Add go-git based signer implementation. #454
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
wlynch
force-pushed
the
gogit-signer
branch
2 times, most recently
from
cb05eb9
to
51e47c7
Compare
wlynch
force-pushed
the
gogit-signer
branch
3 times, most recently
from
d4b1419
to
1475ad9
Compare
Adds a git.Signer implementation + e2e test to demonstrate how signing is done. Verify still WIP upstream, so commit marshalling + verification still done manually for now. Signed-off-by: Billy Lynch <billy@chainguard.dev>
lance
pushed a commit
to securesign/gitsign
that referenced
this pull request
Jun 6, 2024
* Add go-git based signer implementation. (sigstore#454) Adds a git.Signer implementation + e2e test to demonstrate how signing is done. Verify still WIP upstream, so commit marshalling + verification still done manually for now. Signed-off-by: Billy Lynch <billy@chainguard.dev> * Run e2e Go tests first. (sigstore#462) I suspect why the e2e tests are failing is because we're running this after the staging tests when the sigstore root has been changed to staging. Current the tests hardcode prod sigstore, which is likely what is causing the issues since we're trying to verify a prod signature with the staging root. TBD if this is the right thing to do (or if we should use staging instead), but this should hopefully fix us for the time being. * Remove GITSIGN_LOG env variable. (sigstore#463) I don't think we're really using this meaningfully (since we fallback to tty for debug output). This should also fix the remaining e2e test failures. Signed-off-by: Billy Lynch <billy@chainguard.dev> * CI updates and fix lints (sigstore#461) * drop enable auto emrge, due that does not trigger ci when merge Signed-off-by: cpanato <ctadeu@gmail.com> * bump golangci-lint to v1.56.x Signed-off-by: cpanato <ctadeu@gmail.com> * fix lints Signed-off-by: cpanato <ctadeu@gmail.com> * update dependencies Signed-off-by: cpanato <ctadeu@gmail.com> --------- Signed-off-by: cpanato <ctadeu@gmail.com> * Enable autoclose for sigstore confirmation page. (sigstore#455) Signed-off-by: Billy Lynch <billy@chainguard.dev> * Update to use go1.22 and ci udpates (sigstore#465) * update go to 1.22 Signed-off-by: cpanato <ctadeu@gmail.com> * update goreleaser flags Signed-off-by: cpanato <ctadeu@gmail.com> * drop cache this is done in the setup-go action step and always use latest cosign Signed-off-by: cpanato <ctadeu@gmail.com> --------- Signed-off-by: cpanato <ctadeu@gmail.com> * Bump github.com/go-openapi/strfmt from 0.22.0 to 0.22.2 (sigstore#464) Bumps [github.com/go-openapi/strfmt](https://github.com/go-openapi/strfmt) from 0.22.0 to 0.22.2. - [Commits](go-openapi/strfmt@v0.22.0...v0.22.2) --- updated-dependencies: - dependency-name: github.com/go-openapi/strfmt dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump actions/cache from 4.0.0 to 4.0.1 (sigstore#456) Bumps [actions/cache](https://github.com/actions/cache) from 4.0.0 to 4.0.1. - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@13aacd8...ab5e6d0) --- updated-dependencies: - dependency-name: actions/cache dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Add config options for Autoclose and AutocloseTimeout (sigstore#466) * Add autoclose after auth feature Add the ability to have the window `autoclose` after the specified `autocloseTimeout`. If the go template cannot be rendered the page will fallback to the original static html page. Signed-off-by: Steve Garf <garf@chainguard.dev> * Update README and default values Signed-off-by: Steve Garf <garf@chainguard.dev> * Update README.md Co-authored-by: Billy Lynch <1844673+wlynch@users.noreply.github.com> Signed-off-by: stgarf <stgarf@users.noreply.github.com> --------- Signed-off-by: Steve Garf <garf@chainguard.dev> Signed-off-by: stgarf <stgarf@users.noreply.github.com> Co-authored-by: Billy Lynch <1844673+wlynch@users.noreply.github.com> * Bump github.com/go-jose/go-jose/v3 from 3.0.2 to 3.0.3 (sigstore#468) * Bump gopkg.in/go-jose/go-jose.v2 