Appu and Ramon Petgrave
a481a1974e
feat: verify provenance for bcr modules produced by trusted reusable workflows ( #840 )
...
@fweikert these are the changes I think might be needed to get this to
work (it's somewhat hacky, I'm not sure I've fully covered what's
needed).
@ramonpetgrave64 is this kinda what's needed?
This now adds the `verify-github-attestation` sub command. Use this
instead of `verify-artifact`.
---------
Signed-off-by: Appu Goundan <appu@google.com >
Signed-off-by: Appu <appu@google.com >
Co-authored-by: Ramon Petgrave <32398091+ramonpetgrave64@users.noreply.github.com >
2025-04-10 14:09:09 -04:00
Ramon Petgrave
4cd7d4802e
chore: update go and golanci lint ( #810 )
...
This PR updates go to 1.23.1 and updates golanci-lint to v1.61.1, while
fixing new lint errors.
---------
Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com >
Signed-off-by: Ramon Petgrave <32398091+ramonpetgrave64@users.noreply.github.com >
2024-10-10 13:07:08 -04:00
Ramon Petgrave
ceaebee236
fix : #642 : don't use go-cmp for outputting diff ( #737 )
...
Previously we used the go-cmp's Diff for displaying a human-friendly
diff between two structs in an error message.
I had intended to do a json print of the structs and do a line-by-line
diff. There is an internal library for calculating text diff, but I
don't see any external functions that expose it to make it available for
our use: https://pkg.go.dev/golang.org/x/tools/internal/diff
Instead, this we will simply display both structs in their own "actual"
and "expected" sections. The user can use their other tools to find a
human-friendly diff.
Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com >
2024-01-17 10:05:28 -08:00
laurentsimon and Ian Lewis
58eede7e66
feat: gcb v1.0 support ( #691 )
...
closes https://github.com/slsa-framework/slsa-verifier/issues/683
This is a large PR, but there is not much new code.
The code adding support for v1.0 is under:
- verifiers/internal/gcb/slsaprovenance/v1.0/*
- verifiers/internal/gcb/slsaprovenance/provenance.go
The rest is mostly some re-factoring needed
Remaining is regression tests, tracked in
https://github.com/slsa-framework/slsa-verifier/issues/690
---------
Signed-off-by: laurentsimon <laurentsimon@google.com >
Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com >
Co-authored-by: Ian Lewis <ianlewis@google.com >
2023-08-18 17:32:58 +00:00
laurentsimon and Ian Lewis
9aef8ff8aa
feat: GCB refactor for v1.0 support ( #682 )
...
In anticipation for GCB's v1.0 support, this PR re-factors the code to
look similar to GHA's code
---------
Signed-off-by: laurentsimon <laurentsimon@google.com >
Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com >
Co-authored-by: Ian Lewis <ianlewis@google.com >
2023-08-15 18:15:49 +00:00
asraa
467e0820b6
chore: update slsa provenance to v1 ( #579 )
...
* chore: update slsa provenance to v1
Signed-off-by: Asra Ali <asraa@google.com >
* fix import path
Signed-off-by: Asra Ali <asraa@google.com >
* update dsse testcases
Signed-off-by: Asra Ali <asraa@google.com >
* fix cosign image verification in update
Signed-off-by: Asra Ali <asraa@google.com >
---------
Signed-off-by: Asra Ali <asraa@google.com >
2023-05-08 15:18:16 +00:00
laurentsimon and Ian Lewis
c0cadc0117
feat: support for BYOB verification ( #562 )
...
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* Update verifiers/internal/gha/provenance.go
Co-authored-by: Ian Lewis <ianlewis@google.com >
Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
---------
Signed-off-by: laurentsimon <laurentsimon@google.com >
Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com >
Co-authored-by: Ian Lewis <ianlewis@google.com >
2023-04-19 19:07:27 +00:00
laurentsimon
37e3b406cb
feat: GCB tag and versioned-tag support for containers ( #540 )
...
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
---------
Signed-off-by: laurentsimon <laurentsimon@google.com >
2023-03-23 16:57:34 +00:00
laurentsimon and Ian Lewis
ae38103ecf
feat: verify sourceURI for npm packages ( #521 )
...
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* Update verifiers/internal/gha/provenance.go
Co-authored-by: Ian Lewis <ianlewis@google.com >
Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
---------
Signed-off-by: laurentsimon <laurentsimon@google.com >
Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com >
Co-authored-by: Ian Lewis <ianlewis@google.com >
2023-03-10 17:13:29 +00:00
asraa
5a77b25fb4
fix: fix GCB verification with git material source prefix ( #519 )
...
