feat: produce sigstore Bundles for generic generator and go builder workflows #3777

ramonpetgrave64 · 2024-08-14T20:29:02Z

Summary

pending slsa-framework/slsa-verifier#799

Changes the internal go code to produce Sigstore Bundles, instead of only signed DSSE envelopes. This means that the generic generator and go builder workflows now produce Sigstore Bundles, just like the other BYOB-type workflows.

Testing Process

Testing done on a previous commit with a test workflow. It's using a slightly modified slsa-verifier that respects sls-aw workflows from non-main branches.

https://github.com/slsa-framework/slsa-github-generator/actions/runs/10425271660

Followup

[ ] Produce the provenance in v1 format, rather than the current v0.2 format.
[ ] fix initialism of [build]invocationID to [build]invocationId #3876

Checklist

Review the contributing guidelines
Add a reference to related issues in the PR description.
Update documentation if applicable.
Add unit tests if applicable.
Add changes to the CHANGELOG if applicable.

ramonpetgrave64 · 2024-08-15T14:30:48Z

github/oidc.go

@@ -39,6 +39,9 @@ const (

 // OIDCToken represents the contents of a GitHub OIDC JWT token.
 type OIDCToken struct {
+	// Expiry is the expiration date of the token.


lint: reordering fields by type.

ramonpetgrave64 · 2024-09-12T17:37:35Z

@ianlewis @laurentsimon

ramonpetgrave64 · 2024-09-12T17:39:28Z

internal/builders/docker/pkg/builder_test.go

@@ -53,7 +53,7 @@ func Test_CreateBuildDefinition(t *testing.T) {
 	}

 	if diff := cmp.Diff(got, want); diff != "" {
-		t.Errorf(diff)
+		t.Error(diff)


lint: change t.Errorf to t.Error when not actually using any string formatting.

haydentherapper

This is really great!

signing/sigstore/bundle.go

haydentherapper · 2024-09-16T23:41:48Z

signing/sigstore/bundle.go

+	// Bundle will have already verified that the TLog entries are signed.
+	logIndex := innerBundle.GetVerificationMaterial().GetTlogEntries()[0].GetLogIndex()
+	fmt.Printf("Signed attestation is in rekor with UUID %d.\n", logIndex)
+	fmt.Printf("You could use rekor-cli to view the log entry details:\n\n"+


Minor thing, but I would avoid printing the info about how to look up the entry given these look ups aren't verifying inclusion. In Cosign we've always struggled with what is useful output, and I don't have a good answer there - maybe a list of steps that the client took (requested token, fetched cert, uploaded entry to log, etc)?

It's more of a UX thing, since I'm deleting another print statement that showed the log UUID.

I now see I need to update that text to say Log Index, not UUID.

haydentherapper · 2024-09-16T23:44:22Z

signing/sigstore/bundle.go

Could we add any tests for this? Possibly e2e tests with a similar setup like Colleen added in Cosign? https://github.com/sigstore/cosign/blob/main/test/README.md

There are e2e tests in slsa-framework/example-package that will produce and verify. We can't have the e2e tests in PRs because PRs don't have the needed token permissions to sign.

https://github.com/slsa-framework/example-package/blob/b771344a4ceeb4224c0e683910fc60360f91827c/.github/workflows/e2e.generic.release.main.default.slsa3.yml#L84

Can you use the identity token workflow we set up for conformance testing that publishes a valid ID token? Here's an example of gitsign using it - https://github.com/sigstore/gitsign/pull/549/files

We could definitely tweak this code to use that alternative token in PRs, but then verification won't work with slsa-verifier until we tweak it to trust alternative workflow and certificate identities:

feat: testing mode from non-main slsa-framework/slsa-github-generator branches slsa-verifier#797

