-
Notifications
You must be signed in to change notification settings - Fork 21
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Example of verifying OCI referenced images using sigstore-go (#30)
* Add a doc for verifying OCI images with sigstore-go Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com> * Add oci image verification support to sigstore-go Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com> * Ignore conformance binary and DS_Store Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com> * Fix linting error Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com> * Update docs/oci-image-verification.md Co-authored-by: Fredrik Skogman <kommendorkapten@github.com> Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com> * State explicitly that this is just an example use of sigstore-go Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com> * Move the image example to examples/oci-image-verification Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com> * Update docs/oci-image-verification.md Co-authored-by: Cody Soyland <codysoyland@github.com> Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com> --------- Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com> Co-authored-by: Fredrik Skogman <kommendorkapten@github.com> Co-authored-by: Cody Soyland <codysoyland@github.com>
- Loading branch information
3 people
committed
Dec 7, 2023
1 parent
ae8a96d
commit 6a8bf18
Showing
5 changed files
with
1,586 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,3 +1,5 @@ | ||
| .idea | ||
| .DS_Store | ||
| /sigstore-go | ||
| /tufdata | ||
| /conformance |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,139 @@ | ||
| # Example of OCI image verification using `sigstore-go` | ||
|
|
||
| This document will walk through using the `sigstore-go` library to verify an OCI image reference. | ||
|
|
||
| ## Disclaimer | ||
|
|
||
| This is an example of how to use the `sigstore-go` library to verify an OCI image reference and is not intended to | ||
| replace cosign and/or be reused in production. The `sigstore-go` library is still in development and is subject to change. | ||
| The following issue tracks the cosign support of the protobuf bundle format - [#3139](https://github.com/sigstore/cosign/issues/3139). | ||
|
|
||
| ## Overview | ||
|
|
||
| In this example, we'll use the `sigstore-go` library to verify an OCI image reference. | ||
| This simple CLI is a wrapper around the Go API with the difference that it constructs a | ||
