Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: Non-compulsory BuilderID for BYOB Builders #674

Merged
merged 42 commits into from
Aug 11, 2023
Merged

feat: Non-compulsory BuilderID for BYOB Builders #674

merged 42 commits into from
Aug 11, 2023

Conversation

enteraga6
Copy link
Contributor

/cc @mihaimaruseac
/cc @laurentsimon

Based off the prefix of the BuilderID within the provenance, if the builder use to build the artifact is one of the BYOB builders of slsa-framework/slsa-github-generator repo, the --builderid flag is not need and is handled automatically. This was done to increase access to users since before the automatic pickup of the builder-id would get the delegator.

Test cases that cover verifyProvenance will need to be complete after the v1.8.0 release of slsa-framework/slsa-github-generator.

The main structure that is changed is the ExpectedBuilderPath is hardcoded now to slsa-framework builders within /cli/slsa-verifier/verify/verify_artifact.go . This can later be changed now if needed to be an input like the other fields of provenanceOpts populated during verify_artifact.go. The added function within provenance.go, verifyBuilderIDPath is called during verifyProvenance to check this path within provenanceOpts. Upon failure of this function, expected and received BuilderID's are also outputted.

closes #659
makes use of discussion on closed pr #673

enteraga6 added 3 commits July 31, 2023 22:19
@enteraga6
Squash commits from byob patch
646a3ad 
Signed-off-by: Noah Elzner <elzner@google.com>
@enteraga6
improve error message and comments
fa2148a 
Signed-off-by: Noah Elzner <elzner@google.com>
@enteraga6
Improvements
ebf4ffc 
Signed-off-by: Noah Elzner <elzner@google.com>
laurentsimon
laurentsimon reviewed Aug 1, 2023
View reviewed changes
options/options.go Outdated Show resolved Hide resolved
cli/slsa-verifier/verify/verify_artifact.go Outdated Show resolved Hide resolved
verifiers/internal/gha/provenance.go Outdated Show resolved Hide resolved
verifiers/internal/gha/provenance.go Outdated Show resolved Hide resolved
verifiers/internal/gha/provenance.go Outdated Show resolved Hide resolved
verifiers/internal/gha/provenance.go Outdated Show resolved Hide resolved
verifiers/internal/gha/provenance.go Outdated Show resolved Hide resolved
@enteraga6
Fixed logic and comments from review feedback
67c29de 
Signed-off-by: Noah Elzner <elzner@google.com>
@enteraga6 enteraga6 changed the title [feat] Non-compulsory BuilderID for BYOB Builders feat: Non-compulsory BuilderID for BYOB Builders Aug 1, 2023
@enteraga6
changed scope of comment
38ce418 
Signed-off-by: Noah Elzner <elzner@google.com>
@enteraga6
Improved function description
03b26a6 
Signed-off-by: Noah Elzner <elzner@google.com>
@enteraga6
condense comment
1095060 
Signed-off-by: Noah Elzner <elzner@google.com>
@enteraga6
space nit
acac0b8 
Signed-off-by: Noah Elzner <elzner@google.com>
laurentsimon
laurentsimon reviewed Aug 1, 2023
View reviewed changes
verifiers/internal/gha/builder.go Outdated Show resolved Hide resolved
verifiers/internal/gha/provenance.go Outdated Show resolved Hide resolved
verifiers/internal/gha/provenance.go Outdated Show resolved Hide resolved
verifiers/internal/gha/provenance.go Outdated Show resolved Hide resolved
verifiers/internal/gha/provenance.go Outdated Show resolved Hide resolved
@enteraga6
nit: end sentence with period
fd17c7d 
Signed-off-by: Noah Elzner <elzner@google.com>
@enteraga6
Fix function and improve comment on conditional logic
eb104b8 
Signed-off-by: Noah Elzner <elzner@google.com>
@enteraga6
Use builder.go vars for trusted builder string
c974544 
Signed-off-by: Noah Elzner <elzner@google.com>
@enteraga6
comment fix
9318f88 
Signed-off-by: Noah Elzner <elzner@google.com>
@enteraga6
moved comment to caller for better understanding
ae63dee 
Signed-off-by: Noah Elzner <elzner@google.com>
ianlewis
ianlewis reviewed Aug 2, 2023
View reviewed changes
options/options.go Outdated Show resolved Hide resolved
options/options.go Outdated Show resolved Hide resolved
verifiers/internal/gha/provenance.go Outdated Show resolved Hide resolved
verifiers/internal/gha/provenance.go Outdated Show resolved Hide resolved
verifiers/internal/gha/provenance.go Outdated Show resolved Hide resolved
verifiers/internal/gha/provenance.go Outdated Show resolved Hide resolved
verifiers/internal/gha/provenance.go Outdated Show resolved Hide resolved
verifiers/internal/gha/builder.go Outdated Show resolved Hide resolved
verifiers/internal/gha/provenance.go Outdated Show resolved Hide resolved
enteraga6 and others added 2 commits August 2, 2023 10:41
@enteraga6
nit: start doc comments with the name of the function as if it was pu…
f00ae0d 
…blic.

Co-authored-by: Ian Lewis <ianlewis@google.com>
Signed-off-by: Noah Elzner <78953604+enteraga6@users.noreply.github.com>
@enteraga6
nit: builderIDPath --> builderIDPathPrefix
42d475e 
Signed-off-by: Noah Elzner <78953604+enteraga6@users.noreply.github.com>
@enteraga6 enteraga6 requested a review from kpk47 as a code owner August 2, 2023 17:46
enteraga6 and others added 4 commits August 2, 2023 10:50
@enteraga6
nit: pass in only expectedID instead of entire builderOpts
90aa32a 
Signed-off-by: Noah Elzner <78953604+enteraga6@users.noreply.github.com>
@enteraga6
nit: only pass in builderOpts.ExpectedID
2301ade 
Signed-off-by: Noah Elzner <78953604+enteraga6@users.noreply.github.com>
@enteraga6
nit: fix off comment
996892d 
Signed-off-by: Noah Elzner <78953604+enteraga6@users.noreply.github.com>
@enteraga6
nit: inputted
217f027 
Co-authored-by: Ian Lewis <ianlewis@google.com>
Signed-off-by: Noah Elzner <78953604+enteraga6@users.noreply.github.com>
@enteraga6
trusted builder test case added
d03a11e 
Signed-off-by: Noah Elzner <elzner@google.com>
@enteraga6
Added test case for untrusted builder
0118fea 
Signed-off-by: Noah Elzner <elzner@google.com>
ianlewis
ianlewis reviewed Aug 7, 2023
View reviewed changes
verifiers/internal/gha/builder_test.go Outdated Show resolved Hide resolved
verifiers/internal/gha/builder_test.go Outdated Show resolved Hide resolved
verifiers/internal/gha/provenance.go Outdated Show resolved Hide resolved
verifiers/internal/gha/provenance.go Outdated Show resolved Hide resolved
verifiers/internal/gha/provenance_test.go Outdated Show resolved Hide resolved
verifiers/internal/gha/provenance_test.go Outdated Show resolved Hide resolved
enteraga6 and others added 9 commits August 7, 2023 23:36
@enteraga6
lint
4209ffe 
Signed-off-by: Noah Elzner <elzner@google.com>
@enteraga6
explicity set id to nil
6cd1257 
Co-authored-by: Ian Lewis <ianlewis@google.com>
Signed-off-by: Noah Elzner <78953604+enteraga6@users.noreply.github.com>
@enteraga6
set id to nil explicitly
4fcc8b1 
Co-authored-by: Ian Lewis <ianlewis@google.com>
Signed-off-by: Noah Elzner <78953604+enteraga6@users.noreply.github.com>
@enteraga6
nit: capitalization
1a17e0c 
Co-authored-by: Ian Lewis <ianlewis@google.com>
Signed-off-by: Noah Elzner <78953604+enteraga6@users.noreply.github.com>
@enteraga6
nit: remove empty lines
c98f650 
Co-authored-by: Ian Lewis <ianlewis@google.com>
Signed-off-by: Noah Elzner <78953604+enteraga6@users.noreply.github.com>
@enteraga6
nit: remove empty lines
ca9e7ae 
Co-authored-by: Ian Lewis <ianlewis@google.com>
Signed-off-by: Noah Elzner <78953604+enteraga6@users.noreply.github.com>
@enteraga6
remove confusing comment
032b098 
Signed-off-by: Noah Elzner <elzner@google.com>
@enteraga6
Merge remote-tracking branch 'origin/byob-builder-feat' into byob-bui…
e999450 
…lder-feat
@enteraga6
nit: remove empty space
1ff4e9b 
Signed-off-by: Noah Elzner <elzner@google.com>
laurentsimon
laurentsimon reviewed Aug 8, 2023
View reviewed changes
Copy link
Contributor

@laurentsimon laurentsimon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Let's just use files to store the large content of the tests

verifiers/internal/gha/provenance_test.go Outdated Show resolved Hide resolved
@enteraga6
Restructure Tests
e6d22d4 
Signed-off-by: Noah Elzner <elzner@google.com>
@enteraga6
rename for clarity
b6e36b7 
Signed-off-by: Noah Elzner <elzner@google.com>
laurentsimon
laurentsimon approved these changes Aug 11, 2023
View reviewed changes
Copy link
Contributor

