Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
143 commits
Select commit Hold shift + click to select a range
4337447
add attestation cmd
malancas Feb 13, 2024
fa39995
add codeowners
malancas Feb 13, 2024
2be3de6
update args passed to the attestation cmd
malancas Feb 13, 2024
cd221b7
rename file
malancas Feb 13, 2024
e3ae656
use gh-attestation branch for passing iostreams from the root
malancas Feb 13, 2024
24865a6
add package security team entry to codeowners
malancas Mar 1, 2024
2ccc34a
Merge branch 'trunk' into gh-attestation-cmd
malancas Mar 1, 2024
a082815
start moving over verify cmd and general verification code
malancas Mar 1, 2024
3a08c03
clean up common and verify specific policy code
malancas Mar 1, 2024
97c10f4
move artifact package over
malancas Mar 1, 2024
5462df5
start pulling in the github api client wrapper
malancas Mar 1, 2024
7f3e818
fix imports
malancas Mar 2, 2024
82bd13b
add logger and test packages
malancas Mar 2, 2024
501add4
add additional packages to support verify command
malancas Mar 4, 2024
ff1eb37
fix mock api client
malancas Mar 4, 2024
fe5d85e
clean up mock api client
malancas Mar 4, 2024
a340e9b
include missing fields
malancas Mar 4, 2024
b8a570f
use correct owner
malancas Mar 4, 2024
b1fbfdd
add more mock api client options
malancas Mar 4, 2024
cbd57de
add download cmd
malancas Mar 4, 2024
884fe22
add inspect cmd
malancas Mar 4, 2024
f832d57
pass factory object to inspect cmd, add inspect sub cmd to attestatio…
malancas Mar 4, 2024
e35bec9
add verify-tuf-root cmd
malancas Mar 4, 2024
fa22214
pass iostream struct from command
malancas Mar 4, 2024
4df1548
rename logger pkg to logger
malancas Mar 4, 2024
31a00b4
fix path in codeowners
malancas Mar 4, 2024
149a78a
formatter
malancas Mar 4, 2024
7fddc8f
Merge branch 'trunk' into gh-attestation-cmd
malancas Mar 4, 2024
532fe95
go mod tidy
malancas Mar 4, 2024
9c3d1e5
Merge branch 'gh-attestation-cmd' of github.com:malancas/cli into gh-…
malancas Mar 4, 2024
fec5bfb
fix printf linter issue
malancas Mar 4, 2024
625c441
fix printf linter issue
malancas Mar 4, 2024
af90403
check user's GH host for compatibility
malancas Mar 5, 2024
6507122
pass oci client to commands directly
malancas Mar 5, 2024
56261d7
rename command
malancas Mar 5, 2024
2923d10
mark tuf-root-verify cmd hidden
malancas Mar 5, 2024
155a7c9
move client initialization back to subcommands
malancas Mar 6, 2024
4273980
add more verbose options and logging
malancas Mar 6, 2024
277af34
add missing logger
malancas Mar 6, 2024
5492f89
add testing around OCI and API client
malancas Mar 6, 2024
956e10a
add integration test
malancas Mar 6, 2024
3e34139
Merge branch 'trunk' into gh-attestation-cmd
malancas Mar 6, 2024
e756694
fix file path
malancas Mar 6, 2024
1a7fa8e
Merge branch 'gh-attestation-cmd' of github.com:malancas/cli into gh-…
malancas Mar 6, 2024
9b9ddcd
fix command
malancas Mar 6, 2024
617a9f3
build executable before integration test
malancas Mar 6, 2024
b973914
split integration tests
malancas Mar 6, 2024
e171f97
remove integration test steps
malancas Mar 6, 2024
e43d98f
fix flag value
malancas Mar 6, 2024
b64e003
run integration tests on ubuntu for now
malancas Mar 6, 2024
fbba7b5
pull over doc updates
malancas Mar 6, 2024
5ad63c0
delete unused test data
malancas Mar 6, 2024
5dbdb3e
Merge branch 'trunk' into gh-attestation-cmd
malancas Mar 7, 2024
b42fc73
Merge branch 'trunk' into gh-attestation-cmd
malancas Mar 12, 2024
cf54f05
remove Go patch version
malancas Mar 12, 2024
e0fc8c7
switch assert to require
malancas Mar 12, 2024
71480af
rename file
malancas Mar 12, 2024
8f412af
move integration tests to prexisting test workflow
malancas Mar 12, 2024
fbb27df
use platform matrix for integration tests
malancas Mar 12, 2024
ac79032
simplify build step
malancas Mar 12, 2024
f1a2f8f
use StringEnumFlag handling
malancas Mar 12, 2024
b8c9f96
typo
malancas Mar 12, 2024
be6b042
use the iostreams.Test helper func
malancas Mar 12, 2024
f055517
create interface for oci client
malancas Mar 12, 2024
38adc43
add tests for oci client
malancas Mar 12, 2024
54db553
rename files
malancas Mar 12, 2024
4690166
format file
malancas Mar 12, 2024
cd1c30a
fix shellcheck issues
malancas Mar 12, 2024
f78e104
use testing TempDir method
malancas Mar 12, 2024
63b5872
cleanup unused tempdir handling
malancas Mar 12, 2024
3ee14bb
use table driven tests
malancas Mar 12, 2024
658fab2
check correct cmd
malancas Mar 12, 2024
0018903
support repo option in download sub cmd
malancas Mar 12, 2024
9ad3b22
switch over to using RunE
malancas Mar 12, 2024
4ae0470
unexport top level subcommand funcs
malancas Mar 13, 2024
310a54f
add comment around keychain option
malancas Mar 13, 2024
7565cc4
update comments
malancas Mar 13, 2024
be8ce2b
fix inconsistent naming
malancas Mar 13, 2024
9becdc5
add tests for CLI commands
malancas Mar 13, 2024
af7f699
Merge branch 'trunk' into gh-attestation-cmd
malancas Mar 14, 2024
01260ef
check for noattestationsfound err
malancas Mar 14, 2024
06801fb
try out metadata abstraction instead
malancas Mar 14, 2024
39a76fd
switch to using MetadataStore abstraction
malancas Mar 14, 2024
7f477af
include test case with failing metadata store
malancas Mar 14, 2024
8e3c197
look for err specific to file write
malancas Mar 14, 2024
3c2ded1
unexport fields
malancas Mar 14, 2024
2cf02a4
return err when an unsupported hash alg is provided
malancas Mar 14, 2024
587b318
PrintTableToStdOut returns err when rendering fails
malancas Mar 14, 2024
5787fef
start adding sigstore verifier unit tests
malancas Mar 15, 2024
99111a3
add more sigstore verifier specific tests
malancas Mar 15, 2024
11eba5e
use cli table printer
malancas Mar 15, 2024
338f9cf
return JSON results in slice instead of table
malancas Mar 15, 2024
ff1e8e4
move mock client to test file
malancas Mar 15, 2024
24412d2
remove unneeded table printer method
malancas Mar 15, 2024
cf8f0ea
add initial tests for tufrootverify cmd
malancas Mar 15, 2024
8177c6c
formatting
malancas Mar 15, 2024
79fa437
cleanup method
malancas Mar 15, 2024
ead84a2
close file in error handling branch
malancas Mar 15, 2024
1ba04c6
normalize artifact path
malancas Mar 15, 2024
67ac04b
remove unneeded embedded file system
malancas Mar 15, 2024
7067130
include image name reference err
malancas Mar 15, 2024
007d368
use GH_DEBUG value for io handling
malancas Mar 15, 2024
af75fe8
remove quiet and verbose flags
malancas Mar 15, 2024
2ef8eb6
add more tufrootveriify tests
malancas Mar 15, 2024
b5f6bd5
GitHubTUFOptions no longer needs to return error
malancas Mar 15, 2024
08f0a56
remove unneeded slice
malancas Mar 15, 2024
274af8b
normalize all relative paths
malancas Mar 15, 2024
5cc2f6a
clean up nil client checks
malancas Mar 18, 2024
cbcd34e
set api server based on host
malancas Mar 18, 2024
b37bf1f
Merge branch 'trunk' into gh-attestation-cmd
malancas Mar 18, 2024
53df7cd
add comment about http client
malancas Mar 18, 2024
172e4f6
use format flag to handle json output in verify cmd
malancas Mar 18, 2024
09b11db
use format flag to handle json output
malancas Mar 18, 2024
6abd1fe
Merge branch 'trunk' into gh-attestation-cmd
malancas Mar 18, 2024
4f2f719
use normalized path for cli test arg
malancas Mar 18, 2024
b5ffcf1
Merge branch 'gh-attestation-cmd' of github.com:malancas/cli into gh-…
malancas Mar 18, 2024
12c7de2
add tests for json output
malancas Mar 18, 2024
02a1274
cleanup error wrapping
malancas Mar 18, 2024
807eefd
use test fixtures correctly by normalizing path
malancas Mar 18, 2024
1e51ec7
Merge branch 'trunk' into gh-attestation-cmd
malancas Mar 18, 2024
2a00a02
dont clean
malancas Mar 18, 2024
5172edd
escape backwards slash for windows files with replace
malancas Mar 19, 2024
023b2af
Merge branch 'trunk' into gh-attestation-cmd
malancas Mar 19, 2024
79d3c95
use strings.Split func
malancas Mar 19, 2024
98d7bef
use strings.Replace for all command tests
malancas Mar 19, 2024
3391fb1
Merge branch 'trunk' into gh-attestation-cmd
malancas Mar 20, 2024
49dfa3f
use CLI cache dir to store tuf metadata
malancas Mar 20, 2024
c16406b
Merge branch 'gh-attestation-cmd' of github.com:malancas/cli into gh-…
malancas Mar 20, 2024
2e1d27a
Tweaked docstrings for gh attestation download
phillmv Mar 22, 2024
416d981
Tweaked docstrings for gh attestation verify
phillmv Mar 22, 2024
e9e1b09
Fix for bug in gh attestation where the wrong hostname was being pass…
phillmv Mar 22, 2024
96da5f7
lets hide tuf-root-verify eh?
phillmv Mar 22, 2024
0b14695
Forgot verify's short str.
phillmv Mar 25, 2024
6b4f387
Merge branch 'trunk' into gh-attestation-cmd
malancas Mar 25, 2024
de63dea
Merge pull request #2 from phillmv/gh-attestation-cmd
malancas Mar 25, 2024
64c3fd0
Merge pull request #1 from phillmv/fix-verify-api-requests
malancas Mar 25, 2024
c0ceb99
add remote verification test
malancas Mar 25, 2024
bb3b6ab
Revert "add remote verification test"
malancas Mar 25, 2024
2522b10
update json result handling
malancas Mar 25, 2024
ad0b36c
add json tags to struct returned by command
malancas Mar 25, 2024
308a2c4
fix how json results are handled
malancas Mar 25, 2024
ccd1cc4
add test to ensure JSON output is valid
malancas Mar 25, 2024
ded4bea
Merge branch 'trunk' into gh-attestation-cmd
malancas Mar 29, 2024
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .github/CODEOWNERS
Original file line number Diff line number Diff line change
Expand Up @@ -2,3 +2,6 @@

pkg/cmd/codespace/ @cli/codespaces
internal/codespaces/ @cli/codespaces

# Limit Package Security team ownership to the attestation command package
pkg/cmd/attestation/ @cli/package-security
26 changes: 25 additions & 1 deletion .github/workflows/go.yml
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
name: Tests
name: Unit and Integration Tests
on: [push, pull_request]

permissions:
Expand Down Expand Up @@ -37,3 +37,27 @@ jobs:

- name: Build
run: go build -v ./cmd/gh

integration-tests:
env:
GH_TOKEN: ${{ github.token }}
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, windows-latest, macos-latest]
runs-on: ${{ matrix.os }}

steps:
- name: Set up Go 1.21
uses: actions/setup-go@v5
with:
go-version: 1.21

- name: Check out code
uses: actions/checkout@v4

- name: Build executable
run: make

- name: Run attestation command integration Tests
run: ./test/integration/attestation-cmd/download-and-verify-package-attestation.sh
111 changes: 94 additions & 17 deletions go.mod
Original file line number Diff line number Diff line change
Expand Up @@ -14,33 +14,38 @@ require (
github.com/cli/safeexec v1.0.1
github.com/cpuguy83/go-md2man/v2 v2.0.4
github.com/creack/pty v1.1.21
github.com/distribution/reference v0.5.0
github.com/gabriel-vasile/mimetype v1.4.3
github.com/gdamore/tcell/v2 v2.5.4
github.com/google/go-cmp v0.5.9
github.com/google/go-cmp v0.6.0
github.com/google/go-containerregistry v0.19.0
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510
github.com/gorilla/websocket v1.4.2
github.com/gorilla/websocket v1.5.0
github.com/hashicorp/go-multierror v1.1.1
github.com/hashicorp/go-version v1.3.0
github.com/henvic/httpretty v0.1.3
github.com/in-toto/in-toto-golang v0.9.0
github.com/joho/godotenv v1.5.1
github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
github.com/mattn/go-colorable v0.1.13
github.com/mattn/go-isatty v0.0.20
github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d
github.com/microsoft/dev-tunnels v0.0.25
github.com/muhammadmuzzammil1998/jsonc v0.0.0-20201229145248-615b0916ca38
github.com/opentracing/opentracing-go v1.1.0
github.com/opentracing/opentracing-go v1.2.0
github.com/rivo/tview v0.0.0-20221029100920-c4a7e501810d
github.com/shurcooL/githubv4 v0.0.0-20230704064427-599ae7bbf278
github.com/spf13/cobra v1.6.1
github.com/sigstore/protobuf-specs v0.3.0
github.com/sigstore/sigstore-go v0.2.1-0.20240222221148-8bd2a8139edc
github.com/spf13/cobra v1.8.0
github.com/spf13/pflag v1.0.5
github.com/stretchr/testify v1.8.4
github.com/zalando/go-keyring v0.2.4
golang.org/x/crypto v0.17.0
golang.org/x/sync v0.1.0
golang.org/x/term v0.15.0
golang.org/x/crypto v0.19.0
golang.org/x/sync v0.6.0
golang.org/x/term v0.17.0
golang.org/x/text v0.14.0
google.golang.org/grpc v1.56.3
google.golang.org/grpc v1.61.0
google.golang.org/protobuf v1.33.0
gopkg.in/h2non/gock.v1 v1.1.2
gopkg.in/yaml.v3 v3.0.1
Expand All @@ -49,41 +54,113 @@ require (
require (
github.com/alecthomas/chroma v0.10.0 // indirect
github.com/alessio/shellescape v1.4.2 // indirect
github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
github.com/aymanbagabas/go-osc52 v1.0.3 // indirect
github.com/aymerick/douceur v0.2.0 // indirect
github.com/blang/semver v3.5.1+incompatible // indirect
github.com/cli/browser v1.3.0 // indirect
github.com/cli/shurcooL-graphql v0.0.4 // indirect
github.com/containerd/stargz-snapshotter/estargz v0.14.3 // indirect
github.com/cyberphone/json-canonicalization v0.0.0-20220623050100-57a0ce2678a7 // indirect
github.com/danieljoos/wincred v1.2.1 // indirect
github.com/davecgh/go-spew v1.1.1 // indirect
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
github.com/digitorus/pkcs7 v0.0.0-20230818184609-3a137a874352 // indirect
github.com/digitorus/timestamp v0.0.0-20231217203849-220c5c2851b7 // indirect
github.com/dlclark/regexp2 v1.4.0 // indirect
github.com/fatih/color v1.7.0 // indirect
github.com/docker/cli v24.0.0+incompatible // indirect
github.com/docker/distribution v2.8.2+incompatible // indirect
github.com/docker/docker v24.0.7+incompatible // indirect
github.com/docker/docker-credential-helpers v0.7.0 // indirect
github.com/fatih/color v1.14.1 // indirect
github.com/fsnotify/fsnotify v1.7.0 // indirect
github.com/gdamore/encoding v1.0.0 // indirect
github.com/go-chi/chi v4.1.2+incompatible // indirect
github.com/go-logr/logr v1.4.1 // indirect
github.com/go-logr/stdr v1.2.2 // indirect
github.com/go-openapi/analysis v0.22.0 // indirect
github.com/go-openapi/errors v0.21.0 // indirect
github.com/go-openapi/jsonpointer v0.20.2 // indirect
github.com/go-openapi/jsonreference v0.20.4 // indirect
github.com/go-openapi/loads v0.21.5 // indirect
