Ramon Petgrave and GitHub
17f79583c5
fix: fix method for getting leaf certs in Bundle v0.3 ( #813 )
...
Followup to
https://github.com/slsa-framework/slsa-github-generator/pull/3777
This PR adds a missing modification for getting the leaf certificate in
the new Bundle format v0.3.
In my original experiments, I did have this method in a dev branch, but
neglected to include it in the final PR.
-
https://github.com/slsa-framework/slsa-verifier/compare/main...verify-sigstore-go-Bundlev3#diff-a9bfffae1bd0d145e950805e7a35b8e65adc7a68affa605b484f4831097b989cR98-R107
- https://github.com/slsa-framework/slsa-verifier/pull/799/files
## Testing
- I re-used the same attestation file from a failing workflow for unit
tests and manual invocation.
-
https://github.com/slsa-framework/example-package/actions/runs/11511156484
## Followup
- Finish finding a way to test changes within PRs.
-
https://github.com/slsa-framework/slsa-github-generator/pull/3777#discussion_r1795254767
- https://github.com/slsa-framework/slsa-verifier/pull/797
---------
Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com >
2024-10-29 16:43:56 -04:00
f6ae402f45
fix: npm publish verification ( #705 )
...
- adding support for IEEE P1363 formatted signatures
- fix the npm publish attestation bug. The verification always return
success, because it was not using PAE signature
---------
Signed-off-by: laurentsimon <laurentsimon@google.com >
Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com >
Co-authored-by: Ian Lewis <ianlewis@google.com >
Co-authored-by: Trishank Karthik Kuppusamy <trishank.kuppusamy@datadoghq.com >
2023-10-02 10:12:51 -07:00
8bcf1f0525
feat: Non-compulsory BuilderID for BYOB Builders ( #674 )
...
/cc @mihaimaruseac
/cc @laurentsimon
Based off the prefix of the BuilderID within the provenance, if the
builder use to build the artifact is one of the BYOB builders of
slsa-framework/slsa-github-generator repo, the --builderid flag is not
need and is handled automatically. This was done to increase access to
users since before the automatic pickup of the builder-id would get the
delegator.
Test cases that cover verifyProvenance will need to be complete after
the v1.8.0 release of slsa-framework/slsa-github-generator.
The main structure that is changed is the ExpectedBuilderPath is
hardcoded now to slsa-framework builders within
`/cli/slsa-verifier/verify/verify_artifact.go `. This can later be
changed now if needed to be an input like the other fields of
`provenanceOpts` populated during `verify_artifact.go`. The added
function within `provenance.go`, `verifyBuilderIDPath` is called during
`verifyProvenance` to check this path within `provenanceOpts`. Upon
failure of this function, expected and received BuilderID's are also
outputted.
closes #659
makes use of discussion on closed pr #673
---------
Signed-off-by: Noah Elzner <elzner@google.com >
Signed-off-by: Noah Elzner <78953604+enteraga6@users.noreply.github.com >
Co-authored-by: Ian Lewis <ianlewis@google.com >
Co-authored-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com >
2023-08-11 14:20:58 +00:00
Ian Lewis and GitHub
90f4f23e1e
test: Add more ProvenanceFromEnvelope tests ( #640 )
...
Fixes #573
---------
Signed-off-by: Ian Lewis <ianlewis@google.com >
2023-06-26 02:03:34 +00:00
Ian Lewis and GitHub
9bfbc91c5b
refactor: Provenance tests ( #628 )
...
Refactors GHA provenance tests to use `testProvenance` which makes it clearer what is actually being tested. This will also make it easier to support `buildType` as a way to have different verification logic as the tests no longer rely on testdata with the `"https://github.com/Attestations/GitHubActionsWorkflow@v1 "` build type, which isn't used by any supported builders.
A couple of updates to utilities:
- `VerifyTag` will now validate the ref returned by the `Provenance` instance.
- `VerifyBranch` will now validate the ref returned by the `Provenance` instance.
