feat: Non-compulsory BuilderID for BYOB Builders #674

enteraga6 · 2023-07-31T22:48:32Z

Based off the prefix of the BuilderID within the provenance, if the builder use to build the artifact is one of the BYOB builders of slsa-framework/slsa-github-generator repo, the --builderid flag is not need and is handled automatically. This was done to increase access to users since before the automatic pickup of the builder-id would get the delegator.

Test cases that cover verifyProvenance will need to be complete after the v1.8.0 release of slsa-framework/slsa-github-generator.

The main structure that is changed is the ExpectedBuilderPath is hardcoded now to slsa-framework builders within /cli/slsa-verifier/verify/verify_artifact.go . This can later be changed now if needed to be an input like the other fields of provenanceOpts populated during verify_artifact.go. The added function within provenance.go, verifyBuilderIDPath is called during verifyProvenance to check this path within provenanceOpts. Upon failure of this function, expected and received BuilderID's are also outputted.

closes #659
makes use of discussion on closed pr #673

Signed-off-by: Noah Elzner <elzner@google.com>

options/options.go

cli/slsa-verifier/verify/verify_artifact.go

verifiers/internal/gha/provenance.go

Signed-off-by: Noah Elzner <elzner@google.com>

verifiers/internal/gha/builder.go

verifiers/internal/gha/provenance.go

Signed-off-by: Noah Elzner <elzner@google.com>

verifiers/internal/gha/builder_test.go

Signed-off-by: Noah Elzner <elzner@google.com>

verifiers/internal/gha/provenance.go

options/options.go

verifiers/internal/gha/provenance.go

verifiers/internal/gha/builder.go

verifiers/internal/gha/provenance.go

…blic. Co-authored-by: Ian Lewis <ianlewis@google.com> Signed-off-by: Noah Elzner <78953604+enteraga6@users.noreply.github.com>

Signed-off-by: Noah Elzner <78953604+enteraga6@users.noreply.github.com>

Co-authored-by: Ian Lewis <ianlewis@google.com> Signed-off-by: Noah Elzner <78953604+enteraga6@users.noreply.github.com>

Signed-off-by: Noah Elzner <elzner@google.com>

verifiers/internal/gha/builder_test.go

verifiers/internal/gha/provenance.go

verifiers/internal/gha/provenance_test.go

Signed-off-by: Noah Elzner <elzner@google.com>

Co-authored-by: Ian Lewis <ianlewis@google.com> Signed-off-by: Noah Elzner <78953604+enteraga6@users.noreply.github.com>

Signed-off-by: Noah Elzner <elzner@google.com>

…lder-feat

Signed-off-by: Noah Elzner <elzner@google.com>

laurentsimon

LGTM. Let's just use files to store the large content of the tests

verifiers/internal/gha/provenance_test.go

Signed-off-by: Noah Elzner <elzner@google.com>

laurentsimon

Thanks @enteraga6 !

