Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: Update doc for v2.4.0 #699

Merged
merged 3 commits into from
Aug 25, 2023
Merged

chore: Update doc for v2.4.0 #699

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
677b12c
updates
laurentsimon Aug 25, 2023
fa368ca
updates
laurentsimon Aug 25, 2023
78703e5
updates
laurentsimon Aug 25, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,7 +97,7 @@ You have two options to install the verifier.
If you want to install the verifier, you can run the following command:

```bash
$ go install github.com/slsa-framework/slsa-verifier/v2/cli/slsa-verifier@v2.3.0
$ go install github.com/slsa-framework/slsa-verifier/v2/cli/slsa-verifier@v2.4.0
$ slsa-verifier <options>
```

Expand Down Expand Up @@ -143,7 +143,7 @@ $ go install github.com/slsa-framework/slsa-verifier/v2/cli/slsa-verifier

```bash
$ git clone git@github.com:slsa-framework/slsa-verifier.git
$ cd slsa-verifier && git checkout v2.3.0
$ cd slsa-verifier && git checkout v2.4.0
$ go run ./cli/slsa-verifier <options>
```

Expand All @@ -153,7 +153,7 @@ If you need to install the verifier to run in a GitHub workflow, use the install

### Download the binary

Download the binary from the latest release at [https://github.com/slsa-framework/slsa-verifier/releases/tag/v2.3.0](https://github.com/slsa-framework/slsa-verifier/releases/tag/v2.3.0)
Download the binary from the latest release at [https://github.com/slsa-framework/slsa-verifier/releases/tag/v2.4.0](https://github.com/slsa-framework/slsa-verifier/releases/tag/v2.4.0)

Download the [SHA256SUM.md](https://github.com/slsa-framework/slsa-verifier/blob/main/SHA256SUM.md).

Expand Down
1 change: 1 addition & 0 deletions RELEASE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,6 +83,7 @@ Follow the steps:
$ git clone git@github.com:slsa-framework/slsa-verifier.git
$ cd slsa-verifier
# $ (Optional: git checkout tags/v1.1.1: you may need to change the command below)
# You can run `bash verify-release.sh vX.Y.Z`: it will download all artifacts and verify them.
$ go run ./cli/slsa-verifier verify-artifact ~/Downloads/slsa-verifier-linux-amd64 --provenance-path ~/Downloads/slsa-verifier-linux-amd64.intoto.jsonl --source-uri github.com/slsa-framework/slsa-verifier --source-tag vX.Y.Z
```

Expand Down
9 changes: 9 additions & 0 deletions SHA256SUM.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,12 @@
### [v2.4.0](https://github.com/slsa-framework/slsa-verifier/releases/tag/v2.4.0)

9e67318937b936014b6127affc14bc45f1fb10d9899b0105877778e8179b3029 slsa-verifier-darwin-amd64
b55009be65f8f6dae4399522e4ab5685a5cfe0b72dca3134f12ba144b8860607 slsa-verifier-darwin-arm64
9883e4c7fd0fead95815de1533db62d1ae19daf9d333b359e192fc65ffb401b2 slsa-verifier-linux-amd64
bb025462acd9e93da32694e3ed82bfa57cb487a28c989a083caf2a3569d3cfbe slsa-verifier-linux-arm64
a8ea35a4abf450f3828d42cf0b9be3628692508184bec8610a472a7bf4afc843 slsa-verifier-windows-amd64.exe
b14cd8228fecabe53e3676ec2d94b53d7aee11f6f5a8dabbe07e840143d48e8d slsa-verifier-windows-arm64.exe

### [v2.3.0](https://github.com/slsa-framework/slsa-verifier/releases/tag/v2.3.0)

44ae609925c2dddafa45b2f98da62b40abcf739bbbe6f9dc792f3aba6e236e9c slsa-verifier-darwin-amd64
Expand Down
2 changes: 1 addition & 1 deletion actions/installer/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ For more information about SLSA in general, see [https://slsa.dev](https://slsa.
To install a specific version of `slsa-verifier`, use:

```yaml
uses: slsa-framework/slsa-verifier/actions/installer@v2.3.0
uses: slsa-framework/slsa-verifier/actions/installer@v2.4.0
```

See https://github.com/slsa-framework/slsa-verifier/releases for the list of available `slsa-verifier` releases. Only versions greater or equal to 2.0.1 are supported.
Expand Down
40 changes: 40 additions & 0 deletions verify-release.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,40 @@
#!/bin/bash

set -euo pipefail

if [ "$#" -ne 1 ]; then
echo "Usage: $0 tag"
exit 1
fi

# Verify GH_TOKEN is set.
if [[ -z "${GH_TOKEN:-}" ]]; then
echo "GH_TOKEN is unset"
exit 1
fi

# Set the gh CLI.
if [[ -z "${GH:-}" ]]; then
GH="gh"
fi

dir=$(mktemp -d)
tag="$1"

mkdir -p "${dir}"
rm -rf "${dir:?}/"* 2>/dev/null || true

echo "INFO: using dir: ${dir}"
echo

# Download artifacts and provenance.
cd "${dir}"
"${GH}" release -R slsa-framework/slsa-verifier download "${tag}"
cd -

for file in "${dir}"/*; do
if [[ "${file}" == *".intoto.jsonl" ]]; then
continue
fi
go run ./cli/slsa-verifier verify-artifact "${file}" --provenance-path "${file}".intoto.jsonl --source-uri github.com/slsa-framework/slsa-verifier --source-tag "${tag}"
done