Upgrade sigstore-go to v0.6.1 #9566
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||
|---|---|---|---|---|
| @@ -1,8 +1,8 @@ | ||||
| module github.com/cli/cli/v2 | ||||
|
|
||||
| go 1.22.5 | ||||
|
|
||||
| toolchain go1.22.6 | ||||
|
There was a problem hiding this comment. Since this PR was created,
Is this worth bumping to?
Suggested change
|
||||
|
|
||||
| require ( | ||||
| github.com/AlecAivazis/survey/v2 v2.3.7 | ||||
|
|
@@ -26,7 +26,7 @@ require ( | |||
| github.com/hashicorp/go-multierror v1.1.1 | ||||
| github.com/hashicorp/go-version v1.3.0 | ||||
| github.com/henvic/httpretty v0.1.3 | ||||
| github.com/in-toto/attestation v1.1.0 | ||||
| github.com/joho/godotenv v1.5.1 | ||||
| github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 | ||||
| github.com/mattn/go-colorable v0.1.13 | ||||
|
|
@@ -38,15 +38,15 @@ require ( | |||
| github.com/rivo/tview v0.0.0-20221029100920-c4a7e501810d | ||||
| github.com/shurcooL/githubv4 v0.0.0-20240120211514-18a1ae0e79dc | ||||
| github.com/sigstore/protobuf-specs v0.3.2 | ||||
| github.com/sigstore/sigstore-go v0.6.1 | ||||
| github.com/spf13/cobra v1.8.1 | ||||
| github.com/spf13/pflag v1.0.5 | ||||
| github.com/stretchr/testify v1.9.0 | ||||
| github.com/zalando/go-keyring v0.2.5 | ||||
| golang.org/x/crypto v0.26.0 | ||||
| golang.org/x/sync v0.8.0 | ||||
| golang.org/x/term v0.23.0 | ||||
| golang.org/x/text v0.17.0 | ||||
| google.golang.org/grpc v1.64.1 | ||||
| google.golang.org/protobuf v1.34.2 | ||||
| gopkg.in/h2non/gock.v1 v1.1.2 | ||||
|
|
@@ -99,6 +99,7 @@ require ( | |||
| github.com/hashicorp/go-cleanhttp v0.5.2 // indirect | ||||
| github.com/hashicorp/go-retryablehttp v0.7.7 // indirect | ||||
| github.com/hashicorp/hcl v1.0.0 // indirect | ||||
| github.com/in-toto/in-toto-golang v0.9.0 // indirect | ||||
| github.com/inconshreveable/mousetrap v1.1.0 // indirect | ||||
| github.com/itchyny/gojq v0.12.15 // indirect | ||||
| github.com/itchyny/timefmt-go v0.1.5 // indirect | ||||
|
|
@@ -132,7 +133,7 @@ require ( | |||
| github.com/shibumi/go-pathspec v1.3.0 // indirect | ||||
| github.com/shurcooL/graphql v0.0.0-20230722043721-ed46e5a46466 // indirect | ||||
| github.com/sigstore/rekor v1.3.6 // indirect | ||||
| github.com/sigstore/sigstore v1.8.9 // indirect | ||||
| github.com/sigstore/timestamp-authority v1.2.2 // indirect | ||||
| github.com/sirupsen/logrus v1.9.3 // indirect | ||||
| github.com/sourcegraph/conc v0.3.0 // indirect | ||||
|
|
@@ -156,9 +157,9 @@ require ( | |||
| go.uber.org/multierr v1.11.0 // indirect | ||||
| go.uber.org/zap v1.27.0 // indirect | ||||
| golang.org/x/exp v0.0.0-20240112132812-db7319d0e0e3 // indirect | ||||
| golang.org/x/mod v0.20.0 // indirect | ||||
| golang.org/x/net v0.27.0 // indirect | ||||
| golang.org/x/sys v0.23.0 // indirect | ||||
| google.golang.org/genproto/googleapis/api v0.0.0-20240520151616-dc85e6b867a5 // indirect | ||||
| google.golang.org/genproto/googleapis/rpc v0.0.0-20240520151616-dc85e6b867a5 // indirect | ||||
| gopkg.in/ini.v1 v1.67.0 // indirect | ||||
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -43,31 +43,13 @@ func TestLiveSigstoreVerifier(t *testing.T) { | |
| }) | ||
|
|
||
| t.Run("with missing verification material", func(t *testing.T) { | ||
| _, err := GetLocalAttestations("../test/data/github_provenance_demo-0.0.12-py3-none-any-bundle-missing-verification-material.jsonl") | ||
|
There was a problem hiding this comment. @codysoyland @malancas should these files go into another test file? Glancing at this, since they don't There was a problem hiding this comment. Good point, I will move them in a follow-up PR! |
||
| require.ErrorContains(t, err, "missing verification material") | ||
| }) | ||
|
|
||
| t.Run("with missing verification certificate", func(t *testing.T) { | ||
| _, err := GetLocalAttestations("../test/data/github_provenance_demo-0.0.12-py3-none-any-bundle-missing-cert.jsonl") | ||
malancas marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| require.ErrorContains(t, err, "missing bundle content") | ||
| }) | ||
|
|
||
| t.Run("with GitHub Sigstore artifact", func(t *testing.T) { | ||
|
|
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Is there a dependency causing this to be updated?
Just making to understand when/why this changes as https://go.dev/doc/toolchain always reads like stereo instructions 🤣
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks to @williammartin to pointing out it's
sigstore-gofault here: https://github.com/sigstore/sigstore-go/blob/main/go.mod