Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 33ab0b8

Browse filesBrowse files
phillmvphillmv
committed
Tweaked language a bit, improved error message.
1 parent 321e568 commit 33ab0b8
Copy full SHA for 33ab0b8

2 files changed

+22-16Lines changed: 22 additions & 16 deletions

File tree

Expand file treeCollapse file tree
Open diff view settings
Filter options
Expand file treeCollapse file tree
Open diff view settings
Collapse file

‎pkg/cmd/attestation/verify/policy.go‎

Copy file name to clipboardExpand all lines: pkg/cmd/attestation/verify/policy.go
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -161,7 +161,7 @@ func validateSignerWorkflow(hostname, signerWorkflow string) (string, error) {
161161
// if the provided workflow did not match the expect format
162162
// we move onto creating a signer workflow using the provided host name
163163
if hostname == "" {
164-
return "", errors.New("unknown host")
164+
return "", errors.New("unknown signer workflow host")
165165
}
166166

167167
return fmt.Sprintf("^https://%s/%s", hostname, signerWorkflow), nil
Collapse file

‎pkg/cmd/attestation/verify/verify.go‎

Copy file name to clipboardExpand all lines: pkg/cmd/attestation/verify/verify.go
+21-15Lines changed: 21 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -30,13 +30,16 @@ func NewVerifyCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Command
3030
Verify the integrity and provenance of an artifact using its associated
3131
cryptographically signed attestations.
3232
33-
## Verification
33+
## Understanding Verification
34+
35+
An attestation is a claim (i.e. a provenance statement) made by an actor
36+
(i.e. a GitHub Actions workflow) regarding a subject (i.e. an artifact).
3437
3538
In order to verify an attestation, you must provide an artifact and validate:
3639
* the identity of the actor that produced the attestation
37-
* the expected attestation predicate type
40+
* the expected attestation predicate type (the nature of the claim)
3841
39-
By default, this command enforces the "%[2]s"
42+
By default, this command enforces the %[1]s%[2]s%[1]s
4043
predicate type. To verify other attestation predicate types use the
4144
%[1]s--predicate-type%[1]s flag.
4245
@@ -52,8 +55,11 @@ func NewVerifyCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Command
5255
It is up to you to decide how precisely you want to enforce this identity.
5356
5457
At a minimum, this command requires either:
55-
* the %[1]s--repo%[1]s flag (e.g. --repo github/example), or
56-
* the %[1]s--owner%[1]s flag (e.g. --owner github)
58+
* the %[1]s--owner%[1]s flag (e.g. --owner github), or
59+
* the %[1]s--repo%[1]s flag (e.g. --repo github/example)
60+
61+
The more precisely you specify the identity, the more control you will
62+
have over the security guarantees offered by the verification process.
5763
5864
Ideally, the path of the signer workflow is also validated using the
5965
%[1]s--signer-workflow%[1]s or %[1]s--cert-identity%[1]s flags.
@@ -224,23 +230,23 @@ func NewVerifyCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Command
224230
verifyCmd.Flags().StringVarP(&opts.Repo, "repo", "R", "", "Repository name in the format <owner>/<repo>")
225231
verifyCmd.MarkFlagsMutuallyExclusive("owner", "repo")
226232
verifyCmd.MarkFlagsOneRequired("owner", "repo")
227-
verifyCmd.Flags().StringVarP(&opts.PredicateType, "predicate-type", "", verification.SLSAPredicateV1, "Filter attestations by provided predicate type")
228233
verifyCmd.Flags().BoolVarP(&opts.NoPublicGood, "no-public-good", "", false, "Do not verify attestations signed with Sigstore public good instance")
229234
