diff --git a/README.md b/README.md new file mode 100644 index 0000000..d072da1 --- /dev/null +++ b/README.md @@ -0,0 +1,248 @@ +# SLSA Attester + +`slsa-attester` generates signed [SLSA](https://slsa.dev) attestations as +in-toto statements built on the official SLSA predicate protos: + +- **Build provenance**, in the v1 and v0.2 predicates. +- **Verification summary attestations** (VSAs), v1. +- **Provenance for GitHub Actions runs**, with a *watcher* that observes a + run from a job of its own, waits for the other jobs, and attests the + artifacts they produced. This is the successor to the attestation half of + `slsa-github-generator`. + +It is a command line tool and a Go library. What it produces verifies with +the [SLSA Verifier](https://github.com/slsa-framework/verifier): the two +tools share the `algorithm:digest` syntax for subjects, so a digest written +at attest time reads back verbatim at verify time. + +## Installing + +Download a binary from the +[releases](https://github.com/slsa-framework/attester/releases) for Linux +(amd64, arm64), macOS (arm64) or Windows (amd64), or build from source: + +```sh +go install github.com/slsa-framework/attester@latest +``` + +Every release ships its own provenance, `attestations.jsonl`, generated by +the attester itself (see [Releases of this repository](#releases-of-this-repository)). +To verify a download before trusting it: + +```sh +slsa-verifier build attestations.jsonl slsa-attester-v0.1.0-linux-amd64 \ + --param expected_source:github.com/slsa-framework/attester \ + --param 'trusted_builders:[https://github.com/slsa-framework/attester/.github/workflows/release.yaml@refs/tags/v0.1.0]' \ + --signer 'sigstore::https://token.actions.githubusercontent.com::https://github.com/slsa-framework/actions/.github/workflows/attest_actions.yml@refs/heads/main' \ + --require-signatures +``` + +The [`slsa-framework/actions`](https://github.com/slsa-framework/actions) +repository does this for you in GitHub Actions. + +## Attesting GitHub Actions runs + +`slsa-attester watch` observes a workflow run, waits for its jobs to finish +and attests the artifacts they produced, as provenance of the +[watcher build type](docs/buildtypes/watcher/v1.md) +(`https://slsa.dev/buildtypes/watcher/v1`). The provenance names the +workflow that ran as the builder, records the ref, event, repository and +inputs the run was triggered with, and the commit it built. + +### From inside the run + +The easiest way is the reusable workflow in `slsa-framework/actions`, added +as one more job to the workflow being attested: + +```yaml +jobs: + build: + runs-on: ubuntu-latest + steps: + # ... build and upload your artifacts ... + + provenance: + permissions: + id-token: write # sigstore keyless signing + actions: read # read the run's jobs and artifacts + contents: read + uses: slsa-framework/actions/.github/workflows/attest_actions.yml@main +``` + +The job waits for every other job of the run, downloads their workflow +artifacts, hashes them and signs the provenance. Because the signing +happens inside the reusable workflow, the sigstore certificate identifies +`slsa-framework/actions`, a builder identity independent of the workflow +being attested, the way `slsa-github-generator` worked. The attestation is +uploaded as a workflow artifact (`slsa-attestations` by default). + +The workflow's inputs choose what is attested: + +| Input | Meaning | +| --- | --- | +| `watch-jobs` | Only these jobs are waited for (default: every other job) | +| `collect-artifacts`, `expand-artifacts` | Attest the run's workflow artifacts, unpacking archives to one subject per file (both default on) | +| `artifacts-filter` | Globs on artifact and asset names; only matches are attested | +| `release` | Also attest the assets of this release tag | +| `sboms` | Collector sources of SBOMs whose top-level elements are attested | +| `subjects`, `checksums`, `dependencies` | Extra subjects as `algorithm:digest`, a `sha256sum` listing, and extra resolved dependencies | +| `version`, `verify`, `build-from-source` | Which attester runs, and whether its release is verified against its provenance first | + +**The attester must have a job of its own.** Every step that runs earlier in +a job can tamper with the attester, and every step in the job shares the +OIDC identity the attestation is signed with. The watcher inspects its own +job and refuses to run beside any other step. A hostile step that already +ran could defeat that check too, which is why verifiers pin the signing +identity rather than trust the check. + +### From outside the run + +Any run can be watched by its spec, with a `GITHUB_TOKEN` in the +environment that can read it. The watcher waits for the whole run and +attests when it completes: + +```sh +slsa-attester watch github://slsa-framework/attester/123456789 --release v0.1.0 -o provenance.json +``` + +Outside the attested run the ref is resolved through the API, telling tags +from branches; the workflow's inputs can only be recorded as the defaults +the workflow declares, since the platform does not expose the values a run +was given after the fact. + +### Where subjects come from + +| Source | Flag | Digest computed by | +| --- | --- | --- | +| Workflow artifacts of the run | `--collect-artifacts` (default) | the attester, which downloads and hashes them | +| Release assets of a tag | `--release ` | the platform, which reports the digest it computed at upload; assets without one are downloaded and hashed | +| Top-level elements of an SBOM | `--sbom ` | asserted by the SBOM; elements without hashes are rejected | +| Checksum files (`sha256sum` output) | `--checksums ` | asserted by the caller | +| Explicit digests | `-s algorithm:digest` | asserted by the caller | + +SBOMs are located with the +[carabiner collector](https://github.com/carabiner-dev/collector), so a +source can be a directory (`fs:sboms/`), a release (`release:owner/repo@v1.0.0`) +or anything else a collector driver reaches, and are read with protobom, +so SPDX and CycloneDX documents work, bare or wrapped in an attestation. + +## Attesting builds + +`slsa-attester build` writes build provenance over subjects given as files, +which are hashed, or as digests: + +```sh +slsa-attester build --builder-id=https://builder.example/ci \ + --build-type=https://builder.example/buildtypes/container/v1 \ + --invocation-id=run-42 -o provenance.json bin/app +``` + +Flags use the latest (v1) vocabulary. Selecting the older predicate with +`--predicate-version v0.2` maps them onto the older field names +(`--invocation-id` becomes `metadata.buildInvocationId`, resolved +dependencies become materials), and a flag that exists in only one version +is refused when targeting the other. + +A whole predicate can be passed as a base with `--predicate`, as JSON or +`@file`. It is parsed strictly against the official SLSA proto of the +selected version, and the content flags are merged onto it: + +```sh +slsa-attester build --predicate @predicate.json --finished-on 2026-10-05T12:00:00Z bin/app +``` + +Resource descriptors (`--resolved-dependency`, `--byproduct`, +`--builder-dependency`) take JSON, `@file`, or the shorthand +`name=…,uri=…,sha256=…`. + +## Attesting verifications + +`slsa-attester vsa` writes a verification summary attestation, the record +a verifier leaves of what it verified and to which level: + +```sh +slsa-attester vsa --verifier-id=https://verifier.example \ + --resource-uri=pkg:oci/app@sha256:9f86d0… \ + --verification-result=PASSED --verified-level=SLSA_BUILD_LEVEL_3 \ + --policy-uri=https://policies.example/release.json \ + -s sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08 +``` + +`--input-attestation` records the attestations the verdict was based on, +and `--dependency-level` the levels of the resource's dependencies. + +## Signing + +Every command signs by default, with sigstore: ambient credentials are +used where they exist (GitHub Actions, GitLab CI, GCP), with the browser +flow as the fallback. The result is a sigstore bundle, recorded in Rekor +and timestamped. `--sigstore-instance github` signs against GitHub's +sigstore instance instead of the public one. + +With a key the result is a DSSE envelope; without signing, a bare +statement: + +```sh +slsa-attester build --signing-key key.pem ... # DSSE envelope; the passphrase comes from $SIGNING_KEY_PASSPHRASE +slsa-attester build --sign=false ... # unsigned statement +``` + +Keys may be PEM (PKCS#8, PKCS#1, SEC1) or OpenPGP. A SPIFFE identity signs +with `--signing-backend spiffe`. + +## Verifying + +Attestations verify with the SLSA Verifier. The provenance's `builder.id` +is a claim; the verifier binds it to the signing identity. For provenance +generated through the reusable workflow, the certificate proves which +workflow's run the attester observed, so the builder is proven rather than +claimed: + +```sh +slsa-verifier build attestations.jsonl your-artifact \ + --param expected_source:github.com/your-org/your-repo \ + --param 'trusted_builders:[https://github.com/your-org/your-repo/.github/workflows/release.yml@refs/tags/v1.0.0]' \ + --signer 'sigstore::https://token.actions.githubusercontent.com::https://github.com/slsa-framework/actions/.github/workflows/attest_actions.yml@refs/heads/main' \ + --require-signatures --level 3 +``` + +The release tag is held by the `@ref` on the trusted builder. The +`verify/build` action in `slsa-framework/actions` runs the same check in a +workflow. + +## Using the library + +The `attest` package exposes the same functionality through one canonical +option set; the per-version mapping and the compatibility checks happen +inside: + +```go +import "github.com/slsa-framework/attester/attest" + +writer := &attest.Writer{} +err := writer.Attest(attest.SlsaProvenanceV1, []string{"bin/app"}, + attest.WithBuilderID("https://builder.example/ci"), + attest.WithInvocationID("run-42"), + attest.WithWriter(out), +) +``` + +`Attest` takes the format (`SlsaProvenanceV1`, `SlsaProvenanceV02`, +`VsaV1`) and the subject files; `AttestSlsaProvenanceV1`, +`AttestSlsaProvenanceV02` and `AttestVSAV1` are the same with the format +fixed. Subjects known only by digest come in with `WithSubjects`, a base +predicate with `WithPredicate`, and a `Signer` with `WithSigner`; without +one the statement is written unsigned. + +## Releases of this repository + +Each release is attested by the attester itself: the release workflow has +one job that builds and publishes with goreleaser, and a second, dedicated +job that runs the reusable workflow to watch the first and attest the +release assets. The provenance is signed with the `slsa-framework/actions` +identity, so the command under [Installing](#installing) verifies it. + +## Contributing + +The SLSA attester is released under the terms of the Apache 2.0 license. +Patches and issues are welcome in the repository. diff --git