RunAttestors refactor #131
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: chaosinthecrd <[email protected]>
Signed-off-by: chaosinthecrd <[email protected]>
Signed-off-by: chaosinthecrd <[email protected]>
Signed-off-by: chaosinthecrd <[email protected]>
jkjell
force-pushed
the
run-attestors-refactor
branch
from
ba4ecd8
to
cd129ce
Compare
jkjell
reviewed
Jan 23, 2024
Signed-off-by: chaosinthecrd <[email protected]>
…witness into run-attestors-refactor Signed-off-by: chaosinthecrd <[email protected]>
Signed-off-by: chaosinthecrd <[email protected]>
Signed-off-by: Tom Meadows <[email protected]>
mikhailswift
previously approved these changes
Jan 31, 2024
|
I'll take a peak at the linting job and see if I can sort anything out... |
|
I cleared the golang-lint-ci cache for this job, and that cleared up the cache restoration error on this branch. It seemed to be an issue limited to this branch but if it crops up again we may need to take a deeper look at what's going on. The lining is now erroring out because |
|
I raised #145 to disable the cache and remove this issue going forward, but I am happy to leave that for now as you've sorted the problem. We can always make this change in the future if this reoccurs. Without sounding too ignorant do you mind me asking how you cleared the cach in the job @mikhailswift? 😆 |
Signed-off-by: chaosinthecrd <[email protected]>
|
On the subject of go version, this seems like a sensible time to bump https://github.com/in-toto/witness also. I think it would also be a good idea to figure out if there is any consideration we need to make in synchronizing the move to newer versions of go across repositories, and also some consideration on how long we wait before moving to new major versions. Just a thought. |
Yup! It's in the Actions section of the repo:
|
mikhailswift
approved these changes
Feb 2, 2024
jkjell
pushed a commit
that referenced
this pull request
Feb 3, 2024
* improving run attestors Signed-off-by: chaosinthecrd <[email protected]> * finalising changes. Signed-off-by: chaosinthecrd <[email protected]> * improving run attestors Signed-off-by: chaosinthecrd <[email protected]> * finalising changes. Signed-off-by: chaosinthecrd <[email protected]> * addressing review, restoring run type order Signed-off-by: chaosinthecrd <[email protected]> * updating error handling logic Signed-off-by: chaosinthecrd <[email protected]> * updating to go 1.21 for errors.Join Signed-off-by: chaosinthecrd <[email protected]> --------- Signed-off-by: chaosinthecrd <[email protected]> Signed-off-by: Tom Meadows <[email protected]>
jkjell
pushed a commit
that referenced
this pull request
Feb 5, 2024
* improving run attestors Signed-off-by: chaosinthecrd <[email protected]> * finalising changes. Signed-off-by: chaosinthecrd <[email protected]> * improving run attestors Signed-off-by: chaosinthecrd <[email protected]> * finalising changes. Signed-off-by: chaosinthecrd <[email protected]> * addressing review, restoring run type order Signed-off-by: chaosinthecrd <[email protected]> * updating error handling logic Signed-off-by: chaosinthecrd <[email protected]> * updating to go 1.21 for errors.Join Signed-off-by: chaosinthecrd <[email protected]> --------- Signed-off-by: chaosinthecrd <[email protected]> Signed-off-by: Tom Meadows <[email protected]> Signed-off-by: John Kjell <[email protected]>
ChaosInTheCRD
added a commit
that referenced
this pull request
May 9, 2024
* Initial link attestor Signed-off-by: John Kjell <[email protected]> * refactor: move gitoid code to cyrptoutil, use digestvalue everywhere (#139) When the functionality to calculate gitoids was added, there was a bit of tech debt incurred since they didn't implement hash.Hash. This remedies this with an admitedly hacky implementation of hash.Hash that wraps the gitoid code. This also standardizes our cryptoutil fucntions around the DigestValue struct that was added around this time to differentiate between gitoids and regular hash functions. Signed-off-by: Mikhail Swift <[email protected]> Signed-off-by: John Kjell <[email protected]> * chore: bump actions/upload-artifact from 4.2.0 to 4.3.0 (#142) Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.2.0 to 4.3.0. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@694cdab...26f96df) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: John Kjell <[email protected]> * chore: bump github/codeql-action from 3.23.1 to 3.23.2 (#143) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.23.1 to 3.23.