Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

update golangci-lint to v1.53.x and add depguard rules #1216

Merged
merged 1 commit into from Jun 17, 2023
Merged

update golangci-lint to v1.53.x and add depguard rules #1216

merged 1 commit into from Jun 17, 2023

Conversation

cpanato
Copy link
Member

@cpanato cpanato commented Jun 13, 2023

Summary

  • update golangci-lint to v1.53.x and add depguard rules

haydentherapper
haydentherapper reviewed Jun 13, 2023
View reviewed changes
Copy link
Contributor

@haydentherapper haydentherapper left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What is the purpose of depguard?

@cpanato
Copy link
Member Author

cpanato commented Jun 15, 2023

What is the purpose of depguard?

A Go linter that checks package imports are in a list of acceptable packages. This allows you to allow imports from a whole organization or only allow specific packages within a repository.

I was thinking and I am not sure if we want to have that. What are your thoughts?

@haydentherapper
Copy link
Contributor

I think this would make sense more at the org level rather than repo. Because if I want to add a dependency, I’ll just update this list in the same PR.

I’m hesitant to put this at the org level though since that sounds like a lot of effort to maintain.

@cpanato
Copy link
Member Author

cpanato commented Jun 16, 2023

I think this would make sense more at the org level rather than repo. Because if I want to add a dependency, I’ll just update this list in the same PR.

I’m hesitant to put this at the org level, thought since that sounds like a lot of effort to maintain.

agree and thinking more for now that is just overhead to us, i will drop that change and remove the depguard check, thanks for the review and feedback

@cpanato
update golangci-lint to v1.53.x and add depguard rules
743278b 
Signed-off-by: cpanato <ctadeu@gmail.com>
@cpanato cpanato merged commit 4a1077d into sigstore:main Jun 17, 2023
9 checks passed
ianlewis pushed a commit to slsa-framework/slsa-github-generator that referenced this pull request Jun 27, 2023
@renovate-bot
fix(deps): update go (#2338)
685c08c 
[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [github.com/sigstore/cosign/v2](https://togithub.com/sigstore/cosign)
| require | minor | `v2.0.2` -> `v2.1.0` |
| [github.com/sigstore/sigstore](https://togithub.com/sigstore/sigstore)
| require | minor | `v1.6.4` -> `v1.7.1` |

---

### ⚠ Dependency Lookup Warnings ⚠

Warnings were logged while processing this repo. Please check the
Dependency Dashboard for more information.

---

### Release Notes

<details>
<summary>sigstore/cosign</summary>

###
[`v2.1.0`](https://togithub.com/sigstore/cosign/blob/HEAD/CHANGELOG.md#v210)

[Compare
Source](https://togithub.com/sigstore/cosign/compare/v2.0.2...v2.1.0)

**Breaking Change: The predicate is now a required flag in the attest
commands, set via the --type flag.**

#### Enhancements

- Verify sigs and attestations in parallel
([#&#8203;3066](https://togithub.com/sigstore/cosign/issues/3066))
- Deep inspect attestations when filtering download
([#&#8203;3031](https://togithub.com/sigstore/cosign/issues/3031))
- refactor bundle validation code, add support for DSSE rekor type
([#&#8203;3016](https://togithub.com/sigstore/cosign/issues/3016))
- Allow overriding remote options
([#&#8203;3049](https://togithub.com/sigstore/cosign/issues/3049))
- feat: adds no cert found on sig exit code
([#&#8203;3038](https://togithub.com/sigstore/cosign/issues/3038))
- Make predicate a required flag in attest commands
([#&#8203;3033](https://togithub.com/sigstore/cosign/issues/3033))
- Added support for attaching Time stamp authority Response in attach
command
([#&#8203;3001](https://togithub.com/sigstore/cosign/issues/3001))
- Add `sign --sign-container-identity` CLI
([#&#8203;2984](https://togithub.com/sigstore/cosign/issues/2984))
- Feature: Allow cosign to sign digests before they are uploaded.
([#&#8203;2959](https://togithub.com/sigstore/cosign/issues/2959))
- accepts `attachment-tag-prefix` for `cosign copy`
([#&#8203;3014](https://togithub.com/sigstore/cosign/issues/3014))
- Feature: adds '--allow-insecure-registry' for cosign load
([#&#8203;3000](https://togithub.com/sigstore/cosign/issues/3000))
- download attestation: support --platform flag
([#&#8203;2980](https://togithub.com/sigstore/cosign/issues/2980))
- Cleanup: Add `Digest` to the `SignedEntity` interface.
([#&#8203;2960](https://togithub.com/sigstore/cosign/issues/2960))
- verify command: support keyless verification using only a provided
certificate chain with non-fulcio roots
([#&#8203;2845](https://togithub.com/sigstore/cosign/issues/2845))
- verify: use workers to limit the paralellism when verifying images
with --max-workers flag
([#&#8203;3069](https://togithub.com/sigstore/cosign/issues/3069))

