docker/actions-toolkit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sigstore: default blob attestation verification to SLSA provenance v1

Browse Source 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
This commit is contained in:
CrazyMax
2026-04-07 16:41:12 +02:00
parent 76d6a50711
commit ab22ca5180
3 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
__tests__/sigstore/sigstore.test.itg.ts
View File

@@ -36,7 +36,7 @@ const maybeIdToken = runTest && process.env.ACTIONS_ID_TOKEN_REQUEST_URL ? descr
beforeAll(async () => { beforeAll(async () => {
const cosignInstall = new CosignInstall(); const cosignInstall = new CosignInstall();
const cosignBinPath = await cosignInstall.download({ const cosignBinPath = await cosignInstall.download({
version: 'v3.0.4' version: 'v3.0.6'
}); });
await cosignInstall.install(cosignBinPath); await cosignInstall.install(cosignBinPath);
}, 100000); }, 100000);

5
src/sigstore/sigstore.ts
View File

@@ -55,6 +55,8 @@ export interface SigstoreOpts {
imageTools?: ImageTools; imageTools?: ImageTools;
} }
const COSIGN_PREDICATE_SLSA_PROVENANCE_V1 = 'slsaprovenance1';
export class Sigstore { export class Sigstore {
private readonly cosign: Cosign; private readonly cosign: Cosign;
private readonly imageTools: ImageTools; private readonly imageTools: ImageTools;
@@ -352,7 +354,8 @@ export class Sigstore {
'verify-blob-attestation', 'verify-blob-attestation',
'--new-bundle-format', '--new-bundle-format',
'--certificate-oidc-issuer', 'https://token.actions.githubusercontent.com', '--certificate-oidc-issuer', 'https://token.actions.githubusercontent.com',
'--certificate-identity-regexp', opts.certificateIdentityRegexp '--certificate-identity-regexp', opts.certificateIdentityRegexp,
'--type', opts.predicateType ?? COSIGN_PREDICATE_SLSA_PROVENANCE_V1
] ]
if (opts.noTransparencyLog || !signedRes.tlogID) { if (opts.noTransparencyLog || !signedRes.tlogID) {
// if there is no tlog entry, we skip tlog verification but still verify the signed timestamp // if there is no tlog entry, we skip tlog verification but still verify the signed timestamp

1
src/types/sigstore/sigstore.ts
View File

@@ -73,6 +73,7 @@ export interface SignProvenanceBlobsResult extends ParsedBundle {
} }
export interface VerifySignedArtifactsOpts { export interface VerifySignedArtifactsOpts {
predicateType?: string;
certificateIdentityRegexp: string; certificateIdentityRegexp: string;
noTransparencyLog?: boolean; noTransparencyLog?: boolean;
} }