# Summary Followup to #3746 Removes the verify job, which won't work, because the ref will be incorrect. - https://github.com/slsa-framework/slsa-github-generator/actions/runs/10115454784/job/27976327657#step:5:1 ``` WARNING: Insecure SLSA_VERIFIER_TESTING is enabled. Verifying artifact ./target/test-java-project-1.21.97.jar: FAILED: invalid ref: "refs/heads/main": unexpected ref type: "heads" FAILED: SLSA verification failed: invalid ref: "refs/heads/main": unexpected ref type: "heads" Error: Process completed with exit code 1. ``` ## Testing Process The e2e test is executed in this PR, which now passes. ## Checklist - [x] Review the contributing [guidelines](https://github.com/slsa-framework/slsa-github-generator/blob/main/CONTRIBUTING.md) - [x] Add a reference to related issues in the PR description. - [ ] Update documentation if applicable. - [x] Add unit tests if applicable. - [ ] Add changes to the [CHANGELOG](https://github.com/slsa-framework/slsa-github-generator/blob/main/CHANGELOG.md) if applicable. --------- Signed-off-by: Ramon Petgrave <[email protected]> Signed-off-by: Ramon Petgrave <[email protected]> Signed-off-by: Ramon Petgrave <[email protected]>

Signed-off-by: Ramon Petgrave <[email protected]> Signed-off-by: Ramon Petgrave <[email protected]>

…o 25.0.6+incompatible in the go_modules group (#3760) Bumps the go_modules group with 1 update: [github.com/docker/docker](https://github.com/docker/docker). Updates `github.com/docker/docker` from 24.0.9+incompatible to 25.0.6+incompatible <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/docker/docker/releases">github.com/docker/docker's releases</a>.</em></p> <blockquote> <h2>v25.0.6</h2> <h2>25.0.6</h2> <p>For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:</p> <ul> <li><a href="https://github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A25.0.6">docker/cli, 25.0.6 milestone</a></li> <li><a href="https://github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A25.0.6">moby/moby, 25.0.6 milestone</a></li> <li>Deprecated and removed features, see <a href="https://github.com/docker/cli/blob/v25.0.6/docs/deprecated.md">Deprecated Features</a>.</li> <li>Changes to the Engine API, see <a href="https://github.com/moby/moby/blob/v25.0.6/docs/api/version-history.md">API version history</a>.</li> </ul> <h3>Security</h3> <p>This release contains a fix for <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41110">CVE-2024-41110</a> / <a href="https://github.com/moby/moby/security/advisories/GHSA-v23v-6jw2-98fq">GHSA-v23v-6jw2-98fq</a> that impacted setups using <a href="https://docs.docker.com/engine/extend/plugins_authorization/">authorization plugins (AuthZ)</a> for access control.</p> <h3>Bug fixes and enhancements</h3> <ul> <li>[25.0] remove erroneous <code>platform</code> from image <code>config</code> OCI descriptor in <code>docker save</code> output. <a href="https://redirect.github.com/moby/moby/pull/47695">moby/moby#47695</a></li> <li>[25.0 backport] Fix a nil dereference when getting image history for images having layers without the <code>Created</code> value set. <a href="https://redirect.github.com/moby/moby/pull/47759">moby/moby#47759</a></li> <li>[25.0 backport] apparmor: Allow confined runc to kill containers. <a href="https://redirect.github.com/moby/moby/pull/47830">moby/moby#47830</a></li> <li>[25.0 backport] Fix an issue where rapidly promoting a Swarm node after another node was demoted could cause the promoted node to fail its promotion. <a href="https://redirect.github.com/moby/moby/pull/47869">moby/moby#47869</a></li> <li>[25.0 backport] don't depend on containerd platform.Parse to return a typed error. <a href="https://redirect.github.com/moby/moby/pull/47890">moby/moby#47890</a></li> <li>[25.0 backport] builder/mobyexporter: Add missing nil check <a href="https://redirect.github.com/moby/moby/pull/47987">moby/moby#47987</a></li> </ul> <h3>Packaging updates</h3> <ul> <li>Update AWS SDK Go v2 to v1.24.1 for AWS CloudWatch logging driver. <a href="https://redirect.github.com/moby/moby/pull/47724">moby/moby#47724</a></li> <li>Update Go runtime to 1.21.12, which contains security fixes for <a href="https://github.com/advisories/GHSA-hw49-2p59-3mhj">CVE-2024-24791</a> <a href="https://redirect.github.com/moby/moby/pull/48146">moby/moby#48146</a></li> <li>Update Containerd (static binaries only) to <a href="https://github.com/containerd/containerd/releases/tag/v1.7.20">v1.7.20</a>. <a href="https://redirect.github.com/moby/moby/pull/48199">moby/moby#48199</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/moby/moby/compare/v25.0.5...v25.0.6">https://github.com/moby/moby/compare/v25.0.5...v25.0.6</a></p> <h2>v25.0.5</h2> <h2>25.0.5</h2> <p>For a full list of pull requests and changes in this release, refer to the relevant GitHub milestones:</p> <ul> <li><a href="https://github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A25.0.5">docker/cli, 25.0.5 milestone</a></li> <li><a href="https://github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A25.0.5">moby/moby, 25.0.5 milestone</a></li> <li>Deprecated and removed features, see <a href="https://github.com/docker/cli/blob/v25.0.5/docs/deprecated.md">Deprecated Features</a>.</li> <li>Changes to the Engine API, see <a href="https://github.com/moby/moby/blob/v25.0.5/docs/api/version-history.md">API version history</a>.</li> </ul> <h3>Security</h3> <p>This release contains a security fix for <a href="https://github.com/moby/moby/security/advisories/GHSA-mq39-4gv4-mvpx">CVE-2024-29018</a>, a potential data exfiltration from 'internal' networks via authoritative DNS servers.</p> <h3>Bug fixes and enhancements</h3> <ul> <li> <p><a href="https://github.com/moby/moby/security/advisories/GHSA-mq39-4gv4-mvpx">CVE-2024-29018</a>: Do not forward requests to external DNS servers for a container that is only connected to an 'internal' network. Previously, requests were forwarded if the host's DNS server was running on a loopback address, like systemd's 127.0.0.53. <a href="https://redirect.github.com/moby/moby/pull/47589">moby/moby#47589</a></p> </li> <li> <p>plugin: fix mounting /etc/hosts when running in UserNS. <a href="https://redirect.github.com/moby/moby/pull/47588">moby/moby#47588</a></p> </li> <li> <p>rootless: fix <code>open /etc/docker/plugins: permission denied</code>. <a href="https://redirect.github.com/moby/moby/pull/47587">moby/moby#47587</a></p> </li> <li> <p>Fix multiple parallel <code>docker build</code> runs leaking disk space. <a href="https://redirect.github.com/moby/moby/pull/47527">moby/moby#47527</a></p> </li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/moby/moby/commit/b08a51fe16eed67de3861c03b363ba403643b12e"><code>b08a51f</code></a> Merge pull request <a href="https://redirect.github.com/docker/docker/issues/48231">#48231</a> from austinvazquez/backport-vendor-otel-v0.46.1-to-...</li> <li><a href="https://github.com/moby/moby/commit/d151b0f87f9673f206b477c90db25956e1704ba5"><code>d151b0f</code></a> vendor: OTEL v0.46.1 / v1.21.0</li> <li><a href="https://github.com/moby/moby/commit/c6ba9a5124603357bfc4a64971cbb9708180f06e"><code>c6ba9a5</code></a> Merge pull request <a href="https://redirect.github.com/docker/docker/issues/48225">#48225</a> from austinvazquez/backport-workflow-artifact-reten...</li> <li><a href="https://github.com/moby/moby/commit/4673a3ca2c37ae30270a29c281ccd9477107dcee"><code>4673a3c</code></a> Merge pull request <a href="https://redirect.github.com/docker/docker/issues/48227">#48227</a> from austinvazquez/backport-backport-branch-check-t...</li> <li><a href="https://github.com/moby/moby/commit/30f89081028ce6fb1b49a71c02c156dacbe9aa62"><code>30f8908</code></a> github/ci: Check if backport is opened against the expected branch</li> <li><a href="https://github.com/moby/moby/commit/7454d6a2e672b0b977aaa14463c9aeb53acd06af"><code>7454d6a</code></a> ci: update workflow artifacts retention</li> <li><a href="https://github.com/moby/moby/commit/65cc597cea28cdc25bea3b8a86384b4251872919"><code>65cc597</code></a> Merge commit from fork</li> <li><a href="https://github.com/moby/moby/commit/b722836927669b414569c42f096869cd800b59a6"><code>b722836</code></a> Merge pull request <a href="https://redirect.github.com/docker/docker/issues/48199">#48199</a> from austinvazquez/update-containerd-binary-to-1.7.20</li> <li><a href="https://github.com/moby/moby/commit/e8ecb9c76d97579ebbf3f9d3ef770d08ac303809"><code>e8ecb9c</code></a> update containerd binary to v1.7.20</li> <li><a href="https://github.com/moby/moby/commit/e6cae1f2373d4ff37499570e67f23b2cebb7a043"><code>e6cae1f</code></a> update containerd binary to v1.7.19</li> <li>Additional commits viewable in <a href="https://github.com/docker/docker/compare/v24.0.9...v25.0.6">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/docker/docker&package-manager=go_modules&previous-version=24.0.9+incompatible&new-version=25.0.6+incompatible)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/slsa-framework/slsa-github-generator/network/alerts). </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: Ramon Petgrave <[email protected]> Signed-off-by: Ramon Petgrave <[email protected]>

