Mend Renovate and GitHub
3ee6cee147
chore(deps): update github-actions ( #607 )
...
Signed-off-by: Renovate Bot <bot@renovateapp.com >
2023-06-12 09:44:31 +09:00
asraa and GitHub
3a772f79ec
test: add tests for v1.7.0 builders ( #638 )
...
* test: add tests for v1.7.0 builders
Signed-off-by: Asra Ali <asraa@google.com >
---------
Signed-off-by: Asra Ali <asraa@google.com >
2023-06-08 21:14:28 +00:00
Ian Lewis and GitHub
c39b10c4c9
fix: allow workflow_dispatch to trigger release.yml ( #637 )
...
Signed-off-by: Ian Lewis <ianlewis@google.com >
2023-06-08 22:49:25 +09:00
asraa and GitHub
733cecb300
chore: update toc in README.md ( #636 )
...
Signed-off-by: Asra Ali <asraa@google.com >
2023-06-07 09:15:51 -05:00
asraa and GitHub
aac022747e
feat: remove experimental on Sigstore bundle and v1.0 SLSA provenance format ( #634 )
...
* feat: remove experimental on Sigstore bundle and v1.0 SLSA provenance format
Signed-off-by: Asra Ali <asraa@google.com >
* docs: update verifier README.md for docker-based builder
Signed-off-by: Asra Ali <asraa@google.com >
---------
Signed-off-by: Asra Ali <asraa@google.com >
2023-06-06 22:07:20 +00:00
Ian Lewis and GitHub
8faf24c6dc
fix: builder ID verification for testing ( #635 )
...
Fix builder ID verification for testing
Signed-off-by: Ian Lewis <ianlewis@google.com >
2023-06-06 08:32:20 -05:00
laurentsimon and GitHub
7b942b8666
fix: only allow hashes of 256 bits or more ( #633 )
...
Signed-off-by: laurentsimon <laurentsimon@google.com >
2023-06-05 08:32:53 +09:00
Mend Renovate and GitHub
5ca5eb0120
fix(deps): update module github.com/sigstore/rekor to v1.2.0 [security] ( #622 )
...
Signed-off-by: Renovate Bot <bot@renovateapp.com >
2023-06-02 09:10:53 -05:00
Ian Lewis and GitHub
9bfbc91c5b
refactor: Provenance tests ( #628 )
...
Refactors GHA provenance tests to use `testProvenance` which makes it clearer what is actually being tested. This will also make it easier to support `buildType` as a way to have different verification logic as the tests no longer rely on testdata with the `"https://github.com/Attestations/GitHubActionsWorkflow@v1 "` build type, which isn't used by any supported builders.
A couple of updates to utilities:
- `VerifyTag` will now validate the ref returned by the `Provenance` instance.
- `VerifyBranch` will now validate the ref returned by the `Provenance` instance.
- `VerifyDigest` now supports the 160 bit `"sha1"` algo (FWIW) and will now search all subject entries even if one subject entry's algorithm does not match the expected algorithm.
---------
Signed-off-by: Ian Lewis <ianlewis@google.com >
2023-06-02 13:34:56 +09:00
asraa and GitHub
8fe8ee9f3f
fix: revert to using resolvedDepdendencies for source verification ( #629 )
...
Signed-off-by: Asra Ali <asraa@google.com >
2023-06-01 20:15:22 +00:00
asraa and GitHub
70d23d4f26
test: re-generate container-based tests ( #627 )
...
Signed-off-by: Asra Ali <asraa@google.com >
2023-05-30 14:38:47 -05:00
asraa and GitHub
db0560e328
fix: use ExternalParameters["source"] for the Source URI for SLSA v1.0 provenance ( #621 )
...
