utils

Jan 28, 2025

Changes in this version

+ func GetDefaultSigstoreTUFClient() (*sigstoreTUF.Client, error)

+ func GetSigstoreTrustedRoot() (*sigstoreRoot.LiveTrustedRoot, error)

+ type SigstoreTUFClient interface

+ GetTarget func(target string) ([]byte, error)

Oct 16, 2023

Changes in this version

+ func DsseVerifierNew(content []byte, format KeyFormat, keyID string, sigEncoding *SignatureEncoding) (*dsselib.EnvelopeVerifier, error)

+ func EnvelopeFromBytes(payload []byte) (*dsselib.Envelope, error)

+ func StatementFromBytes(payload []byte) (*intoto.Statement, error)

+ func StatementFromEnvelope(env *dsselib.Envelope) (*intoto.Statement, error)

+ type KeyFormat int

+ const KeyFormatDER

+ const KeyFormatPEM

+ type SignatureEncoding int

+ const SignatureEncodingDER

+ const SignatureEncodingIEEEP1363

Aug 24, 2023 GO-2023-2188

  GO-2023-2188: slsa-verifier vulnerable to mproper validation of npm's publish attestations in github.com/slsa-framework/slsa-verifier

Changes in this version

+ func BranchFromGitRef(ref string) (string, error)

+ func IsValidBuilderTag(ref string, testing bool) error

+ func IsValidJreleaserBuilderTag(ref string) error

+ func MergeMaps(m1, m2 map[K]V) map[K]V

+ func NormalizeGitURI(s string) string

+ func ParseGitRef(ref string) (string, string)

+ func ParseGitURIAndRef(uri string) (string, string, error)

+ func TagFromGitRef(ref string) (string, error)

+ func ValidateGitRef(refType, ref string) (string, error)

Aug 24, 2023 GO-2023-2188

  GO-2023-2188: slsa-verifier vulnerable to mproper validation of npm's publish attestations in github.com/slsa-framework/slsa-verifier

Aug 24, 2023 GO-2023-2188

  GO-2023-2188: slsa-verifier vulnerable to mproper validation of npm's publish attestations in github.com/slsa-framework/slsa-verifier

May 10, 2023 GO-2023-2188

  GO-2023-2188: slsa-verifier vulnerable to mproper validation of npm's publish attestations in github.com/slsa-framework/slsa-verifier

Changes in this version

type TrustedBuilderID

+ func (b *TrustedBuilderID) MatchesFull(builderID string, allowRef bool) error

+ func (b *TrustedBuilderID) MatchesLoose(builderID string, allowRef bool) error

May 10, 2023 GO-2023-2188

  GO-2023-2188: slsa-verifier vulnerable to mproper validation of npm's publish attestations in github.com/slsa-framework/slsa-verifier

May 8, 2023 GO-2023-2188

  GO-2023-2188: slsa-verifier vulnerable to mproper validation of npm's publish attestations in github.com/slsa-framework/slsa-verifier

May 1, 2023 GO-2023-2188

  GO-2023-2188: slsa-verifier vulnerable to mproper validation of npm's publish attestations in github.com/slsa-framework/slsa-verifier

Apr 20, 2023 GO-2023-2188

  GO-2023-2188: slsa-verifier vulnerable to mproper validation of npm's publish attestations in github.com/slsa-framework/slsa-verifier

Apr 11, 2023 GO-2023-2188

  GO-2023-2188: slsa-verifier vulnerable to mproper validation of npm's publish attestations in github.com/slsa-framework/slsa-verifier

Changes in this version

+ func VerifyVersionedTag(provenanceTag, expectedTag string) error

Apr 11, 2023 GO-2023-2188

  GO-2023-2188: slsa-verifier vulnerable to mproper validation of npm's publish attestations in github.com/slsa-framework/slsa-verifier

Mar 6, 2023 GO-2023-2188

  GO-2023-2188: slsa-verifier vulnerable to mproper validation of npm's publish attestations in github.com/slsa-framework/slsa-verifier

Mar 14, 2023 GO-2023-2188

  GO-2023-2188: slsa-verifier vulnerable to mproper validation of npm's publish attestations in github.com/slsa-framework/slsa-verifier

Changes in this version

+ func DecodeSignature(s string) ([]byte, error)

+ func PayloadFromEnvelope(env *dsselib.Envelope) ([]byte, error)

Mar 14, 2023 GO-2023-2188

  GO-2023-2188: slsa-verifier vulnerable to mproper validation of npm's publish attestations in github.com/slsa-framework/slsa-verifier

Mar 9, 2023 GO-2023-2188

  GO-2023-2188: slsa-verifier vulnerable to mproper validation of npm's publish attestations in github.com/slsa-framework/slsa-verifier

Dec 8, 2022 GO-2023-2188

  GO-2023-2188: slsa-verifier vulnerable to mproper validation of npm's publish attestations in github.com/slsa-framework/slsa-verifier

Changes in this version

+ func ParseBuilderID(id string, needVersion bool) (string, string, error)

+ func TagFromGitHubRef(ref string) (string, error)

+ func ValidateGitHubTagRef(tag string) error

+ type TrustedBuilderID struct

+ func TrustedBuilderIDNew(builderID string) (*TrustedBuilderID, error)

+ func (b *TrustedBuilderID) Matches(builderID string, allowRef bool) error

+ func (b *TrustedBuilderID) Name() string

+ func (b *TrustedBuilderID) String() string

+ func (b *TrustedBuilderID) Version() string

Dec 8, 2022 GO-2023-2188

  GO-2023-2188: slsa-verifier vulnerable to mproper validation of npm's publish attestations in github.com/slsa-framework/slsa-verifier

Dec 6, 2022 GO-2023-2188

  GO-2023-2188: slsa-verifier vulnerable to mproper validation of npm's publish attestations in github.com/slsa-framework/slsa-verifier

Dec 6, 2022 GO-2023-2188

  GO-2023-2188: slsa-verifier vulnerable to mproper validation of npm's publish attestations in github.com/slsa-framework/slsa-verifier

Dec 3, 2022 GO-2023-2188

  GO-2023-2188: slsa-verifier vulnerable to mproper validation of npm's publish attestations in github.com/slsa-framework/slsa-verifier