v2.0.0

Breaking Changes

• refactor: add subcommands and separate functionality from artifacts a… by @asraa in #231. Users running

slsa-verifier -artifact-path ${ARTIFACT} -provenance ${PROVENANCE} -source ${SOURCE} -tag ${TAG} -branch ${BRANCH} -versioned-tag ${VTAG}

must migrate to

slsa-verifier verify-artifact ${ARTIFACT} -provenance-path ${PROVENANCE} -source-uri ${SOURCE} -source-tag {TAG} -source-branch {BRANCH} -source-versioned-tag ${VTAG}

Major Features

• feat: slsa-verifier now performs OCI verification using slsa-verifier verify-image. See #147.
• feat: GCB-generated container image SLSA provenance verification is supported. See https://github.com/slsa-framework/slsa-verifier#verification-for-google-cloud-build and #202
• feat: Add a GitHub Action for installing slsa-verifier. by @kpk47 in #246

What's Changed

• release: release v1.3.0 of verifier by @asraa in #218
• feat: support oci image verification by @asraa in #147
• fix(deps): update module github.com/go-openapi/swag to v0.22.3 by @renovate-bot in #215
• chore(deps): update golang:1.18 docker digest to 616aa98 by @renovate-bot in #214
• chore(deps): update github-actions by @renovate-bot in #222
• chore(deps): update actions/checkout action to v3 by @renovate-bot in #227
• fix(deps): update module github.com/sigstore/cosign to v1.11.0 by @renovate-bot in #224
• fix(deps): update module github.com/sigstore/rekor to v0.11.0 by @renovate-bot in #225
• chore(deps): update gcr.io/distroless/base:nonroot docker digest to 533c15e by @renovate-bot in #228
• feat: Support for GCB verification by @laurentsimon in #202
• Correct installation command in README by @laurentsimon in #241
• release: add release v1.0.3 by @asraa in #235
• Verify text provenance for GCB by @laurentsimon in #242
• doc: fix comment typos by @laurentsimon in #244
• fix(deps): update module github.com/sigstore/cosign to v1.11.1 by @renovate-bot in #239
• chore(deps): update github-actions by @renovate-bot in #240
• feat: add CLI tests for GCB verification by @laurentsimon in #245
• chore(deps): update github/codeql-action action to v2.1.22 by @renovate-bot in #249
• chore(deps): update golang:1.18 docker digest to 5540a6a by @renovate-bot in #238
• feat: support for GCB v0.3 verification by @laurentsimon in #248
• fix: fix CLI flag mishap by @asraa in #250
• feat: CLI tests for GCB verification by @laurentsimon in #251
• feat: support builderID matching with or without semver for GCB by @laurentsimon in #256
• chore(deps): update golang docker tag to v1.19 by @renovate-bot in #196
• chore(deps): update ossf/scorecard-action action to v2 by @renovate-bot in #255
• fix(deps): update module github.com/google/go-cmp to v0.5.9 by @renovate-bot in #253
• feat: support builderID matching with or without semver for GHA by @laurentsimon in #257
• fix(deps): update module github.com/sigstore/cosign to v1.12.0 by @renovate-bot in #264
• chore(deps): update gcr.io/distroless/base:nonroot docker digest to 33fac4d by @renovate-bot in #260
• chore(deps): update github/codeql-action action to v2.1.24 by @renovate-bot in #262
• Add a GitHub Action for installing slsa-verifier. by @kpk47 in #246
• fix(deps): update module github.com/sigstore/sigstore to v1.4.1 by @renovate-bot in #263
• doc: document build id and GCB vs GHA by @laurentsimon in #266
• doc: add links to GH builders by @laurentsimon in #268
• chore(deps): update github-actions by @renovate-bot in #274
• fix(deps): update module github.com/sigstore/sigstore to v1.4.2 by @renovate-bot in #272
• Update README.md by @laurentsimon in #276
• fix: make client shard aware when verifying by @asraa in #282
• chore(deps): update github-actions by @renovate-bot in #284
• Update pre-submits by @ianlewis in #289
• release: add release v1.3.1 and v1.2.1 by @asraa in #288
• release: add release hash for v1.1.2 and v1.0.4 by @asraa in #291
• chore(deps): pin dependencies by @renovate-bot in #269
• chore(deps): update dependency jasmine to v4.4.0 by @renovate-bot in #283
• gcb: add gcb compatibility for provenance formats and buckets by @asraa in #292
• fix: fix release configuration and workflow for version info by @asraa in #296
• ci: use upstream version lib to provide version, commit, and tree state by @asraa in #297
• fix: env vars are case sensitive in configuration by @asraa in #298
• chore(deps): update github-actions by @renovate-bot in #295
• fix(deps): update module github.com/sigstore/sigstore to v1.4.4 by @renovate-bot in #294
• chore(deps): update gcr.io/distroless/base:nonroot docker digest to 3778d4f by @renovate-bot in #293
• chore(deps): update gcr.io/distroless/base:nonroot docker digest to a6441d1 by @renovate-bot in #306
• chore(deps): update dependency eslint-plugin-github to v4.4.0 by @renovate-bot in #305
• fix(deps): update module github.com/go-openapi/runtime to v0.24.2 by @renovate-bot in #304
• rekor: use rekor client with retries by @asraa in #301
• chore(deps): update dependency eslint to v8.25.0 by @renovate-bot in #273
• tests: fix builder id matching by @asraa in #308
• test: add v1.2.1 builder tests by @asraa in #310
• docs: update release.md docs to describe a pre-release by @asraa in #314
• fix: address gcb verifier comments and add gcb documentation by @asraa in #300
• Add optional by @wietse-gmail in #316
• Fix installer: Add arguments to actions/checkout so that it checks ou… by @kpk47 in #319
• Make GitHub token optional by @laurentsimon in #324
• chore(deps): update dependency eslint to v8.26.0 by @renovate-bot in #323
• feat: run CLI tests daily by @laurentsimon in #327
• Update sigstore libraries by @ianlewis in #326
• chore(deps): update dependency typescript to v4.8.4 by @renovate-bot in #270
• chore(deps): update dependency jasmine to v4.5.0 by @renovate-bot in #345
• chore(deps): update github-actions to v3 (major) by @renovate-bot in #344
• chore(deps): update dependency @types/node to v18.11.8 by @renovate-bot in #341
• chore(deps): update github-actions by @renovate-bot in #342
• fix(deps): update module github.com/spf13/cobra to v1.6.1 by @renovate-bot in #340
• releases: add new releases to SHA256SUM.md by @asraa in #347
• refactor: consolidate verification funcs for GHA by @asraa in #348
• fixing typo by @tahirraza in #352
• fix: fix error logs by @suzuki-shunsuke in #356
• Add e2e tests for slsa-github-generator v1.2.2 by @ianlewis in #355
• chore(deps): update github-actions by @renovate-bot in #351
• Add golangci-lint and yamllint by @ianlewis in #365
• Update renovate config to group PRs by @ianlewis in #368
• Update README by @ianlewis in #361
• Update to reference v1.3.2 as latest version. by @asraa in #369
• chore(deps): update github-actions by @renovate-bot in #359
• chore(deps): update actions/dependency-review-action action to v3 by @renovate-bot in #358

New Contributors

• @kpk47 made their first contribution in #246
• @wietse-gmail made their first contribution in #316
• @tahirraza made their first contribution in #352
• @suzuki-shunsuke made their first contribution in #356

Full Changelog: v1.3.2...v2.0.0-rc.0