- `VerifyDigest` now supports the 160 bit `"sha1"` algo (FWIW) and will now search all subject entries even if one subject entry's algorithm does not match the expected algorithm.
---------
Signed-off-by: Ian Lewis <ianlewis@google.com >
2023-06-02 13:34:56 +09:00
laurentsimon and GitHub
3a4e992444
feat: verify claims in provenance match the certificate ( #572 )
...
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
---------
Signed-off-by: laurentsimon <laurentsimon@google.com >
2023-05-09 23:52:36 +00:00
asraa and GitHub
467e0820b6
chore: update slsa provenance to v1 ( #579 )
...
* chore: update slsa provenance to v1
Signed-off-by: Asra Ali <asraa@google.com >
* fix import path
Signed-off-by: Asra Ali <asraa@google.com >
* update dsse testcases
Signed-off-by: Asra Ali <asraa@google.com >
* fix cosign image verification in update
Signed-off-by: Asra Ali <asraa@google.com >
---------
Signed-off-by: Asra Ali <asraa@google.com >
2023-05-08 15:18:16 +00:00
Ian Lewis and GitHub
2e60ff0e48
fix: Read newer attestation file format ( #564 )
...
* Read newer attestation file format
Signed-off-by: Ian Lewis <ianlewis@google.com >
* Update error message
Signed-off-by: Ian Lewis <ianlewis@google.com >
* revert change
Signed-off-by: Ian Lewis <ianlewis@google.com >
* Update test data
Signed-off-by: Ian Lewis <ianlewis@google.com >
---------
Signed-off-by: Ian Lewis <ianlewis@google.com >
2023-04-21 07:38:16 +09:00
laurentsimon and GitHub
82a12591ff
feat: npm default runner support ( #495 )
...
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
---------
Signed-off-by: laurentsimon <laurentsimon@google.com >
2023-03-02 21:53:29 +00:00
asraa and GitHub
5d6c770d43
feat: support branch and tag from slsa v1 provenance ( #476 )
...
* feat: support branch and tag from slsa v1 provenance
Signed-off-by: Asra Ali <asraa@google.com >
Signed-off-by: Asra Ali <asraa@google.com >
2023-02-10 21:33:16 +00:00
asraa and GitHub
239c4489ce
feat: add slsa v1?draft provenance experimental support ( #470 )
...
* feat: add slsa v1?draft provenance support
Signed-off-by: Asra Ali <asraa@google.com >
Signed-off-by: Asra Ali <asraa@google.com >
2023-02-09 17:21:15 +00:00
asraa and GitHub
fec5b6a7b5
refactor: generalize provenance out of predicate type info ( #463 )
...
* refactor: generalize provenance out of predicate type info
Signed-off-by: Asra Ali <asraa@google.com >
2023-02-03 23:30:23 +00:00
asraa and GitHub
362bd1a331
feat: add offline bundle signature verification ( #457 )
...
* feat: add bundle signature verification
Signed-off-by: Asra Ali <asraa@google.com >
2023-02-03 09:31:40 -06:00
laurentsimon and GitHub
5bb13ef508
feat: add a -workflow-input option ( #216 )
...
* update
2022-08-15 19:38:15 +00:00
4ca6320994
feat: make branch optional ( #192 )
...
* update
* update
* update
* update
* Update verifiers/internal/gha/provenance.go
Co-authored-by: Ian Lewis <ianlewis@google.com >
* update
* update
* update
* update
* update
* update
* update
* update
Co-authored-by: Ian Lewis <ianlewis@google.com >
2022-08-09 22:49:36 +00:00
laurentsimon and GitHub
edb792b342
feat: Create interface for verifiers ( #187 )
...
* update
* update
* unit tests
* update
* comments
* update
* update
* update
* update
* Use interface for builders
* update
* update
* update
* update
* fix
* update
* update
* update
* update
* update
* update
* update
* update
* update
* update
* update
* update
2022-08-05 14:31:34 -07:00
Ramon PetgraveandGitHub
asraaandGitHub