github.com/go-openapi/runtime v0.27.1 // indirect
github.com/go-openapi/spec v0.20.14 // indirect
github.com/go-openapi/strfmt v0.22.0 // indirect
github.com/go-openapi/swag v0.22.9 // indirect
github.com/go-openapi/validate v0.22.6 // indirect
github.com/godbus/dbus/v5 v5.1.0 // indirect
github.com/golang/protobuf v1.5.3 // indirect
github.com/google/certificate-transparency-go v1.1.7 // indirect
github.com/google/uuid v1.6.0 // indirect
github.com/gorilla/css v1.0.0 // indirect
github.com/h2non/parth v0.0.0-20190131123155-b4df798d6542 // indirect
github.com/hashicorp/errwrap v1.0.0 // indirect
github.com/inconshreveable/mousetrap v1.0.1 // indirect
github.com/hashicorp/errwrap v1.1.0 // indirect
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
github.com/hashicorp/go-retryablehttp v0.7.5 // indirect
github.com/hashicorp/hcl v1.0.0 // indirect
github.com/inconshreveable/mousetrap v1.1.0 // indirect
github.com/itchyny/gojq v0.12.13 // indirect
github.com/itchyny/timefmt-go v0.1.5 // indirect
github.com/kr/text v0.2.0 // indirect
github.com/jedisct1/go-minisign v0.0.0-20211028175153-1c139d1cc84b // indirect
github.com/josharian/intern v1.0.0 // indirect
github.com/klauspost/compress v1.17.0 // indirect
github.com/letsencrypt/boulder v0.0.0-20230907030200-6d76a0f91e1e // indirect
github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
github.com/magiconair/properties v1.8.7 // indirect
github.com/mailru/easyjson v0.7.7 // indirect
github.com/mattn/go-runewidth v0.0.14 // indirect
github.com/microcosm-cc/bluemonday v1.0.26 // indirect
github.com/mitchellh/go-homedir v1.1.0 // indirect
github.com/mitchellh/mapstructure v1.5.0 // indirect
github.com/muesli/reflow v0.3.0 // indirect
github.com/muesli/termenv v0.13.0 // indirect
github.com/oklog/ulid v1.3.1 // indirect
github.com/olekukonko/tablewriter v0.0.5 // indirect
github.com/pmezard/go-difflib v1.0.0 // indirect
github.com/opencontainers/go-digest v1.0.0 // indirect
github.com/opencontainers/image-spec v1.1.0-rc5 // indirect
github.com/pelletier/go-toml/v2 v2.1.0 // indirect
github.com/pkg/errors v0.9.1 // indirect
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
github.com/rivo/uniseg v0.4.4 // indirect
github.com/rodaine/table v1.0.1 // indirect
github.com/russross/blackfriday/v2 v2.1.0 // indirect
github.com/sagikazarmark/locafero v0.4.0 // indirect
github.com/sagikazarmark/slog-shim v0.1.0 // indirect
github.com/sassoftware/relic v7.2.1+incompatible // indirect
github.com/secure-systems-lab/go-securesystemslib v0.8.0 // indirect
github.com/shibumi/go-pathspec v1.3.0 // indirect
github.com/shurcooL/graphql v0.0.0-20230722043721-ed46e5a46466 // indirect
github.com/sigstore/rekor v1.3.5 // indirect
github.com/sigstore/sigstore v1.8.1 // indirect
github.com/sigstore/timestamp-authority v1.2.2 // indirect
github.com/sirupsen/logrus v1.9.3 // indirect
github.com/sourcegraph/conc v0.3.0 // indirect
github.com/spf13/afero v1.11.0 // indirect
github.com/spf13/cast v1.6.0 // indirect
github.com/spf13/viper v1.18.2 // indirect
github.com/stretchr/objx v0.5.0 // indirect
github.com/subosito/gotenv v1.6.0 // indirect
github.com/theupdateframework/go-tuf v0.7.0 // indirect
github.com/theupdateframework/go-tuf/v2 v2.0.0-20240222081530-454b12158917 // indirect
github.com/thlib/go-timezone-local v0.0.0-20210907160436-ef149e42d28e // indirect
github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 // indirect
github.com/transparency-dev/merkle v0.0.2 // indirect
github.com/vbatts/tar-split v0.11.3 // indirect
github.com/yuin/goldmark v1.5.2 // indirect
github.com/yuin/goldmark-emoji v1.0.1 // indirect
golang.org/x/net v0.17.0 // indirect
go.mongodb.org/mongo-driver v1.13.1 // indirect
go.opentelemetry.io/otel v1.22.0 // indirect
go.opentelemetry.io/otel/metric v1.22.0 // indirect
go.opentelemetry.io/otel/trace v1.22.0 // indirect
go.uber.org/multierr v1.11.0 // indirect
go.uber.org/zap v1.26.0 // indirect
golang.org/x/exp v0.0.0-20231006140011-7918f672742d // indirect
golang.org/x/mod v0.15.0 // indirect
golang.org/x/net v0.21.0 // indirect
golang.org/x/sys v0.18.0 // indirect
google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1 // indirect
gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 // indirect
google.golang.org/genproto v0.0.0-20240116215550-a9fa1716bcac // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20240125205218-1f4bbc51befe // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20240116215550-a9fa1716bcac // indirect
gopkg.in/go-jose/go-jose.v2 v2.6.1 // indirect
gopkg.in/ini.v1 v1.67.0 // indirect
k8s.io/klog/v2 v2.120.0 // indirect
)
Loading