Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Adding function for adding a single attestor #104

Closed
wants to merge 21 commits into from
Closed

Adding function for adding a single attestor #104

wants to merge 21 commits into from

Conversation

ChaosInTheCRD
Copy link
Collaborator

@ChaosInTheCRD ChaosInTheCRD commented Dec 15, 2023 •
edited
Loading

This change has been added so we can add one attestor at a time. See in-toto/witness#332 for use case.

@ChaosInTheCRD ChaosInTheCRD mentioned this pull request Dec 15, 2023
Closed
kairoaraujo
kairoaraujo reviewed Dec 18, 2023
View reviewed changes
Copy link
Collaborator

@kairoaraujo kairoaraujo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overall, the changes are pretty simple; I have a question about library API compatibility.

attestation/factory.go
return attestors[0], nil
}

func AddAttestors(nameOrTypes []string) ([]Attestor, error) {
Copy link
Collaborator

@kairoaraujo kairoaraujo Dec 18, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see it breaks compatibility with previous versions. (I see you fix it in in-toto/witness#332)
How will we document for other users of go-witness?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, I think we would need to keep a func Attestors with a deprecation notice that just calls AddAttestors.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One quick thing -- The Attestors function currently would be more equivalent to a GetAttestors function -- it's returning a slice of instantiated Attestors from the factory.

AddAttestor, to me, seems to imply we're adding more attestors to the factory.

ChaosInTheCRD and others added 20 commits January 16, 2024 16:41
@ChaosInTheCRD
adding function to add a single attestor
90292ed 
Signed-off-by: chaosinthecrd <[email protected]>
@ChaosInTheCRD
Fixing bug introduced in logs - warning and debug logs not printing (i…
2a9cd8d 
…n-toto#103)

warning logs and debug logs werent printing after error check - fixing
it

Signed-off-by: chaosinthecrd <[email protected]>
@jkjell @ChaosInTheCRD
Point to v0.2.0 of archivista (in-toto#105)
7e5dc35 
Signed-off-by: John Kjell <[email protected]>
Signed-off-by: chaosinthecrd <[email protected]>
@jkjell @ChaosInTheCRD
Create SECURITY.md (in-toto#107)
9fa0a5a 
Add an initial SECURITY.md file.

Signed-off-by: John Kjell <[email protected]>
Signed-off-by: chaosinthecrd <[email protected]>
@dependabot @ChaosInTheCRD
chore: bump github/codeql-action from 2.22.9 to 3.22.11 (in-toto#110)
210da2a 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.22.9 to 3.22.11.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@c0d1daa...b374143)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: chaosinthecrd <[email protected]>
@dependabot @jkjell @ChaosInTheCRD
chore: bump actions/download-artifact from 3.0.2 to 4.0.0 (in-toto#112)
a2db58c 
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 3.0.2 to 4.0.0.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@9bc31d5...7a1cd32)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: John Kjell <[email protected]>
Signed-off-by: chaosinthecrd <[email protected]>
@dependabot @ChaosInTheCRD
chore: bump actions/upload-artifact from 3.1.3 to 4.0.0 (in-toto#111)
af8e161 
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 3.1.3 to 4.0.0.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@a8a3f3a...c7d193f)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: chaosinthecrd <[email protected]>
@dependabot @ChaosInTheCRD
chore: bump golang.org/x/crypto from 0.14.0 to 0.17.0 (in-toto#115)
efa0140 
Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.14.0 to 0.17.0.
- [Commits](golang/crypto@v0.14.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: chaosinthecrd <[email protected]>
@dependabot @ChaosInTheCRD
chore: bump github.com/go-git/go-git/v5 from 5.5.2 to 5.11.0 (in-toto…
736674d 
…#119)

Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.5.2 to 5.11.0.
- [Release notes](https://github.com/go-git/go-git/releases)
- [Commits](go-git/go-git@v5.5.2...v5.11.0)