#### Bug Fixes

- Fix pkg/cosign/errors
([#&#8203;3050](https://togithub.com/sigstore/cosign/issues/3050))
- fix: update doc to refer to github-actions oidc provider
([#&#8203;3040](https://togithub.com/sigstore/cosign/issues/3040))
- fix: prefer GitHub OIDC provider if enabled
([#&#8203;3044](https://togithub.com/sigstore/cosign/issues/3044))
- Fix --sig-only in cosign copy
([#&#8203;3074](https://togithub.com/sigstore/cosign/issues/3074))

#### Documentation

- Fix links to sigstore/docs in markdown files
([#&#8203;3064](https://togithub.com/sigstore/cosign/issues/3064))
- Update release readme
([#&#8203;2942](https://togithub.com/sigstore/cosign/issues/2942))

**Thank you to our contributors!**

-   Bob Callaway
-   Carlos Tadeu Panato Junior
-   Chok Yip Lau
-   Chris Burns
-   Dmitry Savintsev
-   Enyinna Ochulor
-   Hayden B
-   Hector Fernandez
-   Jakub Hrozek
-   Jason Hall
-   Jon Johnson
-   Luiz Carvalho
-   Matt Moore
-   Mritunjay Kumar Sharma
-   Mukuls77
-   Ramkumar Chinchani
-   Sascha Grunert
-   Yolanda Robla Mota
-   priyawadhwa

</details>

<details>
<summary>sigstore/sigstore</summary>

###
[`v1.7.1`](https://togithub.com/sigstore/sigstore/releases/tag/v1.7.1)

[Compare
Source](https://togithub.com/sigstore/sigstore/compare/v1.7.0...v1.7.1)

#### What's Changed

- Allow the user to optionally pass a Key Vault key version, update the
SDK by [@&#8203;malancas](https://togithub.com/malancas) in
[sigstore/sigstore#1231
- update golangci-lint to v1.53.x by
[@&#8203;cpanato](https://togithub.com/cpanato) in
[sigstore/sigstore#1216

**Full Changelog**:
sigstore/sigstore@v1.7.0...v1.7.1

###
[`v1.7.0`](https://togithub.com/sigstore/sigstore/releases/tag/v1.7.0)

[Compare
Source](https://togithub.com/sigstore/sigstore/compare/v1.6.5...v1.7.0)

#### What's Changed

- Update Azure Key Vault client by
[@&#8203;malancas](https://togithub.com/malancas) in
[sigstore/sigstore#1170
- kms: split KMS providers into separate Go modules by
[@&#8203;imjasonh](https://togithub.com/imjasonh) in
[sigstore/sigstore#1115
- have submodules specify real s/s releases by
[@&#8203;imjasonh](https://togithub.com/imjasonh) in
[sigstore/sigstore#1178
- Update go.mod and dependabot config by
[@&#8203;cpanato](https://togithub.com/cpanato) in
[sigstore/sigstore#1184
- Add `Cosign.ClaimedIdentity` API by
[@&#8203;saschagrunert](https://togithub.com/saschagrunert) in
[sigstore/sigstore#1166
- build(deps): bump github.com/aws/aws-sdk-go from 1.44.274 to 1.44.275
in /pkg/signature/kms/aws by
[@&#8203;dependabot](https://togithub.com/dependabot) in
[sigstore/sigstore#1199
- Azure KMS: Infer hash function from key by
[@&#8203;codysoyland](https://togithub.com/codysoyland) in
[sigstore/sigstore#1149
- update golang.org/x/crypto to v0.10.0 and golang.org/x/oauth2 v0.9.0
by [@&#8203;cpanato](https://togithub.com/cpanato) in
[sigstore/sigstore#1225

#### New Contributors

- [@&#8203;saschagrunert](https://togithub.com/saschagrunert) made their
first contribution in
[sigstore/sigstore#1166

**Full Changelog**:
sigstore/sigstore@v1.6.4...v1.7.0

###
[`v1.6.5`](https://togithub.com/sigstore/sigstore/releases/tag/v1.6.5)

[Compare
Source](https://togithub.com/sigstore/sigstore/compare/v1.6.4...v1.6.5)

#### What's Changed

- Update Azure Key Vault client by
[@&#8203;malancas](https://togithub.com/malancas) in
[sigstore/sigstore#1170
- kms: split KMS providers into separate Go modules by
[@&#8203;imjasonh](https://togithub.com/imjasonh) in
[sigstore/sigstore#1115
- have submodules specify real s/s releases by
[@&#8203;imjasonh](https://togithub.com/imjasonh) in
[sigstore/sigstore#1178

**Full Changelog**:
sigstore/sigstore@v1.6.4...v1.6.5

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "every weekend" (UTC), Automerge - At
any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config help](https://togithub.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://developer.mend.io/github/slsa-framework/slsa-github-generator).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNS4xMzEuMCIsInVwZGF0ZWRJblZlciI6IjM1LjEzMS4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiJ9-->

Signed-off-by: Mend Renovate <bot@renovateapp.com>
enteraga6 pushed a commit to enteraga6/slsa-github-generator that referenced this pull request Jul 18, 2023
@renovate-bot @enteraga6
fix(deps): update go (slsa-framework#2338)
380a898 
[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [github.com/sigstore/cosign/v2](https://togithub.com/sigstore/cosign)
| require | minor | `v2.0.2` -> `v2.1.0` |
| [github.com/sigstore/sigstore](https://togithub.com/sigstore/sigstore)
| require | minor | `v1.6.4` -> `v1.7.1` |

---

### ⚠ Dependency Lookup Warnings ⚠

Warnings were logged while processing this repo. Please check the
Dependency Dashboard for more information.

---

### Release Notes

<details>
<summary>sigstore/cosign</summary>

###
[`v2.1.0`](https://togithub.com/sigstore/cosign/blob/HEAD/CHANGELOG.md#v210)

[Compare
Source](https://togithub.com/sigstore/cosign/compare/v2.0.2...v2.1.0)

**Breaking Change: The predicate is now a required flag in the attest
commands, set via the --type flag.**

#### Enhancements

- Verify sigs and attestations in parallel
([#&#8203;3066](https://togithub.com/sigstore/cosign/issues/3066))
- Deep inspect attestations when filtering download
([#&#8203;3031](https://togithub.com/sigstore/cosign/issues/3031))
- refactor bundle validation code, add support for DSSE rekor type
([#&#8203;3016](https://togithub.com/sigstore/cosign/issues/3016))
- Allow overriding remote options
([#&#8203;3049](https://togithub.com/sigstore/cosign/issues/3049))
- feat: adds no cert found on sig exit code
([#&#8203;3038](https://togithub.com/sigstore/cosign/issues/3038))
- Make predicate a required flag in attest commands
([#&#8203;3033](https://togithub.com/sigstore/cosign/issues/3033))
- Added support for attaching Time stamp authority Response in attach
command
([#&#8203;3001](https://togithub.com/sigstore/cosign/issues/3001))
- Add `sign --sign-container-identity` CLI
([#&#8203;2984](https://togithub.com/sigstore/cosign/issues/2984))
- Feature: Allow cosign to sign digests before they are uploaded.
([#&#8203;2959](https://togithub.com/sigstore/cosign/issues/2959))
- accepts `attachment-tag-prefix` for `cosign copy`
([#&#8203;3014](https://togithub.com/sigstore/cosign/issues/3014))
- Feature: adds '--allow-insecure-registry' for cosign load
([#&#8203;3000](https://togithub.com/sigstore/cosign/issues/3000))
- download attestation: support --platform flag
([#&#8203;2980](https://togithub.com/sigstore/cosign/issues/2980))
- Cleanup: Add `Digest` to the `SignedEntity` interface.
([#&#8203;2960](https://togithub.com/sigstore/cosign/issues/2960))
- verify command: support keyless verification using only a provided
certificate chain with non-fulcio roots
([#&#8203;2845](https://togithub.com/sigstore/cosign/issues/2845))
- verify: use workers to limit the paralellism when verifying images
with --max-workers flag
([#&#8203;3069](https://togithub.com/sigstore/cosign/issues/3069))

#### Bug Fixes

- Fix pkg/cosign/errors
([#&#8203;3050](https://togithub.com/sigstore/cosign/issues/3050))
- fix: update doc to refer to github-actions oidc provider
([#&#8203;3040](https://togithub.com/sigstore/cosign/issues/3040))
- fix: prefer GitHub OIDC provider if enabled
([#&#8203;3044](https://togithub.com/sigstore/cosign/issues/3044))
- Fix --sig-only in cosign copy
([#&#8203;3074](https://togithub.com/sigstore/cosign/issues/3074))

#### Documentation

- Fix links to sigstore/docs in markdown files
([#&#8203;3064](https://togithub.com/sigstore/cosign/issues/3064))
- Update release readme
([#&#8203;2942](https://togithub.com/sigstore/cosign/issues/2942))

