slsa-verifier

mirror of https://github.com/slsa-framework/slsa-verifier.git synced 2026-05-06 00:26:39 +00:00

Files

Ramon Petgrave c789437815 feat: refactor: use sigstore-go for fetching TrustedRoot (#791 )

Uses the `sigstore-go` library for fetching the `TrustedRoot`, which
contains the Sigstore infrastructure certificates needed to validate the
leaf ephemeral certificates used to sign artifacts.

Refactors:

- replace `TrustedRootSingleton()` with `getDefaultCosignCheckOpts()`,
since only `VerifyImage()` will now need that data.
- replace `cosign.ValidateAndUnpackCert`
with`sigstoreVerify.VerifyLeafCertificate()`
- use `sync.Once` for sigstore and rekor clients, and the `TrustedRoot`

## Testing

- existing tests continue to pass
- [negative tests
](d96b977709/cli/slsa-verifier/main_regression_test.go (L450-L471))
against rekor TLogs
- manual invocations of `verify-artifact`.

---------

Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>

2024-08-02 21:47:50 +00:00

container

chore: update slsa provenance to v1 (#579 )

2023-05-08 15:18:16 +00:00

builder_test.go

feat: Use tags vX.Y.Z-<language> for JReleaser builders (#644 )

2023-07-10 16:42:48 +00:00

builder.go

feat: Use tags vX.Y.Z-<language> for JReleaser builders (#644 )

2023-07-10 16:42:48 +00:00

dsse_test.go

feat: npm default runner support (#495 )