verifiers/internal/gha/testdata/bazel-trusted-dsseEnvelope.build.slsa

verifiers/internal/gha/testdata/bazel-untrusted-dsseEnvelope.sigstore

verifiers/internal/gha/provenance_test.go

Signed-off-by: Noah Elzner <elzner@google.com>

verifiers/internal/gha/provenance_test.go

Signed-off-by: Noah Elzner <elzner@google.com>

…lder-feat

[![Mend Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/checkout](https://togithub.com/actions/checkout) | action | minor | `v3.5.3` -> `v3.6.0` | | [actions/dependency-review-action](https://togithub.com/actions/dependency-review-action) | action | minor | `v3.0.7` -> `v3.1.0` | | [actions/setup-node](https://togithub.com/actions/setup-node) | action | patch | `v3.8.0` -> `v3.8.1` | | [actions/upload-artifact](https://togithub.com/actions/upload-artifact) | action | patch | `v3.1.2` -> `v3.1.3` | | [github/codeql-action](https://togithub.com/github/codeql-action) | action | minor | `v2.21.4` -> `v2.22.1` | | [ossf/scorecard-action](https://togithub.com/ossf/scorecard-action) | action | minor | `v2.2.0` -> `v2.3.0` | | [slsa-framework/slsa-github-generator](https://togithub.com/slsa-framework/slsa-github-generator) | action | minor | `v1.8.0` -> `v1.9.0` | | [slsa-framework/slsa-verifier](https://togithub.com/slsa-framework/slsa-verifier) | action | minor | `v2.3.0` -> `v2.4.0` | --- ### ⚠ Dependency Lookup Warnings ⚠ Warnings were logged while processing this repo. Please check the Dependency Dashboard for more information. --- ### Release Notes <details> <summary>actions/checkout (actions/checkout)</summary> ### [`v3.6.0`](https://togithub.com/actions/checkout/blob/HEAD/CHANGELOG.md#v360) [Compare Source](https://togithub.com/actions/checkout/compare/v3.5.3...v3.6.0) - [Fix: Mark test scripts with Bash'isms to be run via Bash](https://togithub.com/actions/checkout/pull/1377) - [Add option to fetch tags even if fetch-depth > 0](https://togithub.com/actions/checkout/pull/579) </details> <details> <summary>actions/dependency-review-action (actions/dependency-review-action)</summary> ### [`v3.1.0`](https://togithub.com/actions/dependency-review-action/releases/tag/v3.1.0): 3.1.0 [Compare Source](https://togithub.com/actions/dependency-review-action/compare/v3.0.8...v3.1.0) #### What's New Added support for dependencies submitted through the [dependency submission API](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review#best-practices-for-using-the-dependency-review-api-and-the-dependency-submission-api-together). This includes two new configuration parameters: `retry-on-snapshot-warnings` and `retry-on-snapshot-warnings-timeout`. #### What's Changed - Fix(docs): Correct action input name by [@oerd](https://togithub.com/oerd) in [actions/dependency-review-action#551 #### New Contributors - [@oerd](https://togithub.com/oerd) made their first contribution in [actions/dependency-review-action#551 **Full Changelog**: actions/dependency-review-action@v3...v3.1.0 ### [`v3.0.8`](https://togithub.com/actions/dependency-review-action/releases/tag/v3.0.8): 3.0.8 [Compare Source](https://togithub.com/actions/dependency-review-action/compare/v3.0.7...v3.0.8) #### What's Changed Added `on-failure` option to `comment-summary-in-pr` setting by [@sgmurphy](https://togithub.com/sgmurphy) in [actions/dependency-review-action#540 Previous configuration files using `true`/`false` for `comment-summary-in-pr` will be mapped automatically to the new values, but we encourage you to update to `always`/`on-failure`/`never`. #### New Contributors - [@sgmurphy](https://togithub.com/sgmurphy) made their first contribution in [actions/dependency-review-action#540 **Full Changelog**: actions/dependency-review-action@v3...v3.0.8 </details> <details> <summary>actions/setup-node (actions/setup-node)</summary> ### [`v3.8.1`](https://togithub.com/actions/setup-node/releases/tag/v3.8.1) [Compare Source](https://togithub.com/actions/setup-node/compare/v3.8.0...v3.8.1) #### What's Changed In scope of this release, the filter was removed within the cache-save step by [@dmitry-shibanov](https://togithub.com/dmitry-shibanov) in [actions/setup-node#831. It is filtered and checked in the toolkit/cache library. **Full Changelog**: actions/setup-node@v3...v3.8.1 </details> <details> <summary>actions/upload-artifact (actions/upload-artifact)</summary> ### [`v3.1.3`](https://togithub.com/actions/upload-artifact/releases/tag/v3.1.3) [Compare Source](https://togithub.com/actions/upload-artifact/compare/v3.1.2...v3.1.3) #### What's Changed - chore(github): remove trailing whitespaces by [@ljmf00](https://togithub.com/ljmf00) in [actions/upload-artifact#313 - Bump [@actions/artifact](https://togithub.com/actions/artifact) version to v1.1.2 by [@bethanyj28](https://togithub.com/bethanyj28) in [actions/upload-artifact#436 **Full Changelog**: actions/upload-artifact@v3...v3.1.3 </details> <details> <summary>github/codeql-action (github/codeql-action)</summary> ### [`v2.22.1`](https://togithub.com/github/codeql-action/compare/v2.22.0...v2.22.1) [Compare Source](https://togithub.com/github/codeql-action/compare/v2.22.0...v2.22.1) ### [`v2.22.0`](https://togithub.com/github/codeql-action/compare/v2.21.9...v2.22.0) [Compare Source](https://togithub.com/github/codeql-action/compare/v2.21.9...v2.22.0) ### [`v2.21.9`](https://togithub.com/github/codeql-action/compare/v2.21.8...v2.21.9) [Compare Source](https://togithub.com/github/codeql-action/compare/v2.21.8...v2.21.9) ### [`v2.21.8`](https://togithub.com/github/codeql-action/compare/v2.21.7...v2.21.8) [Compare Source](https://togithub.com/github/codeql-action/compare/v2.21.7...v2.21.8) ### [`v2.21.7`](https://togithub.com/github/codeql-action/compare/v2.21.6...v2.21.7) [Compare Source](https://togithub.com/github/codeql-action/compare/v2.21.6...v2.21.7) ### [`v2.21.6`](https://togithub.com/github/codeql-action/compare/v2.21.5...v2.21.6) [Compare Source](https://togithub.com/github/codeql-action/compare/v2.21.5...v2.21.6) ### [`v2.21.5`](https://togithub.com/github/codeql-action/compare/v2.21.4...v2.21.5) [Compare Source](https://togithub.com/github/codeql-action/compare/v2.21.4...v2.21.5) </details> <details> <summary>ossf/scorecard-action (ossf/scorecard-action)</summary> ### [`v2.3.0`](https://togithub.com/ossf/scorecard-action/releases/tag/v2.3.0) [Compare Source](https://togithub.com/ossf/scorecard-action/compare/v2.2.0...v2.3.0) #### What's Changed - 🌱 Bump github.com/ossf/scorecard/v4 from v4.11.0 to v4.13.0 by [@spencerschrock](https://togithub.com/spencerschrock) in [ossf/scorecard-action#1270 - For a full changelist of what this includes, see the [v4.12.0](https://togithub.com/ossf/scorecard/releases/tag/v4.12.0) and [v4.13.0](https://togithub.com/ossf/scorecard/releases/tag/v4.13.0) release notes - ✨ Send rekor tlog index to webapp when publishing results by [@spencerschrock](https://togithub.com/spencerschrock) in [ossf/scorecard-action#1169 - 🐛 Prevent url clipping for GHES instances by [@rajbos](https://togithub.com/rajbos) in [ossf/scorecard-action#1225 ##### Documentation - 📖 Update access rights needed to see the results in code scanning by [@rajbos](https://togithub.com/rajbos) in [ossf/scorecard-action#1229 - 📖 Add package comments. by [@spencerschrock](https://togithub.com/spencerschrock) in [ossf/scorecard-action#1221 - 📖 Add SECURITY.md file by [@david-a-wheeler](https://togithub.com/david-a-wheeler) in [ossf/scorecard-action#1250 - 📖 Fix typo in token input docs by [@aabouzaid](https://togithub.com/aabouzaid) in [ossf/scorecard-action#1258 #### New Contributors - [@david-a-wheeler](https://togithub.com/david-a-wheeler) made their first contribution in [ossf/scorecard-action#1250 - [@aabouzaid](https://togithub.com/aabouzaid) made their first contribution in [ossf/scorecard-action#1258 **Full Changelog**: ossf/scorecard-action@v2.2.0...v2.3.0 </details> <details> <summary>slsa-framework/slsa-github-generator (slsa-framework/slsa-github-generator)</summary> ### [`v1.9.0`](https://togithub.com/slsa-framework/slsa-github-generator/blob/HEAD/CHANGELOG.md#v190) [Compare