github/slsa-verifier
1
0
Fork 0
mirror of https://github.com/slsa-framework/slsa-verifier.git synced 2026-08-18 19:18:16 +00:00
Code Issues Packages Projects Releases Wiki Activity
425 Commits 41 Branches 45 Tags
ramonpetgrave64-patch-4
Commit Graph
74 Commits
Author SHA1 Message Date
Ramon PetgraveandGitHub 8c9ed07f8f feat: fixes #547: add npm sigstore-tuf suport (#731) 
Addresses: https://github.com/slsa-framework/slsa-verifier/issues/547
 - [x] Pending: https://github.com/sigstore/sigstore-go/pull/41
Uses the new
[sigstore-go@0.2.0](https://github.com/sigstore/sigstore-go/releases/tag/v0.2.0)

Currently slsa-verifier has npmjs' attestation key hardcoded. But
sigstore now stores the same key within their own TUF root.

This PR 
- dynamically use the keyid specified in the sigstore bundle, rather
than the hardcoded keyid.
- uses an updated ([pending](
https://github.com/sigstore/sigstore-go/pull/41)) sigstore-go library
that allows us to fetch a signed and verified copy of the same key.

---------

Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
 2024-04-16 17:21:49 +00:00
Ramon PetgraveandGitHub fe539a2bde fix: use sigstore/pkg/fulcioroots to lessen deps (#746) 
We've long had the problem that slsa-verifier has too many dependencies.

This PR replaces `"github.com/sigstore/cosign/v2/cmd/cosign/cli/fulcio"`
with `"github.com/sigstore/sigstore/pkg/fulcioroots"`,
removing lot's of unneeded transitive dependencies like
`"github.com/aws/aws-sdk-go-v2"` and
`"github.com/Azure/go-autorest/autorest"` from our `go.mod`.

## Investigation

At
[deps.dep](https://deps.dev/go/github.com%2Fslsa-framework%2Fslsa-verifier%2Fv2/v2.4.1/dependencies/graph?filter=aws),
we can see that the indirect dependencies of `aws/aws-sdk-go-v2` come
from `cosign/cosign`.

<img width="1110" alt="image"
src="https://github.com/slsa-framework/slsa-verifier/assets/32398091/3de1adf4-29ac-4bec-a511-0ae191c3141c">

That's a good start, but this gives us only module-wide dependencies,
not package-level dependencies. We can instead use `go mod why <pkg>` to
get the package-level dependency chain.

Now we know that it's our `gha` package that imports a fulcio package,
which imports an aws package.

```
➜  slsa-verifier git:(main) ✗ go mod why github.com/aws/aws-sdk-go-v2/                                  
# github.com/aws/aws-sdk-go-v2
github.com/slsa-framework/slsa-verifier/v2/verifiers/internal/gha
github.com/sigstore/cosign/v2/cmd/cosign/cli/fulcio
github.com/sigstore/cosign/v2/cmd/cosign/cli/options
github.com/awslabs/amazon-ecr-credential-helper/ecr-login
github.com/awslabs/amazon-ecr-credential-helper/ecr-login/api
github.com/aws/aws-sdk-go-v2/config
github.com/aws/aws-sdk-go-v2/internal/ini
github.com/aws/aws-sdk-go-v2
```

Looking at our `gha` package we can see that the required methods from
fulcio are `Get()` and `GetIntermediates()`. Looking at the source
codes, we see that
`"github.com/sigstore/cosign/v2/cmd/cosign/cli/fulcio"`'s implementation
of these methods is the same as
`"github.com/sigstore/sigstore/pkg/fulcioroots"`'s implementation. So we
chose the latter's implementation, which happens to require fewer
module-level dependencies.

-
https://github.com/sigstore/cosign/blob/546f1c5b91ef58d6b034a402d0211d980184a0e5/cmd/cosign/cli/fulcio/fulcio.go#L16
-
https://github.com/sigstore/cosign/blob/546f1c5b91ef58d6b034a402d0211d980184a0e5/internal/pkg/cosign/fulcio/fulcioroots/fulcioroots.go#L16
-
https://github.com/sigstore/sigstore/blob/25dd9f3e52ec1e666b3c913edd1a0b7aa236b246/pkg/fulcioroots/fulcioroots.go#L17

## Testing

- unit tests continue to pass
- manual test to verify a provenance with the steps in our
[readme](https://github.com/slsa-framework/slsa-verifier?tab=readme-ov-file#npm-packages-built-using-the-slsa3-nodejs-builder)

## Future Work

The sigstore-go library is meant to be a more long-term solution, for
replacing much of the sigstore-related functionality that slsa-verifier
implements directly.

Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
 2024-03-27 14:27:09 +00:00
Hayden BandGitHub 52c099b4d3 feat: Add support for DSSE Rekor type (#742) 
This is in preparation for switching over the Rekor entry type in the
slsa github generator to be the newer DSSE type. This adds support for
searching for both intoto v001 and dsse v001 entries.

Signed-off-by: Hayden Blauzvern <hblauzvern@google.com>
 2024-03-04 07:23:16 -08:00
Ramon PetgraveGitHubMend Renovate
 		74119b2a7f fix(deps): update go to 1.21 (#738) 
Fixing the existing PR
https://github.com/slsa-framework/slsa-verifier/pull/498 to also change
the github actions to use the go 1.21 sourced directly from `go.mod`.

-
https://github.com/slsa-framework/slsa-github-generator/blob/07e64b653f10a80b6510f4568f685f8b7b9ea830/.github/workflows/builder_go_slsa3.yml#L56
-
https://github.com/actions/setup-go?tab=readme-ov-file#getting-go-version-from-the-gomod-file
-
https://github.com/slsa-framework/slsa-verifier/actions/runs/7559933600/job/20584856777?pr=498


> ...
Error: We were unable to automatically build your code. Please replace
the call to the autobuild action with your custom build steps.
Encountered a fatal error while running
"/opt/hostedtoolcache/CodeQL/2.15.5/x64/codeql/go/tools/autobuild.sh".
Exit code was 1 and error was: 2024/01/17 18:06:58 Autobuilder was built
with go1.21.5, environment has go1.20.12
...

Also fixing some more lint checks about repeated strings

---------

Signed-off-by: Mend Renovate <bot@renovateapp.com>
Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
Co-authored-by: Mend Renovate <bot@renovateapp.com>
 2024-01-24 09:29:20 -08:00
saisatishkarraGitHublaurentsimon
 		9b2467f836 feat: fixes #724: add input for --provenance-repository while image verification (#736) 
@laurentsimon Added a new image verification cmd input
`--provenance-repository`
This replicates the feature of the `COSIGN_REPOSITORY` environment
variable when provenance is stored in a different repository/registry

Order of precedence:
- If input `--provenance-repository` is set, leverages the non-empty
input value
- If the env variable `COSIGN_REPOSITORY` is set, it is NOT consumed

README edit :
https://github.com/slsa-framework/slsa-verifier/pull/736/files#diff-b335630551682c19a781afebcf4d07bf978fb1f8ac04c6bf87428ed5106870f5R280

---------

Signed-off-by: saisatishkarra <saisatish.karra@konghq.com>
Co-authored-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>
 2024-01-22 18:10:11 +00:00
Ramon PetgraveandGitHub ceaebee236 fix: #642: don't use go-cmp for outputting diff (#737) 
Previously we used the go-cmp's Diff for displaying a human-friendly
diff between two structs in an error message.

I had intended to do a json print of the structs and do a line-by-line
diff. There is an internal library for calculating text diff, but I
don't see any external functions that expose it to make it available for
our use: https://pkg.go.dev/golang.org/x/tools/internal/diff

Instead, this we will simply display both structs in their own "actual"
and "expected" sections. The user can use their other tools to find a
human-friendly diff.

Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
 2024-01-17 10:05:28 -08:00
saisatishkarraGitHublaurentsimon
 		f09d99f91c feat: Add cosign registry opts for provenance registry (#729) 
triggered on specification of COSIGN_REPOSITORY env

---------

Signed-off-by: saisatishkarra <saisatish.karra@konghq.com>
Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>
Co-authored-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>
 2024-01-04 01:39:42 +00:00
laurentsimonandGitHub 3b171c4140 feat: Address unresolved comments from #705 (#708) 
closes https://github.com/slsa-framework/slsa-verifier/issues/707

Signed-off-by: laurentsimon <laurentsimon@google.com>
 2023-10-09 23:17:48 +00:00
laurentsimonandGitHub 417b7aacc6 feat: Rename verifySubjectDigest function (#712) 
closes https://github.com/slsa-framework/slsa-verifier/issues/711

Signed-off-by: laurentsimon <laurentsimon@google.com>
 2023-10-10 07:37:38 +09:00
laurentsimonGitHubIan LewisTrishank Karthik Kuppusamy
 		f6ae402f45 fix: npm publish verification (#705) 
- adding support for IEEE P1363 formatted signatures
- fix the npm publish attestation bug. The verification always return
success, because it was not using PAE signature

---------

Signed-off-by: laurentsimon <laurentsimon@google.com>
Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>
Co-authored-by: Ian Lewis <ianlewis@google.com>
Co-authored-by: Trishank Karthik Kuppusamy <trishank.kuppusamy@datadoghq.com>
 2023-10-02 10:12:51 -07:00
laurentsimonandGitHub 54010d9735 fix: Support npm v2 format (#704) 
closes https://github.com/slsa-framework/slsa-verifier/issues/703

---------

Signed-off-by: laurentsimon <laurentsimon@google.com>
 2023-09-21 17:10:01 -07:00
laurentsimonGitHubIan Lewis
 		58eede7e66 feat: gcb v1.0 support (#691) 
closes https://github.com/slsa-framework/slsa-verifier/issues/683

This is a large PR, but there is not much new code.

The code adding support for v1.0 is under:
- verifiers/internal/gcb/slsaprovenance/v1.0/*
- verifiers/internal/gcb/slsaprovenance/provenance.go

The rest is mostly some re-factoring needed

Remaining is regression tests, tracked in
https://github.com/slsa-framework/slsa-verifier/issues/690

---------

Signed-off-by: laurentsimon <laurentsimon@google.com>
Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>
Co-authored-by: Ian Lewis <ianlewis@google.com>
 2023-08-18 17:32:58 +00:00
laurentsimonandGitHub 2a24d8e0f1 feat: Allow byob builders ref at main for e2e tests (#689) 
Signed-off-by: laurentsimon <laurentsimon@google.com>
 2023-08-16 00:57:17 +00:00
laurentsimonGitHubIan Lewis
 		9aef8ff8aa feat: GCB refactor for v1.0 support (#682) 
In anticipation for GCB's v1.0 support, this PR re-factors the code to
look similar to GHA's code

---------

Signed-off-by: laurentsimon <laurentsimon@google.com>
Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>
Co-authored-by: Ian Lewis <ianlewis@google.com>
 2023-08-15 18:15:49 +00:00
Noah ElznerGitHubIan Lewislaurentsimon
 		8bcf1f0525 feat: Non-compulsory BuilderID for BYOB Builders (#674) 
/cc @mihaimaruseac
/cc @laurentsimon 

Based off the prefix of the BuilderID within the provenance, if the
builder use to build the artifact is one of the BYOB builders of
slsa-framework/slsa-github-generator repo, the --builderid flag is not
need and is handled automatically. This was done to increase access to
users since before the automatic pickup of the builder-id would get the
delegator.