[![Mend Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com) The Renovate config in this repository needs migrating. Typically this is because one or more configuration options you are using have been renamed. You don't need to merge this PR right away, because Renovate will continue to migrate these fields internally each time it runs. But later some of these fields may be fully deprecated and the migrations removed. So it's a good idea to merge this migration PR soon. 🔕 **Ignore**: Close this PR and you won't be reminded about config migration again, but one day your current config may no longer be valid. ❓ Got questions? Does something look wrong to you? Please don't hesitate to [request help here](https://togithub.com/renovatebot/renovate/discussions). --- This PR was generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View the [repository job log](https://developer.mend.io/github/slsa-framework/slsa-github-generator). Signed-off-by: Ramon Petgrave <[email protected]> Signed-off-by: Ramon Petgrave <[email protected]>

Signed-off-by: Ramon Petgrave <[email protected]> Signed-off-by: Ramon Petgrave <[email protected]>

This reverts commit 8cde63a. Signed-off-by: Ramon Petgrave <[email protected]> Signed-off-by: Ramon Petgrave <[email protected]>

verification Signed-off-by: Ramon Petgrave <[email protected]> Signed-off-by: Ramon Petgrave <[email protected]>

Signed-off-by: Ramon Petgrave <[email protected]> Signed-off-by: Ramon Petgrave <[email protected]>

Signed-off-by: Ramon Petgrave <[email protected]>

…ndlev2

…builder workflows" (#3985) Reverts #3777 Lots of new failing errors in our e2e tests today. We may have missed something when testing these changes. For now, we should revert while we debug, and come up with more robust testing methods. - https://github.com/slsa-framework/example-package/actions/runs/11511156484/job/32044242878#step:6:125 - #3967 ``` **** Verifying provenance authenticity with verifier at HEAD ***** Testing against builder args **** Default parameters (annotated tags) ***** WARNING: Insecure SLSA_VERIFIER_TESTING is enabled. Verifying artifact hello: FAILED: missing signing certificate in bundle FAILED: SLSA verification failed: missing signing certificate in bundle ✖ 1 == 0 :: not main default parameters (annotated_tags) Error: Process completed with exit code 1. ```

