GO-2023-2188: slsa-verifier vulnerable to mproper validation of npm's publish attestations in github.com/slsa-framework/slsa-verifier

The highest tagged major version is v2.

verifiers

package

v1.4.1 Latest Latest Go to latest Published: Oct 8, 2022 License: Apache-2.0 Imports: 8 Imported by: 1

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/slsa-framework/slsa-verifier

Links

Open Source Insights

Documentation ¶

Index ¶

func VerifyArtifact(ctx context.Context, provenance []byte, artifactHash string, ...) ([]byte, *utils.TrustedBuilderID, error)
func VerifyImage(ctx context.Context, artifactImage string, provenance []byte, ...) ([]byte, *utils.TrustedBuilderID, error)

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

func VerifyArtifact ¶ added in v1.4.0

func VerifyArtifact(ctx context.Context,
	provenance []byte, artifactHash string,
	provenanceOpts *options.ProvenanceOpts,
	builderOpts *options.BuilderOpts,
) ([]byte, *utils.TrustedBuilderID, error)

func VerifyImage ¶ added in v1.4.0

func VerifyImage(ctx context.Context, artifactImage string,
	provenance []byte,
	provenanceOpts *options.ProvenanceOpts,
	builderOpts *options.BuilderOpts,
) ([]byte, *utils.TrustedBuilderID, error)

Types ¶

This section is empty.

Source Files ¶

View all Source files

verifier.go

Directories ¶

Path	Synopsis
internal
gcb
gcb/keys
gha
utils
container

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL