Ramon PetgraveandGitHub c789437815 feat: refactor: use sigstore-go for fetching TrustedRoot (#791) ...

Uses the `sigstore-go` library for fetching the `TrustedRoot`, which
contains the Sigstore infrastructure certificates needed to validate the
leaf ephemeral certificates used to sign artifacts.

Refactors:

- replace `TrustedRootSingleton()` with `getDefaultCosignCheckOpts()`,
since only `VerifyImage()` will now need that data.
- replace `cosign.ValidateAndUnpackCert`
with`sigstoreVerify.VerifyLeafCertificate()`
- use `sync.Once` for sigstore and rekor clients, and the `TrustedRoot`

## Testing

- existing tests continue to pass
- [negative tests
](https://github.com/slsa-framework/slsa-verifier/blob/d96b9777090694fa5096ee1b9c710a46b5a66f5e/cli/slsa-verifier/main_regression_test.go#L450-L471)
against rekor TLogs
- manual invocations of `verify-artifact`.

---------

Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>

2024-08-02 21:47:50 +00:00

..

workflows

feat: refactor: use sigstore-go for fetching TrustedRoot (#791)

2024-08-02 21:47:50 +00:00

pr-title-checker-config.json

ci: add pr workflow to check pr title format (#372)

2022-11-30 21:35:33 +00:00