New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[e2e]: nodejs create main default slsa3 #2224

Closed

ianlewis opened this issue Jun 6, 2023 · 4 comments

Assignees

Labels

area:nodejs e2e type:bug

Member

ianlewis commented Jun 6, 2023

Repo: https://github.com/slsa-framework/example-package/tree/v39.0.3
Run: https://github.com/slsa-framework/example-package/actions/runs/5184401927
Workflow file: https://github.com/slsa-framework/example-package/tree/main/.github/workflows/e2e.nodejs.create.main.default.slsa3.yml
Workflow runs: https://github.com/slsa-framework/example-package/actions/workflows/e2e.nodejs.create.main.default.slsa3.yml
Trigger: create
Branch: v39.0.3
Date: Tue Jun 6 04:00:28 UTC 2023

ianlewis added e2e type:bug area:nodejs labels

Member Author

ianlewis commented Jun 6, 2023

Verifying npm package /tmp/tmp.0LxY0z8fOV: FAILED: invalid ref: v1.7.0-rc.0: not of the form vX.Y.Z

It seems like we should be returning from IsValidBuilderTag here: https://github.com/slsa-framework/slsa-verifier/blob/7b942b86662e47fa343ef1888eb9878b88a3fde0/verifiers/utils/builder.go#L140

Though I'm not sure why we didn't catch this in other e2e tests?

Member Author

ianlewis commented Jun 6, 2023

Though I'm not sure why we didn't catch this in other e2e tests?

Looks like the bug was added in this commit which hasn't been released in any versions so far:
slsa-framework/slsa-verifier@93d3f8c

ianlewis self-assigned this

ianlewis mentioned this issue

fix: builder ID verification for testing slsa-framework/slsa-verifier#635

Merged

Member Author

ianlewis commented Jun 6, 2023

Repo: https://github.com/slsa-framework/example-package/tree/v39.0.4
Run: https://github.com/slsa-framework/example-package/actions/runs/5185175728
Workflow file: https://github.com/slsa-framework/example-package/tree/main/.github/workflows/e2e.nodejs.create.main.default.slsa3.yml
Workflow runs: https://github.com/slsa-framework/example-package/actions/workflows/e2e.nodejs.create.main.default.slsa3.yml
Trigger: create
Branch: v39.0.4
Date: Tue Jun 6 06:12:24 UTC 2023

ianlewis added this to the Node.js builder GA milestone

Member Author

ianlewis commented Jun 6, 2023

Repo: https://github.com/slsa-framework/example-package/tree/v39.0.5
Run: https://github.com/slsa-framework/example-package/actions/runs/5189207219
Workflow file: https://github.com/slsa-framework/example-package/tree/main/.github/workflows/e2e.nodejs.create.main.default.slsa3.yml
Workflow runs: https://github.com/slsa-framework/example-package/actions/workflows/e2e.nodejs.create.main.default.slsa3.yml
Trigger: create
Branch: v39.0.5
Date: Tue Jun 6 13:39:17 UTC 2023

Tests are passing now. Closing this issue.

ianlewis closed this as completed

ianlewis removed this from the Node.js builder GA milestone

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment