Skip to content

Releases: slsa-framework/slsa-verifier

v2.3.0-rc.2

09 May 07:03
@ianlewis ianlewis
v2.3.0-rc.2
8da58c6
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v2.3.0-rc.2 Pre-release
Pre-release

What's Changed

  • docs(gh-action): update actions installer path by @sunnyyip in #581
  • chore: update slsa provenance to v1 by @asraa in #579
  • fix(deps): update github.com/sigstore/protobuf-specs digest to 91485b4 by @renovate-bot in #584
  • chore(deps): update github/codeql-action action to v2.3.3 by @renovate-bot in #585

New Contributors

Full Changelog: v2.3.0-rc.1...v2.3.0-rc.2

Contributors

asraa, sunnyyip, and renovate-bot
Assets 14
Loading

v2.3.0-rc.1

01 May 08:16
@ianlewis ianlewis
v2.3.0-rc.1
88cd40e
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v2.3.0-rc.1 Pre-release
Pre-release

What's Changed

Full Changelog: v2.3.0-rc.0...v2.3.0-rc.1

Contributors

ianlewis, renovate-bot, and laurentsimon
Assets 14
Loading

v2.3.0-rc.0

25 Apr 04:15
@ianlewis ianlewis
v2.3.0-rc.0
2e60ff0
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v2.3.0-rc.0 Pre-release
Pre-release

Summary

Initial support was added to the verify-npm-package command for the Node.js builder.

What's Changed

Full Changelog: v2.2.0...v2.3.0-rc.0

Contributors

ianlewis, asraa, and 2 other contributors
Assets 14
Loading

v2.2.0

12 Apr 08:30
@ianlewis ianlewis
v2.2.0
623cf20
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v2.2.0

Summary

Support was added for the --source-tag and --source-versioned-tag flags for GCB container provenance verification.

What's Changed

New Contributors

Full Changelog: v2.1.0...v2.2.0

Contributors

ianlewis, asraa, and 4 other contributors
Assets 14
Loading

v2.2.0-rc.0

11 Apr 04:51
@ianlewis ianlewis
v2.2.0-rc.0
623cf20
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v2.2.0-rc.0 Pre-release
Pre-release

Summary

Support was added for the --source-tag and --source-versioned-tag flags for GCB container provenance verification.

What's Changed

New Contributors

Full Changelog: v2.1.0...v2.1.1-rc.0

Contributors

ianlewis, asraa, and 4 other contributors
Assets 14
Loading

v2.1.0

14 Mar 14:44
@asraa asraa
v2.1.0
1ed3847
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v2.1.0

Summary

This release adds support for:

  • GCB V1's global signing key that uses PAE encoding for signing
  • Installer Action to install the slsa-verifier in GitHub workflows. See Setup GitHub Action
  • Verification of multiple artifacts via the CLI

Fixes:

  • GCB now adds a prefix git+ to their material source URIs. This is fixed in #519

This release also includes the following experimental changes:

  • npm package verification from the public registry via an SLSA_VERIFIER_EXPERIMENTAL=1 flag.
  • Offline verification using a Sigstore bundle behind the SLSA_VERIFIER_EXPERIMENTAL=1 flag.

What's Changed

New Contributors

Full Changelog: v2.0.1...v2.1.0

Contributors

ianlewis, mihaimaruseac, and 5 other contributors
Assets 14
Loading

v2.0.1

13 Dec 23:46
@asraa asraa
v2.0.1
a438882
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v2.0.1

v2.0.1

This patch release fixes the Go module path for the major version update to support installation via go install.
It also ensures a version is displayed in the version command.

Bug Fixes

What's Changed

Full Changelog: v2.0.0...v2.0.1

Contributors

ianlewis, asraa, and 2 other contributors
Assets 4
Loading

v2.0.0

01 Dec 22:43
@asraa asraa
v2.0.0
128324f
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v2.0.0

Breaking Changes

  • refactor: add subcommands and separate functionality from artifacts a… by @asraa in #231. Users running
slsa-verifier -artifact-path ${ARTIFACT} -provenance ${PROVENANCE} -source ${SOURCE} -tag ${TAG} -branch ${BRANCH} -versioned-tag ${VTAG}

must migrate to

slsa-verifier verify-artifact ${ARTIFACT} -provenance-path ${PROVENANCE} -source-uri ${SOURCE} -source-tag {TAG} -source-branch {BRANCH} -source-versioned-tag ${VTAG}

Major Features

What's Changed

Read more

Contributors

ianlewis, kpk47, and 6 other contributors
Assets 4
Loading

v1.3.2

31 Oct 19:31
@asraa asraa
v1.3.2
0ff6656
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.3.2

This fixes issue #325. Sigstore root metadata was updated to a key format incompatible with old go-tuf (the underlying TUF client) libraries. This updated sigstore libraries to new ones that pulled in the updated go-tuf libraries.

What's Changed

  • Backport release/v1.3: Update sigstore libraries by @ianlewis in #329
  • release/v1.3: update release builder by @asraa in #333

Full Changelog: v1.3.1...v1.3.2

Contributors

ianlewis and asraa
Assets 4
Loading

v1.2.2

31 Oct 19:32
@asraa asraa
v1.2.2
300ff1c
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.2.2

This fixes issue #325. Sigstore root metadata was updated to a key format incompatible with old go-tuf (the underlying TUF client) libraries. This updated sigstore libraries to new ones that pulled in the updated go-tuf libraries.

What's Changed

  • chore(deps): update github-actions by @renovate-bot in #295
  • fix(deps): update module github.com/sigstore/sigstore to v1.4.4 by @renovate-bot in #294
  • chore(deps): update gcr.io/distroless/base:nonroot docker digest to 3778d4f by @renovate-bot in #293
  • chore(deps): update gcr.io/distroless/base:nonroot docker digest to a6441d1 by @renovate-bot in #306
  • chore(deps): update dependency eslint-plugin-github to v4.4.0 by @renovate-bot in #305
  • fix(deps): update module github.com/go-openapi/runtime to v0.24.2 by @renovate-bot in #304
  • rekor: use rekor client with retries by @asraa in #301
  • chore(deps): update dependency eslint to v8.25.0 by @renovate-bot in #273
  • tests: fix builder id matching by @asraa in #308

Full Changelog: v1.4.1...v1.2.2

Contributors

asraa and renovate-bot
Assets 4
Loading