@laurentsimon laurentsimon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @enteraga6 !

verifiers/internal/gha/testdata/bazel-trusted-dsseEnvelope.build.slsa Show resolved Hide resolved
verifiers/internal/gha/testdata/bazel-untrusted-dsseEnvelope.sigstore Show resolved Hide resolved
verifiers/internal/gha/provenance_test.go Outdated Show resolved Hide resolved
enteraga6 and others added 3 commits August 11, 2023 01:52
@enteraga6
use t.Errorf
3ba89d9 
Signed-off-by: Noah Elzner <elzner@google.com>
@enteraga6
Go Lint
7ada2ad 
Signed-off-by: Noah Elzner <elzner@google.com>
@laurentsimon
Merge branch 'main' into byob-builder-feat
a630e1f
@laurentsimon laurentsimon enabled auto-merge (squash) August 11, 2023 02:00
@laurentsimon laurentsimon disabled auto-merge August 11, 2023 02:02
@laurentsimon laurentsimon enabled auto-merge (squash) August 11, 2023 14:11
@laurentsimon laurentsimon merged commit 8bcf1f0 into slsa-framework:main Aug 11, 2023
@p-linnane p-linnane mentioned this pull request Aug 25, 2023
Merged
laurentsimon referenced this pull request Dec 1, 2023
@renovate-bot @laurentsimon
chore(deps): update github-actions (#695)
b72da83 
[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [actions/checkout](https://github.com/actions/checkout) | action |
minor | `v3.5.3` -> `v3.6.0` |
|
[actions/dependency-review-action](https://github.com/actions/dependency-review-action)
| action | minor | `v3.0.7` -> `v3.1.0` |
| [actions/setup-node](https://github.com/actions/setup-node) | action
| patch | `v3.8.0` -> `v3.8.1` |
|
[actions/upload-artifact](https://github.com/actions/upload-artifact)
| action | patch | `v3.1.2` -> `v3.1.3` |
| [github/codeql-action](https://github.com/github/codeql-action) |
action | minor | `v2.21.4` -> `v2.22.1` |
| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) |
action | minor | `v2.2.0` -> `v2.3.0` |
|
[slsa-framework/slsa-github-generator](https://github.com/slsa-framework/slsa-github-generator)
| action | minor | `v1.8.0` -> `v1.9.0` |
|
[slsa-framework/slsa-verifier](https://github.com/slsa-framework/slsa-verifier)
| action | minor | `v2.3.0` -> `v2.4.0` |

---

### ⚠ Dependency Lookup Warnings ⚠

Warnings were logged while processing this repo. Please check the
Dependency Dashboard for more information.

---

### Release Notes

<details>
<summary>actions/checkout (actions/checkout)</summary>

###
[`v3.6.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v360)

[Compare
Source](https://github.com/actions/checkout/compare/v3.5.3...v3.6.0)

- [Fix: Mark test scripts with Bash'isms to be run via
Bash](https://github.com/actions/checkout/pull/1377)
- [Add option to fetch tags even if fetch-depth >
0](https://github.com/actions/checkout/pull/579)

</details>

<details>
<summary>actions/dependency-review-action
(actions/dependency-review-action)</summary>

###
[`v3.1.0`](https://github.com/actions/dependency-review-action/releases/tag/v3.1.0):
3.1.0

[Compare
Source](https://github.com/actions/dependency-review-action/compare/v3.0.8...v3.1.0)

#### What's New

Added support for dependencies submitted through the [dependency
submission
API](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review#best-practices-for-using-the-dependency-review-api-and-the-dependency-submission-api-together).
This includes two new configuration parameters:
`retry-on-snapshot-warnings` and `retry-on-snapshot-warnings-timeout`.

#### What's Changed

- Fix(docs): Correct action input name by
[@&#8203;oerd](https://github.com/oerd) in
[https://github.com/actions/dependency-review-action/pull/551](https://github.com/actions/dependency-review-action/pull/551)

#### New Contributors

- [@&#8203;oerd](https://github.com/oerd) made their first
contribution in
[https://github.com/actions/dependency-review-action/pull/551](https://github.com/actions/dependency-review-action/pull/551)

**Full Changelog**:
actions/dependency-review-action@v3...v3.1.0

###
[`v3.0.8`](https://github.com/actions/dependency-review-action/releases/tag/v3.0.8):
3.0.8

[Compare
Source](https://github.com/actions/dependency-review-action/compare/v3.0.7...v3.0.8)

#### What's Changed

Added `on-failure` option to `comment-summary-in-pr` setting by
[@&#8203;sgmurphy](https://github.com/sgmurphy) in
[https://github.com/actions/dependency-review-action/pull/540](https://github.com/actions/dependency-review-action/pull/540)

Previous configuration files using `true`/`false` for
`comment-summary-in-pr` will be mapped automatically to the new values,
but we encourage you to update to `always`/`on-failure`/`never`.

#### New Contributors

- [@&#8203;sgmurphy](https://github.com/sgmurphy) made their first
contribution in
[https://github.com/actions/dependency-review-action/pull/540](https://github.com/actions/dependency-review-action/pull/540)

**Full Changelog**:
actions/dependency-review-action@v3...v3.0.8

</details>

<details>
<summary>actions/setup-node (actions/setup-node)</summary>

###
[`v3.8.1`](https://github.com/actions/setup-node/releases/tag/v3.8.1)

[Compare
Source](https://github.com/actions/setup-node/compare/v3.8.0...v3.8.1)

#### What's Changed

In scope of this release, the filter was removed within the cache-save
step by [@&#8203;dmitry-shibanov](https://github.com/dmitry-shibanov)
in
[https://github.com/actions/setup-node/pull/831](https://github.com/actions/setup-node/pull/831).
It is filtered and checked in the toolkit/cache library.

**Full Changelog**:
actions/setup-node@v3...v3.8.1

</details>

<details>
<summary>actions/upload-artifact (actions/upload-artifact)</summary>

###
[`v3.1.3`](https://github.com/actions/upload-artifact/releases/tag/v3.1.3)

[Compare
Source](https://github.com/actions/upload-artifact/compare/v3.1.2...v3.1.3)

#### What's Changed

- chore(github): remove trailing whitespaces by
[@&#8203;ljmf00](https://github.com/ljmf00) in
[https://github.com/actions/upload-artifact/pull/313](https://github.com/actions/upload-artifact/pull/313)
- Bump [@&#8203;actions/artifact](https://github.com/actions/artifact)
version to v1.1.2 by
[@&#8203;bethanyj28](https://github.com/bethanyj28) in
[https://github.com/actions/upload-artifact/pull/436](https://github.com/actions/upload-artifact/pull/436)

**Full Changelog**:
actions/upload-artifact@v3...v3.1.3

</details>

<details>
<summary>github/codeql-action (github/codeql-action)</summary>

###
[`v2.22.1`](https://github.com/github/codeql-action/compare/v2.22.0...v2.22.1)

[Compare
Source](https://github.com/github/codeql-action/compare/v2.22.0...v2.22.1)

###
[`v2.22.0`](https://github.com/github/codeql-action/compare/v2.21.9...v2.22.0)

[Compare
Source](https://github.com/github/codeql-action/compare/v2.21.9...v2.22.0)

###
[`v2.21.9`](https://github.com/github/codeql-action/compare/v2.21.8...v2.21.9)

[Compare
Source](https://github.com/github/codeql-action/compare/v2.21.8...v2.21.9)

###
[`v2.21.8`](https://github.com/github/codeql-action/compare/v2.21.7...v2.21.8)

[Compare
Source](https://github.com/github/codeql-action/compare/v2.21.7...v2.21.8)

###
[`v2.21.7`](https://github.com/github/codeql-action/compare/v2.21.6...v2.21.7)

[Compare
Source](https://github.com/github/codeql-action/compare/v2.21.6...v2.21.7)

###
[`v2.21.6`](https://github.com/github/codeql-action/compare/v2.21.5...v2.21.6)

[Compare
Source](https://github.com/github/codeql-action/compare/v2.21.5...v2.21.6)

###
[`v2.21.5`](https://github.com/github/codeql-action/compare/v2.21.4...v2.21.5)

[Compare
Source](https://github.com/github/codeql-action/compare/v2.21.4...v2.21.5)

</details>

<details>
<summary>ossf/scorecard-action (ossf/scorecard-action)</summary>

###
[`v2.3.0`](https://github.com/ossf/scorecard-action/releases/tag/v2.3.0)

[Compare
Source](https://github.com/ossf/scorecard-action/compare/v2.2.0...v2.3.0)

#### What's Changed

- 🌱 Bump github.com/ossf/scorecard/v4 from v4.11.0 to v4.13.0
by [@&#8203;spencerschrock](https://github.com/spencerschrock) in
[https://github.com/ossf/scorecard-action/pull/1270](https://github.com/ossf/scorecard-action/pull/1270)
- For a full changelist of what this includes, see the
[v4.12.0](https://github.com/ossf/scorecard/releases/tag/v4.12.0) and
[v4.13.0](https://github.com/ossf/scorecard/releases/tag/v4.13.0)
release notes
- ✨ Send rekor tlog index to webapp when publishing results by
[@&#8203;spencerschrock](https://github.com/spencerschrock) in
[https://github.com/ossf/scorecard-action/pull/1169](https://github.com/ossf/scorecard-action/pull/1169)
- 🐛 Prevent url clipping for GHES instances by
[@&#8203;rajbos](https://github.com/rajbos) in
[https://github.com/ossf/scorecard-action/pull/1225](https://github.com/ossf/scorecard-action/pull/1225)

##### Documentation

- 📖 Update access rights needed to see the results in code scanning
by [@&#8203;rajbos](https://github.com/rajbos) in
[https://github.com/ossf/scorecard-action/pull/1229](https://github.com/ossf/scorecard-action/pull/1229)
- 📖 Add package comments. by
[@&#8203;spencerschrock](https://github.com/spencerschrock) in
[https://github.com/ossf/scorecard-action/pull/1221](https://github.com/ossf/scorecard-action/pull/1221)
- 📖 Add SECURITY.md file by
[@&#8203;david-a-wheeler](https://github.com/david-a-wheeler) in
[https://github.com/ossf/scorecard-action/pull/1250](https://github.com/ossf/scorecard-action/pull/1250)
- 📖 Fix typo in token input docs by
[@&#8203;aabouzaid](https://github.com/aabouzaid) in
[https://github.com/ossf/scorecard-action/pull/1258](https://github.com/ossf/scorecard-action/pull/1258)

#### New Contributors

- [@&#8203;david-a-wheeler](https://github.com/david-a-wheeler) made
their first contribution in
[https://github.com/ossf/scorecard-action/pull/1250](https://github.com/ossf/scorecard-action/pull/1250)
- [@&#8203;aabouzaid](https://github.com/aabouzaid) made their first
contribution in
[https://github.com/ossf/scorecard-action/pull/1258](https://github.com/ossf/scorecard-action/pull/1258)

**Full Changelog**:
ossf/scorecard-action@v2.2.0...v2.3.0

</details>

<details>
<summary>slsa-framework/slsa-github-generator
(slsa-framework/slsa-github-generator)</summary>

###
[`v1.9.0`](https://github.com/slsa-framework/slsa-github-generator/blob/HEAD/CHANGELOG.md#v190)

[Compare
Source](https://github.com/slsa-framework/slsa-github-generator/compare/v1.8.0...v1.9.0)

Release \[v1.9.0] includes bug fixes and new features.

See the [full change
list](https://github.com/slsa-framework/slsa-github-generator/compare/v1.8.0...v1.9.0).

##### v1.9.0: BYOB framework (beta)

- **New**: A [new
framework](https://github.com/slsa-framework/slsa-github-generator/blob/main/BYOB.md)
to turn GitHub Actions into SLSA compliant builders.

##### v1.9.0: Maven builder (beta)

- **New**: A [Maven
builder](https://github.com/slsa-framework/slsa-github-generator/tree/main/internal/builders/maven)
to build Java projects and publish to Maven central.

##### v1.9.0: Gradle builder (beta)

- **New**: A [Gradle
builder](https://github.com/slsa-framework/slsa-github-generator/tree/main/internal/builders/gradle)
to build Java projects and publish to Maven central.

##### v1.9.0: JReleaser builder

- **New**: A [JReleaser
builder](https://github.com/jreleaser/release-action/tree/v1.0.0-java)
that wraps the official [JReleaser
Action](https://github.com/jreleaser/release-action/tree/v1.0.0-java).

</details>

<details>
<summary>slsa-framework/slsa-verifier
(slsa-framework/slsa-verifier)</summary>

###
[`v2.4.0`](https://github.com/slsa-framework/slsa-verifier/releases/tag/v2.4.0)

[Compare
Source](https://github.com/slsa-framework/slsa-verifier/compare/v2.3.0...v2.4.0)

#### Summary

Support for BYOB-based builders released in
https://github.com/slsa-framework/slsa-github-generator/releases/tag/v1.9.0