---
updated-dependencies:
- dependency-name: github.com/go-git/go-git/v5
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: chaosinthecrd <[email protected]>
@dependabot @ChaosInTheCRD
chore: bump github/codeql-action from 3.22.11 to 3.22.12 (in-toto#118)
ab18e20 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.22.11 to 3.22.12.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@b374143...012739e)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: chaosinthecrd <[email protected]>
@dependabot @ChaosInTheCRD
chore: bump actions/download-artifact from 4.0.0 to 4.1.0 (in-toto#117)
a106144 
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4.0.0 to 4.1.0.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@7a1cd32...f44cd7b)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: chaosinthecrd <[email protected]>
@dependabot @ChaosInTheCRD
chore: bump k8s.io/apimachinery from 0.26.11 to 0.26.12 (in-toto#116)
1dd0166 
Bumps [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) from 0.26.11 to 0.26.12.
- [Commits](kubernetes/apimachinery@v0.26.11...v0.26.12)

---
updated-dependencies:
- dependency-name: k8s.io/apimachinery
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: chaosinthecrd <[email protected]>
@jkjell @ChaosInTheCRD
Update SECURITY-INSIGHTS.yml with additional information (in-toto#108)
a037e9f 
* Update SECURITY-INSIGHTS.yml with additional information

Signed-off-by: John Kjell <[email protected]>

* Address Scorecard feedback and add dependency policy.

Signed-off-by: John Kjell <[email protected]>

---------

Signed-off-by: John Kjell <[email protected]>
Signed-off-by: chaosinthecrd <[email protected]>
@dependabot @ChaosInTheCRD
chore: bump github.com/cloudflare/circl from 1.3.3 to 1.3.7 (in-toto#121
0185ffa 
)

Bumps [github.com/cloudflare/circl](https://github.com/cloudflare/circl) from 1.3.3 to 1.3.7.
- [Release notes](https://github.com/cloudflare/circl/releases)
- [Commits](cloudflare/circl@v1.3.3...v1.3.7)

---
updated-dependencies:
- dependency-name: github.com/cloudflare/circl
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: chaosinthecrd <[email protected]>
@dependabot @ChaosInTheCRD
chore: bump actions/dependency-review-action from 3.1.4 to 3.1.5 (in-…
44c86b2 
…toto#123)

Bumps [actions/dependency-review-action](https://github.com/actions/dependency-review-action) from 3.1.4 to 3.1.5.
- [Release notes](https://github.com/actions/dependency-review-action/releases)
- [Commits](actions/dependency-review-action@01bc870...c74b580)

---
updated-dependencies:
- dependency-name: actions/dependency-review-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: chaosinthecrd <[email protected]>
@dependabot @jkjell @ChaosInTheCRD
chore: bump github/codeql-action from 3.22.12 to 3.23.0 (in-toto#122)
0824d9c 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.22.12 to 3.23.0.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@012739e...e5f05b8)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: John Kjell <[email protected]>
Signed-off-by: chaosinthecrd <[email protected]>
@pkwiatkowski1 @ChaosInTheCRD
fix: added oidc redirect url option for fulcio (in-toto#76)
9684b66 
* fix: added oidc redirect url option for fulcio

Signed-off-by: Patrick Kwiatkowski <[email protected]>

* Update fulcio.go

---------

Signed-off-by: Patrick Kwiatkowski <[email protected]>
Signed-off-by: Tom Meadows <[email protected]>
Co-authored-by: Tom Meadows <[email protected]>
Signed-off-by: chaosinthecrd <[email protected]>
@dependabot @ChaosInTheCRD
chore: bump actions/upload-artifact from 4.0.0 to 4.1.0 (in-toto#126)
08bf768 
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.0.0 to 4.1.0.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@c7d193f...1eb3cb2)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: chaosinthecrd <[email protected]>
@dependabot @ChaosInTheCRD
chore: bump actions/download-artifact from 4.1.0 to 4.1.1 (in-toto#127)
0adde0e 
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4.1.0 to 4.1.1.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@f44cd7b...6b208ae)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: chaosinthecrd <[email protected]>
@ChaosInTheCRD
added old function with deprecation warning
4ebd16e 
Signed-off-by: chaosinthecrd <[email protected]>
@ChaosInTheCRD
Copy link
Collaborator Author

Just gone and made a mess of this by signing off a load of commits that aren't mine 🤦 going to close this PR and reopen on a fresh branch as it's only a tiny change

@ChaosInTheCRD ChaosInTheCRD mentioned this pull request Jan 16, 2024
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@mikhailswift mikhailswift mikhailswift left review comments

@kairoaraujo kairoaraujo kairoaraujo left review comments

@jkjell jkjell Awaiting requested review from jkjell

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@ChaosInTheCRD @jkjell @kairoaraujo @mikhailswift @pkwiatkowski1