Ramon Petgrave
17f79583c5
fix: fix method for getting leaf certs in Bundle v0.3 ( #813 )
...
Followup to
https://github.com/slsa-framework/slsa-github-generator/pull/3777
This PR adds a missing modification for getting the leaf certificate in
the new Bundle format v0.3.
In my original experiments, I did have this method in a dev branch, but
neglected to include it in the final PR.
-
https://github.com/slsa-framework/slsa-verifier/compare/main...verify-sigstore-go-Bundlev3#diff-a9bfffae1bd0d145e950805e7a35b8e65adc7a68affa605b484f4831097b989cR98-R107
- https://github.com/slsa-framework/slsa-verifier/pull/799/files
## Testing
- I re-used the same attestation file from a failing workflow for unit
tests and manual invocation.
-
https://github.com/slsa-framework/example-package/actions/runs/11511156484
## Followup
- Finish finding a way to test changes within PRs.
-
https://github.com/slsa-framework/slsa-github-generator/pull/3777#discussion_r1795254767
- https://github.com/slsa-framework/slsa-verifier/pull/797
---------
Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com >
2024-10-29 16:43:56 -04:00
Ramon Petgrave
4cd7d4802e
chore: update go and golanci lint ( #810 )
...
This PR updates go to 1.23.1 and updates golanci-lint to v1.61.1, while
fixing new lint errors.
---------
Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com >
Signed-off-by: Ramon Petgrave <32398091+ramonpetgrave64@users.noreply.github.com >
2024-10-10 13:07:08 -04:00
Ramon Petgrave
767ecf9e0a
feat: handle dssev001 tlog entry types ( #799 )
...
re: https://github.com/slsa-framework/slsa-github-generator/issues/3750
Rekor TLog entries can now be of the type dsse v0.0.1, as when what's
returned when using sigstore-go's `Bundle()`.
This is to support eventual Sigstore Bundles produced by
slsa-github-generator's "generic" generator, which will likely use
sigstore-go's Bundle to produce attestations
-
https://github.com/slsa-framework/slsa-github-generator/compare/main...ramonpetgrave64-internal-builder-sigstore-bundlev2#diff-b186a0c5d9ae459b11b694f05455568453699670926d21cad06cafec3dbf895eR101
-
https://github.com/slsa-framework/slsa-github-generator/actions/runs/10359750833
## Tesing
- Added unit tests with stub data
- manual invocations to very both new and old attestations and bundles,
with some modifications for testing purposes
-
https://github.com/slsa-framework/slsa-verifier/compare/main...verify-sigstore-go-Bundlev3#diff-94741068472ee694a12811cd704179dd478a9fa20a3bf45cf6ea2d4406214dc2R179
## Followup
Finish the work to produce bundles from the generic generators
-
https://github.com/slsa-framework/slsa-github-generator/compare/main...ramonpetgrave64-internal-builder-sigstore-bundlev2#diff-b186a0c5d9ae459b11b694f05455568453699670926d21cad06cafec3dbf895eR101
---------
Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com >
Signed-off-by: Ramon Petgrave <32398091+ramonpetgrave64@users.noreply.github.com >
2024-08-24 03:31:43 +00:00
Ramon Petgrave
c789437815
feat: refactor: use sigstore-go for fetching TrustedRoot ( #791 )
...
Uses the `sigstore-go` library for fetching the `TrustedRoot`, which
contains the Sigstore infrastructure certificates needed to validate the
leaf ephemeral certificates used to sign artifacts.
Refactors:
- replace `TrustedRootSingleton()` with `getDefaultCosignCheckOpts()`,
since only `VerifyImage()` will now need that data.
- replace `cosign.ValidateAndUnpackCert`
with`sigstoreVerify.VerifyLeafCertificate()`
- use `sync.Once` for sigstore and rekor clients, and the `TrustedRoot`
## Testing
- existing tests continue to pass
- [negative tests
](https://github.com/slsa-framework/slsa-verifier/blob/d96b9777090694fa5096ee1b9c710a46b5a66f5e/cli/slsa-verifier/main_regression_test.go#L450-L471 )
against rekor TLogs
- manual invocations of `verify-artifact`.
---------
Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com >
2024-08-02 21:47:50 +00:00
laurentsimon
3a4e992444
feat: verify claims in provenance match the certificate ( #572 )
...
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
---------
Signed-off-by: laurentsimon <laurentsimon@google.com >
2023-05-09 23:52:36 +00:00
asraa
362bd1a331
feat: add offline bundle signature verification ( #457 )
...
* feat: add bundle signature verification
Signed-off-by: Asra Ali <asraa@google.com >
2023-02-03 09:31:40 -06:00
Ramon Petgrave
laurentsimon
asraa