Followup to slsa-framework/slsa-github-generator#3777 This PR adds a missing modification for getting the leaf certificate in the new Bundle format v0.3. In my original experiments, I did have this method in a dev branch, but neglected to include it in the final PR. - main...verify-sigstore-go-Bundlev3#diff-a9bfffae1bd0d145e950805e7a35b8e65adc7a68affa605b484f4831097b989cR98-R107 - https://github.com/slsa-framework/slsa-verifier/pull/799/files ## Testing - I re-used the same attestation file from a failing workflow for unit tests and manual invocation. - https://github.com/slsa-framework/example-package/actions/runs/11511156484 ## Followup - Finish finding a way to test changes within PRs. - slsa-framework/slsa-github-generator#3777 (comment) - #797 --------- Signed-off-by: Ramon Petgrave <[email protected]>

ramonpetgrave64 force-pushed the ramonpetgrave64-internal-builder-sigstore-bundlev2 branch from 20e2376 to f9a7e3e Compare August 14, 2024 22:18

ramonpetgrave64 commented Aug 15, 2024

View reviewed changes

ramonpetgrave64 marked this pull request as ready for review August 15, 2024 14:42

ramonpetgrave64 requested review from laurentsimon, joshuagl and kpk47 as code owners August 15, 2024 14:42

ramonpetgrave64 requested review from haydentherapper, loosebazooka, ianlewis and laurentsimon and removed request for kpk47, joshuagl and laurentsimon August 15, 2024 14:42

ramonpetgrave64 marked this pull request as draft August 16, 2024 19:32

ramonpetgrave64 force-pushed the ramonpetgrave64-internal-builder-sigstore-bundlev2 branch from 7d5dcde to 91fc61e Compare August 16, 2024 19:33

ramonpetgrave64 marked this pull request as ready for review August 16, 2024 19:45

ramonpetgrave64 mentioned this pull request Aug 21, 2024

[feature] Output provenance as Sigstore bundle format #3750

Closed

ramonpetgrave64 commented Sep 12, 2024

View reviewed changes

ramonpetgrave64 mentioned this pull request Sep 12, 2024

[bug] Standard discrepancy: buildInvocationId versus buildInvocationID #3876

Open

haydentherapper reviewed Sep 16, 2024

View reviewed changes

ramonpetgrave64 and others added 9 commits October 8, 2024 07:05

debug: print a message

ec2ef9d

Signed-off-by: Ramon Petgrave <[email protected]> Signed-off-by: Ramon Petgrave <[email protected]>

debug: print token payload

26f0792

Signed-off-by: Ramon Petgrave <[email protected]> Signed-off-by: Ramon Petgrave <[email protected]>

debug: make sigstore bundle

8aac1ea

Signed-off-by: Ramon Petgrave <[email protected]> Signed-off-by: Ramon Petgrave <[email protected]>

debug: add checks for err

0ec6b32

Signed-off-by: Ramon Petgrave <[email protected]> Signed-off-by: Ramon Petgrave <[email protected]>

full bundle print

5c4c4ec

Signed-off-by: Ramon Petgrave <[email protected]> Signed-off-by: Ramon Petgrave <[email protected]>

debug: timout and retires

576a078

Signed-off-by: Ramon Petgrave <[email protected]> Signed-off-by: Ramon Petgrave <[email protected]>

debug: no trusted root, no verifying the bundle upon creation

d3be460

Signed-off-by: Ramon Petgrave <[email protected]> Signed-off-by: Ramon Petgrave <[email protected]>

debug: marshall the bunlde

a74d494

Signed-off-by: Ramon Petgrave <[email protected]> Signed-off-by: Ramon Petgrave <[email protected]>

ramonpetgrave64 and others added 18 commits October 8, 2024 07:05

lint

777f1fc

Signed-off-by: Ramon Petgrave <[email protected]> Signed-off-by: Ramon Petgrave <[email protected]>

modularize the fulcio and rekor URLs

b38f9d6

Signed-off-by: Ramon Petgrave <[email protected]> Signed-off-by: Ramon Petgrave <[email protected]>

lint

fe81c3a

Signed-off-by: Ramon Petgrave <[email protected]> Signed-off-by: Ramon Petgrave <[email protected]>

print the rekor log index

7127022

Signed-off-by: Ramon Petgrave <[email protected]> Signed-off-by: Ramon Petgrave <[email protected]>

lint

76ca145

Signed-off-by: Ramon Petgrave <[email protected]> Signed-off-by: Ramon Petgrave <[email protected]>

fix help text

e04b6f8

Signed-off-by: Ramon Petgrave <[email protected]> Signed-off-by: Ramon Petgrave <[email protected]>

remove debug fiel

769ff49

Signed-off-by: Ramon Petgrave <[email protected]> Signed-off-by: Ramon Petgrave <[email protected]>

