github/slsa-verifier
1
0
Fork 0
mirror of https://github.com/slsa-framework/slsa-verifier.git synced 2026-08-26 09:37:19 +00:00
Code Issues Packages Projects Releases Wiki Activity
405 Commits 41 Branches 45 Tags
ramonpetgrave64-patch-1
Commit Graph
73 Commits
Author SHA1 Message Date
Ramon Petgrave fe539a2bde fix: use sigstore/pkg/fulcioroots to lessen deps (#746) 
We've long had the problem that slsa-verifier has too many dependencies.

This PR replaces `"github.com/sigstore/cosign/v2/cmd/cosign/cli/fulcio"`
with `"github.com/sigstore/sigstore/pkg/fulcioroots"`,
removing lot's of unneeded transitive dependencies like
`"github.com/aws/aws-sdk-go-v2"` and
`"github.com/Azure/go-autorest/autorest"` from our `go.mod`.

## Investigation

At
[deps.dep](https://deps.dev/go/github.com%2Fslsa-framework%2Fslsa-verifier%2Fv2/v2.4.1/dependencies/graph?filter=aws),
we can see that the indirect dependencies of `aws/aws-sdk-go-v2` come
from `cosign/cosign`.

<img width="1110" alt="image"
src="https://github.com/slsa-framework/slsa-verifier/assets/32398091/3de1adf4-29ac-4bec-a511-0ae191c3141c">

That's a good start, but this gives us only module-wide dependencies,
not package-level dependencies. We can instead use `go mod why <pkg>` to
get the package-level dependency chain.

Now we know that it's our `gha` package that imports a fulcio package,
which imports an aws package.

```
➜  slsa-verifier git:(main) ✗ go mod why github.com/aws/aws-sdk-go-v2/                                  
# github.com/aws/aws-sdk-go-v2
github.com/slsa-framework/slsa-verifier/v2/verifiers/internal/gha
github.com/sigstore/cosign/v2/cmd/cosign/cli/fulcio
github.com/sigstore/cosign/v2/cmd/cosign/cli/options
github.com/awslabs/amazon-ecr-credential-helper/ecr-login
github.com/awslabs/amazon-ecr-credential-helper/ecr-login/api
github.com/aws/aws-sdk-go-v2/config
github.com/aws/aws-sdk-go-v2/internal/ini
github.com/aws/aws-sdk-go-v2
```

Looking at our `gha` package we can see that the required methods from
fulcio are `Get()` and `GetIntermediates()`. Looking at the source
codes, we see that
`"github.com/sigstore/cosign/v2/cmd/cosign/cli/fulcio"`'s implementation
of these methods is the same as
`"github.com/sigstore/sigstore/pkg/fulcioroots"`'s implementation. So we
chose the latter's implementation, which happens to require fewer
module-level dependencies.

-
https://github.com/sigstore/cosign/blob/546f1c5b91ef58d6b034a402d0211d980184a0e5/cmd/cosign/cli/fulcio/fulcio.go#L16
-
https://github.com/sigstore/cosign/blob/546f1c5b91ef58d6b034a402d0211d980184a0e5/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go#L16
-
https://github.com/sigstore/sigstore/blob/25dd9f3e52ec1e666b3c913edd1a0b7aa236b246/pkg/fulcioroots/fulcioroots.go#L17

## Testing

- unit tests continue to pass
- manual test to verify a provenance with the steps in our
[readme](https://github.com/slsa-framework/slsa-verifier?tab=readme-ov-file#npm-packages-built-using-the-slsa3-nodejs-builder)

## Future Work

The sigstore-go library is meant to be a more long-term solution, for
replacing much of the sigstore-related functionality that slsa-verifier
implements directly.

Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
 2024-03-27 14:27:09 +00:00
Mend Renovateandlaurentsimon 449e404e2a fix(deps): update module google.golang.org/protobuf to v1.33.0 [security] (#743) 
[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
|
[google.golang.org/protobuf](https://togithub.com/protocolbuffers/protobuf-go)
| `v1.32.0` -> `v1.33.0` |
[![age](https://developer.mend.io/api/mc/badges/age/go/google.golang.org%2fprotobuf/v1.33.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/go/google.golang.org%2fprotobuf/v1.33.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/go/google.golang.org%2fprotobuf/v1.32.0/v1.33.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/go/google.golang.org%2fprotobuf/v1.32.0/v1.33.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|

---

> [!WARNING]
> Some dependencies could not be looked up. Check the Dependency
Dashboard for more information.

### GitHub Vulnerability Alerts

#### [CVE-2024-24786](https://nvd.nist.gov/vuln/detail/CVE-2024-24786)

The protojson.Unmarshal function can enter an infinite loop when
unmarshaling certain forms of invalid JSON. This condition can occur
when unmarshaling into a message which contains a google.protobuf.Any
value, or when the UnmarshalOptions.DiscardUnknown option is set.

---

### Release Notes

<details>
<summary>protocolbuffers/protobuf-go
(google.golang.org/protobuf)</summary>

###
[`v1.33.0`](https://togithub.com/protocolbuffers/protobuf-go/compare/v1.32.0...v1.33.0)

[Compare
Source](https://togithub.com/protocolbuffers/protobuf-go/compare/v1.32.0...v1.33.0)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "before 4am" (UTC), Automerge - At any
time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://developer.mend.io/github/slsa-framework/slsa-verifier).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4yMzguMSIsInVwZGF0ZWRJblZlciI6IjM3LjIzOC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiJ9-->

Signed-off-by: Mend Renovate <bot@renovateapp.com>
Co-authored-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>
 2024-03-26 15:33:59 +00:00
Mend Renovate bb41cb6ab2 fix(deps): update go (#498) 
[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
|
[github.com/go-openapi/runtime](https://togithub.com/go-openapi/runtime)
| `v0.26.2` -> `v0.27.0` |
[![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fgo-openapi%2fruntime/v0.27.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/go/github.com%2fgo-openapi%2fruntime/v0.27.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/go/github.com%2fgo-openapi%2fruntime/v0.26.2/v0.27.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fgo-openapi%2fruntime/v0.26.2/v0.27.0?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
| [github.com/go-openapi/swag](https://togithub.com/go-openapi/swag) |
`v0.22.7` -> `v0.22.8` |
[![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fgo-openapi%2fswag/v0.22.8?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/go/github.com%2fgo-openapi%2fswag/v0.22.8?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/go/github.com%2fgo-openapi%2fswag/v0.22.7/v0.22.8?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fgo-openapi%2fswag/v0.22.7/v0.22.8?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|

---

> [!WARNING]
> Some dependencies could not be looked up. Check the Dependency
Dashboard for more information.

---

### Release Notes

<details>
<summary>go-openapi/runtime (github.com/go-openapi/runtime)</summary>

###
[`v0.27.0`](https://togithub.com/go-openapi/runtime/compare/v0.26.2...v0.27.0)

[Compare
Source](https://togithub.com/go-openapi/runtime/compare/v0.26.2...v0.27.0)

</details>

<details>
<summary>go-openapi/swag (github.com/go-openapi/swag)</summary>

###
[`v0.22.8`](https://togithub.com/go-openapi/swag/compare/v0.22.7...v0.22.8)

[Compare
Source](https://togithub.com/go-openapi/swag/compare/v0.22.7...v0.22.8)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "before 4am on the first day of the
month" (UTC), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config help](https://togithub.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://developer.mend.io/github/slsa-framework/slsa-verifier).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNC4xMjUuMSIsInVwZGF0ZWRJblZlciI6IjM3LjEzNS4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiJ9-->

Signed-off-by: Mend Renovate <bot@renovateapp.com>
 2024-01-24 14:31:57 -08:00
Ramon PetgraveandMend Renovate 74119b2a7f fix(deps): update go to 1.21 (#738) 
Fixing the existing PR
https://github.com/slsa-framework/slsa-verifier/pull/498 to also change
the github actions to use the go 1.21 sourced directly from `go.mod`.

-
https://github.com/slsa-framework/slsa-github-generator/blob/07e64b653f10a80b6510f4568f685f8b7b9ea830/.github/workflows/builder_go_slsa3.yml#L56
-
https://github.com/actions/setup-go?tab=readme-ov-file#getting-go-version-from-the-gomod-file
-
https://github.com/slsa-framework/slsa-verifier/actions/runs/7559933600/job/20584856777?pr=498


> ...
Error: We were unable to automatically build your code. Please replace
the call to the autobuild action with your custom build steps.
Encountered a fatal error while running
"/opt/hostedtoolcache/CodeQL/2.15.5/x64/codeql/go/tools/autobuild.sh".
Exit code was 1 and error was: 2024/01/17 18:06:58 Autobuilder was built
with go1.21.5, environment has go1.20.12
...

Also fixing some more lint checks about repeated strings

---------

Signed-off-by: Mend Renovate <bot@renovateapp.com>
Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
Co-authored-by: Mend Renovate <bot@renovateapp.com>
 2024-01-24 09:29:20 -08:00
laurentsimon e986dfc0ff feat: Digest for new release (#722) 
#label:release v2.4.1

How to LGTM this PR:

Ensure you have installed the GitHub client from https://cli.github.com.
If it is not installed in your `PATH`, set `export GH=/path/to/your/gh`

Set your `export GH_TOKEN=...`

Use [verify-release.sh](./verify-release.sh) script in this repository:
```
bash verify-release v2.4.1
```

Once it completes, you will see the last line `Verifying artifact
/tmp/tmp.SomeRanDOm/` and do:
```bash
sha256sum /tmp/tmp.SomeRanDOm/* | grep -v intoto
```

This will print out the hashes. Compare them to the changes in this PR

---------

Signed-off-by: laurentsimon <laurentsimon@google.com>
 2023-11-07 17:23:25 -08:00
laurentsimon 2184d9d604 chore: bump versions (#715) 
Signed-off-by: laurentsimon <laurentsimon@google.com>
 2023-10-10 00:27:33 +00:00
Mend Renovate 0e5b3a3d11 fix(deps): update golang.org/x/exp digest to 7918f67 (#694) 
[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| golang.org/x/exp | require | digest | `10a5072` -> `7918f67` |

---

### ⚠ Dependency Lookup Warnings ⚠

Warnings were logged while processing this repo. Please check the
Dependency Dashboard for more information.

---

### Configuration

📅 **Schedule**: Branch creation - "every weekend" (UTC), Automerge - At
any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://developer.mend.io/github/slsa-framework/slsa-verifier).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNi40My4yIiwidXBkYXRlZEluVmVyIjoiMzcuMC4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiJ9-->

Signed-off-by: Mend Renovate <bot@renovateapp.com>
 2023-10-09 09:59:53 -07:00
laurentsimonandIan Lewis 58eede7e66 feat: gcb v1.0 support (#691) 
closes https://github.com/slsa-framework/slsa-verifier/issues/683

This is a large PR, but there is not much new code.

The code adding support for v1.0 is under:
- verifiers/internal/gcb/slsaprovenance/v1.0/*
- verifiers/internal/gcb/slsaprovenance/provenance.go

The rest is mostly some re-factoring needed

Remaining is regression tests, tracked in
https://github.com/slsa-framework/slsa-verifier/issues/690

---------

Signed-off-by: laurentsimon <laurentsimon@google.com>
Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>
Co-authored-by: Ian Lewis <ianlewis@google.com>
 2023-08-18 17:32:58 +00:00
Ian Lewis f025c630ac refactor: Use Go 1.20 (#643) 
Fixes #589

---------

Signed-off-by: Ian Lewis <ianlewis@google.com>
 2023-06-26 10:49:52 +09:00
Mend Renovate dab7d387fa fix(deps): update github.com/sigstore/protobuf-specs digest to 5ef5406 (#606) 
Signed-off-by: Renovate Bot <bot@renovateapp.com>
 2023-06-12 01:33:18 +00:00
Mend Renovate 5ca5eb0120 fix(deps): update module github.com/sigstore/rekor to v1.2.0 [security] (#622) 
Signed-off-by: Renovate Bot <bot@renovateapp.com>
 2023-06-02 09:10:53 -05:00
laurentsimon 3a4e992444 feat: verify claims in provenance match the certificate (#572) 
* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

---------

Signed-off-by: laurentsimon <laurentsimon@google.com>
 2023-05-09 23:52:36 +00:00
Mend Renovate 9b6ec903b9 fix(deps): update github.com/sigstore/protobuf-specs digest to 91485b4 (#584) 
Signed-off-by: Renovate Bot <bot@renovateapp.com>
 2023-05-09 00:32:22 +09:00
asraa 467e0820b6 chore: update slsa provenance to v1 (#579) 
* chore: update slsa provenance to v1

Signed-off-by: Asra Ali <asraa@google.com>

* fix import path

Signed-off-by: Asra Ali <asraa@google.com>

* update dsse testcases

Signed-off-by: Asra Ali <asraa@google.com>

* fix cosign image verification in update

Signed-off-by: Asra Ali <asraa@google.com>

---------

Signed-off-by: Asra Ali <asraa@google.com>
 2023-05-08 15:18:16 +00:00
Mend Renovate 954a421526 fix(deps): update github.com/sigstore/protobuf-specs digest to 13e09aa (#578) 
Signed-off-by: Renovate Bot <bot@renovateapp.com>
 2023-05-01 01:35:03 +00:00
Mend RenovateandIan Lewis 0a7e71cb09 fix(deps): update github.com/sigstore/protobuf-specs digest to b6d2576 (#559) 
Signed-off-by: Renovate Bot <bot@renovateapp.com>
Co-authored-by: Ian Lewis <ianlewis@google.com>
 2023-04-19 13:34:26 +09:00
Mend RenovateandIan Lewis 6137b13c0e fix(deps): update github.com/sigstore/protobuf-specs digest to 4dbf10b (#553) 
Signed-off-by: Renovate Bot <bot@renovateapp.com>
Co-authored-by: Ian Lewis <ianlewis@google.com>
 2023-04-11 00:20:40 +00:00
Mend Renovateandasraa a09c6aa06a fix(deps): update github.com/sigstore/protobuf-specs digest to c8a23a4 (#528) 
Signed-off-by: Renovate Bot <bot@renovateapp.com>
Co-authored-by: asraa <asraa@google.com>
 2023-03-24 13:45:48 +00:00
Mend Renovate 5fc3389c24 fix(deps): update github.com/sigstore/protobuf-specs digest to 44103a5 (#499) 
Signed-off-by: Renovate Bot <bot@renovateapp.com>
 2023-02-22 12:21:03 +09:00
Mend Renovate 64d1a7f5e9 fix(deps): update module github.com/sigstore/cosign/v2 to v2.0.0-rc.2 (#481) 
Signed-off-by: Renovate Bot <bot@renovateapp.com>
 2023-02-14 07:12:13 +09:00
asraa 5d6c770d43 feat: support branch and tag from slsa v1 provenance (#476) 
* feat: support branch and tag from slsa v1 provenance

Signed-off-by: Asra Ali <asraa@google.com>

Signed-off-by: Asra Ali <asraa@google.com>
 2023-02-10 21:33:16 +00:00
asraa 239c4489ce feat: add slsa v1?draft provenance experimental support (#470) 
* feat: add slsa v1?draft provenance support

