Skip to content

Commit a0b8cc8

Browse files
nkanenkane
committed
Squashed 'subtrees/go-witness/' changes from cd0c222..0b28c0f
0b28c0f Adding support for using timestamp authority and CA certificates for verifying policy (in-toto#124) 43a586f Adding support for supplying POM on Maven Attestor (in-toto#129) 61576e0 Adding function to add a single attestor (in-toto#128) 404b654 chore: bump actions/download-artifact from 4.1.0 to 4.1.1 (in-toto#127) 8937af7 chore: bump actions/upload-artifact from 4.0.0 to 4.1.0 (in-toto#126) a54b4c0 fix: added oidc redirect url option for fulcio (in-toto#76) 0aaf29b chore: bump github/codeql-action from 3.22.12 to 3.23.0 (in-toto#122) 4354822 chore: bump actions/dependency-review-action from 3.1.4 to 3.1.5 (in-toto#123) 90c26c3 chore: bump github.com/cloudflare/circl from 1.3.3 to 1.3.7 (in-toto#121) 9875fcc Update SECURITY-INSIGHTS.yml with additional information (in-toto#108) 3088442 chore: bump k8s.io/apimachinery from 0.26.11 to 0.26.12 (in-toto#116) 6ab0399 chore: bump actions/download-artifact from 4.0.0 to 4.1.0 (in-toto#117) c5246d4 chore: bump github/codeql-action from 3.22.11 to 3.22.12 (in-toto#118) a39d484 chore: bump github.com/go-git/go-git/v5 from 5.5.2 to 5.11.0 (in-toto#119) c28d93f chore: bump golang.org/x/crypto from 0.14.0 to 0.17.0 (in-toto#115) 603cfa9 chore: bump actions/upload-artifact from 3.1.3 to 4.0.0 (in-toto#111) 84bdf2a chore: bump actions/download-artifact from 3.0.2 to 4.0.0 (in-toto#112) 9465ff4 chore: bump github/codeql-action from 2.22.9 to 3.22.11 (in-toto#110) cfee7c9 Create SECURITY.md (in-toto#107) 6094e21 Point to v0.2.0 of archivista (in-toto#105) 00081b0 Fixing bug introduced in logs - warning and debug logs not printing (in-toto#103) 5b5647c WIP: Migrating Go module to in-toto (in-toto#101) c555ac6 Adding go test command to Makefile (in-toto#96) 737eed8 Updating README (in-toto#97) 70efbcf Improving `--signer-fulcio-token` flag to accept both path and raw token string (in-toto#82) b11e25f chore: bump github/codeql-action from 2.22.8 to 2.22.9 (in-toto#90) 1ec7071 chore: bump actions/dependency-review-action from 2.5.1 to 3.1.4 (in-toto#91) 765aa2b chore: bump actions/checkout from 3.6.0 to 4.1.1 (in-toto#92) 9243257 chore: bump actions/setup-go from 4.1.0 to 5.0.0 (in-toto#93) 19d2725 chore: bump ossf/scorecard-action from 2.0.6 to 2.3.1 (in-toto#89) a10252c Don't run FOSSA Scan on PR from fork (in-toto#95) bec608e Changes to improve CLOMonitor Score (in-toto#88) 3328596 Fix pre-commit violations (in-toto#87) eac781c [StepSecurity] Apply security best practices (in-toto#86) 1d30fe2 Refactoring error messages to use %w formatting directive and fix logging issue (in-toto#85) 7ec4004 Update README.md 2bdd1c6 chore: bump github.com/go-jose/go-jose/v3 from 3.0.0 to 3.0.1 3e86283 chore: bump github.com/open-policy-agent/opa from 0.49.1 to 0.49.2 86c8967 chore: bump github.com/mattn/go-isatty from 0.0.17 to 0.0.20 5f74d75 chore: bump k8s.io/apimachinery from 0.26.10 to 0.26.11 9a2cff0 chore: bump github.com/stretchr/testify from 1.8.2 to 1.8.4 40c7ed5 chore: bump github.com/sigstore/sigstore from 1.5.1 to 1.5.2 4ddd1b4 chore: bump k8s.io/apimachinery from 0.26.1 to 0.26.10 e927252 chore: bump go.step.sm/crypto from 0.25.0 to 0.25.2 4273fcf chore: bump github.com/spiffe/go-spiffe/v2 from 2.1.2 to 2.1.6 c5bac1b chore: bump github.com/aws/aws-sdk-go from 1.44.207 to 1.44.334 044ab95 chore: bump actions/setup-go from 2 to 4 46ff412 chore: bump actions/checkout from 2 to 4 78ca945 Improve DigestSet logic and JSON marshalling c487391 Changed to pointer receiver when both were mixed 08d1c37 Add dependabot config, reusable witness workflow, and update pipeline 5c92286 Add maintainers file (in-toto#64) 69cb3ee chore(deps): bump google.golang.org/grpc from 1.53.0 to 1.56.3 (in-toto#60) 5e567f0 chore(deps): bump golang.org/x/net from 0.7.0 to 0.17.0 (in-toto#54) 03cf3f0 chore(deps): bump github.com/cloudflare/circl from 1.3.2 to 1.3.3 (in-toto#44) 4f01b96 Add support for controller-gen deepcopy of policy package structs. This will be required for archivista data provider controllers (in-toto#53) git-subtree-dir: subtrees/go-witness git-subtree-split: 0b28c0f52c40cdac5e3a15151ca360d965929086
1 parent 0251839 commit a0b8cc8

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

87 files changed

+1600
-742
lines changed

‎.clomonitor.yml

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# Copyright 2023 The Witness Contributors
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
# CLOMonitor metadata file
16+
# This file must be located at the root of the repository
17+
18+
# Checks exemptions
19+
exemptions:
20+
- check: artifacthub_badge # Check identifier (see https://github.com/cncf/clomonitor/blob/main/docs/checks.md#exemptions)
21+
reason: "Project is a library and does not create an artifact" # Justification of this exemption (mandatory, it will be displayed on the UI)

‎.github/dependabot.yml

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
# Copyright 2023 The Witness Contributors
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
version: 2
16+
17+
updates:
18+
- package-ecosystem: "github-actions"
19+
directory: "/"
20+
schedule:
21+
interval: "weekly"
22+
commit-message:
23+
prefix: "chore"
24+
25+
- package-ecosystem: "gomod"
26+
directory: "/"
27+
schedule:
28+
interval: "weekly"
29+
commit-message:
30+
prefix: "chore"
31+
ignore:
32+
- dependency-name: "*"
33+
update-types:
34+
- "version-update:semver-major"
35+
- "version-update:semver-minor"
36+
37+
- package-ecosystem: docker
38+
directory: /
39+
schedule:
40+
interval: daily
41+
commit-message:
42+
prefix: "chore"

‎.github/workflows/codeql.yml

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
# Copyright 2023 The Witness Contributors
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
# For most projects, this workflow file will not need changing; you simply need
16+
# to commit it to your repository.
17+
#
18+
# You may wish to alter this file to override the set of languages analyzed,
19+
# or to provide custom queries or build logic.
20+
#
21+
# ******** NOTE ********
22+
# We have attempted to detect the languages in your repository. Please check
23+
# the `language` matrix defined below to confirm you have the correct set of
24+
# supported CodeQL languages.
25+
#
26+
name: "CodeQL"
27+
28+
on:
29+
push:
30+
branches: ["main"]
31+
pull_request:
32+
# The branches below must be a subset of the branches above
33+
branches: ["main"]
34+
schedule:
35+
- cron: "0 0 * * 1"
36+
37+
permissions:
38+
contents: read
39+
40+
jobs:
41+
analyze:
42+
name: Analyze
43+
runs-on: ubuntu-latest
44+
permissions:
45+
actions: read
46+
contents: read
47+
security-events: write
48+
49+
strategy:
50+
fail-fast: false
51+
matrix:
52+
language: ["go"]
53+
# CodeQL supports [ $supported-codeql-languages ]
54+
# Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
55+
56+
steps:
57+
- name: Harden Runner
58+
uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
59+
with:
60+
egress-policy: audit
61+
62+
- name: Checkout repository
63+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
64+
65+
# Initializes the CodeQL tools for scanning.
66+
- name: Initialize CodeQL
67+
uses: github/codeql-action/init@e5f05b81d5b6ff8cfa111c80c22c5fd02a384118 # v3.23.0
68+
with:
69+
languages: ${{ matrix.language }}
70+
# If you wish to specify custom queries, you can do so here or in a config file.
71+
# By default, queries listed here will override any specified in a config file.
72+
# Prefix the list here with "+" to use these queries and those in the config file.
73+
74+
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
75+
# If this step fails, then you should remove it and run the build manually (see below)
76+
- name: Autobuild
77+
uses: github/codeql-action/autobuild@e5f05b81d5b6ff8cfa111c80c22c5fd02a384118 # v3.23.0
78+
79+
# ℹ️ Command-line programs to run using the OS shell.
80+
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
81+
82+
# If the Autobuild fails above, remove it and uncomment the following three lines.
83+
# modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
84+
85+
# - run: |
86+
# echo "Run, Build Application using script"
87+
# ./location_of_script_within_repo/buildscript.sh
88+
89+
- name: Perform CodeQL Analysis
90+
uses: github/codeql-action/analyze@e5f05b81d5b6ff8cfa111c80c22c5fd02a384118 # v3.23.0
91+
with:
92+
category: "/language:${{matrix.language}}"

‎.github/workflows/dependency-review.yml

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
# Copyright 2023 The Witness Contributors
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
# Dependency Review Action
16+
#
17+
# This Action will scan dependency manifest files that change as part of a Pull Request,
18+
# surfacing known-vulnerable versions of the packages declared or updated in the PR.
19+
# Once installed, if the workflow run is marked as required,
20+
# PRs introducing known-vulnerable packages will be blocked from merging.
21+
#
22+
# Source repository: https://github.com/actions/dependency-review-action
23+
name: 'Dependency Review'
24+
on: [pull_request]
25+
26+
permissions:
27+
contents: read
28+
29+
jobs:
30+
dependency-review:
31+
runs-on: ubuntu-latest
32+
steps:
33+
- name: Harden Runner
34+
uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
35+
with:
36+
egress-policy: audit
37+
38+
- name: 'Checkout Repository'
39+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
40+
- name: 'Dependency Review'
41+
uses: actions/dependency-review-action@c74b580d73376b7750d3d2a50bfb8adc2c937507 # v3.1.5

‎.github/workflows/fossa.yml

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
name: "Fossa Scan"
2+
3+
on:
4+
push:
5+
branches: ["main"]
6+
pull_request:
7+
# The branches below must be a subset of the branches above
8+
branches: ["main"]
9+
schedule:
10+
- cron: "0 0 * * 1"
11+
12+
permissions:
13+
contents: read
14+
15+
jobs:
16+
fossa-scan:
17+
env:
18+
FOSSA_API_KEY: ${{ secrets.fossaApiKey }}
19+
runs-on: ubuntu-latest
20+
steps:
21+
- if: ${{ env.FOSSA_API_KEY != '' }}
22+
name: "Checkout Code"
23+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
24+
- if: ${{ env.FOSSA_API_KEY != '' }}
25+
name: "Run FOSSA Scan"
26+
uses: fossas/fossa-action@f61a4c0c263690f2ddb54b9822a719c25a7b608f # v1.3.1
27+
with:
28+
api-key: ${{ env.FOSSA_API_KEY }}

‎.github/workflows/golangci-lint.yml

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -29,12 +29,17 @@ jobs:
2929
name: lint
3030
runs-on: ubuntu-latest
3131
steps:
32-
- uses: actions/checkout@v2
33-
- uses: actions/setup-go@v3
32+
- name: Harden Runner
33+
uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
34+
with:
35+
egress-policy: audit
36+
37+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
38+
- uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
3439
with:
3540
go-version-file: "go.mod"
3641
- name: golangci-lint
37-
uses: golangci/golangci-lint-action@v3
42+
uses: golangci/golangci-lint-action@3a919529898de77ec3da873e3063ca4b10e7f5cc # v3.7.0
3843
with:
3944
version: latest
4045
args: --timeout=3m

‎.github/workflows/release.yml

Lines changed: 38 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -12,55 +12,46 @@
1212
# See the License for the specific language governing permissions and
1313
# limitations under the License.
1414

15-
permissions:
16-
id-token: write # This is required for requesting the JWT
17-
contents: read # This is required for actions/checkout
1815
name: release
1916
on: [push, pull_request]
20-
jobs:
21-
test:
22-
strategy:
23-
matrix:
24-
go-version: [ 1.19.x ]
25-
os: [ ubuntu-latest ]
26-
runs-on: ${{ matrix.os }}
27-
steps:
28-
- name: Install Go
29-
uses: actions/setup-go@v2
30-
with:
31-
go-version: ${{ matrix.go-version }}
32-
- name: Checkout code
33-
uses: actions/checkout@v2
34-
- uses: actions/cache@v2
35-
with:
36-
path: |
37-
~/go/pkg/mod
38-
~/.cache/go-build
39-
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
40-
restore-keys: |
41-
${{ runner.os }}-go-
42-
- name: Format Unix
43-
run: test -z $(go fmt ./...)
44-
- name: Install GoKart
45-
run: go install github.com/praetorian-inc/gokart@latest
4617

47-
- name: Static Analysis
48-
uses: testifysec/witness-run-action@40aa4ef36fc431a37de7c3faebcb66513c03b934
49-
with:
50-
step: static-analysis
51-
attestations: "github sarif"
52-
command: gokart scan . -o sarif-results.json -s
18+
permissions:
19+
contents: read
20+
21+
jobs:
22+
fmt:
23+
uses: ./.github/workflows/witness.yml
24+
permissions:
25+
id-token: write # This is required for requesting the JWT
26+
contents: read
27+
with:
28+
pull_request: ${{ github.event_name == 'pull_request' }}
29+
step: fmt
30+
attestations: "git github environment"
31+
command: go fmt ./...
5332

54-
- name: Test
55-
uses: testifysec/witness-run-action@40aa4ef36fc431a37de7c3faebcb66513c03b934
56-
with:
57-
step: "test"
58-
attestations: "github"
59-
command: go test -v -coverprofile=profile.cov -covermode=atomic ./...
33+
sast:
34+
needs: [fmt]
35+
uses: ./.github/workflows/witness.yml
36+
permissions:
37+
id-token: write # This is required for requesting the JWT
38+
contents: read
39+
with:
40+
pull_request: ${{ github.event_name == 'pull_request' }}
41+
step: sast
42+
attestations: "git github environment"
43+
command: go vet ./...
6044

61-
- name: Send coverage
62-
env:
63-
COVERALLS_TOKEN: ${{ secrets.GITHUB_TOKEN }}
64-
run: |
65-
GO111MODULE=off go get github.com/mattn/goveralls
66-
$(go env GOPATH)/bin/goveralls -coverprofile=profile.cov -service=github
45+
unit-test:
46+
needs: [fmt]
47+
uses: ./.github/workflows/witness.yml
48+
permissions:
49+
id-token: write # This is required for requesting the JWT
50+
contents: read
51+
with:
52+
pull_request: ${{ github.event_name == 'pull_request' }}
53+
step: unit-test
54+
attestations: "git github environment"
55+
command: go test -v -coverprofile=profile.cov -covermode=atomic ./...
56+
artifact-upload-name: profile.cov
57+
artifact-upload-path: profile.cov

0 commit comments

Comments
 (0)