Source](https://togithub.com/slsa-framework/slsa-github-generator/compare/v1.8.0...v1.9.0) Release \[v1.9.0] includes bug fixes and new features. See the [full change list](https://togithub.com/slsa-framework/slsa-github-generator/compare/v1.8.0...v1.9.0). ##### v1.9.0: BYOB framework (beta) - **New**: A [new framework](https://togithub.com/slsa-framework/slsa-github-generator/blob/main/BYOB.md) to turn GitHub Actions into SLSA compliant builders. ##### v1.9.0: Maven builder (beta) - **New**: A [Maven builder](https://togithub.com/slsa-framework/slsa-github-generator/tree/main/internal/builders/maven) to build Java projects and publish to Maven central. ##### v1.9.0: Gradle builder (beta) - **New**: A [Gradle builder](https://togithub.com/slsa-framework/slsa-github-generator/tree/main/internal/builders/gradle) to build Java projects and publish to Maven central. ##### v1.9.0: JReleaser builder - **New**: A [JReleaser builder](https://togithub.com/jreleaser/release-action/tree/v1.0.0-java) that wraps the official [JReleaser Action](https://togithub.com/jreleaser/release-action/tree/v1.0.0-java). </details> <details> <summary>slsa-framework/slsa-verifier (slsa-framework/slsa-verifier)</summary> ### [`v2.4.0`](https://togithub.com/slsa-framework/slsa-verifier/releases/tag/v2.4.0) [Compare Source](https://togithub.com/slsa-framework/slsa-verifier/compare/v2.3.0...v2.4.0) #### Summary Support for BYOB-based builders released in https://github.com/slsa-framework/slsa-github-generator/releases/tag/v1.9.0 #### What's Changed - chore: Update SHA256SUM.md for v2.3.0 by [@ianlewis](https://togithub.com/ianlewis) in [#592 - docs: Make npm package version and name non-optional by [@laurentsimon](https://togithub.com/laurentsimon) in [#591 - docs: npm provenance verification from GitHub runner by [@laurentsimon](https://togithub.com/laurentsimon) in [#595 - chore(deps): update dependency [@types/node](https://togithub.com/types/node) to v18.16.9 by [@renovate-bot](https://togithub.com/renovate-bot) in [#596 - chore(deps): update github-actions by [@renovate-bot](https://togithub.com/renovate-bot) in [#597 - chore(deps): update dependency jasmine to v5 by [@renovate-bot](https://togithub.com/renovate-bot) in [#598 - feat: BYOB verification support by [@laurentsimon](https://togithub.com/laurentsimon) in [#604 - feat: Support for v1.0 verification in BYOB by [@laurentsimon](https://togithub.com/laurentsimon) in [#609 - feat: Use env variable to retrieve trigger workflow by [@laurentsimon](https://togithub.com/laurentsimon) in [#615 - test: Add test data for v1.6.0 by [@ianlewis](https://togithub.com/ianlewis) in [#612 - fix: Verify the TRW tag is a semver tag by [@laurentsimon](https://togithub.com/laurentsimon) in [#619 - chore: Don't be verbose with tests locally by [@ianlewis](https://togithub.com/ianlewis) in [#620 - fix: use ExternalParameters\["source"] for the Source URI for SLSA v1.0 provenance by [@asraa](https://togithub.com/asraa) in [#621 - test: re-generate container-based tests by [@asraa](https://togithub.com/asraa) in [#627 - fix: revert to using resolvedDepdendencies for source verification by [@asraa](https://togithub.com/asraa) in [#629 - refactor: Provenance tests by [@ianlewis](https://togithub.com/ianlewis) in [#628 - fix(deps): update module github.com/sigstore/rekor to v1.2.0 \[security] by [@renovate-bot](https://togithub.com/renovate-bot) in [#622 - fix: only allow hashes of 256 bits or more by [@laurentsimon](https://togithub.com/laurentsimon) in [#633 - fix: builder ID verification for testing by [@ianlewis](https://togithub.com/ianlewis) in [#635 - feat: remove experimental on Sigstore bundle and v1.0 SLSA provenance format by [@asraa](https://togithub.com/asraa) in [#634 - chore: update toc in README.md by [@asraa](https://togithub.com/asraa) in [#636 - fix: allow workflow_dispatch to trigger release.yml by [@ianlewis](https://togithub.com/ianlewis) in [#637 - test: add tests for v1.7.0 builders by [@asraa](https://togithub.com/asraa) in [#638 - chore(deps): update github-actions by [@renovate-bot](https://togithub.com/renovate-bot) in [#607 - chore(deps): update gcr.io/distroless/base:nonroot docker digest to [`c623859`](https://togithub.com/slsa-framework/slsa-verifier/commit/c623859) by [@renovate-bot](https://togithub.com/renovate-bot) in [#567 - fix(deps): update github.com/sigstore/protobuf-specs digest to [`5ef5406`](https://togithub.com/slsa-framework/slsa-verifier/commit/5ef5406) by [@renovate-bot](https://togithub.com/renovate-bot) in [#606 - chore(deps): update npm dev by [@renovate-bot](https://togithub.com/renovate-bot) in [#608 - chore(deps): update golang:1.19 docker digest to [`83f9f84`](https://togithub.com/slsa-framework/slsa-verifier/commit/83f9f84) by [@renovate-bot](https://togithub.com/renovate-bot) in [#583 - feat: Verify provenance by build type by [@ianlewis](https://togithub.com/ianlewis) in [#632 - refactor: Use Go 1.20 by [@ianlewis](https://togithub.com/ianlewis) in [#643 - test: Add more ProvenanceFromEnvelope tests by [@ianlewis](https://togithub.com/ianlewis) in [#640 - fix: pre-submit: e2e-cli.sh artifact download by [@ianlewis](https://togithub.com/ianlewis) in [#646 - refactor: Add more git utils by [@ianlewis](https://togithub.com/ianlewis) in [#645 - refactor: Use full builder id by [@ianlewis](https://togithub.com/ianlewis) in [#648 - feat: Use tags `vX.Y.Z-<language>` for JReleaser builders by [@laurentsimon](https://togithub.com/laurentsimon) in [#644 - chore(deps): update github-actions by [@renovate-bot](https://togithub.com/renovate-bot) in [#651 - feat: move maven-plugin from slsa-github-generator by [@AdamKorcz](https://togithub.com/AdamKorcz) in [#664 - docs: Fix maven-plugin README by [@laurentsimon](https://togithub.com/laurentsimon) in [#671 - feat: Verification for when sha1 is specified in BYOB TRW by [@ianlewis](https://togithub.com/ianlewis) in [#641 - docs: Add example for maven verification plugin by [@laurentsimon](https://togithub.com/laurentsimon) in [#676 - chore: Add Kris to codeowners by [@laurentsimon](https://togithub.com/laurentsimon) in [#678 - feat: Print byob builder by [@laurentsimon](https://togithub.com/laurentsimon) in [#677 - test: Add test data for v1.8.0 by [@ianlewis](https://togithub.com/ianlewis) in [#681 - chore(deps): update github-actions by [@renovate-bot](https://togithub.com/renovate-bot) in [#666 - feat: Non-compulsory BuilderID for BYOB Builders by [@enteraga6](https://togithub.com/enteraga6) in [#674 - chore(deps): update golang docker tag to v1.21 by [@renovate-bot](https://togithub.com/renovate-bot) in [#687 - chore(deps): update github-actions by [@renovate-bot](https://togithub.com/renovate-bot) in [#686 - feat: GCB refactor for v1.0 support by [@laurentsimon](https://togithub.com/laurentsimon) in [#682 - feat: Allow byob builders ref at main for e2e tests by [@laurentsimon](https://togithub.com/laurentsimon) in [#689 - feat: Update doc and code for Maven plugin by [@laurentsimon](https://togithub.com/laurentsimon) in [#680 - feat: gcb v1.0 support by [@laurentsimon](https://togithub.com/laurentsimon) in [#691 - feat: v1.9.0 regression tests by [@laurentsimon](https://togithub.com/laurentsimon) in [#696 - fix: release failure by [@laurentsimon](https://togithub.com/laurentsimon) in [#697 #### New Contributors - [@AdamKorcz](https://togithub.com/AdamKorcz) made their first contribution in [#664 - [@enteraga6](https://togithub.com/enteraga6) made their first contribution in [#674 **Full Changelog**: v2.3.0...v2.4.0 </details> --- ### Configuration 📅 **Schedule**: Branch creation - "every weekend" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://togithub.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/slsa-framework/slsa-verifier).  Signed-off-by: Mend Renovate <bot@renovateapp.com> Co-authored-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>