Test cases that cover verifyProvenance will need to be complete after
the v1.8.0 release of slsa-framework/slsa-github-generator.

The main structure that is changed is the ExpectedBuilderPath is
hardcoded now to slsa-framework builders within
`/cli/slsa-verifier/verify/verify_artifact.go `. This can later be
changed now if needed to be an input like the other fields of
`provenanceOpts` populated during `verify_artifact.go`. The added
function within `provenance.go`, `verifyBuilderIDPath` is called during
`verifyProvenance` to check this path within `provenanceOpts`. Upon
failure of this function, expected and received BuilderID's are also
outputted.

closes #659 
makes use of discussion on closed pr #673

---------

Signed-off-by: Noah Elzner <elzner@google.com>
Signed-off-by: Noah Elzner <78953604+enteraga6@users.noreply.github.com>
Co-authored-by: Ian Lewis <ianlewis@google.com>
Co-authored-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>
 2023-08-11 14:20:58 +00:00
laurentsimonandGitHub 9aa2319ef0 feat: Print byob builder (#677) 
closes https://github.com/slsa-framework/slsa-verifier/issues/672

---------

Signed-off-by: laurentsimon <laurentsimon@google.com>
 2023-08-02 18:34:13 +00:00
Ian LewisGitHublaurentsimon
 		e7fc7a4621 feat: Verification for when sha1 is specified in BYOB TRW (#641) 
Fixes #600

---------

Signed-off-by: Ian Lewis <ianlewis@google.com>
Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>
Co-authored-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>
 2023-07-25 11:29:15 +09:00
laurentsimonandGitHub c6d12b745c feat: Use tags vX.Y.Z-<language> for JReleaser builders (#644) 
Signed-off-by: laurentsimon <laurentsimon@google.com>
 2023-07-10 16:42:48 +00:00
Ian LewisandGitHub 1778495466 refactor: Use full builder id (#648) 
Internally use full builder IDs including server url rather than worflow
ref as a path. This should hopefully avoid confusion between dealing
with builder IDs and `GITHUB_WORKFLOW_REF` which only contains the path
portion. `GITHUB_WORKFLOW_REF` is the only thing that doesn't include
the domain/server url part of the workflow/builder ID. The Fulcio OID
claims include the full url.

Code extracted from #641

---------

Signed-off-by: Ian Lewis <ianlewis@google.com>
 2023-07-10 06:23:48 +00:00
Ian LewisandGitHub 965f5784c1 refactor: Add more git utils (#645) 
Adds the functions `NormalizeGitURI`, `ParseGitURIAndRef`, and
`ValidateGitRef`. `ParseGitRef` was updated to be permissive of the ref
type whereas `ValidateGitRef` validates that the type is of a given
type.

Code extracted from #641

Signed-off-by: Ian Lewis <ianlewis@google.com>
 2023-07-01 09:03:52 +09:00
Ian LewisandGitHub 90f4f23e1e test: Add more ProvenanceFromEnvelope tests (#640) 
Fixes #573

---------

Signed-off-by: Ian Lewis <ianlewis@google.com>
 2023-06-26 02:03:34 +00:00
Ian LewisandGitHub d2dc8193ae feat: Verify provenance by build type (#632) 
Fixes #473

Updates handling of provenance by providing implementations based on
[buildType](https://slsa.dev/provenance/v1#buildType) since this
determines how to interpret parameters and dependencies. This is done
because we need a way to interpret parameters not just based on the
predicateType. The 3 major build types with format differences are:
  - non-BYOB SLSA v0.2
  - BYOB SLSA v0.2
  - BYOB SLSA v1.0

---------

Signed-off-by: Ian Lewis <ianlewis@google.com>
 2023-06-16 09:54:20 +09:00
asraaandGitHub aac022747e feat: remove experimental on Sigstore bundle and v1.0 SLSA provenance format (#634) 
* feat: remove experimental on Sigstore bundle and v1.0 SLSA provenance format

Signed-off-by: Asra Ali <asraa@google.com>

* docs: update verifier README.md for docker-based builder

Signed-off-by: Asra Ali <asraa@google.com>

---------

Signed-off-by: Asra Ali <asraa@google.com>
 2023-06-06 22:07:20 +00:00
Ian LewisandGitHub 8faf24c6dc fix: builder ID verification for testing (#635) 
Fix builder ID verification for testing

Signed-off-by: Ian Lewis <ianlewis@google.com>
 2023-06-06 08:32:20 -05:00
laurentsimonandGitHub 7b942b8666 fix: only allow hashes of 256 bits or more (#633) 
Signed-off-by: laurentsimon <laurentsimon@google.com>
 2023-06-05 08:32:53 +09:00
Ian LewisandGitHub 9bfbc91c5b refactor: Provenance tests (#628) 
Refactors GHA provenance tests to use `testProvenance` which makes it clearer what is actually being tested. This will also make it easier to support `buildType` as a way to have different verification logic as the tests no longer rely on testdata with the `"https://github.com/Attestations/GitHubActionsWorkflow@v1"` build type, which isn't used by any supported builders.

A couple of updates to utilities:
- `VerifyTag` will now validate the ref returned by the `Provenance` instance.
- `VerifyBranch` will now validate the ref returned by the `Provenance` instance.
- `VerifyDigest` now supports the 160 bit `"sha1"` algo (FWIW) and will now search all subject entries even if one subject entry's algorithm does not match the expected algorithm.

---------

Signed-off-by: Ian Lewis <ianlewis@google.com>
 2023-06-02 13:34:56 +09:00
asraaandGitHub 8fe8ee9f3f fix: revert to using resolvedDepdendencies for source verification (#629) 
Signed-off-by: Asra Ali <asraa@google.com>
 2023-06-01 20:15:22 +00:00
asraaandGitHub db0560e328 fix: use ExternalParameters["source"] for the Source URI for SLSA v1.0 provenance (#621) 
* feat: add support for checking a source annotation when there are multiple resolveddependencies

Signed-off-by: Asra Ali <asraa@google.com>

* revert to using external parameters source key

Signed-off-by: Asra Ali <asraa@google.com>

* unused file

Signed-off-by: Asra Ali <asraa@google.com>

---------

Signed-off-by: Asra Ali <asraa@google.com>
 2023-05-27 02:28:44 +00:00
laurentsimonGitHubIan Lewis
 		93d3f8c06c fix: Verify the TRW tag is a semver tag (#619) 
* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* Update verifiers/utils/builder.go

Co-authored-by: Ian Lewis <ianlewis@google.com>
Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>

---------

Signed-off-by: laurentsimon <laurentsimon@google.com>
Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>
Co-authored-by: Ian Lewis <ianlewis@google.com>
 2023-05-26 01:15:32 +00:00
laurentsimonandGitHub fba178ea9c feat: Use env variable to retrieve trigger workflow (#615) 
* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

---------

Signed-off-by: laurentsimon <laurentsimon@google.com>
 2023-05-25 14:32:48 -07:00
laurentsimonandGitHub ba32c706ac feat: Support for v1.0 verification in BYOB (#609) 
* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

---------

Signed-off-by: laurentsimon <laurentsimon@google.com>
 2023-05-23 07:31:13 -07:00
laurentsimonandGitHub bda35e0238 feat: BYOB verification support (#604) 
* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

---------

Signed-off-by: laurentsimon <laurentsimon@google.com>
 2023-05-23 01:41:17 +00:00
laurentsimonandGitHub 3a4e992444 feat: verify claims in provenance match the certificate (#572) 
* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

---------

Signed-off-by: laurentsimon <laurentsimon@google.com>
 2023-05-09 23:52:36 +00:00
asraaandGitHub 467e0820b6 chore: update slsa provenance to v1 (#579) 
* chore: update slsa provenance to v1

Signed-off-by: Asra Ali <asraa@google.com>

* fix import path

Signed-off-by: Asra Ali <asraa@google.com>

* update dsse testcases

Signed-off-by: Asra Ali <asraa@google.com>

* fix cosign image verification in update

Signed-off-by: Asra Ali <asraa@google.com>

---------

Signed-off-by: Asra Ali <asraa@google.com>
 2023-05-08 15:18:16 +00:00
Ian LewisandGitHub 88cd40e2ee feat: Use low-perms delegator for Node.js builder (#577) 
Signed-off-by: Ian Lewis <ianlewis@google.com>
 2023-05-01 16:27:58 +09:00
Ian LewisandGitHub 2e60ff0e48 fix: Read newer attestation file format (#564) 
* Read newer attestation file format

Signed-off-by: Ian Lewis <ianlewis@google.com>

* Update error message

Signed-off-by: Ian Lewis <ianlewis@google.com>

* revert change

Signed-off-by: Ian Lewis <ianlewis@google.com>

* Update test data

Signed-off-by: Ian Lewis <ianlewis@google.com>

---------

Signed-off-by: Ian Lewis <ianlewis@google.com>
 2023-04-21 07:38:16 +09:00
laurentsimonGitHubIan Lewis
 		c0cadc0117 feat: support for BYOB verification (#562) 
* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* Update verifiers/internal/gha/provenance.go

Co-authored-by: Ian Lewis <ianlewis@google.com>
Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

---------

Signed-off-by: laurentsimon <laurentsimon@google.com>
Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>
Co-authored-by: Ian Lewis <ianlewis@google.com>
 2023-04-19 19:07:27 +00:00
Ian LewisandGitHub f96d91bdd2 fix: Support pre-releases on trusted repos (#552) 
Support pre-releases on trusted repos

---------

Signed-off-by: Ian Lewis <ianlewis@google.com>
 2023-04-11 08:54:33 +09:00
laurentsimonandGitHub 37e3b406cb feat: GCB tag and versioned-tag support for containers (#540) 
* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

---------

Signed-off-by: laurentsimon <laurentsimon@google.com>
 2023-03-23 16:57:34 +00:00
laurentsimonGitHubIan Lewis
 		ae38103ecf feat: verify sourceURI for npm packages (#521) 
* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* Update verifiers/internal/gha/provenance.go

Co-authored-by: Ian Lewis <ianlewis@google.com>
Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

---------

Signed-off-by: laurentsimon <laurentsimon@google.com>
Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>
Co-authored-by: Ian Lewis <ianlewis@google.com>
 2023-03-10 17:13:29 +00:00
asraaandGitHub 5a77b25fb4 fix: fix GCB verification with git material source prefix (#519) 
Signed-off-by: Asra Ali <asraa@google.com>
 2023-03-09 10:00:19 +09:00
Kevin HalkandGitHub 47495c7d5b feat: Update SLSA verifier to support a global signing key for GCB V1 which… (#509) 
* Update SLSA verifier to support a global signing key for GCB V1 which creates the signature in a DSSE-conformant PAE format

- new public key for "global PAE signing key"
- test data and unit tests

Signed-off-by: Kevin Halk <khalk@google.com>

* Update SLSA verifier to support a global signing key for GCB V1 which creates the signature in a DSSE-conformant PAE format

- new public key for "global PAE signing key"
- test data and unit tests

Signed-off-by: Kevin Halk <khalk@google.com>

* Update SLSA verifier to support a global signing key for GCB V1 which creates the signature in a DSSE-conformant PAE format

- new public key for "global PAE signing key"
- test data and unit tests

Signed-off-by: Kevin Halk <khalk@google.com>

* Update SLSA verifier to support a global signing key for GCB V1 which creates the signature in a DSSE-conformant PAE format

- new public key for "global PAE signing key"
- test data and unit tests

Signed-off-by: Kevin Halk <khalk@google.com>

* Update SLSA verifier to support a global signing key for GCB V1 which creates the signature in a DSSE-conformant PAE format

- new public key for "global PAE signing key"
- test data and unit tests

Signed-off-by: Kevin Halk <khalk@google.com>

* Update SLSA verifier to support a global signing key for GCB V1 which creates the signature in a DSSE-conformant PAE format

- new public key for "global PAE signing key"
- test data and unit tests

Signed-off-by: Kevin Halk <khalk@google.com>

* Update SLSA verifier to support a global signing key for GCB V1 which creates the signature in a DSSE-conformant PAE format

- new public key for "global PAE signing key"
- test data and unit tests

Signed-off-by: Kevin Halk <khalk@google.com>

---------

Signed-off-by: Kevin Halk <khalk@google.com>
 2023-03-06 16:02:30 +00:00
laurentsimonandGitHub 82a12591ff feat: npm default runner support (#495) 
* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

---------

Signed-off-by: laurentsimon <laurentsimon@google.com>
 2023-03-02 21:53:29 +00:00
asraaandGitHub d8c2961d82 test: add docker based spport and start adding tests (#486) 
Signed-off-by: Asra Ali <asraa@google.com>
 2023-02-15 20:46:11 +00:00
asraaandGitHub 0bb98050f2 fix: use a uniform verifier interface for provenance type (#478) 
* cleanup: use a uniform verifier interface for provenance type

Signed-off-by: Asra Ali <asraa@google.com>

* fix experimental gateg

Signed-off-by: Asra Ali <asraa@google.com>

* oops

Signed-off-by: Asra Ali <asraa@google.com>

---------

Signed-off-by: Asra Ali <asraa@google.com>
 2023-02-10 14:04:12 -08:00
asraaandGitHub 5d6c770d43 feat: support branch and tag from slsa v1 provenance (#476) 
* feat: support branch and tag from slsa v1 provenance

Signed-off-by: Asra Ali <asraa@google.com>

Signed-off-by: Asra Ali <asraa@google.com>
 2023-02-10 21:33:16 +00:00
asraaandGitHub 239c4489ce feat: add slsa v1?draft provenance experimental support (#470) 
* feat: add slsa v1?draft provenance support

Signed-off-by: Asra Ali <asraa@google.com>
Signed-off-by: Asra Ali <asraa@google.com>
 2023-02-09 17:21:15 +00:00
asraaandGitHub fec5b6a7b5 refactor: generalize provenance out of predicate type info (#463) 
* refactor: generalize provenance out of predicate type info

Signed-off-by: Asra Ali <asraa@google.com>
 2023-02-03 23:30:23 +00:00
asraaandGitHub 362bd1a331 feat: add offline bundle signature verification (#457) 
* feat: add bundle signature verification

Signed-off-by: Asra Ali <asraa@google.com>
 2023-02-03 09:31:40 -06:00
asraaandGitHub bcd23c945e chore: enable some Go linters (#456) 
* enable deadcode

Signed-off-by: Asra Ali <asraa@google.com>

* enable unconvert

Signed-off-by: Asra Ali <asraa@google.com>

* enable thelper

Signed-off-by: Asra Ali <asraa@google.com>

* enable stylecheck

Signed-off-by: Asra Ali <asraa@google.com>

* enable misspell

Signed-off-by: Asra Ali <asraa@google.com>

* enable gocritic

Signed-off-by: Asra Ali <asraa@google.com>

* enable godot

Signed-off-by: Asra Ali <asraa@google.com>

* enable staticcheck

Signed-off-by: Asra Ali <asraa@google.com>

* address experimental deadcode

Signed-off-by: Asra Ali <asraa@google.com>

Signed-off-by: Asra Ali <asraa@google.com>
 2023-01-25 19:51:10 +00:00