.yml
var trustedReusableWorkflows = map[string]bool{
"slsa-framework/slsa-github-generator-go/.github/workflows/slsa3_builder.yml": true,
"slsa-framework/slsa-github-generator-go/.github/workflows/builder.yml": true,
}
var (
ErrorInvalidDssePayload = errors.New("invalid DSSE envelope payload")
errorRekorSearch = errors.New("error searching rekor entries")
@@ -377,7 +381,7 @@ func VerifyWorkflowIdentity(id *WorkflowIdentity, source string) error {
return errors.New("malformed URI for workflow")
}
if !strings.EqualFold(strings.Trim(workflowPath[0], "/"), trustedReusableWorkflow) {
if _, ok := trustedReusableWorkflows[strings.Trim(workflowPath[0], "/")]; !ok {
return errors.New("untrusted reuseable workflow")
}