Mend Renovate
5ca5eb0120
fix(deps): update module github.com/sigstore/rekor to v1.2.0 [security] ( #622 )
...
Signed-off-by: Renovate Bot <bot@renovateapp.com >
2023-06-02 09:10:53 -05:00
Ian Lewis
9bfbc91c5b
refactor: Provenance tests ( #628 )
...
Refactors GHA provenance tests to use `testProvenance` which makes it clearer what is actually being tested. This will also make it easier to support `buildType` as a way to have different verification logic as the tests no longer rely on testdata with the `"https://github.com/Attestations/GitHubActionsWorkflow@v1 "` build type, which isn't used by any supported builders.
A couple of updates to utilities:
- `VerifyTag` will now validate the ref returned by the `Provenance` instance.
- `VerifyBranch` will now validate the ref returned by the `Provenance` instance.
- `VerifyDigest` now supports the 160 bit `"sha1"` algo (FWIW) and will now search all subject entries even if one subject entry's algorithm does not match the expected algorithm.
---------
Signed-off-by: Ian Lewis <ianlewis@google.com >
2023-06-02 13:34:56 +09:00
asraa
8fe8ee9f3f
fix: revert to using resolvedDepdendencies for source verification ( #629 )
...
Signed-off-by: Asra Ali <asraa@google.com >
2023-06-01 20:15:22 +00:00
asraa
70d23d4f26
test: re-generate container-based tests ( #627 )
...
Signed-off-by: Asra Ali <asraa@google.com >
2023-05-30 14:38:47 -05:00
asraa
db0560e328
fix: use ExternalParameters["source"] for the Source URI for SLSA v1.0 provenance ( #621 )
...
* feat: add support for checking a source annotation when there are multiple resolveddependencies
Signed-off-by: Asra Ali <asraa@google.com >
* revert to using external parameters source key
Signed-off-by: Asra Ali <asraa@google.com >
* unused file
Signed-off-by: Asra Ali <asraa@google.com >
---------
Signed-off-by: Asra Ali <asraa@google.com >
2023-05-27 02:28:44 +00:00
Ian Lewis
7e2c7ae288
chore: Don't be verbose with tests locally ( #620 )
...
It can sometimes be unwieldy when running tests with the verbose flag. This changes the Makefile to run tests without the flag by default but with the flag set on GitHub Actions.
Signed-off-by: Ian Lewis <ianlewis@google.com >
2023-05-26 05:39:52 +00:00
laurentsimon and Ian Lewis
93d3f8c06c
fix: Verify the TRW tag is a semver tag ( #619 )
...
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* Update verifiers/utils/builder.go
Co-authored-by: Ian Lewis <ianlewis@google.com >
Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com >
---------
Signed-off-by: laurentsimon <laurentsimon@google.com >
Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com >
Co-authored-by: Ian Lewis <ianlewis@google.com >
2023-05-26 01:15:32 +00:00
Ian Lewis
de79463752
test: Add test data for v1.6.0 ( #612 )
...
---------
Signed-off-by: Ian Lewis <ianlewis@google.com >
2023-05-25 23:40:28 +00:00
laurentsimon
fba178ea9c
feat: Use env variable to retrieve trigger workflow ( #615 )
...
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
---------
Signed-off-by: laurentsimon <laurentsimon@google.com >
2023-05-25 14:32:48 -07:00
laurentsimon
ba32c706ac
feat: Support for v1.0 verification in BYOB ( #609 )
...
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
---------
Signed-off-by: laurentsimon <laurentsimon@google.com >
2023-05-23 07:31:13 -07:00
laurentsimon
bda35e0238
feat: BYOB verification support ( #604 )
...
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
---------
Signed-off-by: laurentsimon <laurentsimon@google.com >
2023-05-23 01:41:17 +00:00
Mend Renovate
a86957c6a5
chore(deps): update dependency jasmine to v5 ( #598 )
...
