Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: adds envelope hash to in-toto entries in tlog entry creation #2118

Merged
merged 16 commits into from
Aug 14, 2022
Merged

fix: adds envelope hash to in-toto entries in tlog entry creation #2118

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
16 commits
Select commit Hold shift + click to select a range
55a167c
bufix resoled
nkreiger Aug 2, 2022
9963b76
clean up unused
nkreiger Aug 2, 2022
9af85b4
needs to be upgraded
nkreiger Aug 2, 2022
8d5f300
rm test file
nkreiger Aug 2, 2022
f019a63
clean up for comments
nkreiger Aug 2, 2022
44f884d
accidentally added test
nkreiger Aug 2, 2022
8a3cffb
force rebase
nkreiger Aug 3, 2022
da3fce5
sync back to main branch
nkreiger Aug 5, 2022
076a6b4
fix linting issue
nkreiger Aug 5, 2022
b86723e
merge go.sum
nkreiger Aug 5, 2022
07caaef
address proposed change, sync to main
nkreiger Aug 12, 2022
ffc816d
deleted image
nkreiger Aug 12, 2022
371bdee
restore gif
nkreiger Aug 12, 2022
415ba9d
see if this fixes the build issue
nkreiger Aug 13, 2022
32285ae
Merge branch 'main' of github.com:sigstore/cosign
nkreiger Aug 14, 2022
a1b8b7b
merge in main branch with release utils changes
nkreiger Aug 14, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 3 additions & 11 deletions cmd/cosign/cli/attest/attest.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,6 @@ import (
"github.com/sigstore/cosign/pkg/oci/mutate"
ociremote "github.com/sigstore/cosign/pkg/oci/remote"
"github.com/sigstore/cosign/pkg/oci/static"
sigs "github.com/sigstore/cosign/pkg/signature"
"github.com/sigstore/cosign/pkg/types"
"github.com/sigstore/rekor/pkg/generated/client"
"github.com/sigstore/rekor/pkg/generated/models"
Expand All @@ -48,16 +47,9 @@ import (
type tlogUploadFn func(*client.Rekor, []byte) (*models.LogEntryAnon, error)

func uploadToTlog(ctx context.Context, sv *sign.SignerVerifier, rekorURL string, upload tlogUploadFn) (*cbundle.RekorBundle, error) {
var rekorBytes []byte
// Upload the cert or the public key, depending on what we have
if sv.Cert != nil {
rekorBytes = sv.Cert
} else {
pemBytes, err := sigs.PublicKeyPem(sv, signatureoptions.WithContext(ctx))
if err != nil {
return nil, err
}
rekorBytes = pemBytes
rekorBytes, err := sv.Bytes(ctx)
if err != nil {
return nil, err
}

rekorClient, err := rekor.NewClient(rekorURL)
Expand Down
18 changes: 8 additions & 10 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,14 +55,14 @@ require (
github.com/ryanuber/go-glob v1.0.0
github.com/secure-systems-lab/go-securesystemslib v0.4.0
github.com/sigstore/fulcio v0.1.2-0.20220114150912-86a2036f9bc7
github.com/sigstore/rekor v0.4.1-0.20220114213500-23f583409af3
github.com/sigstore/rekor v0.10.0
github.com/sigstore/sigstore v1.2.1-0.20220614141825-9c0e2e247545
github.com/spf13/cobra v1.5.0
github.com/spf13/pflag v1.0.5
github.com/spf13/viper v1.12.0
github.com/spiffe/go-spiffe/v2 v2.1.1
github.com/stretchr/testify v1.8.0
github.com/theupdateframework/go-tuf v0.3.0
github.com/theupdateframework/go-tuf v0.3.1
github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399
github.com/transparency-dev/merkle v0.0.1
github.com/withfig/autocomplete-tools/packages/cobra v0.0.0-20220122124547-31d3821a6898
Expand Down Expand Up @@ -108,8 +108,6 @@ require (
github.com/OneOfOne/xxhash v1.2.8 // indirect
github.com/PaesslerAG/gval v1.0.0 // indirect
github.com/PaesslerAG/jsonpath v0.1.1 // indirect
github.com/PuerkitoBio/purell v1.1.1 // indirect
github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 // indirect
github.com/ReneKroon/ttlcache/v2 v2.11.0 // indirect
github.com/agnivade/levenshtein v1.0.1 // indirect
github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d // indirect
Expand Down Expand Up @@ -164,13 +162,13 @@ require (
github.com/go-openapi/analysis v0.21.2 // indirect
github.com/go-openapi/errors v0.20.2 // indirect
github.com/go-openapi/jsonpointer v0.19.5 // indirect
github.com/go-openapi/jsonreference v0.19.6 // indirect
github.com/go-openapi/jsonreference v0.20.0 // indirect
github.com/go-openapi/loads v0.21.1 // indirect
github.com/go-openapi/spec v0.20.4 // indirect
github.com/go-openapi/validate v0.21.0 // indirect
github.com/go-openapi/spec v0.20.6 // indirect
github.com/go-openapi/validate v0.22.0 // indirect
github.com/go-playground/locales v0.14.0 // indirect
github.com/go-playground/universal-translator v0.18.0 // indirect
github.com/go-playground/validator/v10 v10.10.0 // indirect
github.com/go-playground/validator/v10 v10.11.0 // indirect
github.com/gobwas/glob v0.2.3 // indirect
github.com/gogo/protobuf v1.3.2 // indirect
github.com/golang-jwt/jwt v3.2.2+incompatible // indirect
Expand All @@ -194,7 +192,7 @@ require (
github.com/hashicorp/vault/api v1.7.2 // indirect
github.com/imdario/mergo v0.3.12 // indirect
github.com/inconshreveable/mousetrap v1.0.0 // indirect
github.com/jedisct1/go-minisign v0.0.0-20210703085342-c1f07ee84431 // indirect
github.com/jedisct1/go-minisign v0.0.0-20211028175153-1c139d1cc84b // indirect
github.com/jhump/protoreflect v1.10.3 // indirect
github.com/jmespath/go-jmespath v0.4.0 // indirect
github.com/jonboulle/clockwork v0.3.0 // indirect
Expand Down Expand Up @@ -283,7 +281,7 @@ require (
google.golang.org/genproto v0.0.0-20220624142145-8cd45d7dbd1f // indirect
gopkg.in/cheggaaa/pb.v1 v1.0.28 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/ini.v1 v1.66.4 // indirect
gopkg.in/ini.v1 v1.66.6 // indirect
gopkg.in/natefinch/lumberjack.v2 v2.0.0 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
gotest.tools/v3 v3.1.0 // indirect
Expand Down
Loading