mirror of
https://github.com/slsa-framework/slsa-verifier.git
synced 2026-05-10 02:26:35 +00:00
8c9ed07f8f
Addresses: https://github.com/slsa-framework/slsa-verifier/issues/547 - [x] Pending: https://github.com/sigstore/sigstore-go/pull/41 Uses the new [sigstore-go@0.2.0](https://github.com/sigstore/sigstore-go/releases/tag/v0.2.0) Currently slsa-verifier has npmjs' attestation key hardcoded. But sigstore now stores the same key within their own TUF root. This PR - dynamically use the keyid specified in the sigstore bundle, rather than the hardcoded keyid. - uses an updated ([pending]( https://github.com/sigstore/sigstore-go/pull/41)) sigstore-go library that allows us to fetch a signed and verified copy of the same key. --------- Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>