| [Sigstore bundle](https://github.com/sigstore/protobuf-specs/blob/main/protos/sigstore_bundle.proto) from the OCI image | ||
| reference metadata as a prerequisite to the verification process. | ||
|
|
||
| ## Requirements | ||
|
|
||
| - Unix-compatible OS | ||
| - [Go 1.21](https://go.dev/doc/install) | ||
|
|
||
| ## Getting started | ||
|
|
||
| Clone this repository and navigate to the `examples/oci-image-verification` directory: | ||
|
|
||
| ```shell | ||
| $ go build . | ||
| ``` | ||
|
|
||
| ## Trusted Root | ||
|
|
||
| The verifier allows you to use the Sigstore Public Good TUF root or your own custom [trusted root](https://github.com/sigstore/protobuf-specs/blob/main/protos/sigstore_trustroot.proto) containing the root/intermediate certificates of the Fulcio/TSA/Rekor instances used to sign the bundle, in order to verify common open source bundles or bundles signed by your own private Sigstore instance. | ||
|
|
||
| ## Verification Process | ||
|
|
||
| The image we are going to verify is `ghcr.io/stacklok/minder/server:latest` | ||
|
|
||
| ```shell | ||
| $ ./oci-image-verification --ociImage="ghcr.io/stacklok/minder/server:latest" \ | ||
| --tufRootURL="tuf-repo-cdn.sigstore.dev" \ | ||
| --expectedSANRegex="^https://github.com/stacklok/minder/" \ | ||
| --expectedIssuer="https://token.actions.githubusercontent.com" | ||
| ``` | ||
|
|
||
| Upon successful verification, the CLI will print the verification result in JSON format along with a `Verification successful!` message. | ||
|
|
||
| Below is an example of the bundle that was constructed for this image(at that point of time) followed by the successful verification result, serialized as JSON: | ||
|
|
||
| ```json | ||
| { | ||
| "mediaType": "application/vnd.dev.sigstore.bundle+json;version=0.1", | ||
| "verificationMaterial": { | ||
| "x509CertificateChain": { | ||
| "certificates": [ | ||
| { | ||
| "rawBytes": "MIIGtDCCBjugAwIBAgIUbd4ghtzt4FI69XTWFG2jdRhQgxcwCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjMxMTI4MjEwNzA4WhcNMjMxMTI4MjExNzA4WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEYPWRO615alYr3u0gSiiL056ZykQQBOe3OUmyoIpOwMpXoPN8zTn5T6OAqFirfg2n9zSwQBD4eXqFXemzR7I/oaOCBVowggVWMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUllhfm6BoyqDLHMEBgQrVW4pFnUwwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wZAYDVR0RAQH/BFowWIZWaHR0cHM6Ly9naXRodWIuY29tL3N0YWNrbG9rL21pbmRlci8uZ2l0aHViL3dvcmtmbG93cy9jaGFydC1wdWJsaXNoLnltbEByZWZzL2hlYWRzL21haW4wOQYKKwYBBAGDvzABAQQraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTASBgorBgEEAYO/MAECBARwdXNoMDYGCisGAQQBg78wAQMEKDZkYzZjNmMyNzE4NGY5MTliYTZjYTI1OGUwNjRiZDdkZDE4ZTkyMDAwIAYKKwYBBAGDvzABBAQSUHVibGlzaCBIZWxtIENoYXJ0MB0GCisGAQQBg78wAQUED3N0YWNrbG9rL21pbmRlcjAdBgorBgEEAYO/MAEGBA9yZWZzL2hlYWRzL21haW4wOwYKKwYBBAGDvzABCAQtDCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMGYGCisGAQQBg78wAQkEWAxWaHR0cHM6Ly9naXRodWIuY29tL3N0YWNrbG9rL21pbmRlci8uZ2l0aHViL3dvcmtmbG93cy9jaGFydC1wdWJsaXNoLnltbEByZWZzL2hlYWRzL21haW4wOAYKKwYBBAGDvzABCgQqDCg2ZGM2YzZjMjcxODRmOTE5YmE2Y2EyNThlMDY0YmQ3ZGQxOGU5MjAwMB0GCisGAQQBg78wAQsEDwwNZ2l0aHViLWhvc3RlZDAyBgorBgEEAYO/MAEMBCQMImh0dHBzOi8vZ2l0aHViLmNvbS9zdGFja2xvay9taW5kZXIwOAYKKwYBBAGDvzABDQQqDCg2ZGM2YzZjMjcxODRmOTE5YmE2Y2EyNThlMDY0YmQ3ZGQxOGU5MjAwMB8GCisGAQQBg78wAQ4EEQwPcmVmcy9oZWFkcy9tYWluMBkGCisGAQQBg78wAQ8ECwwJNjI0MDU2NTU4MCsGCisGAQQBg78wARAEHQwbaHR0cHM6Ly9naXRodWIuY29tL3N0YWNrbG9rMBkGCisGAQQBg78wAREECwwJMTEwMjM3NzQ2MGYGCisGAQQBg78wARIEWAxWaHR0cHM6Ly9naXRodWIuY29tL3N0YWNrbG9rL21pbmRlci8uZ2l0aHViL3dvcmtmbG93cy9jaGFydC1wdWJsaXNoLnltbEByZWZzL2hlYWRzL21haW4wOAYKKwYBBAGDvzABEwQqDCg2ZGM2YzZjMjcxODRmOTE5YmE2Y2EyNThlMDY0YmQ3ZGQxOGU5MjAwMBQGCisGAQQBg78wARQEBgwEcHVzaDBVBgorBgEEAYO/MAEVBEcMRWh0dHBzOi8vZ2l0aHViLmNvbS9zdGFja2xvay9taW5kZXIvYWN0aW9ucy9ydW5zLzcwMjQ1MDI0ODAvYXR0ZW1wdHMvMTAWBgorBgEEAYO/MAEWBAgMBnB1YmxpYzCBigYKKwYBBAHWeQIEAgR8BHoAeAB2AN09MGrGxxEyYxkeHJlnNwKiSl643jyt/4eKcoAvKe6OAAABjBfB1dwAAAQDAEcwRQIhAPOQe9Jb1gH0c5q/lpjztpyrN2P4Zm+xHExfH/mHUoOHAiBgClsjZq4aRMwu8N7bQp07bdir+skM9pMTuxQ/fbkMCTAKBggqhkjOPQQDAwNnADBkAjA7yRocfz9xNVKNXadkL5pXc453uaerc/Y7hrtVkJvI2mXFXl42BWCck3sVPHqvvtACMD/vOb3bWqGT5yTLSbtpXxBNncrp2o0KR12c1c7v5mhtf9UdPo1E3LIAYlqpOoj3QQ==" | ||
| } | ||
| ] | ||
| }, | ||
| "tlogEntries": [ | ||
| { | ||
| "logIndex": "53194260", | ||
| "logId": { | ||
| "keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0=" | ||
| }, | ||
| "kindVersion": { | ||
| "kind": "hashedrekord", | ||
| "version": "0.0.1" | ||
| }, | ||
| "integratedTime": "1701205628", | ||
| "inclusionPromise": { | ||
| "signedEntryTimestamp": "MEYCIQCOvYr8ezbNfJMGw0CIT4krwy2fSnIVMUfWJ4Xjn7ZsOQIhAMROYirqcbs76Y4B4I/wDlqdDavbx3OB6/YPezB46npD" | ||
| }, | ||
| "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiaGFzaGVkcmVrb3JkIiwic3BlYyI6eyJkYXRhIjp7Imhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJhOWQzZWE4Mzk3OWJmYTM1MjJkNTkwNjRjMzI0NzNlZDNiYWM4OGY2MmMzNmIzZGQyNDNmZWZlOTVkZWM2ZGEwIn19LCJzaWduYXR1cmUiOnsiY29udGVudCI6Ik1FUUNJR1RkZnIwbytoQWlMTEZzTkNNR1ZoRnF2aTRYNm52V290amZwc1NPaThxakFpQmloMC9FVjhYckRnMWpiUTVyK2R5Y080Wi94a0hWbGg1VUZSWThnQ2ZzdGc9PSIsInB1YmxpY0tleSI6eyJjb250ZW50IjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVZDBSRU5EUW1wMVowRjNTVUpCWjBsVlltUTBaMmgwZW5RMFJrazJPVmhVVjBaSE1tcGtVbWhSWjNoamQwTm5XVWxMYjFwSmVtb3dSVUYzVFhjS1RucEZWazFDVFVkQk1WVkZRMmhOVFdNeWJHNWpNMUoyWTIxVmRWcEhWakpOVWpSM1NFRlpSRlpSVVVSRmVGWjZZVmRrZW1SSE9YbGFVekZ3WW01U2JBcGpiVEZzV2tkc2FHUkhWWGRJYUdOT1RXcE5lRTFVU1RSTmFrVjNUbnBCTkZkb1kwNU5hazE0VFZSSk5FMXFSWGhPZWtFMFYycEJRVTFHYTNkRmQxbElDa3R2V2tsNmFqQkRRVkZaU1V0dldrbDZhakJFUVZGalJGRm5RVVZaVUZkU1R6WXhOV0ZzV1hJemRUQm5VMmxwVERBMU5scDVhMUZSUWs5bE0wOVZiWGtLYjBsd1QzZE5jRmh2VUU0NGVsUnVOVlEyVDBGeFJtbHlabWN5YmpsNlUzZFJRa1EwWlZoeFJsaGxiWHBTTjBrdmIyRlBRMEpXYjNkbloxWlhUVUUwUndwQk1WVmtSSGRGUWk5M1VVVkJkMGxJWjBSQlZFSm5UbFpJVTFWRlJFUkJTMEpuWjNKQ1owVkdRbEZqUkVGNlFXUkNaMDVXU0ZFMFJVWm5VVlZzYkdobUNtMDJRbTk1Y1VSTVNFMUZRbWRSY2xaWE5IQkdibFYzZDBoM1dVUldVakJxUWtKbmQwWnZRVlV6T1ZCd2VqRlphMFZhWWpWeFRtcHdTMFpYYVhocE5Ga0tXa1E0ZDFwQldVUldVakJTUVZGSUwwSkdiM2RYU1ZwWFlVaFNNR05JVFRaTWVUbHVZVmhTYjJSWFNYVlpNamwwVEROT01GbFhUbkppUnpseVRESXhjQXBpYlZKc1kyazRkVm95YkRCaFNGWnBURE5rZG1OdGRHMWlSemt6WTNrNWFtRkhSbmxrUXpGM1pGZEtjMkZZVG05TWJteDBZa1ZDZVZwWFducE1NbWhzQ2xsWFVucE1NakZvWVZjMGQwOVJXVXRMZDFsQ1FrRkhSSFo2UVVKQlVWRnlZVWhTTUdOSVRUWk1lVGt3WWpKMGJHSnBOV2haTTFKd1lqSTFla3h0WkhBS1pFZG9NVmx1Vm5wYVdFcHFZakkxTUZwWE5UQk1iVTUyWWxSQlUwSm5iM0pDWjBWRlFWbFBMMDFCUlVOQ1FWSjNaRmhPYjAxRVdVZERhWE5IUVZGUlFncG5OemgzUVZGTlJVdEVXbXRaZWxwcVRtMU5lVTU2UlRST1IxazFUVlJzYVZsVVdtcFpWRWt4VDBkVmQwNXFVbWxhUkdScldrUkZORnBVYTNsTlJFRjNDa2xCV1V0TGQxbENRa0ZIUkhaNlFVSkNRVkZUVlVoV2FXSkhiSHBoUTBKSldsZDRkRWxGVG05WldFb3dUVUl3UjBOcGMwZEJVVkZDWnpjNGQwRlJWVVVLUkROT01GbFhUbkppUnpseVRESXhjR0p0VW14amFrRmtRbWR2Y2tKblJVVkJXVTh2VFVGRlIwSkJPWGxhVjFwNlRESm9iRmxYVW5wTU1qRm9ZVmMwZHdwUGQxbExTM2RaUWtKQlIwUjJla0ZDUTBGUmRFUkRkRzlrU0ZKM1kzcHZka3d6VW5aaE1sWjFURzFHYW1SSGJIWmliazExV2pKc01HRklWbWxrV0U1c0NtTnRUblppYmxKc1ltNVJkVmt5T1hSTlIxbEhRMmx6UjBGUlVVSm5OemgzUVZGclJWZEJlRmRoU0ZJd1kwaE5Oa3g1T1c1aFdGSnZaRmRKZFZreU9YUUtURE5PTUZsWFRuSmlSemx5VERJeGNHSnRVbXhqYVRoMVdqSnNNR0ZJVm1sTU0yUjJZMjEwYldKSE9UTmplVGxxWVVkR2VXUkRNWGRrVjBwellWaE9id3BNYm14MFlrVkNlVnBYV25wTU1taHNXVmRTZWt3eU1XaGhWelIzVDBGWlMwdDNXVUpDUVVkRWRucEJRa05uVVhGRVEyY3lXa2ROTWxsNldtcE5hbU40Q2s5RVVtMVBWRVUxV1cxRk1sa3lSWGxPVkdoc1RVUlpNRmx0VVROYVIxRjRUMGRWTlUxcVFYZE5RakJIUTJselIwRlJVVUpuTnpoM1FWRnpSVVIzZDA0S1dqSnNNR0ZJVm1sTVYyaDJZek5TYkZwRVFYbENaMjl5UW1kRlJVRlpUeTlOUVVWTlFrTlJUVWx0YURCa1NFSjZUMms0ZGxveWJEQmhTRlpwVEcxT2RncGlVemw2WkVkR2FtRXllSFpoZVRsMFlWYzFhMXBZU1hkUFFWbExTM2RaUWtKQlIwUjJla0ZDUkZGUmNVUkRaekphUjAweVdYcGFhazFxWTNoUFJGSnRDazlVUlRWWmJVVXlXVEpGZVU1VWFHeE5SRmt3V1cxUk0xcEhVWGhQUjFVMVRXcEJkMDFDT0VkRGFYTkhRVkZSUW1jM09IZEJVVFJGUlZGM1VHTnRWbTBLWTNrNWIxcFhSbXRqZVRsMFdWZHNkVTFDYTBkRGFYTkhRVkZSUW1jM09IZEJVVGhGUTNkM1NrNXFTVEJOUkZVeVRsUlZORTFEYzBkRGFYTkhRVkZSUWdwbk56aDNRVkpCUlVoUmQySmhTRkl3WTBoTk5reDVPVzVoV0ZKdlpGZEpkVmt5T1hSTU0wNHdXVmRPY21KSE9YSk5RbXRIUTJselIwRlJVVUpuTnpoM0NrRlNSVVZEZDNkS1RWUkZkMDFxVFROT2VsRXlUVWRaUjBOcGMwZEJVVkZDWnpjNGQwRlNTVVZYUVhoWFlVaFNNR05JVFRaTWVUbHVZVmhTYjJSWFNYVUtXVEk1ZEV3elRqQlpWMDV5WWtjNWNrd3lNWEJpYlZKc1kyazRkVm95YkRCaFNGWnBURE5rZG1OdGRHMWlSemt6WTNrNWFtRkhSbmxrUXpGM1pGZEtjd3BoV0U1dlRHNXNkR0pGUW5sYVYxcDZUREpvYkZsWFVucE1NakZvWVZjMGQwOUJXVXRMZDFsQ1FrRkhSSFo2UVVKRmQxRnhSRU5uTWxwSFRUSlplbHBxQ2sxcVkzaFBSRkp0VDFSRk5WbHRSVEpaTWtWNVRsUm9iRTFFV1RCWmJWRXpXa2RSZUU5SFZUVk5ha0YzVFVKUlIwTnBjMGRCVVZGQ1p6YzRkMEZTVVVVS1FtZDNSV05JVm5waFJFSldRbWR2Y2tKblJVVkJXVTh2VFVGRlZrSkZZMDFTVjJnd1pFaENlazlwT0haYU1td3dZVWhXYVV4dFRuWmlVemw2WkVkR2FncGhNbmgyWVhrNWRHRlhOV3RhV0VsMldWZE9NR0ZYT1hWamVUbDVaRmMxZWt4NlkzZE5hbEV4VFVSSk1FOUVRWFpaV0ZJd1dsY3hkMlJJVFhaTlZFRlhDa0puYjNKQ1owVkZRVmxQTDAxQlJWZENRV2ROUW01Q01WbHRlSEJaZWtOQ2FXZFpTMHQzV1VKQ1FVaFhaVkZKUlVGblVqaENTRzlCWlVGQ01rRk9NRGtLVFVkeVIzaDRSWGxaZUd0bFNFcHNiazUzUzJsVGJEWTBNMnA1ZEM4MFpVdGpiMEYyUzJVMlQwRkJRVUpxUW1aQ01XUjNRVUZCVVVSQlJXTjNVbEZKYUFwQlVFOVJaVGxLWWpGblNEQmpOWEV2YkhCcWVuUndlWEpPTWxBMFdtMHJlRWhGZUdaSUwyMUlWVzlQU0VGcFFtZERiSE5xV25FMFlWSk5kM1U0VGpkaUNsRndNRGRpWkdseUszTnJUVGx3VFZSMWVGRXZabUpyVFVOVVFVdENaMmR4YUd0cVQxQlJVVVJCZDA1dVFVUkNhMEZxUVRkNVVtOWpabm81ZUU1V1MwNEtXR0ZrYTB3MWNGaGpORFV6ZFdGbGNtTXZXVGRvY25SV2EwcDJTVEp0V0VaWWJEUXlRbGREWTJzemMxWlFTSEYyZG5SQlEwMUVMM1pQWWpOaVYzRkhWQW8xZVZSTVUySjBjRmg0UWs1dVkzSndNbTh3UzFJeE1tTXhZemQyTlcxb2RHWTVWV1JRYnpGRk0weEpRVmxzY1hCUGIyb3pVVkU5UFFvdExTMHRMVVZPUkNCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2c9PSJ9fX19" | ||
| } | ||
| ] | ||
| }, | ||
| "messageSignature": { | ||
| "messageDigest": { | ||
| "algorithm": "SHA2_256", | ||
| "digest": "qdPqg5eb+jUi1ZBkwyRz7TusiPYsNrPdJD/v6V3sbaA=" | ||
| }, | ||
| "signature": "MEQCIGTdfr0o+hAiLLFsNCMGVhFqvi4X6nvWotjfpsSOi8qjAiBih0/EV8XrDg1jbQ5r+dycO4Z/xkHVlh5UFRY8gCfstg==" | ||
| } | ||
| } | ||
| ``` | ||
|
|
||
| and the verification result: | ||
|
|
||
| ```json | ||
| { | ||
| "mediaType": "application/vnd.dev.sigstore.verificationresult+json;version=0.1", | ||
| "signature": { | ||
| "certificate": { | ||
| "certificateIssuer": "CN=sigstore-intermediate,O=sigstore.dev", | ||
| "subjectAlternativeName": { | ||
| "type": "URI", | ||
| "value": "https://github.com/stacklok/minder/.github/workflows/chart-publish.yml@refs/heads/main" | ||
