gha

Jul 11, 2024

Changes in this version

type SignedAttestation

+ PublicKey *proto_v1.PublicKeyIdentifier

Aug 24, 2023 GO-2023-2188

  GO-2023-2188: slsa-verifier vulnerable to mproper validation of npm's publish attestations in github.com/slsa-framework/slsa-verifier

Changes in this version

+ var JReleaserRepository = httpsGithubCom + jReleaserActionRepository

type WorkflowIdentity

+ SubjectWorkflow *url.URL

+ func (id *WorkflowIdentity) SubjectWorkflowName() string

+ func (id *WorkflowIdentity) SubjectWorkflowPath() string

Aug 24, 2023 GO-2023-2188

  GO-2023-2188: slsa-verifier vulnerable to mproper validation of npm's publish attestations in github.com/slsa-framework/slsa-verifier

Aug 24, 2023 GO-2023-2188

  GO-2023-2188: slsa-verifier vulnerable to mproper validation of npm's publish attestations in github.com/slsa-framework/slsa-verifier

May 10, 2023 GO-2023-2188

  GO-2023-2188: slsa-verifier vulnerable to mproper validation of npm's publish attestations in github.com/slsa-framework/slsa-verifier

Changes in this version

+ type Hosted int

+ const HostedGitHub

+ const HostedSelf

type TrustedRoot

+ func TrustedRootSingleton(ctx context.Context) (*TrustedRoot, error)

type WorkflowIdentity

+ BuildConfigPath *string

+ BuildTrigger string

+ RunID *string

+ SourceID *string

+ SourceOwnerID *string

+ SourceRef *string

+ SourceRepository string

+ SourceSha1 string

+ SubjectHosted *Hosted

+ SubjectSha1 *string

+ SubjectWorkflowRef string

May 10, 2023 GO-2023-2188

  GO-2023-2188: slsa-verifier vulnerable to mproper validation of npm's publish attestations in github.com/slsa-framework/slsa-verifier

May 8, 2023 GO-2023-2188

  GO-2023-2188: slsa-verifier vulnerable to mproper validation of npm's publish attestations in github.com/slsa-framework/slsa-verifier

May 1, 2023 GO-2023-2188

  GO-2023-2188: slsa-verifier vulnerable to mproper validation of npm's publish attestations in github.com/slsa-framework/slsa-verifier

Apr 20, 2023 GO-2023-2188

  GO-2023-2188: slsa-verifier vulnerable to mproper validation of npm's publish attestations in github.com/slsa-framework/slsa-verifier

Apr 11, 2023 GO-2023-2188

  GO-2023-2188: slsa-verifier vulnerable to mproper validation of npm's publish attestations in github.com/slsa-framework/slsa-verifier

Apr 11, 2023 GO-2023-2188

  GO-2023-2188: slsa-verifier vulnerable to mproper validation of npm's publish attestations in github.com/slsa-framework/slsa-verifier

Mar 6, 2023 GO-2023-2188

  GO-2023-2188: slsa-verifier vulnerable to mproper validation of npm's publish attestations in github.com/slsa-framework/slsa-verifier

Mar 14, 2023 GO-2023-2188

  GO-2023-2188: slsa-verifier vulnerable to mproper validation of npm's publish attestations in github.com/slsa-framework/slsa-verifier

Changes in this version

+ var ErrorMismatchSignature = errors.New("bundle tlog entry does not match signature")

+ var ErrorMissingCertInBundle = errors.New("missing signing certificate in bundle")

+ var ErrorUnexpectedBundleContent = errors.New("expected DSSE bundle content")

+ var ErrorUnexpectedEntryType = errors.New("unexpected tlog entry type")

+ func IsSigstoreBundle(bytes []byte) bool

+ func VerifyBuilderIdentity(id *WorkflowIdentity, builderOpts *options.BuilderOpts, ...) (*utils.TrustedBuilderID, error)

+ func VerifyCertficateSourceRepository(id *WorkflowIdentity, sourceRepo string) error

+ func VerifyNpmPackageProvenance(env *dsselib.Envelope, provenanceOpts *options.ProvenanceOpts) error

+ func VerifyProvenanceCommonOptions(prov slsaprovenance.Provenance, provenanceOpts *options.ProvenanceOpts, ...) error

+ type BundleBytes []byte

+ func (b *BundleBytes) UnmarshalJSON(data []byte) error

type GHAVerifier

+ func (v *GHAVerifier) VerifyNpmPackage(ctx context.Context, attestations []byte, tarballHash string, ...) ([]byte, *utils.TrustedBuilderID, error)

