laurentsimon and GitHub
f315652a8c
chore: Update doc and digests for v2.5.1 ( #748 )
...
This sets the expected sha256 of the v2.5.1 slsa-verifier released
binary.
How to LGTM this PR (I'll work on a proper doc for this in
https://github.com/slsa-framework/slsa-github-generator/issues/112 ):
1. Download the binary and provenance from
https://github.com/slsa-framework/slsa-verifier/releases/tag/v0.0.1
2. Clone the slsa-verifier repo, compile and verify the provenance using
the steps described in
https://github.com/slsa-framework/slsa-verifier/blob/main/RELEASE.md#verify-provenance
```
$ git clone git@github.com:slsa-framework/slsa-verifier.git
$ cd slsa-verifier
$ bash verify-release.sh v2.5.1
```
The output hash should be the hash I'm updating to in this PR. If they
match, LGTM. If they don't, someone tampered with the released binary
and don't LGTM
---------
Signed-off-by: laurentsimon <laurentsimon@google.com>
2024-03-26 08:11:24 -07:00
laurentsimon and GitHub
e986dfc0ff
feat: Digest for new release ( #722 )
...
#label:release v2.4.1
How to LGTM this PR:
Ensure you have installed the GitHub client from https://cli.github.com .
If it is not installed in your `PATH`, set `export GH=/path/to/your/gh`
Set your `export GH_TOKEN=...`
Use [verify-release.sh](./verify-release.sh) script in this repository:
```
bash verify-release v2.4.1
```
Once it completes, you will see the last line `Verifying artifact
/tmp/tmp.SomeRanDOm/` and do:
```bash
sha256sum /tmp/tmp.SomeRanDOm/* | grep -v intoto
```
This will print out the hashes. Compare them to the changes in this PR
---------
Signed-off-by: laurentsimon <laurentsimon@google.com >
2023-11-07 17:23:25 -08:00
laurentsimon and GitHub
d23c97947e
chore: Update doc for v2.4.0 ( #699 )
...
How to LGTM this PR (I'll work on a proper doc for this in
https://github.com/slsa-framework/slsa-github-generator/issues/112 ):
1. Clone repo
```
$ git clone git@github.com:slsa-framework/slsa-verifier.git
$ cd slsa-verifier
$ bash verify-release.sh v2.4.0 # NOTE: use the file in _this_ PR.
# Note down the path to the temporary dir use. The bash script will print its first line as "INFO: using dir: /tmp/tmp.VaYi6HfbmL"
```
2. Run command below and compare to SHA256SUM.md in this PR
```
$sha256sum /tmp/tmp.VaYi6HfbmL/*
```
The output hash should be the hash I'm updating to in this PR. If they
match, LGTM. If they don't, someone tampered with the released binary
and don't LGTM
---------
Signed-off-by: laurentsimon <laurentsimon@google.com>
2023-08-25 12:09:40 -07:00
Ian Lewis and GitHub
f59b55ef21
chore: Update SHA256SUM.md for v2.3.0 ( #592 )
...
Signed-off-by: Ian Lewis <ianlewis@google.com >
2023-05-12 08:23:56 +09:00
62c0dfdde9
docs: Update docs for 2.2.0 release. ( #556 )
...
* Update SHA256SUM.md
Signed-off-by: Ian Lewis <ianlewis@google.com >
* Update version in docs
Signed-off-by: Ian Lewis <ianlewis@google.com >
---------
Signed-off-by: Ian Lewis <ianlewis@google.com >
Co-authored-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com >
2023-04-13 19:15:15 +00:00
asraa and GitHub
e8ce5c0204
chore: update docs for release v2.1.0 ( #530 )
...
* chore: update docs for release v2.1.0
Signed-off-by: Asra Ali <asraa@google.com >
---------
Signed-off-by: Asra Ali <asraa@google.com >
2023-03-17 15:07:25 +00:00
asraa and GitHub
0bd7a542b4
docs: update docs for release v2.0.1 ( #403 )
...
Signed-off-by: Asra Ali <asraa@google.com >
Signed-off-by: Asra Ali <asraa@google.com >
2022-12-14 16:11:34 +00:00
798db79f54
docs: add the checksum of v2.0.0 ( #374 )
...
Signed-off-by: Shunsuke Suzuki <suzuki.shunsuke.1989@gmail.com >
Co-authored-by: Ian Lewis <ianlewis@google.com >
2022-12-02 12:22:14 +09:00
asraa and GitHub
26f422b6b2
add new releases ( #347 )
...
Signed-off-by: Asra Ali <asraa@google.com >
Signed-off-by: Asra Ali <asraa@google.com >
2022-11-01 09:38:26 +09:00
asraa and GitHub
168f9c3568
release: add release hash for v1.1.2 and v1.0.4 ( #291 )
...
* release: add hash for v1.1.2
Signed-off-by: Asra Ali <asraa@google.com >
* add releaes v1.0
Signed-off-by: Asra Ali <asraa@google.com >
Signed-off-by: Asra Ali <asraa@google.com >
2022-10-04 09:41:40 +09:00
asraa and GitHub
e269a00945
release: add release v1.3.1 and v1.2.1 ( #288 )
...
* release: add release v1.3.1 and v1.2.1
Signed-off-by: Asra Ali <asraa@google.com >
2022-10-03 10:27:24 -05:00
asraa and GitHub
71cf0397cd
release: add v1.0.3 ( #235 )
...
Signed-off-by: Asra Ali <asraa@google.com >
Signed-off-by: Asra Ali <asraa@google.com >
2022-08-29 09:48:21 -07:00
asraa and GitHub
ccb0786c88
release: release v1.3.0 of verifier ( #218 )
...
Signed-off-by: Asra Ali <asraa@google.com >
Signed-off-by: Asra Ali <asraa@google.com >
2022-08-15 13:50:24 -07:00
asraa and GitHub
ad90b50548
release: add notes for release v1.2.0 ( #171 )
...
Signed-off-by: Asra Ali <asraa@google.com >
2022-07-25 11:49:49 -07:00
asraa and GitHub
74c0ac257e
release: v1.0.1 patch release ( #142 )
...
Signed-off-by: Asra Ali <asraa@google.com >
2022-07-12 11:41:57 -05:00
asraa and GitHub
588ddc4344
add v1.1.1 hash ( #114 )
...
Signed-off-by: Asra Ali <asraa@google.com >
2022-06-29 17:39:18 +00:00
asraa and GitHub
5110b6efc4
update to release 1.1.0 ( #104 )
...
Signed-off-by: Asra Ali <asraa@google.com >
2022-06-20 21:35:08 +00:00
asraa and GitHub
2a0dd1c120
Update documentation for release v1.0.0 ( #85 )
...
Signed-off-by: Asra Ali <asraa@google.com >
2022-06-07 15:53:22 -07:00
laurentsimon and GitHub
21527372e3
📖 Release process for the verifier ( #71 )
...
* release for the verifier
* updates
* updates
* updates
* updates
* updates
* updates
* updates
* updates
* updates
* updates
* comments
* updates
2022-06-02 01:20:24 +00:00
laurentsimonandGitHub
Ian LewisandGitHub
asraaandGitHub