| }, | ||
| "issuer": "https://token.actions.githubusercontent.com", | ||
| "githubWorkflowTrigger": "push", | ||
| "githubWorkflowSHA": "6dc6c6c27184f919ba6ca258e064bd7dd18e9200", | ||
| "githubWorkflowName": "Publish Helm Chart", | ||
| "githubWorkflowRepository": "stacklok/minder", | ||
| "githubWorkflowRef": "refs/heads/main", | ||
| "buildSignerURI": "https://github.com/stacklok/minder/.github/workflows/chart-publish.yml@refs/heads/main", | ||
| "buildSignerDigest": "6dc6c6c27184f919ba6ca258e064bd7dd18e9200", | ||
| "runnerEnvironment": "github-hosted", | ||
| "sourceRepositoryURI": "https://github.com/stacklok/minder", | ||
| "sourceRepositoryDigest": "6dc6c6c27184f919ba6ca258e064bd7dd18e9200", | ||
| "sourceRepositoryRef": "refs/heads/main", | ||
| "sourceRepositoryIdentifier": "624056558", | ||
| "sourceRepositoryOwnerURI": "https://github.com/stacklok", | ||
| "sourceRepositoryOwnerIdentifier": "110237746", | ||
| "buildConfigURI": "https://github.com/stacklok/minder/.github/workflows/chart-publish.yml@refs/heads/main", | ||
| "buildConfigDigest": "6dc6c6c27184f919ba6ca258e064bd7dd18e9200", | ||
| "buildTrigger": "push", | ||
| "runInvocationURI": "https://github.com/stacklok/minder/actions/runs/7024502480/attempts/1", | ||
| "sourceRepositoryVisibilityAtSigning": "public" | ||
| } | ||
| }, | ||
| "verifiedTimestamps": [ | ||
| { | ||
| "type": "Tlog", | ||
| "uri": "TODO", | ||
| "timestamp": "2023-11-28T23:07:08+02:00" | ||
| } | ||
| ], | ||
| "verifiedIdentity": { | ||
| "subjectAlternativeName": { | ||
| "regexp": "^https://github.com/stacklok/minder/" | ||
| }, | ||
| "issuer": "https://token.actions.githubusercontent.com" | ||
| } | ||
| } | ||
| ``` | ||
|
|
||
| To explore a more advanced/configurable verification process, see the CLI implementation in [`cmd/sigstore-go/main.go`](../cmd/sigstore-go/main.go). |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,101 @@ | ||
| module github.com/sigstore/sigstore-go/examples/oci-image-verification | ||
|
|
||
| go 1.21 | ||
|
|
||
| require ( | ||
| github.com/google/go-containerregistry v0.17.0 | ||
| github.com/sigstore/protobuf-specs v0.2.1 | ||
| github.com/sigstore/sigstore v1.7.6 | ||
| github.com/sigstore/sigstore-go v0.0.0-20231206154419-7f57c1495ca4 | ||
| ) | ||
|
|
||
| require ( | ||
| github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect | ||
| github.com/blang/semver v3.5.1+incompatible // indirect | ||
| github.com/containerd/stargz-snapshotter/estargz v0.14.3 // indirect | ||