Signed-off-by: Asra Ali <asraa@google.com >
2023-03-09 10:00:19 +09:00
Kevin Halk
47495c7d5b
feat: Update SLSA verifier to support a global signing key for GCB V1 which… ( #509 )
...
* Update SLSA verifier to support a global signing key for GCB V1 which creates the signature in a DSSE-conformant PAE format
- new public key for "global PAE signing key"
- test data and unit tests
Signed-off-by: Kevin Halk <khalk@google.com >
* Update SLSA verifier to support a global signing key for GCB V1 which creates the signature in a DSSE-conformant PAE format
- new public key for "global PAE signing key"
- test data and unit tests
Signed-off-by: Kevin Halk <khalk@google.com >
* Update SLSA verifier to support a global signing key for GCB V1 which creates the signature in a DSSE-conformant PAE format
- new public key for "global PAE signing key"
- test data and unit tests
Signed-off-by: Kevin Halk <khalk@google.com >
* Update SLSA verifier to support a global signing key for GCB V1 which creates the signature in a DSSE-conformant PAE format
- new public key for "global PAE signing key"
- test data and unit tests
Signed-off-by: Kevin Halk <khalk@google.com >
* Update SLSA verifier to support a global signing key for GCB V1 which creates the signature in a DSSE-conformant PAE format
- new public key for "global PAE signing key"
- test data and unit tests
Signed-off-by: Kevin Halk <khalk@google.com >
* Update SLSA verifier to support a global signing key for GCB V1 which creates the signature in a DSSE-conformant PAE format
- new public key for "global PAE signing key"
- test data and unit tests
Signed-off-by: Kevin Halk <khalk@google.com >
* Update SLSA verifier to support a global signing key for GCB V1 which creates the signature in a DSSE-conformant PAE format
- new public key for "global PAE signing key"
- test data and unit tests
Signed-off-by: Kevin Halk <khalk@google.com >
---------
Signed-off-by: Kevin Halk <khalk@google.com >
2023-03-06 16:02:30 +00:00
laurentsimon
82a12591ff
feat: npm default runner support ( #495 )
...
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
---------
Signed-off-by: laurentsimon <laurentsimon@google.com >
2023-03-02 21:53:29 +00:00
asraa
bcd23c945e
chore: enable some Go linters ( #456 )
...
* enable deadcode
Signed-off-by: Asra Ali <asraa@google.com >
* enable unconvert
Signed-off-by: Asra Ali <asraa@google.com >
* enable thelper
Signed-off-by: Asra Ali <asraa@google.com >
* enable stylecheck
Signed-off-by: Asra Ali <asraa@google.com >
* enable misspell
Signed-off-by: Asra Ali <asraa@google.com >
* enable gocritic
Signed-off-by: Asra Ali <asraa@google.com >
* enable godot
Signed-off-by: Asra Ali <asraa@google.com >
* enable staticcheck
Signed-off-by: Asra Ali <asraa@google.com >
* address experimental deadcode
Signed-off-by: Asra Ali <asraa@google.com >
Signed-off-by: Asra Ali <asraa@google.com >
2023-01-25 19:51:10 +00:00
laurentsimon
4a6c5b1677
feat: add more tests for GCB verification ( #389 )
...
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
Signed-off-by: laurentsimon <laurentsimon@google.com >
2022-12-05 13:31:58 -08:00
Ian Lewis
267242e153
fix: Fix error check for decodeSignature ( #385 )
...
Signed-off-by: Ian Lewis <ianmlewis@gmail.com >
Signed-off-by: Ian Lewis <ianmlewis@gmail.com >
2022-12-03 11:05:56 -08:00
laurentsimon and asraa
b9058c5596
docs: Add comment for signature decoding ( #380 )
...
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* Update verifiers/internal/gcb/provenance.go
Co-authored-by: asraa <asraa@google.com >
Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com >
Signed-off-by: laurentsimon <laurentsimon@google.com >
Signed-off-by: laurentsimon <laurentsimon@google.com >
Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com >
Co-authored-by: asraa <asraa@google.com >
2022-12-02 19:34:29 +00:00
Shunsuke Suzuki
74fd528309
fix: fix the Go package version to v2 ( #373 )
...