* feat: add support for checking a source annotation when there are multiple resolveddependencies
Signed-off-by: Asra Ali <asraa@google.com >
* revert to using external parameters source key
Signed-off-by: Asra Ali <asraa@google.com >
* unused file
Signed-off-by: Asra Ali <asraa@google.com >
---------
Signed-off-by: Asra Ali <asraa@google.com >
2023-05-27 02:28:44 +00:00
Ian Lewis and GitHub
7e2c7ae288
chore: Don't be verbose with tests locally ( #620 )
...
It can sometimes be unwieldy when running tests with the verbose flag. This changes the Makefile to run tests without the flag by default but with the flag set on GitHub Actions.
Signed-off-by: Ian Lewis <ianlewis@google.com >
2023-05-26 05:39:52 +00:00
93d3f8c06c
fix: Verify the TRW tag is a semver tag ( #619 )
...
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* Update verifiers/utils/builder.go
Co-authored-by: Ian Lewis <ianlewis@google.com >
Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com >
---------
Signed-off-by: laurentsimon <laurentsimon@google.com >
Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com >
Co-authored-by: Ian Lewis <ianlewis@google.com >
2023-05-26 01:15:32 +00:00
Ian Lewis and GitHub
de79463752
test: Add test data for v1.6.0 ( #612 )
...
---------
Signed-off-by: Ian Lewis <ianlewis@google.com >
2023-05-25 23:40:28 +00:00
laurentsimon and GitHub
fba178ea9c
feat: Use env variable to retrieve trigger workflow ( #615 )
...
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
---------
Signed-off-by: laurentsimon <laurentsimon@google.com >
2023-05-25 14:32:48 -07:00
laurentsimon and GitHub
ba32c706ac
feat: Support for v1.0 verification in BYOB ( #609 )
...
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
---------
Signed-off-by: laurentsimon <laurentsimon@google.com >
2023-05-23 07:31:13 -07:00
laurentsimon and GitHub
bda35e0238
feat: BYOB verification support ( #604 )
...
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
---------
Signed-off-by: laurentsimon <laurentsimon@google.com >
2023-05-23 01:41:17 +00:00
Mend Renovate and GitHub
a86957c6a5
chore(deps): update dependency jasmine to v5 ( #598 )
...
Signed-off-by: Renovate Bot <bot@renovateapp.com >
2023-05-15 04:14:31 +00:00
Mend Renovate and GitHub
52a48d18af
chore(deps): update github-actions ( #597 )
...
Signed-off-by: Renovate Bot <bot@renovateapp.com >
2023-05-15 04:05:12 +00:00
Mend Renovate and GitHub
ab4b6b4cc7
chore(deps): update dependency @types/node to v18.16.9 ( #596 )
...
Signed-off-by: Renovate Bot <bot@renovateapp.com >
2023-05-15 03:55:18 +00:00
1ac77fa5dc
docs: npm provenance verification from GitHub runner ( #595 )
...
Signed-off-by: laurentsimon <laurentsimon@google.com >
Signed-off-by: Ian Lewis <ianlewis@google.com >
Co-authored-by: Ian Lewis <ianlewis@google.com >
2023-05-12 03:13:22 +00:00
laurentsimon and GitHub
18ee30fca6
docs: Make npm package version and name non-optional ( #591 )
...
update
Signed-off-by: laurentsimon <laurentsimon@google.com >
2023-05-12 02:16:46 +00:00
Ian Lewis and GitHub
f59b55ef21
chore: Update SHA256SUM.md for v2.3.0 ( #592 )
...
Signed-off-by: Ian Lewis <ianlewis@google.com >
2023-05-12 08:23:56 +09:00
c9abffe4d2
chore(deps): update npm dev ( #586 )
...
Signed-off-by: Renovate Bot <bot@renovateapp.com >
Co-authored-by: Ian Lewis <ianlewis@google.com >
2023-05-10 00:48:36 +00:00
Ian Lewis and GitHub
95e6555274
docs: Add docs for npm package verification ( #587 )
...