Signed-off-by: Renovate Bot <bot@renovateapp.com >
2023-05-15 04:14:31 +00:00
Mend Renovate
52a48d18af
chore(deps): update github-actions ( #597 )
...
Signed-off-by: Renovate Bot <bot@renovateapp.com >
2023-05-15 04:05:12 +00:00
Mend Renovate
ab4b6b4cc7
chore(deps): update dependency @types/node to v18.16.9 ( #596 )
...
Signed-off-by: Renovate Bot <bot@renovateapp.com >
2023-05-15 03:55:18 +00:00
laurentsimon and Ian Lewis
1ac77fa5dc
docs: npm provenance verification from GitHub runner ( #595 )
...
Signed-off-by: laurentsimon <laurentsimon@google.com >
Signed-off-by: Ian Lewis <ianlewis@google.com >
Co-authored-by: Ian Lewis <ianlewis@google.com >
2023-05-12 03:13:22 +00:00
laurentsimon
18ee30fca6
docs: Make npm package version and name non-optional ( #591 )
...
update
Signed-off-by: laurentsimon <laurentsimon@google.com >
2023-05-12 02:16:46 +00:00
Ian Lewis
f59b55ef21
chore: Update SHA256SUM.md for v2.3.0 ( #592 )
...
Signed-off-by: Ian Lewis <ianlewis@google.com >
2023-05-12 08:23:56 +09:00
Mend Renovate and Ian Lewis
c9abffe4d2
chore(deps): update npm dev ( #586 )
...
Signed-off-by: Renovate Bot <bot@renovateapp.com >
Co-authored-by: Ian Lewis <ianlewis@google.com >
2023-05-10 00:48:36 +00:00
Ian Lewis
95e6555274
docs: Add docs for npm package verification ( #587 )
...
Signed-off-by: Ian Lewis <ianlewis@google.com >
2023-05-10 00:33:29 +00:00
laurentsimon
3a4e992444
feat: verify claims in provenance match the certificate ( #572 )
...
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
---------
Signed-off-by: laurentsimon <laurentsimon@google.com >
2023-05-09 23:52:36 +00:00
Mend Renovate and asraa
8da58c6c6d
chore(deps): update github/codeql-action action to v2.3.3 ( #585 )
...
Signed-off-by: Renovate Bot <bot@renovateapp.com >
Co-authored-by: asraa <asraa@google.com >
2023-05-08 16:30:17 +00:00
Mend Renovate
9b6ec903b9
fix(deps): update github.com/sigstore/protobuf-specs digest to 91485b4 ( #584 )
...
Signed-off-by: Renovate Bot <bot@renovateapp.com >
2023-05-09 00:32:22 +09:00
asraa
467e0820b6
chore: update slsa provenance to v1 ( #579 )
...
* chore: update slsa provenance to v1
Signed-off-by: Asra Ali <asraa@google.com >
* fix import path
Signed-off-by: Asra Ali <asraa@google.com >
* update dsse testcases
Signed-off-by: Asra Ali <asraa@google.com >
* fix cosign image verification in update
Signed-off-by: Asra Ali <asraa@google.com >
---------
Signed-off-by: Asra Ali <asraa@google.com >
2023-05-08 15:18:16 +00:00
sunnyyip
030c40080b
docs(gh-action): update actions installer path ( #581 )
...
Signed-off-by: Sunny Yip <sunny@kusari.dev >
2023-05-03 09:20:04 -07:00
Ian Lewis
88cd40e2ee
feat: Use low-perms delegator for Node.js builder ( #577 )
...
Signed-off-by: Ian Lewis <ianlewis@google.com >
2023-05-01 16:27:58 +09:00
Mend Renovate
5c0baa4f3e
chore(deps): update npm dev ( #568 )
...
Signed-off-by: Renovate Bot <bot@renovateapp.com >
2023-05-01 11:03:55 +09:00
laurentsimon and Ian Lewis
d67e7c1da7
feat: npm: Make package name and version mandatory for verification ( #576 )
...
