github/slsa-verifier
1
0
Fork 0
mirror of https://github.com/slsa-framework/slsa-verifier.git synced 2026-08-26 09:37:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

update link to download the binary to use the latest release (v1.2.0) (#204)

Browse Source 
Signed-off-by: cpanato <ctadeu@gmail.com>
This commit is contained in:
Carlos Tadeu Panato Junior
2022-08-10 13:42:34 +00:00
committed by GitHub
parent 4ca6320994
commit d6c68a496f
2 changed files with 2 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+2 -2
View File
@@ -36,7 +36,7 @@ $ go run . <options>
### Download the binary
Download the binary from the latest release at [https://github.com/slsa-framework/slsa-verifier/releases/tag/v1.1.1](https://github.com/slsa-framework/slsa-verifier/releases/tag/v1.1.2)
Download the binary from the latest release at [https://github.com/slsa-framework/slsa-verifier/releases/tag/v1.2.0](https://github.com/slsa-framework/slsa-verifier/releases/tag/v1.2.0)
Download the [SHA256SUM.md](https://github.com/slsa-framework/slsa-verifier/blob/main/SHA256SUM.md).
@@ -82,7 +82,7 @@ Verified build using builder https://github.com/slsa-framework/slsa-github-gener
PASSED: Verified SLSA provenance
```
The verified in-toto statement may be written to stdout with the `--print-provenance` flag to pipe into policy engines.
The verified in-toto statement may be written to stdout with the `--print-provenance` flag to pipe into policy engines.
## Technical design
RELEASE.md
-1
View File
@@ -94,4 +94,3 @@ and the hash in the pull request matches the one computed on the binary. You can
Send a similar pull request to update the hash and version of the verifier for the workflow [slsa-framework/slsa-github-generator/blob/main/.github/workflows/builder_go_slsa3.yml#L30-L31](https://github.com/slsa-framework/slsa-github-generator/blob/main/.github/workflows/builder_go_slsa3.yml#L30-L31). Explain the steps to verify the hash. If the pull request for the verifier is already merged, you can simply point to it instead.
Note: you need not cut a release for the generator, unless the verifier has important changes that are required for the builders to work properly.