Signed-off-by: Asra Ali <asraa@google.com>
Signed-off-by: Asra Ali <asraa@google.com>
 2023-02-09 17:21:15 +00:00
Mend Renovate 69da812e1c fix(deps): update github.com/sigstore/protobuf-specs digest to 9b722b6 (#465) 
Signed-off-by: Renovate Bot <bot@renovateapp.com>
 2023-02-07 20:15:42 +00:00
Mend Renovate be04b2a04c fix(deps): update module github.com/in-toto/in-toto-golang to v0.6.0 (#468) 
Signed-off-by: Renovate Bot <bot@renovateapp.com>
 2023-02-06 08:52:55 -06:00
asraa 362bd1a331 feat: add offline bundle signature verification (#457) 
* feat: add bundle signature verification

Signed-off-by: Asra Ali <asraa@google.com>
 2023-02-03 09:31:40 -06:00
Mend Renovate b0c071b496 fix(deps): update go (#453) 
Signed-off-by: Renovate Bot <bot@renovateapp.com>

Signed-off-by: Renovate Bot <bot@renovateapp.com>
 2023-01-25 09:52:35 -06:00
Mend RenovateandIan Lewis e8c3438638 fix(deps): update go (#386) 
Co-authored-by: Ian Lewis <ianlewis@google.com>
 2022-12-15 01:39:54 +00:00
Shunsuke Suzuki 74fd528309 fix: fix the Go package version to v2 (#373) 
* fix: fix the package version to v2

```
git ls-files | grep ".go$" | xargs -n 1 gsed -i "s|github.com/slsa-framework/slsa-verifier|github.com/slsa-framework/slsa-verifier/v2|g"
```

Signed-off-by: Shunsuke Suzuki <suzuki.shunsuke.1989@gmail.com>

* fix: fix the package version to v2

Signed-off-by: Shunsuke Suzuki <suzuki.shunsuke.1989@gmail.com>

* test: fix source

Signed-off-by: Shunsuke Suzuki <suzuki.shunsuke.1989@gmail.com>

Signed-off-by: Shunsuke Suzuki <suzuki.shunsuke.1989@gmail.com>
 2022-12-01 18:49:39 -08:00
WhiteSource Renovateandasraa a5568ee8ba fix(deps): update module github.com/spf13/cobra to v1.6.1 (#340) 
Co-authored-by: asraa <asraa@google.com>
 2022-10-31 18:24:56 +00:00
Ian Lewisandasraa c845407336 Update sigstore libraries (#326) 
* Update sigstore libraries

Signed-off-by: Ian Lewis <ianmlewis@gmail.com>

* Update slsa-github-generator

Signed-off-by: Ian Lewis <ianmlewis@gmail.com>

* go mod tidy

Signed-off-by: Ian Lewis <ianmlewis@gmail.com>

Signed-off-by: Ian Lewis <ianmlewis@gmail.com>
Co-authored-by: asraa <asraa@google.com>
 2022-10-27 14:36:36 +00:00
asraa 05d247fb14 rekor: use rekor client with retries (#301) 
Signed-off-by: Asra Ali <asraa@google.com>

Signed-off-by: Asra Ali <asraa@google.com>
 2022-10-17 16:55:40 +00:00
WhiteSource Renovateandasraa beada4bd09 fix(deps): update module github.com/go-openapi/runtime to v0.24.2 (#304) 
Co-authored-by: asraa <asraa@google.com>
 2022-10-17 16:33:55 +00:00
WhiteSource Renovateandasraa 4f09605a47 fix(deps): update module github.com/sigstore/sigstore to v1.4.4 (#294) 
Co-authored-by: asraa <asraa@google.com>
 2022-10-12 14:26:35 +00:00
asraa 936dc46aca ci: fix path to config (#297) 
Signed-off-by: Asra Ali <asraa@google.com>