Signed-off-by: Ian Lewis <ianlewis@google.com >
2023-05-10 00:33:29 +00:00
laurentsimon and GitHub
3a4e992444
feat: verify claims in provenance match the certificate ( #572 )
...
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
---------
Signed-off-by: laurentsimon <laurentsimon@google.com >
2023-05-09 23:52:36 +00:00
8da58c6c6d
chore(deps): update github/codeql-action action to v2.3.3 ( #585 )
...
Signed-off-by: Renovate Bot <bot@renovateapp.com >
Co-authored-by: asraa <asraa@google.com >
2023-05-08 16:30:17 +00:00
Mend Renovate and GitHub
9b6ec903b9
fix(deps): update github.com/sigstore/protobuf-specs digest to 91485b4 ( #584 )
...
Signed-off-by: Renovate Bot <bot@renovateapp.com >
2023-05-09 00:32:22 +09:00
asraa and GitHub
467e0820b6
chore: update slsa provenance to v1 ( #579 )
...
* chore: update slsa provenance to v1
Signed-off-by: Asra Ali <asraa@google.com >
* fix import path
Signed-off-by: Asra Ali <asraa@google.com >
* update dsse testcases
Signed-off-by: Asra Ali <asraa@google.com >
* fix cosign image verification in update
Signed-off-by: Asra Ali <asraa@google.com >
---------
Signed-off-by: Asra Ali <asraa@google.com >
2023-05-08 15:18:16 +00:00
sunnyyip and GitHub
030c40080b
docs(gh-action): update actions installer path ( #581 )
...
Signed-off-by: Sunny Yip <sunny@kusari.dev >
2023-05-03 09:20:04 -07:00
Ian Lewis and GitHub
88cd40e2ee
feat: Use low-perms delegator for Node.js builder ( #577 )
...
Signed-off-by: Ian Lewis <ianlewis@google.com >
2023-05-01 16:27:58 +09:00
Mend Renovate and GitHub
5c0baa4f3e
chore(deps): update npm dev ( #568 )
...
Signed-off-by: Renovate Bot <bot@renovateapp.com >
2023-05-01 11:03:55 +09:00
d67e7c1da7
feat: npm: Make package name and version mandatory for verification ( #576 )
...
Signed-off-by: laurentsimon <laurentsimon@google.com >
Co-authored-by: Ian Lewis <ianlewis@google.com >
2023-05-01 01:48:41 +00:00
Mend Renovate and GitHub
954a421526
fix(deps): update github.com/sigstore/protobuf-specs digest to 13e09aa ( #578 )
...
Signed-off-by: Renovate Bot <bot@renovateapp.com >
2023-05-01 01:35:03 +00:00
Mend Renovate and GitHub
515b41ca3f
chore(deps): update github/codeql-action action to v2.3.2 ( #569 )
...
Signed-off-by: Renovate Bot <bot@renovateapp.com >
2023-05-01 09:48:55 +09:00
Ian Lewis and GitHub
2e60ff0e48
fix: Read newer attestation file format ( #564 )
...
* Read newer attestation file format
Signed-off-by: Ian Lewis <ianlewis@google.com >
* Update error message
Signed-off-by: Ian Lewis <ianlewis@google.com >
* revert change
Signed-off-by: Ian Lewis <ianlewis@google.com >
* Update test data
Signed-off-by: Ian Lewis <ianlewis@google.com >
---------
Signed-off-by: Ian Lewis <ianlewis@google.com >
2023-04-21 07:38:16 +09:00
c0cadc0117
feat: support for BYOB verification ( #562 )
...
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* Update verifiers/internal/gha/provenance.go
Co-authored-by: Ian Lewis <ianlewis@google.com >
Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
---------
Signed-off-by: laurentsimon <laurentsimon@google.com >
Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com >
Co-authored-by: Ian Lewis <ianlewis@google.com >
2023-04-19 19:07:27 +00:00
0a7e71cb09
fix(deps): update github.com/sigstore/protobuf-specs digest to b6d2576 ( #559 )
...