verifyCmd.Flags().StringVarP(&opts.TrustedRoot, "custom-trusted-root", "", "", "Path to a trusted_root.jsonl file; likely for offline verification")
230235
verifyCmd.Flags().IntVarP(&opts.Limit, "limit", "L", api.DefaultLimit, "Maximum number of attestations to fetch")
231236
cmdutil.AddFormatFlags(verifyCmd, &opts.exporter)
237+
verifyCmd.Flags().StringVarP(&opts.Hostname, "hostname", "", "", "Configure host to use")
232238
// policy enforcement flags
239+
verifyCmd.Flags().StringVarP(&opts.PredicateType, "predicate-type", "", verification.SLSAPredicateV1, "Enforce that verified attestations' predicate type matches the provided value")
233240
verifyCmd.Flags().BoolVarP(&opts.DenySelfHostedRunner, "deny-self-hosted-runners", "", false, "Fail verification for attestations generated on self-hosted runners")
234-
verifyCmd.Flags().StringVarP(&opts.SAN, "cert-identity", "", "", "Enforce that the certificate's subject alternative name matches the provided value exactly")
235-
verifyCmd.Flags().StringVarP(&opts.SANRegex, "cert-identity-regex", "i", "", "Enforce that the certificate's subject alternative name matches the provided regex")
236-
verifyCmd.Flags().StringVarP(&opts.SignerRepo, "signer-repo", "", "", "Repository of reusable workflow that signed attestation in the format <owner>/<repo>")
237-
verifyCmd.Flags().StringVarP(&opts.SignerWorkflow, "signer-workflow", "", "", "Workflow that signed attestation in the format [host/]<owner>/<repo>/<path>/<to>/<workflow>")
241+
verifyCmd.Flags().StringVarP(&opts.SAN, "cert-identity", "", "", "Enforce that the certificate's SubjectAlternativeName matches the provided value exactly")
242+
verifyCmd.Flags().StringVarP(&opts.SANRegex, "cert-identity-regex", "i", "", "Enforce that the certificate's SubjectAlternativeName matches the provided regex")
243+
verifyCmd.Flags().StringVarP(&opts.SignerRepo, "signer-repo", "", "", "Enforce that the workflow that signed the attestation's repository matches the provided value (<owner>/<repo>)")
244+
verifyCmd.Flags().StringVarP(&opts.SignerWorkflow, "signer-workflow", "", "", "Enforce that the workflow that signed the attestation matches the provided value ([host/]<owner>/<repo>/<path>/<to>/<workflow>)")
238245
verifyCmd.MarkFlagsMutuallyExclusive("cert-identity", "cert-identity-regex", "signer-repo", "signer-workflow")
239-
verifyCmd.Flags().StringVarP(&opts.OIDCIssuer, "cert-oidc-issuer", "", verification.GitHubOIDCIssuer, "Issuer of the OIDC token")
240-
verifyCmd.Flags().StringVarP(&opts.Hostname, "hostname", "", "", "Configure host to use")
241-
verifyCmd.Flags().StringVarP(&opts.SignerDigest, "signer-digest", "", "", "Digest associated with the signer workflow")
242-
verifyCmd.Flags().StringVarP(&opts.SourceRef, "source-ref", "", "", "Ref associated with the source workflow")
243-
verifyCmd.Flags().StringVarP(&opts.SourceDigest, "source-digest", "", "", "Digest associated with the source workflow")
246+
verifyCmd.Flags().StringVarP(&opts.OIDCIssuer, "cert-oidc-issuer", "", verification.GitHubOIDCIssuer, "Enforce that the issuer of the OIDC token matches the provided value")
247+
verifyCmd.Flags().StringVarP(&opts.SignerDigest, "signer-digest", "", "", "Enforce that the digest associated with the signer workflow matches the provided value")
248+
verifyCmd.Flags().StringVarP(&opts.SourceRef, "source-ref", "", "", "Enforce that the git ref associated with the source repository matches the provided value")
249+
verifyCmd.Flags().StringVarP(&opts.SourceDigest, "source-digest", "", "", "Enforce that the digest associated with the source repository matches the provided value")
244250

245251
return verifyCmd
246252
}

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.