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@0b21cf2...b7bf0a3) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Tom Meadows <[email protected]> Signed-off-by: John Kjell <[email protected]> * Adding job to auto cut releases (#141) adding job to auto cut releases Signed-off-by: chaosinthecrd <[email protected]> Signed-off-by: John Kjell <[email protected]> * fixing error in github actions workflow (#147) fixing error in workflow Signed-off-by: chaosinthecrd <[email protected]> Signed-off-by: John Kjell <[email protected]> * RunAttestors refactor (#131) * improving run attestors Signed-off-by: chaosinthecrd <[email protected]> * finalising changes. Signed-off-by: chaosinthecrd <[email protected]> * improving run attestors Signed-off-by: chaosinthecrd <[email protected]> * finalising changes. Signed-off-by: chaosinthecrd <[email protected]> * addressing review, restoring run type order Signed-off-by: chaosinthecrd <[email protected]> * updating error handling logic Signed-off-by: chaosinthecrd <[email protected]> * updating to go 1.21 for errors.Join Signed-off-by: chaosinthecrd <[email protected]> --------- Signed-off-by: chaosinthecrd <[email protected]> Signed-off-by: Tom Meadows <[email protected]> Signed-off-by: John Kjell <[email protected]> * Adding workaround due to failing workflows (#145) adding workaround due to failing workflows Signed-off-by: chaosinthecrd <[email protected]> Signed-off-by: John Kjell <[email protected]> * Checking policy signature against cert constraints (#144) * adding logic so policy signature can be checked against constraints * threaded options into policy validation functionary --------- Signed-off-by: chaosinthecrd <[email protected]> Signed-off-by: John Kjell <[email protected]> Co-authored-by: John Kjell <[email protected]> Signed-off-by: John Kjell <[email protected]> * [StepSecurity] ci: Harden GitHub Actions (#148) Signed-off-by: StepSecurity Bot <[email protected]> Signed-off-by: John Kjell <[email protected]> * Add import for init and export variables Signed-off-by: John Kjell <[email protected]> * Add mulitple results to run to allow exporting attestors to indivudal files Signed-off-by: John Kjell <[email protected]> * Add collection to result array Signed-off-by: John Kjell <[email protected]> * Replace export parameters in run with attestor option Signed-off-by: John Kjell <[email protected]> * Fix golang lint isues Signed-off-by: John Kjell <[email protected]> * Update link attestor testing Signed-off-by: John Kjell <[email protected]> * Add SLSA attestor Signed-off-by: John Kjell <[email protected]> * Add interface for product attestor Signed-off-by: John Kjell <[email protected]> * Add more attestor interfaces Signed-off-by: John Kjell <[email protected]> * Address some review feedback, licenses, and golanglint Signed-off-by: John Kjell <[email protected]> * More golangcilint errors Signed-off-by: John Kjell <[email protected]> * WIP - Improve testing interfaces for exposing data fields Signed-off-by: John Kjell <[email protected]> * added changes * adding changes to merge into main PR * Link attestor proposed changes (#204) * unmarshal the time in the attestation collection correctly (#203) * add StepName to AttestorContext * use CollectionAttestion to properly set start/end times --------- Signed-off-by: John Kjell <[email protected]> Co-authored-by: Cole Kennedy <[email protected]> Co-authored-by: Cole <[email protected]> Co-authored-by: John Kjell <[email protected]> * Passing SLSA Attest tests for GitHub and GitLab Signed-off-by: John Kjell <[email protected]> * Clean up Signed-off-by: John Kjell <[email protected]> * Add attestation test for link attestor Signed-off-by: John Kjell <[email protected]> * Add data function for git interface and remove unused code Signed-off-by: John Kjell <[email protected]> * adding warning mesage for slsa attestor Signed-off-by: chaosinthecrd <[email protected]> * Try to gracefully handle gitlab jwt Signed-off-by: John Kjell <[email protected]> * ran go mod tidy Signed-off-by: chaosinthecrd <[email protected]> * ensuring link and slsa attestation exporting is optional Signed-off-by: chaosinthecrd <[email protected]> --------- Signed-off-by: John Kjell <[email protected]> Signed-off-by: Mikhail Swift <[email protected]> Signed-off-by: dependabot[bot] <[email protected]> Signed-off-by: chaosinthecrd <[email protected]> Signed-off-by: Tom Meadows <[email protected]> Signed-off-by: StepSecurity Bot <[email protected]> Co-authored-by: Mikhail Swift <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Tom Meadows <[email protected]> Co-authored-by: StepSecurity Bot <[email protected]> Co-authored-by: Cole Kennedy <[email protected]> Co-authored-by: Cole <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Small work done to refactor the
RunAttestors()function.I have also made some changes to the
AttestationContextfunctions, I am not quite sure why copies of the struct fields being returned need to be made. @mikhailswift I'll request your review to try and check that there isn't any extra context on this.