Signed-off-by: Renovate Bot <bot@renovateapp.com >
Co-authored-by: Ian Lewis <ianlewis@google.com >
2023-04-19 13:34:26 +09:00
fb0810e150
chore(deps): update gcr.io/distroless/base:nonroot docker digest to 42311d8 ( #504 )
...
Signed-off-by: Renovate Bot <bot@renovateapp.com >
Co-authored-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com >
Co-authored-by: Ian Lewis <ianlewis@google.com >
2023-04-18 15:50:54 +09:00
a21c8747a4
chore(deps): update golang:1.19 docker digest to 9f2dd04 ( #516 )
...
Signed-off-by: Renovate Bot <bot@renovateapp.com >
Co-authored-by: Ian Lewis <ianlewis@google.com >
2023-04-18 02:03:18 +00:00
Mend Renovate and GitHub
e1ea1da472
chore(deps): update github-actions ( #560 )
...
Signed-off-by: Renovate Bot <bot@renovateapp.com >
2023-04-18 10:52:54 +09:00
Ian Lewis and GitHub
b5000ebfc0
fix: Slack badge ( #558 )
...
Fix slack badge
Signed-off-by: Ian Lewis <ianlewis@google.com >
2023-04-14 10:04:31 +09:00
62c0dfdde9
docs: Update docs for 2.2.0 release. ( #556 )
...
* Update SHA256SUM.md
Signed-off-by: Ian Lewis <ianlewis@google.com >
* Update version in docs
Signed-off-by: Ian Lewis <ianlewis@google.com >
---------
Signed-off-by: Ian Lewis <ianlewis@google.com >
Co-authored-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com >
2023-04-13 19:15:15 +00:00
asraa and GitHub
1bbdd661a8
docs: remove duplicated table of contents ( #557 )
...
* docs: remove duplicated table of contents
Signed-off-by: Asra Ali <asraa@google.com >
* fix action installation list
Signed-off-by: Asra Ali <asraa@google.com >
---------
Signed-off-by: Asra Ali <asraa@google.com >
2023-04-13 11:43:18 -07:00
623cf20a23
fix(deps): update npm ( #535 )
...
* fix(deps): update npm
---------
Signed-off-by: Renovate Bot <bot@renovateapp.com >
Signed-off-by: Ian Lewis <ianlewis@google.com >
Co-authored-by: Ian Lewis <ianlewis@google.com >
2023-04-11 13:41:24 +09:00
e7279e828e
docs: Update README.md ( #541 )
...
Update README.md
Adding an alternative option for installing slsa-verifier if you do not rely on additional tooling. The benefit of this option is improved readability.
Signed-off-by: Drew Roen <102626803+drewroengoogle@users.noreply.github.com >
Co-authored-by: Ian Lewis <ianlewis@google.com >
2023-04-11 02:24:36 +00:00
9c3152fe9f
chore(deps): update github-actions ( #544 )
...
Signed-off-by: Renovate Bot <bot@renovateapp.com >
Co-authored-by: Ian Lewis <ianlewis@google.com >
2023-04-11 02:09:29 +00:00
84c3bbdd84
chore(deps): update npm dev ( #534 )
...
Signed-off-by: Renovate Bot <bot@renovateapp.com >
Co-authored-by: Ian Lewis <ianlewis@google.com >
2023-04-11 10:57:38 +09:00
6137b13c0e
fix(deps): update github.com/sigstore/protobuf-specs digest to 4dbf10b ( #553 )
...
Signed-off-by: Renovate Bot <bot@renovateapp.com >
Co-authored-by: Ian Lewis <ianlewis@google.com >
2023-04-11 00:20:40 +00:00
Mend RenovateandGitHub
asraaandGitHub
Ian LewisandGitHub
laurentsimonandGitHub
sunnyyipandGitHub