from 2.6.1 to 2.6.3 (sigstore#467) Bumps gopkg.in/go-jose/go-jose.v2 from 2.6.1 to 2.6.3. --- updated-dependencies: - dependency-name: gopkg.in/go-jose/go-jose.v2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump anchore/sbom-action from 0.15.8 to 0.15.9 (sigstore#475) * Bump golang.org/x/crypto from 0.20.0 to 0.21.0 (sigstore#474) * Bump google.golang.org/protobuf from 1.32.0 to 1.33.0 (sigstore#473) * Bump golang.org/x/oauth2 from 0.17.0 to 0.18.0 (sigstore#472) * Bump github.com/go-openapi/strfmt from 0.22.2 to 0.23.0 (sigstore#471) * Bump github.com/go-openapi/swag from 0.22.9 to 0.23.0 (sigstore#470) * Bump github.com/go-openapi/runtime from 0.27.1 to 0.28.0 (sigstore#469) * Bump actions/checkout from 4.1.1 to 4.1.2 (sigstore#476) * Bump github.com/docker/docker (sigstore#477) Bumps [github.com/docker/docker](https://github.com/docker/docker) from 24.0.7+incompatible to 24.0.9+incompatible. - [Release notes](https://github.com/docker/docker/releases) - [Commits](moby/moby@v24.0.7...v24.0.9) --- updated-dependencies: - dependency-name: github.com/docker/docker dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump github.com/coreos/go-oidc/v3 from 3.9.0 to 3.10.0 (sigstore#479) * Bump actions/cache from 4.0.1 to 4.0.2 (sigstore#478) * Bump github.com/sigstore/sigstore from 1.8.2 to 1.8.3 (sigstore#482) Bumps [github.com/sigstore/sigstore](https://github.com/sigstore/sigstore) from 1.8.2 to 1.8.3. - [Release notes](https://github.com/sigstore/sigstore/releases) - [Commits](sigstore/sigstore@v1.8.2...v1.8.3) --- updated-dependencies: - dependency-name: github.com/sigstore/sigstore dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump anchore/sbom-action from 0.15.9 to 0.15.10 (sigstore#480) Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action) from 0.15.9 to 0.15.10. - [Release notes](https://github.com/anchore/sbom-action/releases) - [Commits](anchore/sbom-action@9fece9e...ab5d7b5) --- updated-dependencies: - dependency-name: anchore/sbom-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump github.com/go-git/go-git/v5 (sigstore#481) Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.11.1-0.20240221104814-686a0f7a4928 to 5.12.0. - [Release notes](https://github.com/go-git/go-git/releases) - [Commits](https://github.com/go-git/go-git/commits/v5.12.0) --- updated-dependencies: - dependency-name: github.com/go-git/go-git/v5 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * add gitsign image (sigstore#483) Signed-off-by: cpanato <ctadeu@gmail.com> * update base image for gitsign to one with shell available (sigstore#484) Signed-off-by: cpanato <ctadeu@gmail.com> * Bump golang.org/x/crypto from 0.21.0 to 0.22.0 (sigstore#490) * Bump imjasonh/setup-crane from 0.2 to 0.3 (sigstore#485) * Bump golang.org/x/oauth2 from 0.18.0 to 0.19.0 (sigstore#489) Bumps [golang.org/x/oauth2](https://github.com/golang/oauth2) from 0.18.0 to 0.19.0. - [Commits](golang/oauth2@v0.18.0...v0.19.0) --- updated-dependencies: - dependency-name: golang.org/x/oauth2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump github.com/sigstore/rekor from 1.3.5 to 1.3.6 (sigstore#487) Bumps [github.com/sigstore/rekor](https://github.com/sigstore/rekor) from 1.3.5 to 1.3.6. - [Release notes](https://github.com/sigstore/rekor/releases) - [Changelog](https://github.com/sigstore/rekor/blob/main/CHANGELOG.md) - [Commits](sigstore/rekor@v1.3.5...v1.3.6) --- updated-dependencies: - dependency-name: github.com/sigstore/rekor dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump github.com/sigstore/protobuf-specs from 0.3.0 to 0.3.1 (sigstore#486) Bumps [github.com/sigstore/protobuf-specs](https://github.com/sigstore/protobuf-specs) from 0.3.0 to 0.3.1. - [Release notes](https://github.com/sigstore/protobuf-specs/releases) - [Changelog](https://github.com/sigstore/protobuf-specs/blob/main/CHANGELOG.md) - [Commits](sigstore/protobuf-specs@v0.3.0...v0.3.1) --- updated-dependencies: - dependency-name: github.com/sigstore/protobuf-specs dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump github.com/sigstore/fulcio from 1.4.4 to 1.4.5 (sigstore#488) Bumps [github.com/sigstore/fulcio](https://github.com/sigstore/fulcio) from 1.4.4 to 1.4.5. - [Release notes](https://github.com/sigstore/fulcio/releases) - [Changelog](https://github.com/sigstore/fulcio/blob/main/CHANGELOG.md) - [Commits](sigstore/fulcio@v1.4.4...v1.4.5) --- updated-dependencies: - dependency-name: github.com/sigstore/fulcio dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Remove local-user validation. (sigstore#491) This flag isn't required, and we're not really using it today. It's usually used to inform the signing tool what key to use, but for keyless signing we don't need this. Leaving the flag in because we need it defined for git not to error out. We may start using it as a mechanism to support BYO keys in the future. Signed-off-by: Billy Lynch <billy@chainguard.dev> * Bump github.com/sigstore/cosign/v2 from 2.2.3 to 2.2.4 (sigstore#492) Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.2.3 to 2.2.4. - [Release notes](https://github.com/sigstore/cosign/releases) - [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md) - [Commits](sigstore/cosign@v2.2.3...v2.2.4) --- updated-dependencies: - dependency-name: github.com/sigstore/cosign/v2 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump sigstore/cosign-installer from 3.4.0 to 3.5.0 (sigstore#493) Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 3.4.0 to 3.5.0. - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](sigstore/cosign-installer@e1523de...59acb62) --- updated-dependencies: - dependency-name: sigstore/cosign-installer dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump golang.org/x/net from 0.22.0 to 0.23.0 (sigstore#494) Bumps [golang.org/x/net](https://github.com/golang/net) from 0.22.0 to 0.23.0. - [Commits](golang/net@v0.22.0...v0.23.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump actions/checkout from 4.1.2 to 4.1.3 (sigstore#495) Bumps [actions/checkout](https://github.com/actions/checkout) from 4.1.2 to 4.1.3. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@9bb5618...1d96c77) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * e2e.yaml: Avoid non-versioned TUF metadata (sigstore#496) Stop downloading non-versioned TUF metadata. * I'd like to stop publishing non-versioned TUF metadata in the staging repository (and later in production): real clients should not be using non-versioned metadata anyway. * I chose 4.root.json just because the content matches the deprecated versioned URL Signed-off-by: Jussi Kukkonen <jkukkonen@google.com> * Bump golangci/golangci-lint-action from 4.0.0 to 5.0.0 (sigstore#500) Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) from 4.0.0 to 5.0.0. - [Release notes](https://github.com/golangci/golangci-lint-action/releases) - [Commits](golangci/golangci-lint-action@3cfe3a4...82d40c2) --- updated-dependencies: - dependency-name: golangci/golangci-lint-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump golang.org/x/oauth2 from 0.19.0 to 0.20.0 (sigstore#503) Bumps [golang.org/x/oauth2](https://github.com/golang/oauth2) from 0.19.0 to 0.20.0. - [Commits](golang/oauth2@v0.19.0...v0.20.0) --- updated-dependencies: - dependency-name: golang.org/x/oauth2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump google.golang.org/protobuf from 1.33.0 to 1.34.0 (sigstore#502) Bumps google.golang.org/protobuf from 1.33.0 to 1.34.0. --- updated-dependencies: - dependency-name: google.golang.org/protobuf dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump actions/setup-go from 5.0.0 to 5.0.1 (sigstore#504) Bumps [actions/setup-go](https://github.com/actions/setup-go) from 5.0.0 to 5.0.1. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@0c52d54...cdcb360) --- updated-dependencies: - dependency-name: actions/setup-go dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump golangci/golangci-lint-action from 5.0.0 to 5.3.0 (sigstore#505) * Bump golangci/golangci-lint-action from 5.0.0 to 5.3.0 Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) from 5.0.0 to 5.3.0. - [Release notes](https://github.com/golangci/golangci-lint-action/releases) - [Commits](golangci/golangci-lint-action@82d40c2...38e1018) --- updated-dependencies: - dependency-name: golangci/golangci-lint-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * Update verify.yml Signed-off-by: Carlos Tadeu Panato Junior <ctadeu@gmail.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Carlos Tadeu Panato Junior <ctadeu@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Carlos Tadeu Panato Junior <ctadeu@gmail.com> * Bump actions/checkout from 4.1.3 to 4.1.4 (sigstore#499) Bumps [actions/checkout](https://github.com/actions/checkout) from 4.1.3 to 4.1.4. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@1d96c77...0ad4b8f) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump anchore/sbom-action from 0.15.10 to 0.15.11 (sigstore#498) Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action) from 0.15.10 to 0.15.11. - [Release notes](https://github.com/anchore/sbom-action/releases) - [Commits](anchore/sbom-action@ab5d7b5...7ccf588) --- updated-dependencies: - dependency-name: anchore/sbom-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump goreleaser/goreleaser-action from 5.0.0 to 5.1.0 (sigstore#512) Bumps [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) from 5.0.0 to 5.1.0. - [Release notes](https://github.com/goreleaser/goreleaser-action/releases) - [Commits](goreleaser/goreleaser-action@7ec5c2b...5742e2a) --- updated-dependencies: - dependency-name: goreleaser/goreleaser-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump google.golang.org/protobuf from 1.34.0 to 1.34.1 (sigstore#508) Bumps google.golang.org/protobuf from 1.34.0 to 1.34.1. --- updated-dependencies: - dependency-name: google.golang.org/protobuf dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump golangci/golangci-lint-action from 5.3.0 to 6.0.1 (sigstore#511) Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) from 5.3.0 to 6.0.1. - [Release notes](https://github.com/golangci/golangci-lint-action/releases) - [Commits](golangci/golangci-lint-action@38e1018...a4f60bb) --- updated-dependencies: - dependency-name: golangci/golangci-lint-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump actions/checkout from 4.1.4 to 4.1.5 (sigstore#510) Bumps [actions/checkout](https://github.com/actions/checkout) from 4.1.4 to 4.1.5. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@0ad4b8f...44c2b7a) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump github.com/sigstore/protobuf-specs from 0.3.1 to 0.3.2 (sigstore#509) Bumps [github.com/sigstore/protobuf-specs](https://github.com/sigstore/protobuf-specs) from 0.3.1 to 0.3.2. - [Release notes](https://github.com/sigstore/protobuf-specs/releases) - [Changelog](https://github.com/sigstore/protobuf-specs/blob/main/CHANGELOG.md) - [Commits](sigstore/protobuf-specs@v0.3.1...v0.3.2) --- updated-dependencies: - dependency-name: github.com/sigstore/protobuf-specs dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump golang.org/x/crypto from 0.22.0 to 0.23.0 (sigstore#507) Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.22.0 to 0.23.0. - [Commits](golang/crypto@v0.22.0...v0.23.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --------- Signed-off-by: Billy Lynch <billy@chainguard.dev> Signed-off-by: cpanato <ctadeu@gmail.com> Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Steve Garf <garf@chainguard.dev> Signed-off-by: stgarf <stgarf@users.noreply.github.com> Signed-off-by: Jussi Kukkonen <jkukkonen@google.com> Signed-off-by: Carlos Tadeu Panato Junior <ctadeu@gmail.com> Co-authored-by: Billy Lynch <1844673+wlynch@users.noreply.github.com> Co-authored-by: Carlos Tadeu Panato Junior <ctadeu@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: stgarf <stgarf@users.noreply.github.com> Co-authored-by: Jussi Kukkonen <jku@goto.fi> Co-authored-by: tommyd450 <tdalton@redhat.com>
JasonPowr
pushed a commit
to securesign/gitsign
that referenced
this pull request
Jun 7, 2024
* Add go-git based signer implementation. (sigstore#454) Adds a git.Signer implementation + e2e test to demonstrate how signing is done. Verify still WIP upstream, so commit marshalling + verification still done manually for now. Signed-off-by: Billy Lynch <billy@chainguard.dev> * Run e2e Go tests first. (sigstore#462) I suspect why the e2e tests are failing is because we're running this after the staging tests when the sigstore root has been changed to staging. Current the tests hardcode prod sigstore, which is likely what is causing the issues since we're trying to verify a prod signature with the staging root. TBD if this is the right thing to do (or if we should use staging instead), but this should hopefully fix us for the time being. * Remove GITSIGN_LOG env variable. (sigstore#463) I don't think we're really using this meaningfully (since we fallback to tty for debug output). This should also fix the remaining e2e test failures. Signed-off-by: Billy Lynch <billy@chainguard.dev> * CI updates and fix lints (sigstore#461) * drop enable auto emrge, due that does not trigger ci when merge Signed-off-by: cpanato <ctadeu@gmail.com> * bump golangci-lint to v1.56.x Signed-off-by: cpanato <ctadeu@gmail.com> * fix lints Signed-off-by: cpanato <ctadeu@gmail.com> * update dependencies Signed-off-by: cpanato <ctadeu@gmail.com> --------- Signed-off-by: cpanato <ctadeu@gmail.com> * Enable autoclose for sigstore confirmation page. (sigstore#455) Signed-off-by: Billy Lynch <billy@chainguard.dev> * Update to use go1.22 and ci udpates (sigstore#465) * update go to 1.22 Signed-off-by: cpanato <ctadeu@gmail.com> * update goreleaser flags Signed-off-by: cpanato <ctadeu@gmail.com> * drop cache this is done in the setup-go action step and always use latest cosign Signed-off-by: cpanato <ctadeu@gmail.com> --------- Signed-off-by: cpanato <ctadeu@gmail.com> * Bump github.com/go-openapi/strfmt from 0.22.0 to 0.22.2 (sigstore#464) Bumps [github.com/go-openapi/strfmt](https://github.com/go-openapi/strfmt) from 0.22.0 to 0.22.2. - [Commits](go-openapi/strfmt@v0.22.0...v0.22.2) --- updated-dependencies: - dependency-name: github.com/go-openapi/strfmt dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump actions/cache from 4.0.0 to 4.0.1 (sigstore#456) Bumps [actions/cache](https://github.com/actions/cache) from 4.0.0 to 4.0.1. - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@13aacd8...ab5e6d0) --- updated-dependencies: - dependency-name: actions/cache dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Add config options for Autoclose and AutocloseTimeout (sigstore#466) * Add autoclose after auth feature Add the ability to have the window `autoclose` after the specified `autocloseTimeout`. If the go template cannot be rendered the page will fallback to the original static html page. Signed-off-by: Steve Garf <garf@chainguard.dev> * Update README and default values Signed-off-by: Steve Garf <garf@chainguard.dev> * Update README.md Co-authored-by: Billy Lynch <1844673+wlynch@users.noreply.github.com> Signed-off-by: stgarf <stgarf@users.noreply.github.com> --------- Signed-off-by: Steve Garf <garf@chainguard.dev> Signed-off-by: stgarf <stgarf@users.noreply.github.com> Co-authored-by: Billy Lynch <1844673+wlynch@users.noreply.github.com> * Bump github.com/go-jose/go-jose/v3 from 3.0.2 to 3.0.3 (sigstore#468) * Bump gopkg.in/go-jose/go-jose.v2 from 2.6.1 to 2.6.3 (sigstore#467) Bumps gopkg.in/go-jose/go-jose.v2 from 2.6.1 to 2.6.3. --- updated-dependencies: - dependency-name: gopkg.in/go-jose/go-jose.v2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump anchore/sbom-action from 0.15.8 to 0.15.9 (sigstore#475) * Bump golang.org/x/crypto from 0.20.0 to 0.21.0 (sigstore#474) * Bump google.golang.org/protobuf from 1.32.0 to 1.33.0 (sigstore#473) * Bump