**Thank you to our contributors!**

-   Bob Callaway
-   Carlos Tadeu Panato Junior
-   Chok Yip Lau
-   Chris Burns
-   Dmitry Savintsev
-   Enyinna Ochulor
-   Hayden B
-   Hector Fernandez
-   Jakub Hrozek
-   Jason Hall
-   Jon Johnson
-   Luiz Carvalho
-   Matt Moore
-   Mritunjay Kumar Sharma
-   Mukuls77
-   Ramkumar Chinchani
-   Sascha Grunert
-   Yolanda Robla Mota
-   priyawadhwa

</details>

<details>
<summary>sigstore/sigstore</summary>

###
[`v1.7.1`](https://togithub.com/sigstore/sigstore/releases/tag/v1.7.1)

[Compare
Source](https://togithub.com/sigstore/sigstore/compare/v1.7.0...v1.7.1)

#### What's Changed

- Allow the user to optionally pass a Key Vault key version, update the
SDK by [@&#8203;malancas](https://togithub.com/malancas) in
[sigstore/sigstore#1231
- update golangci-lint to v1.53.x by
[@&#8203;cpanato](https://togithub.com/cpanato) in
[sigstore/sigstore#1216

**Full Changelog**:
sigstore/sigstore@v1.7.0...v1.7.1

###
[`v1.7.0`](https://togithub.com/sigstore/sigstore/releases/tag/v1.7.0)

[Compare
Source](https://togithub.com/sigstore/sigstore/compare/v1.6.5...v1.7.0)

#### What's Changed

- Update Azure Key Vault client by
[@&#8203;malancas](https://togithub.com/malancas) in
[sigstore/sigstore#1170
- kms: split KMS providers into separate Go modules by
[@&#8203;imjasonh](https://togithub.com/imjasonh) in
[sigstore/sigstore#1115
- have submodules specify real s/s releases by
[@&#8203;imjasonh](https://togithub.com/imjasonh) in
[sigstore/sigstore#1178
- Update go.mod and dependabot config by
[@&#8203;cpanato](https://togithub.com/cpanato) in
[sigstore/sigstore#1184
- Add `Cosign.ClaimedIdentity` API by
[@&#8203;saschagrunert](https://togithub.com/saschagrunert) in
[sigstore/sigstore#1166
- build(deps): bump github.com/aws/aws-sdk-go from 1.44.274 to 1.44.275
in /pkg/signature/kms/aws by
[@&#8203;dependabot](https://togithub.com/dependabot) in
[sigstore/sigstore#1199
- Azure KMS: Infer hash function from key by
[@&#8203;codysoyland](https://togithub.com/codysoyland) in
[sigstore/sigstore#1149
- update golang.org/x/crypto to v0.10.0 and golang.org/x/oauth2 v0.9.0
by [@&#8203;cpanato](https://togithub.com/cpanato) in
[sigstore/sigstore#1225

#### New Contributors

- [@&#8203;saschagrunert](https://togithub.com/saschagrunert) made their
first contribution in
[sigstore/sigstore#1166

**Full Changelog**:
sigstore/sigstore@v1.6.4...v1.7.0

###
[`v1.6.5`](https://togithub.com/sigstore/sigstore/releases/tag/v1.6.5)

[Compare
Source](https://togithub.com/sigstore/sigstore/compare/v1.6.4...v1.6.5)

#### What's Changed

- Update Azure Key Vault client by
[@&#8203;malancas](https://togithub.com/malancas) in
[sigstore/sigstore#1170
- kms: split KMS providers into separate Go modules by
[@&#8203;imjasonh](https://togithub.com/imjasonh) in
[sigstore/sigstore#1115
- have submodules specify real s/s releases by
[@&#8203;imjasonh](https://togithub.com/imjasonh) in
[sigstore/sigstore#1178

**Full Changelog**:
sigstore/sigstore@v1.6.4...v1.6.5

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "every weekend" (UTC), Automerge - At
any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config help](https://togithub.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://developer.mend.io/github/slsa-framework/slsa-github-generator).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNS4xMzEuMCIsInVwZGF0ZWRJblZlciI6IjM1LjEzMS4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiJ9-->

Signed-off-by: Mend Renovate <bot@renovateapp.com>
Signed-off-by: Noah Elzner <elzner@google.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@haydentherapper haydentherapper haydentherapper approved these changes

@bobcallaway bobcallaway Awaiting requested review from bobcallaway

@hectorj2f hectorj2f Awaiting requested review from hectorj2f

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
2 participants
@cpanato @haydentherapper