Skip to content

fix: Switch to newer DSSE rekor type #3299

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
laurentsimon merged 8 commits into from
Mar 26, 2024
Merged

fix: Switch to newer DSSE rekor type #3299

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
bdeea00
fix: Switch to newer DSSE rekor type
Hayden-IO Feb 29, 2024
9d72468
Update CHANGELOG.md
Hayden-IO Mar 5, 2024
e91f0bc
Fix lint
Hayden-IO Mar 6, 2024
7ec2f7f
Merge branch 'main' into dsse-entry
laurentsimon Mar 26, 2024
bbf63c1
Update CHANGELOG.md
laurentsimon Mar 26, 2024
e0093c8
Update CHANGELOG.md
laurentsimon Mar 26, 2024
99c25a8
Update CHANGELOG.md
laurentsimon Mar 26, 2024
0ed5031
Merge branch 'main' into dsse-entry
laurentsimon Mar 26, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
- [Unreleased: Gradle Builder](#unreleased-gradle-builder)
- [Unreleased: Go Builder](#unreleased-go-builder)
- [Unreleased: Container Generator](#unreleased-container-generator)
- [Unreleased: DSSE Rekor type](#unreleased-dsse-rekor-type)
- [v1.9.0](#v190)
- [v1.9.0: BYOB framework (beta)](#v190-byob-framework-beta)
- [v1.9.0: Maven builder (beta)](#v190-maven-builder-beta)
Expand Down Expand Up @@ -114,6 +115,13 @@ duplication."
- A new `provenance-repository` input was added to allow reading provenance from
a different container repository than the image itself (#2956)

### Unreleased: DSSE Rekor Type

- When uploading signed provenance to the log, the entry created in the log is now
a DSSE Rekor type. This fixes a bug where the current intoto type does not
persist provenance signatures. The attestation will no longer be persisted
in Rekor (#3299)

## v1.9.0

Release [v1.9.0] includes bug fixes and new features.
Expand Down
2 changes: 1 addition & 1 deletion signing/sigstore/rekor.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,7 +80,7 @@ func (r *Rekor) Upload(ctx context.Context, att signing.Attestation) (signing.Lo
return nil, fmt.Errorf("creating rekor client: %w", err)
}
// TODO: Is it a bug that we need []byte(string(k.Cert)) or else we hit invalid PEM?
logEntry, err := cosign.TLogUploadInTotoAttestation(ctx, rekorClient, att.Bytes(), []byte(string(att.Cert())))
logEntry, err := cosign.TLogUploadDSSEEnvelope(ctx, rekorClient, att.Bytes(), []byte(string(att.Cert())))
if err != nil {
return nil, fmt.Errorf("uploading attestation: %w", err)
}
Expand Down
⚡