Signed-off-by: laurentsimon <laurentsimon@google.com >
Co-authored-by: Ian Lewis <ianlewis@google.com >
2023-05-01 01:48:41 +00:00
Mend Renovate
954a421526
fix(deps): update github.com/sigstore/protobuf-specs digest to 13e09aa ( #578 )
...
Signed-off-by: Renovate Bot <bot@renovateapp.com >
2023-05-01 01:35:03 +00:00
Mend Renovate
515b41ca3f
chore(deps): update github/codeql-action action to v2.3.2 ( #569 )
...
Signed-off-by: Renovate Bot <bot@renovateapp.com >
2023-05-01 09:48:55 +09:00
Ian Lewis
2e60ff0e48
fix: Read newer attestation file format ( #564 )
...
* Read newer attestation file format
Signed-off-by: Ian Lewis <ianlewis@google.com >
* Update error message
Signed-off-by: Ian Lewis <ianlewis@google.com >
* revert change
Signed-off-by: Ian Lewis <ianlewis@google.com >
* Update test data
Signed-off-by: Ian Lewis <ianlewis@google.com >
---------
Signed-off-by: Ian Lewis <ianlewis@google.com >
2023-04-21 07:38:16 +09:00
laurentsimon and Ian Lewis
c0cadc0117
feat: support for BYOB verification ( #562 )
...
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* Update verifiers/internal/gha/provenance.go
Co-authored-by: Ian Lewis <ianlewis@google.com >
Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
---------
Signed-off-by: laurentsimon <laurentsimon@google.com >
Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com >
Co-authored-by: Ian Lewis <ianlewis@google.com >
2023-04-19 19:07:27 +00:00
Mend Renovate and Ian Lewis
0a7e71cb09
fix(deps): update github.com/sigstore/protobuf-specs digest to b6d2576 ( #559 )
...
Signed-off-by: Renovate Bot <bot@renovateapp.com >
Co-authored-by: Ian Lewis <ianlewis@google.com >
2023-04-19 13:34:26 +09:00
fb0810e150
chore(deps): update gcr.io/distroless/base:nonroot docker digest to 42311d8 ( #504 )
...
Signed-off-by: Renovate Bot <bot@renovateapp.com >
Co-authored-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com >
Co-authored-by: Ian Lewis <ianlewis@google.com >
2023-04-18 15:50:54 +09:00
Mend Renovate and Ian Lewis
a21c8747a4
chore(deps): update golang:1.19 docker digest to 9f2dd04 ( #516 )
...
Signed-off-by: Renovate Bot <bot@renovateapp.com >
Co-authored-by: Ian Lewis <ianlewis@google.com >
2023-04-18 02:03:18 +00:00
Mend Renovate
e1ea1da472
chore(deps): update github-actions ( #560 )
...
Signed-off-by: Renovate Bot <bot@renovateapp.com >
2023-04-18 10:52:54 +09:00
Ian Lewis
b5000ebfc0
fix: Slack badge ( #558 )
...
Fix slack badge
Signed-off-by: Ian Lewis <ianlewis@google.com >
2023-04-14 10:04:31 +09:00
Ian Lewis and laurentsimon
62c0dfdde9
docs: Update docs for 2.2.0 release. ( #556 )
...
* Update SHA256SUM.md
Signed-off-by: Ian Lewis <ianlewis@google.com >
* Update version in docs
Signed-off-by: Ian Lewis <ianlewis@google.com >
---------
Signed-off-by: Ian Lewis <ianlewis@google.com >
Co-authored-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com >
2023-04-13 19:15:15 +00:00
asraa
1bbdd661a8
docs: remove duplicated table of contents ( #557 )
...
* docs: remove duplicated table of contents
Signed-off-by: Asra Ali <asraa@google.com >
* fix action installation list
Signed-off-by: Asra Ali <asraa@google.com >
---------
Signed-off-by: Asra Ali <asraa@google.com >
2023-04-13 11:43:18 -07:00
Mend Renovate and Ian Lewis
623cf20a23
fix(deps): update npm ( #535 )
...