golang.org/x/oauth2 from 0.17.0 to 0.18.0 (sigstore#472) * Bump github.com/go-openapi/strfmt from 0.22.2 to 0.23.0 (sigstore#471) * Bump github.com/go-openapi/swag from 0.22.9 to 0.23.0 (sigstore#470) * Bump github.com/go-openapi/runtime from 0.27.1 to 0.28.0 (sigstore#469) * Bump actions/checkout from 4.1.1 to 4.1.2 (sigstore#476) * Bump github.com/docker/docker (sigstore#477) Bumps [github.com/docker/docker](https://github.com/docker/docker) from 24.0.7+incompatible to 24.0.9+incompatible. - [Release notes](https://github.com/docker/docker/releases) - [Commits](moby/moby@v24.0.7...v24.0.9) --- updated-dependencies: - dependency-name: github.com/docker/docker dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump github.com/coreos/go-oidc/v3 from 3.9.0 to 3.10.0 (sigstore#479) * Bump actions/cache from 4.0.1 to 4.0.2 (sigstore#478) * Bump github.com/sigstore/sigstore from 1.8.2 to 1.8.3 (sigstore#482) Bumps [github.com/sigstore/sigstore](https://github.com/sigstore/sigstore) from 1.8.2 to 1.8.3. - [Release notes](https://github.com/sigstore/sigstore/releases) - [Commits](sigstore/sigstore@v1.8.2...v1.8.3) --- updated-dependencies: - dependency-name: github.com/sigstore/sigstore dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump anchore/sbom-action from 0.15.9 to 0.15.10 (sigstore#480) Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action) from 0.15.9 to 0.15.10. - [Release notes](https://github.com/anchore/sbom-action/releases) - [Commits](anchore/sbom-action@9fece9e...ab5d7b5) --- updated-dependencies: - dependency-name: anchore/sbom-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump github.com/go-git/go-git/v5 (sigstore#481) Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.11.1-0.20240221104814-686a0f7a4928 to 5.12.0. - [Release notes](https://github.com/go-git/go-git/releases) - [Commits](https://github.com/go-git/go-git/commits/v5.12.0) --- updated-dependencies: - dependency-name: github.com/go-git/go-git/v5 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * add gitsign image (sigstore#483) Signed-off-by: cpanato <ctadeu@gmail.com> * update base image for gitsign to one with shell available (sigstore#484) Signed-off-by: cpanato <ctadeu@gmail.com> * Bump golang.org/x/crypto from 0.21.0 to 0.22.0 (sigstore#490) * Bump imjasonh/setup-crane from 0.2 to 0.3 (sigstore#485) * Bump golang.org/x/oauth2 from 0.18.0 to 0.19.0 (sigstore#489) Bumps [golang.org/x/oauth2](https://github.com/golang/oauth2) from 0.18.0 to 0.19.0. - [Commits](golang/oauth2@v0.18.0...v0.19.0) --- updated-dependencies: - dependency-name: golang.org/x/oauth2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump github.com/sigstore/rekor from 1.3.5 to 1.3.6 (sigstore#487) Bumps [github.com/sigstore/rekor](https://github.com/sigstore/rekor) from 1.3.5 to 1.3.6. - [Release notes](https://github.com/sigstore/rekor/releases) - [Changelog](https://github.com/sigstore/rekor/blob/main/CHANGELOG.md) - [Commits](sigstore/rekor@v1.3.5...v1.3.6) --- updated-dependencies: - dependency-name: github.com/sigstore/rekor dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump github.com/sigstore/protobuf-specs from 0.3.0 to 0.3.1 (sigstore#486) Bumps [github.com/sigstore/protobuf-specs](https://github.com/sigstore/protobuf-specs) from 0.3.0 to 0.3.1. - [Release notes](https://github.com/sigstore/protobuf-specs/releases) - [Changelog](https://github.com/sigstore/protobuf-specs/blob/main/CHANGELOG.md) - [Commits](sigstore/protobuf-specs@v0.3.0...v0.3.1) --- updated-dependencies: - dependency-name: github.com/sigstore/protobuf-specs dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump github.com/sigstore/fulcio from 1.4.4 to 1.4.5 (sigstore#488) Bumps [github.com/sigstore/fulcio](https://github.com/sigstore/fulcio) from 1.4.4 to 1.4.5. - [Release notes](https://github.com/sigstore/fulcio/releases) - [Changelog](https://github.com/sigstore/fulcio/blob/main/CHANGELOG.md) - [Commits](sigstore/fulcio@v1.4.4...v1.4.5) --- updated-dependencies: - dependency-name: github.com/sigstore/fulcio dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Remove local-user validation. (sigstore#491) This flag isn't required, and we're not really using it today. It's usually used to inform the signing tool what key to use, but for keyless signing we don't need this. Leaving the flag in because we need it defined for git not to error out. We may start using it as a mechanism to support BYO keys in the future. Signed-off-by: Billy Lynch <billy@chainguard.dev> * Bump github.com/sigstore/cosign/v2 from 2.2.3 to 2.2.4 (sigstore#492) Bumps [github.com/sigstore/cosign/v2](https://github.com/sigstore/cosign) from 2.2.3 to 2.2.4. - [Release notes](https://github.com/sigstore/cosign/releases) - [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md) - [Commits](sigstore/cosign@v2.2.3...v2.2.4) --- updated-dependencies: - dependency-name: github.com/sigstore/cosign/v2 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump sigstore/cosign-installer from 3.4.0 to 3.5.0 (sigstore#493) Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 3.4.0 to 3.5.0. - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](sigstore/cosign-installer@e1523de...59acb62) --- updated-dependencies: - dependency-name: sigstore/cosign-installer dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump golang.org/x/net from 0.22.0 to 0.23.0 (sigstore#494) Bumps [golang.org/x/net](https://github.com/golang/net) from 0.22.0 to 0.23.0. - [Commits](golang/net@v0.22.0...v0.23.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump actions/checkout from 4.1.2 to 4.1.3 (sigstore#495) Bumps [actions/checkout](https://github.com/actions/checkout) from 4.1.2 to 4.1.3. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@9bb5618...1d96c77) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * e2e.yaml: Avoid non-versioned TUF metadata (sigstore#496) Stop downloading non-versioned TUF metadata. * I'd like to stop publishing non-versioned TUF metadata in the staging repository (and later in production): real clients should not be using non-versioned metadata anyway. * I chose 4.root.json just because the content matches the deprecated versioned URL Signed-off-by: Jussi Kukkonen <jkukkonen@google.com> * Bump golangci/golangci-lint-action from 4.0.0 to 5.0.0 (sigstore#500) Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) from 4.0.0 to 5.0.0. - [Release notes](https://github.com/golangci/golangci-lint-action/releases) - [Commits](golangci/golangci-lint-action@3cfe3a4...82d40c2) --- updated-dependencies: - dependency-name: golangci/golangci-lint-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump golang.org/x/oauth2 from 0.19.0 to 0.20.0 (sigstore#503) Bumps [golang.org/x/oauth2](https://github.com/golang/oauth2) from 0.19.0 to 0.20.0. - [Commits](golang/oauth2@v0.19.0...v0.20.0) --- updated-dependencies: - dependency-name: golang.org/x/oauth2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump google.golang.org/protobuf from 1.33.0 to 1.34.0 (sigstore#502) Bumps google.golang.org/protobuf from 1.33.0 to 1.34.0. --- updated-dependencies: - dependency-name: google.golang.org/protobuf dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump actions/setup-go from 5.0.0 to 5.0.1 (sigstore#504) Bumps [actions/setup-go](https://github.com/actions/setup-go) from 5.0.0 to 5.0.1. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@0c52d54...cdcb360) --- updated-dependencies: - dependency-name: actions/setup-go dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump golangci/golangci-lint-action from 5.0.0 to 5.3.0 (sigstore#505) * Bump golangci/golangci-lint-action from 5.0.0 to 5.3.0 Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) from 5.0.0 to 5.3.0. - [Release notes](https://github.com/golangci/golangci-lint-action/releases) - [Commits](golangci/golangci-lint-action@82d40c2...38e1018) --- updated-dependencies: - dependency-name: golangci/golangci-lint-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * Update verify.yml Signed-off-by: Carlos Tadeu Panato Junior <ctadeu@gmail.