#### What's Changed

- chore: Update SHA256SUM.md for v2.3.0 by
[@&#8203;ianlewis](https://github.com/ianlewis) in
[https://github.com/slsa-framework/slsa-verifier/pull/592](https://github.com/slsa-framework/slsa-verifier/pull/592)
- docs: Make npm package version and name non-optional by
[@&#8203;laurentsimon](https://github.com/laurentsimon) in
[https://github.com/slsa-framework/slsa-verifier/pull/591](https://github.com/slsa-framework/slsa-verifier/pull/591)
- docs: npm provenance verification from GitHub runner by
[@&#8203;laurentsimon](https://github.com/laurentsimon) in
[https://github.com/slsa-framework/slsa-verifier/pull/595](https://github.com/slsa-framework/slsa-verifier/pull/595)
- chore(deps): update dependency
[@&#8203;types/node](https://github.com/types/node) to v18.16.9 by
[@&#8203;renovate-bot](https://github.com/renovate-bot) in
[https://github.com/slsa-framework/slsa-verifier/pull/596](https://github.com/slsa-framework/slsa-verifier/pull/596)
- chore(deps): update github-actions by
[@&#8203;renovate-bot](https://github.com/renovate-bot) in
[https://github.com/slsa-framework/slsa-verifier/pull/597](https://github.com/slsa-framework/slsa-verifier/pull/597)
- chore(deps): update dependency jasmine to v5 by
[@&#8203;renovate-bot](https://github.com/renovate-bot) in
[https://github.com/slsa-framework/slsa-verifier/pull/598](https://github.com/slsa-framework/slsa-verifier/pull/598)
- feat: BYOB verification support by
[@&#8203;laurentsimon](https://github.com/laurentsimon) in
[https://github.com/slsa-framework/slsa-verifier/pull/604](https://github.com/slsa-framework/slsa-verifier/pull/604)
- feat: Support for v1.0 verification in BYOB by
[@&#8203;laurentsimon](https://github.com/laurentsimon) in
[https://github.com/slsa-framework/slsa-verifier/pull/609](https://github.com/slsa-framework/slsa-verifier/pull/609)
- feat: Use env variable to retrieve trigger workflow by
[@&#8203;laurentsimon](https://github.com/laurentsimon) in
[https://github.com/slsa-framework/slsa-verifier/pull/615](https://github.com/slsa-framework/slsa-verifier/pull/615)
- test: Add test data for v1.6.0 by
[@&#8203;ianlewis](https://github.com/ianlewis) in
[https://github.com/slsa-framework/slsa-verifier/pull/612](https://github.com/slsa-framework/slsa-verifier/pull/612)
- fix: Verify the TRW tag is a semver tag by
[@&#8203;laurentsimon](https://github.com/laurentsimon) in
[https://github.com/slsa-framework/slsa-verifier/pull/619](https://github.com/slsa-framework/slsa-verifier/pull/619)
- chore: Don't be verbose with tests locally by
[@&#8203;ianlewis](https://github.com/ianlewis) in
[https://github.com/slsa-framework/slsa-verifier/pull/620](https://github.com/slsa-framework/slsa-verifier/pull/620)
- fix: use ExternalParameters\["source"] for the Source URI for SLSA
v1.0 provenance by [@&#8203;asraa](https://github.com/asraa) in
[https://github.com/slsa-framework/slsa-verifier/pull/621](https://github.com/slsa-framework/slsa-verifier/pull/621)
- test: re-generate container-based tests by
[@&#8203;asraa](https://github.com/asraa) in
[https://github.com/slsa-framework/slsa-verifier/pull/627](https://github.com/slsa-framework/slsa-verifier/pull/627)
- fix: revert to using resolvedDepdendencies for source verification by
[@&#8203;asraa](https://github.com/asraa) in
[https://github.com/slsa-framework/slsa-verifier/pull/629](https://github.com/slsa-framework/slsa-verifier/pull/629)
- refactor: Provenance tests by
[@&#8203;ianlewis](https://github.com/ianlewis) in
[https://github.com/slsa-framework/slsa-verifier/pull/628](https://github.com/slsa-framework/slsa-verifier/pull/628)
- fix(deps): update module github.com/sigstore/rekor to v1.2.0
\[security] by [@&#8203;renovate-bot](https://github.com/renovate-bot)
in
[https://github.com/slsa-framework/slsa-verifier/pull/622](https://github.com/slsa-framework/slsa-verifier/pull/622)
- fix: only allow hashes of 256 bits or more by
[@&#8203;laurentsimon](https://github.com/laurentsimon) in
[https://github.com/slsa-framework/slsa-verifier/pull/633](https://github.com/slsa-framework/slsa-verifier/pull/633)
