Comparing changes

#label:release v2.4.1 How to LGTM this PR: Ensure you have installed the GitHub client from https://cli.github.com. If it is not installed in your `PATH`, set `export GH=/path/to/your/gh` Set your `export GH_TOKEN=...` Use [verify-release.sh](./verify-release.sh) script in this repository: ``` bash verify-release v2.4.1 ``` Once it completes, you will see the last line `Verifying artifact /tmp/tmp.SomeRanDOm/` and do: ```bash sha256sum /tmp/tmp.SomeRanDOm/* | grep -v intoto ``` This will print out the hashes. Compare them to the changes in this PR --------- Signed-off-by: laurentsimon <[email protected]>

Makes renovate create PRs for dependency updates monthly rather than weekly. https://docs.renovatebot.com/presets-schedule/#schedulemonthly Also sets vulnerability PRs to be scheduled daily. https://docs.renovatebot.com/configuration-options/#vulnerabilityalerts Signed-off-by: Ian Lewis <[email protected]>

Should fix #726 Signed-off-by: laurentsimon <[email protected]>

Signed-off-by: laurentsimon <[email protected]>

triggered on specification of COSIGN_REPOSITORY env --------- Signed-off-by: saisatishkarra <[email protected]> Signed-off-by: laurentsimon <[email protected]> Co-authored-by: laurentsimon <[email protected]>

I'm not really contributing to slsa-verifier anymore. Signed-off-by: Ian Lewis <[email protected]>

Previously we used the go-cmp's Diff for displaying a human-friendly diff between two structs in an error message. I had intended to do a json print of the structs and do a line-by-line diff. There is an internal library for calculating text diff, but I don't see any external functions that expose it to make it available for our use: https://pkg.go.dev/golang.org/x/tools/internal/diff Instead, this we will simply display both structs in their own "actual" and "expected" sections. The user can use their other tools to find a human-friendly diff. Signed-off-by: Ramon Petgrave <[email protected]>

@laurentsimon

…erification (#736) @laurentsimon Added a new image verification cmd input `--provenance-repository` This replicates the feature of the `COSIGN_REPOSITORY` environment variable when provenance is stored in a different repository/registry Order of precedence: - If input `--provenance-repository` is set, leverages the non-empty input value - If the env variable `COSIGN_REPOSITORY` is set, it is NOT consumed README edit : https://github.com/slsa-framework/slsa-verifier/pull/736/files#diff-b335630551682c19a781afebcf4d07bf978fb1f8ac04c6bf87428ed5106870f5R280 --------- Signed-off-by: saisatishkarra <[email protected]> Co-authored-by: laurentsimon <[email protected]>

Fixing the existing PR #498 to also change the github actions to use the go 1.21 sourced directly from `go.mod`. - https://github.com/slsa-framework/slsa-github-generator/blob/07e64b653f10a80b6510f4568f685f8b7b9ea830/.github/workflows/builder_go_slsa3.yml#L56 - https://github.com/actions/setup-go?tab=readme-ov-file#getting-go-version-from-the-gomod-file - https://github.com/slsa-framework/slsa-verifier/actions/runs/7559933600/job/20584856777?pr=498 > ... Error: We were unable to automatically build your code. Please replace the call to the autobuild action with your custom build steps. Encountered a fatal error while running "/opt/hostedtoolcache/CodeQL/2.15.5/x64/codeql/go/tools/autobuild.sh". Exit code was 1 and error was: 2024/01/17 18:06:58 Autobuilder was built with go1.21.5, environment has go1.20.12 ... Also fixing some more lint checks about repeated strings --------- Signed-off-by: Mend Renovate <[email protected]> Signed-off-by: Ramon Petgrave <[email protected]> Co-authored-by: Mend Renovate <[email protected]>

This is in preparation for switching over the Rekor entry type in the slsa github generator to be the newer DSSE type. This adds support for searching for both intoto v001 and dsse v001 entries. Signed-off-by: Hayden Blauzvern <[email protected]>

We need the pre-submit to pass. Merging can happen after the builder release --------- Signed-off-by: laurentsimon <[email protected]>

This is part of the release tests in https://github.com/slsa-framework/slsa-verifier/blob/main/RELEASE.md#dry-run to verify that the Action installer works. A follow up PR will be sent prior to release to update to `v2.5.0` --------- Signed-off-by: laurentsimon <[email protected]>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Comparing changes

Open a pull request

Commits on Nov 8, 2023

Commits on Dec 1, 2023

Commits on Dec 5, 2023

Commits on Jan 3, 2024

Commits on Jan 4, 2024

Commits on Jan 16, 2024

Commits on Jan 17, 2024

Commits on Jan 22, 2024

Commits on Jan 24, 2024

Commits on Mar 4, 2024

Commits on Mar 21, 2024

Commits on Mar 22, 2024

Commits on Mar 25, 2024

This comparison is taking too long to generate.