* fix: fix the package version to v2
```
git ls-files | grep ".go$" | xargs -n 1 gsed -i "s|github.com/slsa-framework/slsa-verifier|github.com/slsa-framework/slsa-verifier/v2|g"
```
Signed-off-by: Shunsuke Suzuki <suzuki.shunsuke.1989@gmail.com >
* fix: fix the package version to v2
Signed-off-by: Shunsuke Suzuki <suzuki.shunsuke.1989@gmail.com >
* test: fix source
Signed-off-by: Shunsuke Suzuki <suzuki.shunsuke.1989@gmail.com >
Signed-off-by: Shunsuke Suzuki <suzuki.shunsuke.1989@gmail.com >
2022-12-01 18:49:39 -08:00
asraa
e9cd6b763c
fix: address gcb verifier comments and add gcb documentation ( #300 )
...
* address gcb verifier comments
Signed-off-by: Asra Ali <asraa@google.com >
2022-10-21 21:06:22 +00:00
asraa
a6e069c0ab
gcb: add gcb compatibility ( #292 )
...
Signed-off-by: Asra Ali <asraa@google.com >
Signed-off-by: Asra Ali <asraa@google.com >
2022-10-07 14:21:50 -07:00
laurentsimon
533d347a4b
feat: support builderID matching with or without semver for GHA ( #257 )
...
* update
* update
* update
* update
* update
* update
* update
* update
* update
* update
* update
* update
* update
* update
* update
* update
* update
* update
* update
* update
2022-09-15 14:32:03 -07:00
laurentsimon
b58e752378
feat: support builderID matching with or without semver for GCB ( #256 )
...
* update
* update
* update
* update
* update
* update
* update
* update
* update
* update
* update
* update
* update
* update
* update
* update
* update
* update
* update
* update
2022-09-12 17:17:46 -07:00
laurentsimon
d12dce9526
feat: CLI tests for GCB verification ( #251 )
...
* update
* update
* update
2022-09-08 13:36:56 -07:00
laurentsimon
e0edc0c46f
feat: support for GCB v0.3 verification ( #248 )
...
* update
* update
* update
* update
2022-09-06 23:54:59 +00:00
laurentsimon
0c543fcce0
update ( #244 )
2022-09-01 01:00:56 +00:00
laurentsimon
26c928f5b7
Verify text provenance for GCB ( #242 )
...
* update
* update
* update
* update
* update
* comments
* comments
2022-08-30 23:08:46 +00:00
laurentsimon and Asra Ali
3b5c68f561
feat: Support for GCB verification ( #202 )
...
* add testing folder
Signed-off-by: Asra Ali <asraa@google.com >
* add tests
Signed-off-by: Asra Ali <asraa@google.com >
* update
* updated comments
Signed-off-by: Asra Ali <asraa@google.com >
* update
* update
* update
* update
* update
* update
* update
* draft
* update
* update
* update
* update
* update
* update
* update
* update
* update
* update
Signed-off-by: Asra Ali <asraa@google.com >
Co-authored-by: Asra Ali <asraa@google.com >
2022-08-24 10:17:14 -07:00
asraa and laurentsimon
7b4b9cde06
feat: support oci image verification ( #147 )
...
* feat: support oci image verification
Signed-off-by: Asra Ali <asraa@google.com >
* add testing folder
Signed-off-by: Asra Ali <asraa@google.com >
* update name and make fix
Signed-off-by: Asra Ali <asraa@google.com >
* add tests
Signed-off-by: Asra Ali <asraa@google.com >
* Add initial testing
Signed-off-by: Asra Ali <asraa@google.com >
* updated comments
Signed-off-by: Asra Ali <asraa@google.com >
* update
Signed-off-by: Asra Ali <asraa@google.com >
* fix digest calculation
Signed-off-by: Asra Ali <asraa@google.com >
Signed-off-by: Asra Ali <asraa@google.com >
Co-authored-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com >
2022-08-17 15:59:01 -05:00
laurentsimon
edb792b342
feat: Create interface for verifiers ( #187 )
...
* update
* update
* unit tests
* update
* comments
* update
* update
* update
* update
* Use interface for builders
* update
* update
* update
* update
* fix
* update
* update
* update
* update
* update
* update
* update
* update
* update
* update
* update
* update
2022-08-05 14:31:34 -07:00
AppuandRamon Petgrave
laurentsimonandIan Lewis
asraa
Kevin Halk
Shunsuke Suzuki