[![Mend Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/checkout](https://togithub.com/actions/checkout) | action | minor | `v3.5.3` -> `v3.6.0` | | [actions/dependency-review-action](https://togithub.com/actions/dependency-review-action) | action | minor | `v3.0.7` -> `v3.1.0` | | [actions/setup-node](https://togithub.com/actions/setup-node) | action | patch | `v3.8.0` -> `v3.8.1` | | [actions/upload-artifact](https://togithub.com/actions/upload-artifact) | action | patch | `v3.1.2` -> `v3.1.3` | | [github/codeql-action](https://togithub.com/github/codeql-action) | action | minor | `v2.21.4` -> `v2.22.1` | | [ossf/scorecard-action](https://togithub.com/ossf/scorecard-action) | action | minor | `v2.2.0` -> `v2.3.0` | | [slsa-framework/slsa-github-generator](https://togithub.com/slsa-framework/slsa-github-generator) | action | minor | `v1.8.0` -> `v1.9.0` | | [slsa-framework/slsa-verifier](https://togithub.com/slsa-framework/slsa-verifier) | action | minor | `v2.3.0` -> `v2.4.0` | --- ### ⚠ Dependency Lookup Warnings ⚠ Warnings were logged while processing this repo. Please check the Dependency Dashboard for more information. --- ### Release Notes <details> <summary>actions/checkout (actions/checkout)</summary> ### [`v3.6.0`](https://togithub.com/actions/checkout/blob/HEAD/CHANGELOG.md#v360) [Compare Source](https://togithub.com/actions/checkout/compare/v3.5.3...v3.6.0) - [Fix: Mark test scripts with Bash'isms to be run via Bash](https://togithub.com/actions/checkout/pull/1377) - [Add option to fetch tags even if fetch-depth > 0](https://togithub.com/actions/checkout/pull/579) </details> <details> <summary>actions/dependency-review-action (actions/dependency-review-action)</summary> ### [`v3.1.0`](https://togithub.com/actions/dependency-review-action/releases/tag/v3.1.0): 3.1.0 [Compare Source](https://togithub.com/actions/dependency-review-action/compare/v3.0.8...v3.1.0) #### What's New Added support for dependencies submitted through the [dependency submission API](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review#best-practices-for-using-the-dependency-review-api-and-the-dependency-submission-api-together). This includes two new configuration parameters: `retry-on-snapshot-warnings` and `retry-on-snapshot-warnings-timeout`. #### What's Changed - Fix(docs): Correct action input name by [@oerd](https://togithub.com/oerd) in [actions/dependency-review-action#551 #### New Contributors - [@oerd](https://togithub.com/oerd) made their first contribution in [actions/dependency-review-action#551 **Full Changelog**: actions/dependency-review-action@v3...v3.1.0 ### [`v3.0.8`](https://togithub.com/actions/dependency-review-action/releases/tag/v3.0.8): 3.0.8 [Compare Source](https://togithub.com/actions/dependency-review-action/compare/v3.0.7...v3.0.8) #### What's Changed Added `on-failure` option to `comment-summary-in-pr` setting by [@sgmurphy](https://togithub.com/sgmurphy) in [actions/dependency-review-action#540 Previous configuration files using `true`/`false` for `comment-summary-in-pr` will be mapped automatically to the new values, but we encourage you to update to `always`/`on-failure`/`never`. #### New Contributors - [@sgmurphy](https://togithub.com/sgmurphy) made their first contribution in [actions/dependency-review-action#540 **Full Changelog**: actions/dependency-review-action@v3...v3.0.8 </details> <details> <summary>actions/setup-node (actions/setup-node)</summary> ### [`v3.8.1`](https://togithub.com/actions/setup-node/releases/tag/v3.8.1) [Compare Source](https://togithub.com/actions/setup-node/compare/v3.8.0...v3.8.1) #### What's Changed In scope of this release, the filter was removed within the cache-save step by [@dmitry-shibanov](https://togithub.com/dmitry-shibanov) in [actions/setup-node#831. It is filtered and checked in the toolkit/cache library. **Full Changelog**: actions/setup-node@v3...v3.8.1 </details> <details> <summary>actions/upload-artifact (actions/upload-artifact)</summary> ### [`v3.1.3`](https://togithub.com/actions/upload-artifact/releases/tag/v3.1.3) [Compare Source](https://togithub.com/actions/upload-artifact/compare/v3.1.2...v3.1.3) #### What's Changed - chore(github): remove trailing whitespaces by [@ljmf00](https://togithub.com/ljmf00) in [actions/upload-artifact#313 - Bump [@actions/artifact](https://togithub.com/actions/artifact) version to v1.1.2 by [@bethanyj28](https://togithub.com/bethanyj28) in [actions/upload-artifact#436 **Full Changelog**: actions/upload-artifact@v3...v3.1.3 </details> <details> <summary>github/codeql-action (github/codeql-action)</summary> ### [`v2.22.1`](https://togithub.com/github/codeql-action/compare/v2.22.0...v2.22.1) [Compare Source](https://togithub.com/github/codeql-action/compare/v2.22.0...v2.22.1) ### [`v2.22.0`](https://togithub.com/github/codeql-action/compare/v2.21.9...v2.22.0) [Compare Source](https://togithub.com/github/codeql-action/compare/v2.21.9...v2.22.0) ### [`v2.21.9`](https://togithub.com/github/codeql-action/compare/v2.21.8...v2.21.9) [Compare Source](https://togithub.com/github/codeql-action/compare/v2.21.8...v2.21.9) ### [`v2.21.8`](https://togithub.com/github/codeql-action/compare/v2.21.7...v2.21.8) [Compare Source](https://togithub.com/github/codeql-action/compare/v2.21.7...v2.21.8) ### [`v2.21.7`](https://togithub.com/github/codeql-action/compare/v2.21.6...v2.21.7) [Compare Source](https://togithub.com/github/codeql-action/compare/v2.21.6...v2.21.7) ### [`v2.21.6`](https://togithub.com/github/codeql-action/compare/v2.21.5...v2.21.6) [Compare