* fix(deps): update npm
---------
Signed-off-by: Renovate Bot <bot@renovateapp.com >
Signed-off-by: Ian Lewis <ianlewis@google.com >
Co-authored-by: Ian Lewis <ianlewis@google.com >
2023-04-11 13:41:24 +09:00
Drew Roen and Ian Lewis
e7279e828e
docs: Update README.md ( #541 )
...
Update README.md
Adding an alternative option for installing slsa-verifier if you do not rely on additional tooling. The benefit of this option is improved readability.
Signed-off-by: Drew Roen <102626803+drewroengoogle@users.noreply.github.com >
Co-authored-by: Ian Lewis <ianlewis@google.com >
2023-04-11 02:24:36 +00:00
Mend Renovate and Ian Lewis
9c3152fe9f
chore(deps): update github-actions ( #544 )
...
Signed-off-by: Renovate Bot <bot@renovateapp.com >
Co-authored-by: Ian Lewis <ianlewis@google.com >
2023-04-11 02:09:29 +00:00
Mend Renovate and Ian Lewis
84c3bbdd84
chore(deps): update npm dev ( #534 )
...
Signed-off-by: Renovate Bot <bot@renovateapp.com >
Co-authored-by: Ian Lewis <ianlewis@google.com >
2023-04-11 10:57:38 +09:00
Mend Renovate and Ian Lewis
6137b13c0e
fix(deps): update github.com/sigstore/protobuf-specs digest to 4dbf10b ( #553 )
...
Signed-off-by: Renovate Bot <bot@renovateapp.com >
Co-authored-by: Ian Lewis <ianlewis@google.com >
2023-04-11 00:20:40 +00:00
Mend Renovate and Ian Lewis
3c5abb613f
chore(deps): update dependency typescript to v5 ( #545 )
...
Signed-off-by: Renovate Bot <bot@renovateapp.com >
Co-authored-by: Ian Lewis <ianlewis@google.com >
2023-04-11 00:08:54 +00:00
Ian Lewis
f96d91bdd2
fix: Support pre-releases on trusted repos ( #552 )
...
Support pre-releases on trusted repos
---------
Signed-off-by: Ian Lewis <ianlewis@google.com >
2023-04-11 08:54:33 +09:00
asraa and laurentsimon
b01cb9d69c
chore: report scheduled release workflow failures ( #543 )
...
* chore: report scheduled release workflow failures
Signed-off-by: Asra Ali <asraa@google.com >
* fix: fix yamllint
Signed-off-by: Asra Ali <asraa@google.com >
* empty commit
Signed-off-by: Asra Ali <asraa@google.com >
---------
Signed-off-by: Asra Ali <asraa@google.com >
Co-authored-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com >
2023-03-24 23:40:49 +00:00
Mend Renovate
ed7976a0d4
chore(deps): update github-actions ( #529 )
...
Signed-off-by: Renovate Bot <bot@renovateapp.com >
2023-03-24 14:36:38 +00:00
Mend Renovate and asraa
a09c6aa06a
fix(deps): update github.com/sigstore/protobuf-specs digest to c8a23a4 ( #528 )
...
Signed-off-by: Renovate Bot <bot@renovateapp.com >
Co-authored-by: asraa <asraa@google.com >
2023-03-24 13:45:48 +00:00
Mend Renovate
c4400c7475
chore(deps): update github-actions (major) ( #536 )
...
chore(deps): update github-actions
Signed-off-by: Renovate Bot <bot@renovateapp.com >
2023-03-24 08:33:31 -05:00
laurentsimon
37e3b406cb
feat: GCB tag and versioned-tag support for containers ( #540 )
...
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
* update
Signed-off-by: laurentsimon <laurentsimon@google.com >
---------
Signed-off-by: laurentsimon <laurentsimon@google.com >
2023-03-23 16:57:34 +00:00
Mend Renovate
Ian Lewis
asraa
laurentsimonandIan Lewis
sunnyyip
Drew RoenandIan Lewis