+ type Npm struct

+ func NpmNew(ctx context.Context, root *TrustedRoot, attestationBytes []byte) (*Npm, error)

+ func (n *Npm) ProvenanceEnvelope() *dsse.Envelope

+ func (n *Npm) ProvenanceLeafCertificate() *x509.Certificate

type SignedAttestation

+ func VerifyProvenanceBundle(ctx context.Context, bundleBytes []byte, trustedRoot *TrustedRoot) (*SignedAttestation, error)

+ type TrustedRoot struct

+ CTPubKeys *cosign.TrustedTransparencyLogPubKeys

+ FulcioIntermediates *x509.CertPool

+ FulcioRoot *x509.CertPool

+ RekorPubKeys *cosign.TrustedTransparencyLogPubKeys

+ func GetTrustedRoot(ctx context.Context) (*TrustedRoot, error)

Mar 14, 2023 GO-2023-2188

  GO-2023-2188: slsa-verifier vulnerable to mproper validation of npm's publish attestations in github.com/slsa-framework/slsa-verifier

Mar 9, 2023 GO-2023-2188

  GO-2023-2188: slsa-verifier vulnerable to mproper validation of npm's publish attestations in github.com/slsa-framework/slsa-verifier

Dec 8, 2022 GO-2023-2188

  GO-2023-2188: slsa-verifier vulnerable to mproper validation of npm's publish attestations in github.com/slsa-framework/slsa-verifier

Changes in this version

+ const VerifierName

+ func EnvelopeFromBytes(payload []byte) (env *dsselib.Envelope, err error)

+ func VerifyBranch(prov *intoto.ProvenanceStatement, expectedBranch string) error

+ func VerifyProvenance(env *dsselib.Envelope, provenanceOpts *options.ProvenanceOpts) error

+ func VerifyTag(prov *intoto.ProvenanceStatement, expectedTag string) error

+ func VerifyVersionedTag(prov *intoto.ProvenanceStatement, expectedTag string) error

+ func VerifyWorkflowIdentity(id *WorkflowIdentity, builderOpts *options.BuilderOpts, source string, ...) (*utils.TrustedBuilderID, error)

+ func VerifyWorkflowInputs(prov *intoto.ProvenanceStatement, inputs map[string]string) error

+ type GHAVerifier struct

+ func GHAVerifierNew() *GHAVerifier

+ func (v *GHAVerifier) IsAuthoritativeFor(builderID string) bool

+ func (v *GHAVerifier) VerifyArtifact(ctx context.Context, provenance []byte, artifactHash string, ...) ([]byte, *utils.TrustedBuilderID, error)

+ func (v *GHAVerifier) VerifyImage(ctx context.Context, provenance []byte, artifactImage string, ...) ([]byte, *utils.TrustedBuilderID, error)

+ type SignedAttestation struct

+ Envelope *dsselib.Envelope

+ RekorEntry *models.LogEntryAnon

+ SigningCert *x509.Certificate

+ func GetValidSignedAttestationWithCert(rClient *client.Rekor, provenance []byte) (*SignedAttestation, error)

+ func SearchValidSignedAttestation(ctx context.Context, artifactHash string, provenance []byte, ...) (*SignedAttestation, error)

+ func VerifyProvenanceSignature(ctx context.Context, rClient *client.Rekor, provenance []byte, ...) (*SignedAttestation, error)

+ type WorkflowIdentity struct

+ CallerHash string

+ CallerRepository string

+ Issuer string

+ JobWobWorkflowRef string

+ Trigger string

+ func GetWorkflowInfoFromCertificate(cert *x509.Certificate) (*WorkflowIdentity, error)

Dec 8, 2022 GO-2023-2188

  GO-2023-2188: slsa-verifier vulnerable to mproper validation of npm's publish attestations in github.com/slsa-framework/slsa-verifier

Dec 6, 2022 GO-2023-2188

  GO-2023-2188: slsa-verifier vulnerable to mproper validation of npm's publish attestations in github.com/slsa-framework/slsa-verifier

Dec 6, 2022 GO-2023-2188

  GO-2023-2188: slsa-verifier vulnerable to mproper validation of npm's publish attestations in github.com/slsa-framework/slsa-verifier

Dec 3, 2022 GO-2023-2188

  GO-2023-2188: slsa-verifier vulnerable to mproper validation of npm's publish attestations in github.com/slsa-framework/slsa-verifier