- fix: builder ID verification for testing by
[@&#8203;ianlewis](https://github.com/ianlewis) in
[https://github.com/slsa-framework/slsa-verifier/pull/635](https://github.com/slsa-framework/slsa-verifier/pull/635)
- feat: remove experimental on Sigstore bundle and v1.0 SLSA provenance
format by [@&#8203;asraa](https://github.com/asraa) in
[https://github.com/slsa-framework/slsa-verifier/pull/634](https://github.com/slsa-framework/slsa-verifier/pull/634)
- chore: update toc in README.md by
[@&#8203;asraa](https://github.com/asraa) in
[https://github.com/slsa-framework/slsa-verifier/pull/636](https://github.com/slsa-framework/slsa-verifier/pull/636)
- fix: allow workflow_dispatch to trigger release.yml by
[@&#8203;ianlewis](https://github.com/ianlewis) in
[https://github.com/slsa-framework/slsa-verifier/pull/637](https://github.com/slsa-framework/slsa-verifier/pull/637)
- test: add tests for v1.7.0 builders by
[@&#8203;asraa](https://github.com/asraa) in
[https://github.com/slsa-framework/slsa-verifier/pull/638](https://github.com/slsa-framework/slsa-verifier/pull/638)
- chore(deps): update github-actions by
[@&#8203;renovate-bot](https://github.com/renovate-bot) in
[https://github.com/slsa-framework/slsa-verifier/pull/607](https://github.com/slsa-framework/slsa-verifier/pull/607)
- chore(deps): update gcr.io/distroless/base:nonroot docker digest to
[`c623859`](https://github.com/slsa-framework/slsa-verifier/commit/c623859)
by [@&#8203;renovate-bot](https://github.com/renovate-bot) in
[https://github.com/slsa-framework/slsa-verifier/pull/567](https://github.com/slsa-framework/slsa-verifier/pull/567)
- fix(deps): update github.com/sigstore/protobuf-specs digest to
[`5ef5406`](https://github.com/slsa-framework/slsa-verifier/commit/5ef5406)
by [@&#8203;renovate-bot](https://github.com/renovate-bot) in
[https://github.com/slsa-framework/slsa-verifier/pull/606](https://github.com/slsa-framework/slsa-verifier/pull/606)
- chore(deps): update npm dev by
[@&#8203;renovate-bot](https://github.com/renovate-bot) in
[https://github.com/slsa-framework/slsa-verifier/pull/608](https://github.com/slsa-framework/slsa-verifier/pull/608)
- chore(deps): update golang:1.19 docker digest to
[`83f9f84`](https://github.com/slsa-framework/slsa-verifier/commit/83f9f84)
by [@&#8203;renovate-bot](https://github.com/renovate-bot) in
[https://github.com/slsa-framework/slsa-verifier/pull/583](https://github.com/slsa-framework/slsa-verifier/pull/583)
- feat: Verify provenance by build type by
[@&#8203;ianlewis](https://github.com/ianlewis) in
[https://github.com/slsa-framework/slsa-verifier/pull/632](https://github.com/slsa-framework/slsa-verifier/pull/632)
- refactor: Use Go 1.20 by
[@&#8203;ianlewis](https://github.com/ianlewis) in
[https://github.com/slsa-framework/slsa-verifier/pull/643](https://github.com/slsa-framework/slsa-verifier/pull/643)
- test: Add more ProvenanceFromEnvelope tests by
[@&#8203;ianlewis](https://github.com/ianlewis) in
[https://github.com/slsa-framework/slsa-verifier/pull/640](https://github.com/slsa-framework/slsa-verifier/pull/640)
- fix: pre-submit: e2e-cli.sh artifact download by
[@&#8203;ianlewis](https://github.com/ianlewis) in
[https://github.com/slsa-framework/slsa-verifier/pull/646](https://github.com/slsa-framework/slsa-verifier/pull/646)
- refactor: Add more git utils by
[@&#8203;ianlewis](https://github.com/ianlewis) in
[https://github.com/slsa-framework/slsa-verifier/pull/645](https://github.com/slsa-framework/slsa-verifier/pull/645)
- refactor: Use full builder id by
[@&#8203;ianlewis](https://github.com/ianlewis) in
[https://github.com/slsa-framework/slsa-verifier/pull/648](https://github.com/slsa-framework/slsa-verifier/pull/648)
- feat: Use tags `vX.Y.Z-<language>` for JReleaser builders by
[@&#8203;laurentsimon](https://github.com/laurentsimon) in
[https://github.com/slsa-framework/slsa-verifier/pull/644](https://github.com/slsa-framework/slsa-verifier/pull/644)
- chore(deps): update github-actions by
