Link & SLSA attestor #149
Merged
Link & SLSA attestor #149
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: John Kjell <john@testifysec.com>
…139) When the functionality to calculate gitoids was added, there was a bit of tech debt incurred since they didn't implement hash.Hash. This remedies this with an admitedly hacky implementation of hash.Hash that wraps the gitoid code. This also standardizes our cryptoutil fucntions around the DigestValue struct that was added around this time to differentiate between gitoids and regular hash functions. Signed-off-by: Mikhail Swift <mikhail@testifysec.com> Signed-off-by: John Kjell <john@testifysec.com>
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.2.0 to 4.3.0. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@694cdab...26f96df) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: John Kjell <john@testifysec.com>
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.23.1 to 3.23.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@0b21cf2...b7bf0a3) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Tom Meadows <tom@tmlabs.co.uk> Signed-off-by: John Kjell <john@testifysec.com>
adding job to auto cut releases Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk> Signed-off-by: John Kjell <john@testifysec.com>
fixing error in workflow Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk> Signed-off-by: John Kjell <john@testifysec.com>
* improving run attestors Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk> * finalising changes. Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk> * improving run attestors Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk> * finalising changes. Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk> * addressing review, restoring run type order Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk> * updating error handling logic Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk> * updating to go 1.21 for errors.Join Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk> --------- Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk> Signed-off-by: Tom Meadows <tom@tmlabs.co.uk> Signed-off-by: John Kjell <john@testifysec.com>
adding workaround due to failing workflows Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk> Signed-off-by: John Kjell <john@testifysec.com>
* adding logic so policy signature can be checked against constraints * threaded options into policy validation functionary --------- Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk> Signed-off-by: John Kjell <john@testifysec.com> Co-authored-by: John Kjell <john@testifysec.com> Signed-off-by: John Kjell <john@testifysec.com>
Signed-off-by: StepSecurity Bot <bot@stepsecurity.io> Signed-off-by: John Kjell <john@testifysec.com>
Signed-off-by: John Kjell <john@testifysec.com>
… files Signed-off-by: John Kjell <john@testifysec.com>
Signed-off-by: John Kjell <john@testifysec.com>
Signed-off-by: John Kjell <john@testifysec.com>
Signed-off-by: John Kjell <john@testifysec.com>
Signed-off-by: John Kjell <john@testifysec.com>
|
some opinionated thoughts from me, one little style thing that I think could be a tiny bit neater, but on the whole I ike the principle of the link connector and providing this way of exposing attestations. Code is also really neat and tidy 😄. |
Signed-off-by: John Kjell <john@testifysec.com>
Signed-off-by: John Kjell <john@testifysec.com>
Signed-off-by: John Kjell <john@testifysec.com>
Signed-off-by: John Kjell <john@testifysec.com>
Signed-off-by: John Kjell <john@testifysec.com>
* unmarshal the time in the attestation collection correctly (#203) * add StepName to AttestorContext * use CollectionAttestion to properly set start/end times --------- Signed-off-by: John Kjell <john@testifysec.com> Co-authored-by: Cole Kennedy <colek42@gmail.com> Co-authored-by: Cole <cole@testifysec.com> Co-authored-by: John Kjell <john@testifysec.com>
…nk-attestor Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk>
Signed-off-by: John Kjell <john@testifysec.com>
Signed-off-by: John Kjell <john@testifysec.com>
Signed-off-by: John Kjell <john@testifysec.com>
Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk>
Signed-off-by: John Kjell <john@testifysec.com>
|
Did a quick read through of the code and this all looks reasonable. Will pull and play with it tomorrow. |
Signed-off-by: John Kjell <john@testifysec.com>
3 tasks
Signed-off-by: Tom Meadows <tom@tmlabs.co.uk>
Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk>
Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk>
ChaosInTheCRD
previously approved these changes
May 8, 2024
|
provisionally approving, as long as we can resolve #149 (comment) |
|
Just noticed as well, we need to fix DCO before merge 😄 |
Signed-off-by: John Kjell <john@testifysec.com>
ChaosInTheCRD
approved these changes
May 9, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add a new link attestor and the ability to return multiple signed attestation with
RunWithExportsfunction.