Source](https://togithub.com/github/codeql-action/compare/v2.21.5...v2.21.6) ### [`v2.21.5`](https://togithub.com/github/codeql-action/compare/v2.21.4...v2.21.5) [Compare Source](https://togithub.com/github/codeql-action/compare/v2.21.4...v2.21.5) </details> <details> <summary>ossf/scorecard-action (ossf/scorecard-action)</summary> ### [`v2.3.0`](https://togithub.com/ossf/scorecard-action/releases/tag/v2.3.0) [Compare Source](https://togithub.com/ossf/scorecard-action/compare/v2.2.0...v2.3.0) #### What's Changed - 🌱 Bump github.com/ossf/scorecard/v4 from v4.11.0 to v4.13.0 by [@spencerschrock](https://togithub.com/spencerschrock) in [ossf/scorecard-action#1270 - For a full changelist of what this includes, see the [v4.12.0](https://togithub.com/ossf/scorecard/releases/tag/v4.12.0) and [v4.13.0](https://togithub.com/ossf/scorecard/releases/tag/v4.13.0) release notes - ✨ Send rekor tlog index to webapp when publishing results by [@spencerschrock](https://togithub.com/spencerschrock) in [ossf/scorecard-action#1169 - 🐛 Prevent url clipping for GHES instances by [@rajbos](https://togithub.com/rajbos) in [ossf/scorecard-action#1225 ##### Documentation - 📖 Update access rights needed to see the results in code scanning by [@rajbos](https://togithub.com/rajbos) in [ossf/scorecard-action#1229 - 📖 Add package comments. by [@spencerschrock](https://togithub.com/spencerschrock) in [ossf/scorecard-action#1221 - 📖 Add SECURITY.md file by [@david-a-wheeler](https://togithub.com/david-a-wheeler) in [ossf/scorecard-action#1250 - 📖 Fix typo in token input docs by [@aabouzaid](https://togithub.com/aabouzaid) in [ossf/scorecard-action#1258 #### New Contributors - [@david-a-wheeler](https://togithub.com/david-a-wheeler) made their first contribution in [ossf/scorecard-action#1250 - [@aabouzaid](https://togithub.com/aabouzaid) made their first contribution in [ossf/scorecard-action#1258 **Full Changelog**: ossf/scorecard-action@v2.2.0...v2.3.0 </details> <details> <summary>slsa-framework/slsa-github-generator (slsa-framework/slsa-github-generator)</summary> ### [`v1.9.0`](https://togithub.com/slsa-framework/slsa-github-generator/blob/HEAD/CHANGELOG.md#v190) [Compare Source](https://togithub.com/slsa-framework/slsa-github-generator/compare/v1.8.0...v1.9.0) Release \[v1.9.0] includes bug fixes and new features. See the [full change list](https://togithub.com/slsa-framework/slsa-github-generator/compare/v1.8.0...v1.9.0). ##### v1.9.0: BYOB framework (beta) - **New**: A [new framework](https://togithub.com/slsa-framework/slsa-github-generator/blob/main/BYOB.md) to turn GitHub Actions into SLSA compliant builders. ##### v1.9.0: Maven builder (beta) - **New**: A [Maven builder](https://togithub.com/slsa-framework/slsa-github-generator/tree/main/internal/builders/maven) to build Java projects and publish to Maven central. ##### v1.9.0: Gradle builder (beta) - **New**: A [Gradle builder](https://togithub.com/slsa-framework/slsa-github-generator/tree/main/internal/builders/gradle) to build Java projects and publish to Maven central. ##### v1.9.0: JReleaser builder - **New**: A [JReleaser builder](https://togithub.com/jreleaser/release-action/tree/v1.0.0-java) that wraps the official [JReleaser Action](https://togithub.com/jreleaser/release-action/tree/v1.0.0-java). </details> <details> <summary>slsa-framework/slsa-verifier (slsa-framework/slsa-verifier)</summary> ### [`v2.4.0`](https://togithub.com/slsa-framework/slsa-verifier/releases/tag/v2.4.0) [Compare Source](https://togithub.com/slsa-framework/slsa-verifier/compare/v2.3.0...v2.4.0) #### Summary Support for BYOB-based builders released in https://github.com/slsa-framework/slsa-github-generator/releases/tag/v1.9.0 #### What's Changed - chore: Update SHA256SUM.md for v2.3.0 by [@ianlewis](https://togithub.com/ianlewis) in [slsa-framework#592 - docs: Make npm package version and name non-optional by [@laurentsimon](https://togithub.com/laurentsimon) in [slsa-framework#591 - docs: npm provenance verification from GitHub runner by [@laurentsimon](https://togithub.com/laurentsimon) in [slsa-framework#595 - chore(deps): update dependency [@types/node](https://togithub.com/types/node) to v18.16.9 by [@renovate-bot](https://togithub.com/renovate-bot) in [slsa-framework#596 - chore(deps): update github-actions by [@renovate-bot](https://togithub.com/renovate-bot) in [slsa-framework#597 - chore(deps): update dependency jasmine to v5 by [@renovate-bot](https://togithub.com/renovate-bot) in [slsa-framework#598 - feat: BYOB verification support by [@laurentsimon](https://togithub.com/laurentsimon) in [slsa-framework#604 - feat: Support for v1.0 verification in BYOB by [@laurentsimon](https://togithub.com/laurentsimon) in [slsa-framework#609 - feat: Use env variable to retrieve trigger workflow by [@laurentsimon](https://togithub.com/laurentsimon) in [slsa-framework#615 - test: Add test data for v1.6.0 by [@ianlewis](https://togithub.com/ianlewis) in [slsa-framework#612 - fix: Verify the TRW tag is a semver tag by [@laurentsimon](https://togithub.com/laurentsimon) in [slsa-framework#619 - chore: Don't be verbose with tests locally by [@ianlewis](https://togithub.com/ianlewis) in [slsa-framework#620 - fix: use ExternalParameters\["source"] for the Source URI for SLSA v1.0 provenance by [@asraa](https://togithub.com/asraa) in [slsa-framework#621 - test: re-generate container-based tests by [@asraa](https://togithub.com/asraa) in [slsa-framework#627 - fix: revert to using resolvedDepdendencies for source verification by [@asraa](https://togithub.com/asraa) in [slsa-framework#629 - refactor: Provenance tests by [@ianlewis](https://togithub.com/ianlewis) in [slsa-framework#628 - fix(deps): update module github.com/sigstore/rekor to v1.2.0 \[security] by [@renovate-bot](https://togithub.com/renovate-bot) in [slsa-framework#622 - fix: only allow hashes of 256 bits or more by [@laurentsimon](https://togithub.com/laurentsimon) in [slsa-framework#633 - fix: builder ID verification for testing by [@ianlewis](https://togithub.com/ianlewis) in [slsa-framework#635 - feat: remove experimental on Sigstore bundle and v1.0 SLSA provenance format by [@asraa](https://togithub.com/asraa) in [slsa-framework#634 - chore: update toc in README.md by [@asraa](https://togithub.com/asraa) in [slsa-framework#636 - fix: allow workflow_dispatch to trigger release.yml by [@ianlewis](https://togithub.com/ianlewis) in [slsa-framework#637 - test: add tests for v1.7.0 builders by [@asraa](https://togithub.com/asraa) in [slsa-framework#638 - chore(deps): update github-actions by [@renovate-bot](https://togithub.com/renovate-bot) in [slsa-framework#607 - chore(deps): update gcr.io/distroless/base:nonroot docker digest to [`c623859`](https://togithub.com/slsa-framework/slsa-verifier/commit/c623859) by [@renovate-bot](https://togithub.com/renovate-bot) in [slsa-framework#567 - fix(deps): update github.com/sigstore/protobuf-specs digest to [`5ef5406`](https://togithub.com/slsa-framework/slsa-verifier/commit/5ef5406) by [@renovate-bot](https://togithub.com/renovate-bot) in [slsa-framework#606 - chore(deps): update npm dev by [@renovate-bot](https://togithub.com/renovate-bot) in [slsa-framework#608 - chore(deps): update golang:1.19 docker digest to [`83f9f84`](https://togithub.com/slsa-framework/slsa-verifier/commit/83f9f84) by [@renovate-bot](https://togithub.com/renovate-bot) in [slsa-framework#583 - feat: Verify provenance by build type by [@ianlewis](https://togithub.com/ianlewis) in [slsa-framework#632 - refactor: Use Go 1.20 by [@ianlewis](https://togithub.com/ianlewis) in [slsa-framework#643 - test: Add more ProvenanceFromEnvelope tests by [@ianlewis](https://togithub.com/ianlewis) in [slsa-framework#640 - fix: pre-submit: e2e-cli.sh artifact download by [@ianlewis](https://togithub.com/ianlewis) in [slsa-framework#646 - refactor: Add more git utils by [@ianlewis](https://togithub.com/ianlewis) in [slsa-framework#645 - refactor: Use full builder id by [@ianlewis](https://togithub.com/ianlewis) in [slsa-framework#648 - feat: Use tags `vX.Y.Z-<language>` for JReleaser builders by [@laurentsimon](https://togithub.com/laurentsimon) in [slsa-framework#644 - chore(deps): update github-actions by [@renovate-bot](https://togithub.com/renovate-bot) in [slsa-framework#651 - feat: move maven-plugin from slsa-github-generator by [@AdamKorcz](https://togithub.com/AdamKorcz) in [slsa-framework#664 - docs: Fix maven-plugin README by [@laurentsimon](https://togithub.com/laurentsimon) in [slsa-framework#671 - feat: Verification for when sha1 is specified in BYOB TRW by [@ianlewis](https://togithub.com/ianlewis) in [slsa-framework#641 - docs: Add example for maven verification plugin by [@laurentsimon](https://togithub.com/laurentsimon) in [slsa-framework#676 - chore: Add Kris to codeowners by [@laurentsimon](https://togithub.com/laurentsimon) in [slsa-framework#678 - feat: Print byob builder by [@laurentsimon](https://togithub.com/laurentsimon) in [slsa-framework#677 - test: Add test data for v1.8.0 by [@ianlewis](https://togithub.com/ianlewis) in [slsa-framework#681 - chore(deps): update github-actions by [@renovate-bot](https://togithub.com/renovate-bot) in [slsa-framework#666 - feat: Non-compulsory BuilderID for BYOB Builders by [@enteraga6](https://togithub.com/enteraga6) in [slsa-framework#674 - chore(deps): update golang docker tag to v1.21 by [@renovate-bot](https://togithub.com/renovate-bot) in [slsa-framework#687 - chore(deps): update github-actions by [@renovate-bot](https://togithub.com/renovate-bot) in [slsa-framework#686 - feat: GCB refactor for v1.0 support by [@laurentsimon](https://togithub.com/laurentsimon) in [slsa-framework#682 - feat: Allow byob builders ref at main for e2e tests by [@laurentsimon](https://togithub.com/laurentsimon) in [slsa-framework#689 - feat: Update doc and code for Maven plugin by [@laurentsimon](https://togithub.com/laurentsimon) in [slsa-framework#680 - feat: gcb v1.0 support by [@laurentsimon](https://togithub.com/laurentsimon) in [slsa-framework#691 - feat: v1.9.0 regression tests by [@laurentsimon](https://togithub.com/laurentsimon) in [slsa-framework#696 - fix: release failure by [@laurentsimon](https://togithub.com/laurentsimon) in [slsa-framework#697 #### New Contributors - [@AdamKorcz](https://togithub.com/AdamKorcz) made their first contribution in [slsa-framework#664 - [@enteraga6](https://togithub.com/enteraga6) made their first contribution in [slsa-framework#674 **Full Changelog**: slsa-framework/slsa-verifier@v2.3.0...v2.4.0 </details> --- ### Configuration 📅 **Schedule**: Branch creation - "every weekend" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://togithub.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/slsa-framework/slsa-verifier).  Signed-off-by: Mend Renovate <bot@renovateapp.com> Co-authored-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com> Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>