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Carlos Tadeu Panato Junior <ctadeu@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Carlos Tadeu Panato Junior <ctadeu@gmail.com> * Bump actions/checkout from 4.1.3 to 4.1.4 (sigstore#499) Bumps [actions/checkout](https://github.com/actions/checkout) from 4.1.3 to 4.1.4. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@1d96c77...0ad4b8f) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump anchore/sbom-action from 0.15.10 to 0.15.11 (sigstore#498) Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action) from 0.15.10 to 0.15.11. - [Release notes](https://github.com/anchore/sbom-action/releases) - [Commits](anchore/sbom-action@ab5d7b5...7ccf588) --- updated-dependencies: - dependency-name: anchore/sbom-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump goreleaser/goreleaser-action from 5.0.0 to 5.1.0 (sigstore#512) Bumps [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) from 5.0.0 to 5.1.0. - [Release notes](https://github.com/goreleaser/goreleaser-action/releases) - [Commits](goreleaser/goreleaser-action@7ec5c2b...5742e2a) --- updated-dependencies: - dependency-name: goreleaser/goreleaser-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump google.golang.org/protobuf from 1.34.0 to 1.34.1 (sigstore#508) Bumps google.golang.org/protobuf from 1.34.0 to 1.34.1. --- updated-dependencies: - dependency-name: google.golang.org/protobuf dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump golangci/golangci-lint-action from 5.3.0 to 6.0.1 (sigstore#511) Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) from 5.3.0 to 6.0.1. - [Release notes](https://github.com/golangci/golangci-lint-action/releases) - [Commits](golangci/golangci-lint-action@38e1018...a4f60bb) --- updated-dependencies: - dependency-name: golangci/golangci-lint-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump actions/checkout from 4.1.4 to 4.1.5 (sigstore#510) Bumps [actions/checkout](https://github.com/actions/checkout) from 4.1.4 to 4.1.5. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@0ad4b8f...44c2b7a) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump github.com/sigstore/protobuf-specs from 0.3.1 to 0.3.2 (sigstore#509) Bumps [github.com/sigstore/protobuf-specs](https://github.com/sigstore/protobuf-specs) from 0.3.1 to 0.3.2. - [Release notes](https://github.com/sigstore/protobuf-specs/releases) - [Changelog](https://github.com/sigstore/protobuf-specs/blob/main/CHANGELOG.md) - [Commits](sigstore/protobuf-specs@v0.3.1...v0.3.2) --- updated-dependencies: - dependency-name: github.com/sigstore/protobuf-specs dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump golang.org/x/crypto from 0.22.0 to 0.23.0 (sigstore#507) Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.22.0 to 0.23.0. - [Commits](golang/crypto@v0.22.0...v0.23.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Revert "[SECURESIGN-1011] | Merge upstream 10.2 (#119)" This reverts commit 9c9bf27. --------- Signed-off-by: Billy Lynch <billy@chainguard.dev> Signed-off-by: cpanato <ctadeu@gmail.com> Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Steve Garf <garf@chainguard.dev> Signed-off-by: stgarf <stgarf@users.noreply.github.com> Signed-off-by: Jussi Kukkonen <jkukkonen@google.com> Signed-off-by: Carlos Tadeu Panato Junior <ctadeu@gmail.com> Signed-off-by: Lance Ball <lball@redhat.com> Co-authored-by: Billy Lynch <1844673+wlynch@users.noreply.github.com> Co-authored-by: Carlos Tadeu Panato Junior <ctadeu@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: stgarf <stgarf@users.noreply.github.com> Co-authored-by: Jussi Kukkonen <jku@goto.fi>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Adds a git.Signer implementation + e2e test to demonstrate how signing is done. Verify still WIP upstream, so commit marshalling + verification still done manually for now.
Release Note
Documentation
✅