| github.com/cyberphone/json-canonicalization v0.0.0-20220623050100-57a0ce2678a7 // indirect | ||
| github.com/digitorus/pkcs7 v0.0.0-20230818184609-3a137a874352 // indirect | ||
| github.com/digitorus/timestamp v0.0.0-20230902153158-687734543647 // indirect | ||
| github.com/docker/cli v24.0.0+incompatible // indirect | ||
| github.com/docker/distribution v2.8.2+incompatible // indirect | ||
| github.com/docker/docker v24.0.0+incompatible // indirect | ||
| github.com/docker/docker-credential-helpers v0.7.0 // indirect | ||
| github.com/fsnotify/fsnotify v1.6.0 // indirect | ||
| github.com/go-chi/chi v4.1.2+incompatible // indirect | ||
| github.com/go-logr/logr v1.2.4 // indirect | ||
| github.com/go-logr/stdr v1.2.2 // indirect | ||
| github.com/go-openapi/analysis v0.21.4 // indirect | ||
| github.com/go-openapi/errors v0.20.4 // indirect | ||
| github.com/go-openapi/jsonpointer v0.20.0 // indirect | ||
| github.com/go-openapi/jsonreference v0.20.2 // indirect | ||
| github.com/go-openapi/loads v0.21.2 // indirect | ||
| github.com/go-openapi/runtime v0.26.0 // indirect | ||
| github.com/go-openapi/spec v0.20.11 // indirect | ||
| github.com/go-openapi/strfmt v0.21.8 // indirect | ||
| github.com/go-openapi/swag v0.22.4 // indirect | ||
| github.com/go-openapi/validate v0.22.3 // indirect | ||
| github.com/golang/protobuf v1.5.3 // indirect | ||
| github.com/google/certificate-transparency-go v1.1.7 // indirect | ||
| github.com/hashicorp/go-cleanhttp v0.5.2 // indirect | ||
| github.com/hashicorp/go-retryablehttp v0.7.5 // indirect | ||
| github.com/hashicorp/hcl v1.0.0 // indirect | ||
| github.com/in-toto/in-toto-golang v0.9.0 // indirect | ||
| github.com/inconshreveable/mousetrap v1.1.0 // indirect | ||
| github.com/jedisct1/go-minisign v0.0.0-20211028175153-1c139d1cc84b // indirect | ||
| github.com/josharian/intern v1.0.0 // indirect | ||
| github.com/klauspost/compress v1.17.0 // indirect | ||
| github.com/letsencrypt/boulder v0.0.0-20221109233200-85aa52084eaf // indirect | ||
| github.com/magiconair/properties v1.8.7 // indirect | ||
| github.com/mailru/easyjson v0.7.7 // indirect | ||
| github.com/mitchellh/go-homedir v1.1.0 // indirect | ||
| github.com/mitchellh/mapstructure v1.5.0 // indirect | ||
| github.com/oklog/ulid v1.3.1 // indirect | ||
| github.com/opencontainers/go-digest v1.0.0 // indirect | ||
| github.com/opencontainers/image-spec v1.1.0-rc3 // indirect | ||
| github.com/opentracing/opentracing-go v1.2.0 // indirect | ||
| github.com/pelletier/go-toml/v2 v2.1.0 // indirect | ||
| github.com/pkg/errors v0.9.1 // indirect | ||
| github.com/sagikazarmark/locafero v0.3.0 // indirect | ||
| github.com/sagikazarmark/slog-shim v0.1.0 // indirect | ||
| github.com/sassoftware/relic v7.2.1+incompatible // indirect | ||
| github.com/secure-systems-lab/go-securesystemslib v0.7.0 // indirect | ||
| github.com/shibumi/go-pathspec v1.3.0 // indirect | ||
| github.com/sigstore/rekor v1.3.4 // indirect | ||
| github.com/sigstore/timestamp-authority v1.2.0 // indirect | ||
| github.com/sirupsen/logrus v1.9.3 // indirect | ||
| github.com/sourcegraph/conc v0.3.0 // indirect | ||
| github.com/spf13/afero v1.10.0 // indirect | ||
| github.com/spf13/cast v1.5.1 // indirect | ||
| github.com/spf13/cobra v1.8.0 // indirect | ||
| github.com/spf13/pflag v1.0.5 // indirect | ||
| github.com/spf13/viper v1.17.0 // indirect | ||
| github.com/subosito/gotenv v1.6.0 // indirect | ||
| github.com/theupdateframework/go-tuf v0.7.0 // indirect | ||
| github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 // indirect | ||
| github.com/transparency-dev/merkle v0.0.2 // indirect | ||
| github.com/vbatts/tar-split v0.11.3 // indirect | ||
| go.mongodb.org/mongo-driver v1.12.0 // indirect | ||
| go.opentelemetry.io/otel v1.19.0 // indirect | ||
| go.opentelemetry.io/otel/metric v1.19.0 // indirect | ||
| go.opentelemetry.io/otel/trace v1.19.0 // indirect | ||
| go.uber.org/multierr v1.11.0 // indirect | ||
| go.uber.org/zap v1.26.0 // indirect | ||
| golang.org/x/crypto v0.16.0 // indirect | ||
| golang.org/x/exp v0.0.0-20231006140011-7918f672742d // indirect | ||
| golang.org/x/mod v0.14.0 // indirect | ||
| golang.org/x/net v0.19.0 // indirect | ||
| golang.org/x/sync v0.5.0 // indirect | ||
| golang.org/x/sys v0.15.0 // indirect | ||
| golang.org/x/term v0.15.0 // indirect | ||
| golang.org/x/text v0.14.0 // indirect | ||
| google.golang.org/genproto v0.0.0-20231106174013-bbf56f31fb17 // indirect | ||
| google.golang.org/genproto/googleapis/api v0.0.0-20231106174013-bbf56f31fb17 // indirect | ||
| google.golang.org/genproto/googleapis/rpc v0.0.0-20231120223509-83a465c0220f // indirect | ||
| google.golang.org/grpc v1.59.0 // indirect | ||
| google.golang.org/protobuf v1.31.0 // indirect | ||
| gopkg.in/ini.v1 v1.67.0 // indirect | ||
| gopkg.in/square/go-jose.v2 v2.6.0 // indirect | ||
| gopkg.in/yaml.v2 v2.4.0 // indirect | ||
| gopkg.in/yaml.v3 v3.0.1 // indirect | ||
| k8s.io/klog/v2 v2.100.1 // indirect | ||
| ) |
Oops, something went wrong.