enteraga6 added 3 commits July 31, 2023 22:19

Squash commits from byob patch

646a3ad

Signed-off-by: Noah Elzner <elzner@google.com>

improve error message and comments

fa2148a

Signed-off-by: Noah Elzner <elzner@google.com>

Improvements

ebf4ffc

Signed-off-by: Noah Elzner <elzner@google.com>

enteraga6 requested review from asraa, ianlewis and laurentsimon as code owners July 31, 2023 22:48

laurentsimon reviewed Aug 1, 2023

View reviewed changes

verifiers/internal/gha/provenance.go Outdated Show resolved Hide resolved

Fixed logic and comments from review feedback

67c29de

Signed-off-by: Noah Elzner <elzner@google.com>

enteraga6 changed the title ~~[feat] Non-compulsory BuilderID for BYOB Builders~~ feat: Non-compulsory BuilderID for BYOB Builders Aug 1, 2023

enteraga6 added 4 commits August 1, 2023 22:04

changed scope of comment

38ce418

Signed-off-by: Noah Elzner <elzner@google.com>

Improved function description

03b26a6

Signed-off-by: Noah Elzner <elzner@google.com>

condense comment

1095060

Signed-off-by: Noah Elzner <elzner@google.com>

space nit

acac0b8

Signed-off-by: Noah Elzner <elzner@google.com>

laurentsimon reviewed Aug 1, 2023

View reviewed changes

enteraga6 added 3 commits August 1, 2023 22:21

nit: end sentence with period

fd17c7d

Signed-off-by: Noah Elzner <elzner@google.com>

Fix function and improve comment on conditional logic

eb104b8

Signed-off-by: Noah Elzner <elzner@google.com>

Use builder.go vars for trusted builder string

c974544

Signed-off-by: Noah Elzner <elzner@google.com>

laurentsimon reviewed Aug 1, 2023

View reviewed changes

verifiers/internal/gha/builder_test.go Show resolved Hide resolved

enteraga6 added 2 commits August 1, 2023 22:59

comment fix

9318f88

Signed-off-by: Noah Elzner <elzner@google.com>

moved comment to caller for better understanding

ae63dee

Signed-off-by: Noah Elzner <elzner@google.com>

laurentsimon reviewed Aug 2, 2023

View reviewed changes

verifiers/internal/gha/provenance.go Outdated Show resolved Hide resolved

ianlewis reviewed Aug 2, 2023

View reviewed changes

enteraga6 and others added 2 commits August 2, 2023 10:41

nit: start doc comments with the name of the function as if it was pu…

f00ae0d

…blic. Co-authored-by: Ian Lewis <ianlewis@google.com> Signed-off-by: Noah Elzner <78953604+enteraga6@users.noreply.github.com>