Revert "remove debug fiel"

2f0a04d

This reverts commit 8cde63a. Signed-off-by: Ramon Petgrave <[email protected]> Signed-off-by: Ramon Petgrave <[email protected]>

remove unused rekor addr, use trusted root for partial inline

0f3b0b9

verification Signed-off-by: Ramon Petgrave <[email protected]> Signed-off-by: Ramon Petgrave <[email protected]>

remove debug workflow

ee41a79

Signed-off-by: Ramon Petgrave <[email protected]> Signed-off-by: Ramon Petgrave <[email protected]>

Update pre-submit.lint.yml

5f8b841

Signed-off-by: Ramon Petgrave <[email protected]>

upgrade golancilint

447cfe0

Signed-off-by: Ramon Petgrave <[email protected]>

lint

c399674

Signed-off-by: Ramon Petgrave <[email protected]>

lowercase

78b455f

Signed-off-by: Ramon Petgrave <[email protected]>

correct print string

b23bcf2

Signed-off-by: Ramon Petgrave <[email protected]>

ramonpetgrave64 force-pushed the ramonpetgrave64-internal-builder-sigstore-bundlev2 branch from bf7c4a6 to b23bcf2 Compare October 8, 2024 07:05

Merge branch 'main' into ramonpetgrave64-internal-builder-sigstore-bu…

60e98e9

…ndlev2

haydentherapper approved these changes Oct 24, 2024

View reviewed changes

ramonpetgrave64 added 2 commits October 24, 2024 19:31

Merge branch 'main' into ramonpetgrave64-internal-builder-sigstore-bu…

739ec4a

…ndlev2

1.23.1 in generator_generic

6bf118c

ramonpetgrave64 enabled auto-merge (squash) October 24, 2024 19:40

ramonpetgrave64 merged commit 2333f37 into main Oct 24, 2024
94 checks passed

ramonpetgrave64 mentioned this pull request Oct 25, 2024

revert: "feat: produce sigstore Bundles for generic generator and go builder workflows" #3985

Merged

This was referenced Oct 29, 2024

fix: fix method for getting leaf certs in Bundle v0.3 slsa-framework/slsa-verifier#813

Merged

feat: testing mode from non-main slsa-framework/slsa-github-generator branches slsa-framework/slsa-verifier#797

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: produce sigstore Bundles for generic generator and go builder workflows #3777

feat: produce sigstore Bundles for generic generator and go builder workflows #3777

ramonpetgrave64 commented Aug 14, 2024 •

edited

Loading

ramonpetgrave64 Aug 15, 2024

ramonpetgrave64 commented Sep 12, 2024

ramonpetgrave64 Sep 12, 2024

haydentherapper left a comment

haydentherapper Sep 16, 2024

ramonpetgrave64 Sep 19, 2024

ramonpetgrave64 Oct 8, 2024

haydentherapper Sep 16, 2024

ramonpetgrave64 Sep 19, 2024

haydentherapper Oct 8, 2024

ramonpetgrave64 Oct 10, 2024

feat: produce sigstore Bundles for generic generator and go builder workflows #3777

feat: produce sigstore Bundles for generic generator and go builder workflows #3777

Conversation

ramonpetgrave64 commented Aug 14, 2024 • edited Loading

Summary

Testing Process

Followup

Checklist

Choose a reason for hiding this comment

ramonpetgrave64 commented Sep 12, 2024

Choose a reason for hiding this comment

haydentherapper left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ramonpetgrave64 commented Aug 14, 2024 •

edited

Loading