a/attest/impl_test.go b/attest/impl_test.go index 28a1522..1d7c223 100644 --- a/attest/impl_test.go +++ b/attest/impl_test.go @@ -13,9 +13,9 @@ import ( "path/filepath" "testing" - "github.com/carabiner-dev/signer" - signeroptions "github.com/carabiner-dev/signer/options" intoto "github.com/in-toto/attestation/go/v1" + "github.com/policylabs/signer" + signeroptions "github.com/policylabs/signer/options" sdsse "github.com/sigstore/protobuf-specs/gen/pb-go/dsse" "google.golang.org/protobuf/types/known/structpb" ) diff --git a/attest/options.go b/attest/options.go index b9c9ac0..efce980 100644 --- a/attest/options.go +++ b/attest/options.go @@ -9,9 +9,9 @@ import ( "os" "time" - "github.com/carabiner-dev/signer" - signeroptions "github.com/carabiner-dev/signer/options" intoto "github.com/in-toto/attestation/go/v1" + "github.com/policylabs/signer" + signeroptions "github.com/policylabs/signer/options" "google.golang.org/protobuf/proto" "google.golang.org/protobuf/types/known/structpb" "google.golang.org/protobuf/types/known/timestamppb" @@ -19,7 +19,7 @@ import ( // Signer signs a serialized in-toto statement, returning the signed artifact // (a sigstore bundle or a DSSE envelope). It is satisfied by *signer.Signer -// from github.com/carabiner-dev/signer. +// from github.com/policylabs/signer. type Signer interface { SignStatement(data []byte, funcs ...signeroptions.SignOptFn) (signer.SignedArtifact, error) } diff --git a/go.mod b/go.mod index 5b09838..fb68a63 100644 --- a/go.mod +++ b/go.mod @@ -3,13 +3,13 @@ module github.com/slsa-framework/attester go 1.26.0 require ( - github.com/carabiner-dev/attestation v0.2.1 - github.com/carabiner-dev/collector v0.3.17 - github.com/carabiner-dev/command v0.3.2 + github.com/carabiner-dev/command v0.3.3 github.com/carabiner-dev/hasher v0.2.4 - github.com/carabiner-dev/signer v0.6.2 github.com/google/go-github/v90 v90.0.0 github.com/in-toto/attestation v1.2.0 + github.com/policylabs/attestation v0.3.0 + github.com/policylabs/collector v0.4.0 + github.com/policylabs/signer v0.6.4 github.com/protobom/protobom v0.6.2 github.com/sigstore/protobuf-specs v0.5.2 github.com/slsa-framework/protos v0.0.0-20260905230943-612c99695f3b @@ -39,7 +39,7 @@ require ( github.com/AzureAD/microsoft-authentication-library-for-go v1.7.2 // indirect github.com/CycloneDX/cyclonedx-go v0.12.0 // indirect github.com/Microsoft/go-winio v0.6.2 // indirect - github.com/ProtonMail/go-crypto v1.4.1 // indirect + github.com/ProtonMail/go-crypto v1.5.2 // indirect github.com/anchore/go-struct-converter v0.1.0 // indirect github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect github.com/avast/retry-go/v4 v4.7.0 // indirect @@ -59,18 +59,17 @@ require ( github.com/aws/aws-sdk-go-v2/service/sts v1.45.0 // indirect github.com/aws/smithy-go v1.27.3 // indirect github.com/blang/semver/v4 v4.0.0 // indirect + github.com/carabiner-dev/attestation v0.2.1 // indirect github.com/carabiner-dev/deadrop v0.0.0-20260228173914-d95e9ea2877d // indirect github.com/carabiner-dev/ghrfs v0.3.7 // indirect github.com/carabiner-dev/github v0.2.3 // indirect github.com/carabiner-dev/jsonl v0.2.2 // indirect github.com/carabiner-dev/openeox v1.0.0 // indirect github.com/carabiner-dev/osv v0.1.2 // indirect - github.com/carabiner-dev/policy v0.5.6 // indirect - github.com/carabiner-dev/predicates v0.5.4 // indirect github.com/carabiner-dev/sbomfs v0.2.0 // indirect github.com/carabiner-dev/spdx3 v0.1.0 // indirect - github.com/carabiner-dev/stash v0.0.0-20260914181612-673fcf191e49 // indirect - github.com/carabiner-dev/vcslocator v0.5.0 // indirect + github.com/carabiner-dev/stash v0.0.0-20261004182444-008b3bad7a45 // indirect + github.com/carabiner-dev/vcslocator v0.5.1 // indirect github.com/cenkalti/backoff/v4 v4.3.0 // indirect github.com/cenkalti/backoff/v5 v5.0.3 // indirect github.com/cespare/xxhash/v2 v2.3.0 // indirect @@ -167,7 +166,7 @@ require ( github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6 // indirect github.com/olekukonko/errors v1.3.0 // indirect github.com/olekukonko/ll v0.1.8 // indirect - github.com/olekukonko/tablewriter v1.1.4 // indirect + github.com/olekukonko/tablewriter v1.1.5 // indirect github.com/opencontainers/go-digest v1.0.0 // indirect github.com/opencontainers/image-spec v1.1.1 // indirect github.com/openvex/go-vex v0.2.9 // indirect @@ -176,6 +175,8 @@ require ( github.com/pjbgf/sha1cd v0.6.0 // indirect github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect github.com/pkg/errors v0.9.1 // indirect + github.com/policylabs/policy v0.5.7-0.20261004134513-55e5473eef09 // indirect + github.com/policylabs/predicates v0.6.0 // indirect github.com/regclient/regclient v0.11.6 // indirect github.com/ryanuber/go-glob v1.0.0 // indirect github.com/samber/lo v1.53.0 // indirect @@ -199,7 +200,7 @@ require ( github.com/sirupsen/logrus v1.10.2 // indirect github.com/skeema/knownhosts v1.3.2 // indirect github.com/spdx/tools-golang v0.5.7 // indirect - github.com/spiffe/go-spiffe/v2 v2.8.1 // indirect + github.com/spiffe/go-spiffe/v2 v2.8.2 // indirect github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d // indirect github.com/theupdateframework/go-tuf v0.7.0 // indirect github.com/theupdateframework/go-tuf/v2 v2.4.2 // indirect @@ -222,22 +223,22 @@ require ( go.uber.org/zap v1.28.0 // indirect go.yaml.in/yaml/v2 v2.4.4 // indirect go.yaml.in/yaml/v3 v3.0.5 // indirect - golang.org/x/crypto v0.55.0 // indirect + golang.org/x/crypto v0.57.0 // indirect golang.org/x/mod v0.41.0 // indirect - golang.org/x/net v0.58.0 // indirect + golang.org/x/net v0.59.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect golang.org/x/sync v0.23.0 // indirect golang.org/x/sys v0.48.0 // indirect - golang.org/x/term v0.45.0 // indirect + golang.org/x/term v0.46.0 // indirect golang.org/x/text v0.42.0 // indirect golang.org/x/time v0.15.0 // indirect google.golang.org/api v0.290.0 // indirect google.golang.org/genproto v0.0.0-20260622175928-b703f567277d // indirect google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 // indirect - google.golang.org/grpc v1.83.2 // indirect + google.golang.org/grpc v1.84.0 // indirect gopkg.in/warnings.v0 v0.1.2 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect k8s.io/klog/v2 v2.140.0 // indirect - sigs.k8s.io/release-utils v0.12.5-0.20260825061901-4f1f891011bb // indirect + sigs.k8s.io/release-utils v0.12.5 // indirect ) diff --git a/go.sum b/go.sum index 377be0f..90b5284 100644 --- a/go.sum +++ b/go.sum @@ -52,8 +52,8 @@ github.com/CycloneDX/cyclonedx-go v0.12.0/go.mod h1:V2577HhxDDCDLYfkm55WJrz16nHT github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY= github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY= github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU= -github.com/ProtonMail/go-crypto v1.4.1 h1:9RfcZHqEQUvP8RzecWEUafnZVtEvrBVL9BiF67IQOfM= -github.com/ProtonMail/go-crypto v1.4.1/go.mod h1:e1OaTyu5SYVrO9gKOEhTc+5UcXtTUa+P3uLudwcgPqo= +github.com/ProtonMail/go-crypto v1.5.2 h1:cucYnvqcY7UOXVD//mSyjeaPY0SSN3v5cDkYPxumINk= +github.com/ProtonMail/go-crypto v1.5.2/go.mod h1:/RaSu30DaKO4RY+XdV/ACcCcZkGr7AhUIduq5sjzzCo= github.com/anchore/go-struct-converter v0.1.0 h1:2rDRssAl6mgKBSLNiVCMADgZRhoqtw9dedlWa0OhD30= github.com/anchore/go-struct-converter v0.1.0/go.mod h1:rYqSE9HbjzpHTI74vwPvae4ZVYZd1lue2ta6xHPdblA= github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8= @@ -104,10 +104,8 @@ github.com/c2sp/wycheproof v0.0.0-20260105152342-fca0d3ba9f12 h1:C34LW7dhWgjAaAO github.com/c2sp/wycheproof v0.0.0-20260105152342-fca0d3ba9f12/go.mod h1:U1QjrC6KepOmtVmJn3QsKOTd9HliGr/da5afPEhLRnk= github.com/carabiner-dev/attestation v0.2.1 h1:VhjV5YlO9TsW50Sr/Zd54bdbZhhDAqgxC3kB9z1I+3Q= github.com/carabiner-dev/attestation v0.2.1/go.mod h1:O84vF84RZG3pJO/6BYrPs718bZviHF5DKajP1HsrDpw= -github.com/carabiner-dev/collector v0.3.17 h1:NTW3ErQXgAPOMGk3yZ4RI6KRy8EMaoDjEkK3qVi7vX0= -github.com/carabiner-dev/collector v0.3.17/go.mod h1:UCaZP/2NOftDlzfwfOAlfSuwzciQRrnp6UHBH8rRWgY= -github.com/carabiner-dev/command v0.3.2 h1:lkmgr+Sj9OaPxKk2AHlitR76Mg+hqys6BK7071taywY= -github.com/carabiner-dev/command v0.3.2/go.mod h1:ABHTlUZbUUq7LF1Xmlx01ZY8xMCv4eqleuVEO/LIifU= +github.com/carabiner-dev/command v0.3.3 h1:TwS5tAa+fHhY83lX5XjyakmF12mmcoUSwc87ZLxnBdo= +github.com/carabiner-dev/command v0.3.3/go.mod h1:winbJcNyPQwCnYegXBiNG2TbqXgE9Zyfh7DF9cW/r1s= github.com/carabiner-dev/deadrop v0.0.0-20260228173914-d95e9ea2877d h1:Gl8o56PI73PE6YcDzUd49iJJBdp/ye/METanFm8gG64= github.com/carabiner-dev/deadrop v0.0.0-20260228173914-d95e9ea2877d/go.mod h1:lwgOJlVMxPu8jptfMKOMTTQntzBTTH38VyuvBeaXUVg= github.com/carabiner-dev/ghrfs v0.3.7 h1:P6BVj5LT6yByZZ70AIG5lwKaavFQhD91VDvyYp+xy5A= @@ -122,20 +120,14 @@ github.com/carabiner-dev/openeox v1.0.0 h1:iVfs9jgu2s2Jrb95bJK5FWMx55qF3aHBk9RhU github.com/carabiner-dev/openeox v1.0.0/go.mod h1:+6i8M7PhtWk2jRtUC1anZnhmOr5cXKMLGYjwFcqPDa0= github.com/carabiner-dev/osv v0.1.2 h1:W5nZOGuygnqzB7YbGon6ab3iFHxFZZgzS3m7GEvYnfc= github.com/carabiner-dev/osv v0.1.2/go.mod h1:06cHx1aOdlb53feQxjBIRt3NSFfQKg1b1hrHHj/57QQ= -github.com/carabiner-dev/policy v0.5.6 h1:zM203rdxnv2epn6czUs+CcAxQoyKqJDHqfiWLog+UtM= -github.com/carabiner-dev/policy v0.5.6/go.mod h1:E0KFvUp/xVj6ZCoFHdrPJ1i/G2uUDlwpFn26J+z6M+8= -github.com/carabiner-dev/predicates v0.5.4 h1:koiNmcr0IbjHpjywI/k9OGeEilTIKdMQyh5LZZJt4ok= -github.com/carabiner-dev/predicates v0.5.4/go.mod h1:zHcoDfyIfH7WMOS0zpEKD+lBPikEw+/BNg6988g8c2I= github.com/carabiner-dev/sbomfs v0.2.0 h1:7OG0Su6iz9sPWcAFzSsaauVZQpKayzrJvGWe0NoxbPw= github.com/carabiner-dev/sbomfs v0.2.0/go.mod h1:KaTNcHjm5qbu5G0RCc/7uo3U1KZj1IqRZLFiG+nwC8g= -github.com/carabiner-dev/signer v0.6.2 h1:Tww40YP4RKjLSKdgT5nXVRiqd3Czjvkwd2WRDE7ecJ0= -github.com/carabiner-dev/signer v0.6.2/go.mod h1:xIeR0GMK3Hp9gYsd7dGO9W8EwjftWBk3/+flEle6o0Y= github.com/carabiner-dev/spdx3 v0.1.0 h1:Q6nMLXV0BhtqDQuwRDOaJDZR670TK4jdOvZqvTW/ctY= github.com/carabiner-dev/spdx3 v0.1.0/go.mod h1:d/t010TrZvYZBeYGpvHeId6QpRvGLlqK7cy0E81npPA= -github.com/carabiner-dev/stash v0.0.0-20260914181612-673fcf191e49 h1:1w2A+h9pJd340ONY2cv8/LN+wfwAicplXpBnwja/ljg= -github.com/carabiner-dev/stash v0.0.0-20260914181612-673fcf191e49/go.mod h1:oLgs6W8zu4PFbISAJDjNSsD9PNvHlaDCLwoOpz44cYU= -github.com/carabiner-dev/vcslocator v0.5.0 h1:UpqilJXRJBgwzQHk0MsD03w+8/0GcyC1HbXxX0wZKcU= -github.com/carabiner-dev/vcslocator v0.5.0/go.mod h1:s4zrF5l7b2iZFsxVDKz6Y+6LcaqP4GTshSCGuCbu+Ls= +github.com/carabiner-dev/stash v0.0.0-20261004182444-008b3bad7a45 h1:AehL6+PA85whryLIpD5pkxR4EkrNdkbgAeEQ5dnUDR4= +github.com/carabiner-dev/stash v0.0.0-20261004182444-008b3bad7a45/go.mod h1:S2DNFao2+gFNVBwZv5Mi8AeCHIqIq0n1k2xj0n0VLj4= +github.com/carabiner-dev/vcslocator v0.5.1 h1:IK75RcYgHp2HQ1qxAYlhzEJhYTFnqlP9zRJBhkTJ6GI= +github.com/carabiner-dev/vcslocator v0.5.1/go.mod h1:s4zrF5l7b2iZFsxVDKz6Y+6LcaqP4GTshSCGuCbu+Ls= github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8= github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE= github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM= @@ -433,8 +425,8 @@ github.com/olekukonko/errors v1.3.0 h1:teJvgLGUEqMzBUms+Dj3/3szNqCG/Jdw9iDbum8fR github.com/olekukonko/errors v1.3.0/go.mod h1:ppzxA5jBKcO1vIpCXQ9ZqgDh8iwODz6OXIGKU8r5m4Y= github.com/olekukonko/ll v0.1.8 h1:ysHCJRGHYKzmBSdz9w5AySztx7lG8SQY+naTGYUbsz8= github.com/olekukonko/ll v0.1.8/go.mod h1:RPRC6UcscfFZgjo1nulkfMH5IM0QAYim0LfnMvUuozw= -github.com/olekukonko/tablewriter v1.1.4 h1:ORUMI3dXbMnRlRggJX3+q7OzQFDdvgbN9nVWj1drm6I= -github.com/olekukonko/tablewriter v1.1.4/go.mod h1:+kedxuyTtgoZLwif3P1Em4hARJs+mVnzKxmsCL/C5RY= +github.com/olekukonko/tablewriter v1.1.5 h1:4LoZSfMySpMQY3PT8RWJsJeuEuMIoo9xGRgvmqjg6IQ= +github.com/olekukonko/tablewriter v1.1.5/go.mod h1:+kedxuyTtgoZLwif3P1Em4hARJs+mVnzKxmsCL/C5RY= github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE= github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk= github.com/onsi/ginkgo v1.16.4/go.mod h1:dX+/inL/fNMqNlz0e9LfyB9TswhZpCVdJM/Z6Vvnwo0= @@ -471,6 +463,16 @@ github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U= github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= +github.com/policylabs/attestation v0.3.0 h1:tutwsvbq/T5F0Hwt8+M4u42Egk1qP8YbNx4GQ1hnTTA= +github.com/policylabs/attestation v0.3.0/go.mod h1:z5gJ2M2aAkByYxMLqoOIY31KvAOIX+Ys4ZW2HavM3/o= +github.com/policylabs/collector v0.4.0 h1:OoBVzKdI4dohk9jvSa644UtgxWsN9v4mIuRBYXfBLE4= +github.com/policylabs/collector v0.4.0/go.mod h1:hiZbyhrcxsPbYFBD8EDR68/+ixtBNVT7zZ3jAMZC4jM= +github.com/policylabs/policy v0.5.7-0.20261004134513-55e5473eef09 h1:xfDq4vrXBDv7EboreJwnDEwLn41cA2EqR9onfyBB9HE= +github.com/policylabs/policy v0.5.7-0.20261004134513-55e5473eef09/go.mod h1:NArOX4b9LMPoc/aa8WPuZkEknGavT3IoYiyJ1rHxUBE= +github.com/policylabs/predicates v0.6.0 h1:PgM9/8X8p/i4+Mr+VkijTb2ukeykrHmmjBnk1GuSq+M= +github.com/policylabs/predicates v0.6.0/go.mod h1:g3sbkSBMWlEK8CPVFiUzSOfUoHWKLFYHr7xugF77Z60= +github.com/policylabs/signer v0.6.4 h1:5dBt/X+MVbg1Is+IeH9rmTEV9R4J9c4/Egawe9Q61Bc= +github.com/policylabs/signer v0.6.4/go.mod h1:oPcQlEW6uaiLCWTiwZLxF+KdQuSRhx3h6xVVEcTlFNE= github.com/protobom/protobom v0.6.2 h1:HJTEEnYyU1m3VWoVj0TkDqArWC3Q2CvSFXHUpCkRkoI= github.com/protobom/protobom v0.6.2/go.mod h1:WtLWrIyJthYwjbNqn4uMWzculpjNrmVYY78FgCRXe7w= github.com/regclient/regclient v0.11.6 h1:IUcd3slMqo1CaLQ3JcE0W039gUv7uYZpY5FsyAYowXA= @@ -534,8 +536,8 @@ github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiT github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk= github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= -github.com/spiffe/go-spiffe/v2 v2.8.1 h1:eXZMLsu+3MLEPJyGJkolqtVrteZfQdUpOWj6LTiDl/E= -github.com/spiffe/go-spiffe/v2 v2.8.1/go.mod h1:47Q0Q9/AqGha8QLHp+kxpH4Wca7X7EnOtlIJy3mxZ3U= +github.com/spiffe/go-spiffe/v2 v2.8.2 h1:jUEsvCMD6fH25J8K/w3q/XnIx8W1lb8+YLaEEHIjHmc= +github.com/spiffe/go-spiffe/v2 v2.8.2/go.mod h1:w2CLWKLMTX/PPYUEUPv3ltH0RXsw5S8suwNF46w9/Aw= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs= github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= @@ -626,8 +628,8 @@ golang.org/x/crypto v0.0.0-20190426145343-a29dc8fdc734/go.mod h1:yigFU9vqHzYiE8U golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4= -golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M= -golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis= +golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M= +golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA= golang.org/x/exp v0.0.0-20260820142414-ca536658362e h1:01Ju2A/fZKkci4zqx0eZxw//DnRYOnBiGJG14hFBhO8= golang.org/x/exp v0.0.0-20260820142414-ca536658362e/go.mod h1:zeBbvyFKDaLwa7CH/zI8KXt7gTl14SF7sO08Pl5jBCM= golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= @@ -644,8 +646,8 @@ golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk= golang.org/x/net v0.0.0-20220607020251-c690dde0001d/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= -golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To= -golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU= +golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues= +golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= @@ -679,8 +681,8 @@ golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo= golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= -golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0= -golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w= +golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE= +golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= @@ -711,8 +713,8 @@ google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688 h1: google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688/go.mod h1:1RJ9BQGyNdZwkGc1eTqkErfRZ6RJyYPHZo73BZ1vQqI= google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 h1:cYNAzI2sUwhmCcoj9TxvihSrqsxt6uIkj3rDRhSDmW4= google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688/go.mod h1:DjtHYE8FKJLivXcBEjGwndXfIC23G0VpXiXKqG179uA= -google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU= -google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8= +google.golang.org/grpc v1.84.0 h1:soMyaPJ8pAak5PIQ0DGBUir0XRo2fRoMqhNWMLlLxO0= +google.golang.org/grpc v1.84.0/go.mod h1:ljCht0DrxQrXBDRTZp52Qxh3Ffk8CdYm2sj4O2QN2C0= google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8= google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0= google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM= @@ -742,8 +744,8 @@ gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q= gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA= k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc= k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0= -sigs.k8s.io/release-utils v0.12.5-0.20260825061901-4f1f891011bb h1:ymPX1dai1f6xELeZHdG3geIeAcRVjwRH1B62UDoe/Og= -sigs.k8s.io/release-utils v0.12.5-0.20260825061901-4f1f891011bb/go.mod h1:i+0EG2s3xwlrSh03K0Uewvvl1zXDEVVMMBKvEMbGFE4= +sigs.k8s.io/release-utils v0.12.5 h1:/Ybntn/M7sK+6XjaH88y3pfx3tpJod3WKiItxoS4igg= +sigs.k8s.io/release-utils v0.12.5/go.mod h1:rL6dEVB93VNU8Bd3l8tnh98hR9yoqMMn/puxlCU5buw= sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs= sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4= software.sslmate.com/src/go-pkcs12 v0.5.0 h1:EC6R394xgENTpZ4RltKydeDUjtlM5drOYIG9c6TVj2M= diff --git a/internal/cmd/sign.go b/internal/cmd/sign.go index d7ebc6d..4100956 100644 --- a/internal/cmd/sign.go +++ b/internal/cmd/sign.go @@ -6,8 +6,8 @@ package cmd import ( "errors" - "github.com/carabiner-dev/signer" - signeroptions "github.com/carabiner-dev/signer/options" + "github.com/policylabs/signer" + signeroptions "github.com/policylabs/signer/options" "github.com/spf13/cobra" "github.com/slsa-framework/attester/attest" diff --git a/internal/sbom/sbom.go b/internal/sbom/sbom.go index 9aa83a4..09c151a 100644 --- a/internal/sbom/sbom.go +++ b/internal/sbom/sbom.go @@ -16,9 +16,9 @@ import ( "strings" "sync" - "github.com/carabiner-dev/attestation" - "github.com/carabiner-dev/collector" intoto "github.com/in-toto/attestation/go/v1" + "github.com/policylabs/attestation" + "github.com/policylabs/collector" "github.com/protobom/protobom/pkg/reader" protobom "github.com/protobom/protobom/pkg/sbom" )