nit: builderIDPath --> builderIDPathPrefix

42d475e

Signed-off-by: Noah Elzner <78953604+enteraga6@users.noreply.github.com>

enteraga6 requested a review from kpk47 as a code owner August 2, 2023 17:46

enteraga6 and others added 4 commits August 2, 2023 10:50

nit: pass in only expectedID instead of entire builderOpts

90aa32a

Signed-off-by: Noah Elzner <78953604+enteraga6@users.noreply.github.com>

nit: only pass in builderOpts.ExpectedID

2301ade

Signed-off-by: Noah Elzner <78953604+enteraga6@users.noreply.github.com>

nit: fix off comment

996892d

Signed-off-by: Noah Elzner <78953604+enteraga6@users.noreply.github.com>

nit: inputted

217f027

Co-authored-by: Ian Lewis <ianlewis@google.com> Signed-off-by: Noah Elzner <78953604+enteraga6@users.noreply.github.com>

enteraga6 added 2 commits August 7, 2023 19:05

trusted builder test case added

d03a11e

Signed-off-by: Noah Elzner <elzner@google.com>

Added test case for untrusted builder

0118fea

Signed-off-by: Noah Elzner <elzner@google.com>

ianlewis reviewed Aug 7, 2023

View reviewed changes

enteraga6 and others added 9 commits August 7, 2023 23:36

lint

4209ffe

Signed-off-by: Noah Elzner <elzner@google.com>

explicity set id to nil

6cd1257

Co-authored-by: Ian Lewis <ianlewis@google.com> Signed-off-by: Noah Elzner <78953604+enteraga6@users.noreply.github.com>

set id to nil explicitly

4fcc8b1

Co-authored-by: Ian Lewis <ianlewis@google.com> Signed-off-by: Noah Elzner <78953604+enteraga6@users.noreply.github.com>

nit: capitalization

1a17e0c

Co-authored-by: Ian Lewis <ianlewis@google.com> Signed-off-by: Noah Elzner <78953604+enteraga6@users.noreply.github.com>

nit: remove empty lines

c98f650

Co-authored-by: Ian Lewis <ianlewis@google.com> Signed-off-by: Noah Elzner <78953604+enteraga6@users.noreply.github.com>

nit: remove empty lines

ca9e7ae

Co-authored-by: Ian Lewis <ianlewis@google.com> Signed-off-by: Noah Elzner <78953604+enteraga6@users.noreply.github.com>

remove confusing comment

032b098

Signed-off-by: Noah Elzner <elzner@google.com>

Merge remote-tracking branch 'origin/byob-builder-feat' into byob-bui…

e999450

…lder-feat

nit: remove empty space

1ff4e9b

Signed-off-by: Noah Elzner <elzner@google.com>

laurentsimon reviewed Aug 8, 2023

View reviewed changes

verifiers/internal/gha/provenance_test.go Outdated Show resolved Hide resolved

enteraga6 added 2 commits August 11, 2023 00:51

Restructure Tests

e6d22d4

Signed-off-by: Noah Elzner <elzner@google.com>

rename for clarity

b6e36b7

Signed-off-by: Noah Elzner <elzner@google.com>

laurentsimon approved these changes Aug 11, 2023

View reviewed changes

verifiers/internal/gha/testdata/bazel-trusted-dsseEnvelope.build.slsa Show resolved Hide resolved

verifiers/internal/gha/testdata/bazel-untrusted-dsseEnvelope.sigstore Show resolved Hide resolved

verifiers/internal/gha/provenance_test.go Outdated Show resolved Hide resolved

enteraga6 and others added 3 commits August 11, 2023 01:52

use t.Errorf

3ba89d9

Signed-off-by: Noah Elzner <elzner@google.com>

Go Lint

7ada2ad

Signed-off-by: Noah Elzner <elzner@google.com>

Merge branch 'main' into byob-builder-feat

a630e1f

laurentsimon enabled auto-merge (squash) August 11, 2023 02:00

laurentsimon disabled auto-merge August 11, 2023 02:02

laurentsimon reviewed Aug 11, 2023

View reviewed changes

verifiers/internal/gha/provenance_test.go Show resolved Hide resolved

laurentsimon reviewed Aug 11, 2023

View reviewed changes

verifiers/internal/gha/provenance_test.go Outdated Show resolved Hide resolved

enteraga6 added 2 commits August 11, 2023 05:00

Merged tests and added more

82d0676

Signed-off-by: Noah Elzner <elzner@google.com>

Merge remote-tracking branch 'origin/byob-builder-feat' into byob-bui…

ba333a5

…lder-feat

laurentsimon enabled auto-merge (squash) August 11, 2023 14:11

laurentsimon merged commit 8bcf1f0 into slsa-framework:main Aug 11, 2023
14 checks passed

p-linnane mentioned this pull request Aug 25, 2023

slsa-verifier 2.4.0 Homebrew/homebrew-core#140495

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: Non-compulsory BuilderID for BYOB Builders #674

feat: Non-compulsory BuilderID for BYOB Builders #674

enteraga6 commented Jul 31, 2023

laurentsimon left a comment

laurentsimon left a comment

feat: Non-compulsory BuilderID for BYOB Builders #674

feat: Non-compulsory BuilderID for BYOB Builders #674

Conversation

enteraga6 commented Jul 31, 2023

laurentsimon left a comment

Choose a reason for hiding this comment

laurentsimon left a comment

Choose a reason for hiding this comment