use k8s versioning to show commit and tree state

Signed-off-by: Asra Ali <asraa@google.com>

Signed-off-by: Asra Ali <asraa@google.com>
 2022-10-08 18:31:10 +00:00
WhiteSource Renovateandasraa 7bb343116e fix(deps): update module github.com/sigstore/sigstore to v1.4.2 (#272) 
Co-authored-by: asraa <asraa@google.com>
 2022-09-26 11:35:50 +00:00
WhiteSource Renovate 5f98831104 fix(deps): update module github.com/sigstore/sigstore to v1.4.1 (#263) 2022-09-23 14:04:06 +00:00
WhiteSource Renovate 78a225d3bd fix(deps): update module github.com/sigstore/cosign to v1.12.0 (#264) 2022-09-19 16:33:55 -04:00
WhiteSource Renovateandasraa cddba700c8 fix(deps): update module github.com/google/go-cmp to v0.5.9 (#253) 
Co-authored-by: asraa <asraa@google.com>
 2022-09-14 17:47:23 +00:00
laurentsimon d12dce9526 feat: CLI tests for GCB verification (#251) 
* update

* update

* update
 2022-09-08 13:36:56 -07:00
laurentsimon d5b56c334e feat: add CLI tests for GCB verification (#245) 
* update

* update

* update

* update
 2022-09-02 20:42:40 +00:00
WhiteSource Renovateandasraa 0ff60a240a fix(deps): update module github.com/sigstore/cosign to v1.11.1 (#239) 
Co-authored-by: asraa <asraa@google.com>
 2022-09-01 15:31:07 +00:00
laurentsimon 26c928f5b7 Verify text provenance for GCB (#242) 
* update

* update

* update

* update

* update

* comments

* comments
 2022-08-30 23:08:46 +00:00
WhiteSource Renovate 3fc1dbde46 fix(deps): update module github.com/sigstore/rekor to v0.11.0 (#225) 2022-08-23 09:38:20 -05:00
WhiteSource Renovateandasraa ab0daccd34 fix(deps): update module github.com/sigstore/cosign to v1.11.0 (#224) 
Co-authored-by: asraa <asraa@google.com>
 2022-08-23 14:13:21 +00:00
WhiteSource Renovate 459608e7d8 fix(deps): update module github.com/go-openapi/swag to v0.22.3 (#215) 2022-08-19 11:55:11 -07:00
asraaandlaurentsimon 7b4b9cde06 feat: support oci image verification (#147) 
* feat: support oci image verification

Signed-off-by: Asra Ali <asraa@google.com>

* add testing folder

Signed-off-by: Asra Ali <asraa@google.com>

* update name and make fix

Signed-off-by: Asra Ali <asraa@google.com>

* add tests

Signed-off-by: Asra Ali <asraa@google.com>

* Add initial testing

Signed-off-by: Asra Ali <asraa@google.com>

* updated comments

Signed-off-by: Asra Ali <asraa@google.com>

* update

Signed-off-by: Asra Ali <asraa@google.com>

* fix digest calculation

Signed-off-by: Asra Ali <asraa@google.com>

Signed-off-by: Asra Ali <asraa@google.com>
Co-authored-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>
 2022-08-17 15:59:01 -05:00
WhiteSource Renovateandasraa a7d3c61f21 fix(deps): update module github.com/sigstore/cosign to v1.10.1 (#198) 
Co-authored-by: asraa <asraa@google.com>
 2022-08-08 19:18:50 +00:00
laurentsimon caaf1c1b8e feat: Create a verifier as a service (#182) 
* update

* update

* update

* tests

* update

* update

* update

* update

* update

* update

* update

* update

* update

* update

* comments

* update

* update

* update

* update

* update
 2022-08-03 14:29:25 -07:00
WhiteSource Renovateandasraa cdbab2bf0a fix(deps): update module github.com/google/trillian to v1.4.2 (#176) 
Co-authored-by: asraa <asraa@google.com>
 2022-08-03 09:27:02 -05:00
WhiteSource Renovate b911c68206 fix(deps): update module github.com/sigstore/sigstore to v1.3.1 (#177) 2022-08-02 14:19:30 -05:00