[@&#8203;renovate-bot](https://github.com/renovate-bot) in
[https://github.com/slsa-framework/slsa-verifier/pull/651](https://github.com/slsa-framework/slsa-verifier/pull/651)
- feat: move maven-plugin from slsa-github-generator by
[@&#8203;AdamKorcz](https://github.com/AdamKorcz) in
[https://github.com/slsa-framework/slsa-verifier/pull/664](https://github.com/slsa-framework/slsa-verifier/pull/664)
- docs: Fix maven-plugin README by
[@&#8203;laurentsimon](https://github.com/laurentsimon) in
[https://github.com/slsa-framework/slsa-verifier/pull/671](https://github.com/slsa-framework/slsa-verifier/pull/671)
- feat: Verification for when sha1 is specified in BYOB TRW by
[@&#8203;ianlewis](https://github.com/ianlewis) in
[https://github.com/slsa-framework/slsa-verifier/pull/641](https://github.com/slsa-framework/slsa-verifier/pull/641)
- docs: Add example for maven verification plugin by
[@&#8203;laurentsimon](https://github.com/laurentsimon) in
[https://github.com/slsa-framework/slsa-verifier/pull/676](https://github.com/slsa-framework/slsa-verifier/pull/676)
- chore: Add Kris to codeowners by
[@&#8203;laurentsimon](https://github.com/laurentsimon) in
[https://github.com/slsa-framework/slsa-verifier/pull/678](https://github.com/slsa-framework/slsa-verifier/pull/678)
- feat: Print byob builder by
[@&#8203;laurentsimon](https://github.com/laurentsimon) in
[https://github.com/slsa-framework/slsa-verifier/pull/677](https://github.com/slsa-framework/slsa-verifier/pull/677)
- test: Add test data for v1.8.0 by
[@&#8203;ianlewis](https://github.com/ianlewis) in
[https://github.com/slsa-framework/slsa-verifier/pull/681](https://github.com/slsa-framework/slsa-verifier/pull/681)
- chore(deps): update github-actions by
[@&#8203;renovate-bot](https://github.com/renovate-bot) in
[https://github.com/slsa-framework/slsa-verifier/pull/666](https://github.com/slsa-framework/slsa-verifier/pull/666)
- feat: Non-compulsory BuilderID for BYOB Builders by
[@&#8203;enteraga6](https://github.com/enteraga6) in
[https://github.com/slsa-framework/slsa-verifier/pull/674](https://github.com/slsa-framework/slsa-verifier/pull/674)
- chore(deps): update golang docker tag to v1.21 by
[@&#8203;renovate-bot](https://github.com/renovate-bot) in
[https://github.com/slsa-framework/slsa-verifier/pull/687](https://github.com/slsa-framework/slsa-verifier/pull/687)
- chore(deps): update github-actions by
[@&#8203;renovate-bot](https://github.com/renovate-bot) in
[https://github.com/slsa-framework/slsa-verifier/pull/686](https://github.com/slsa-framework/slsa-verifier/pull/686)
- feat: GCB refactor for v1.0 support by
[@&#8203;laurentsimon](https://github.com/laurentsimon) in
[https://github.com/slsa-framework/slsa-verifier/pull/682](https://github.com/slsa-framework/slsa-verifier/pull/682)
- feat: Allow byob builders ref at main for e2e tests by
[@&#8203;laurentsimon](https://github.com/laurentsimon) in
[https://github.com/slsa-framework/slsa-verifier/pull/689](https://github.com/slsa-framework/slsa-verifier/pull/689)
- feat: Update doc and code for Maven plugin by
[@&#8203;laurentsimon](https://github.com/laurentsimon) in
[https://github.com/slsa-framework/slsa-verifier/pull/680](https://github.com/slsa-framework/slsa-verifier/pull/680)
- feat: gcb v1.0 support by
[@&#8203;laurentsimon](https://github.com/laurentsimon) in
[https://github.com/slsa-framework/slsa-verifier/pull/691](https://github.com/slsa-framework/slsa-verifier/pull/691)
- feat: v1.9.0 regression tests by
[@&#8203;laurentsimon](https://github.com/laurentsimon) in
[https://github.com/slsa-framework/slsa-verifier/pull/696](https://github.com/slsa-framework/slsa-verifier/pull/696)
- fix: release failure by
[@&#8203;laurentsimon](https://github.com/laurentsimon) in
[https://github.com/slsa-framework/slsa-verifier/pull/697](https://github.com/slsa-framework/slsa-verifier/pull/697)

#### New Contributors

- [@&#8203;AdamKorcz](https://github.com/AdamKorcz) made their first
contribution in
[https://github.com/slsa-framework/slsa-verifier/pull/664](https://github.com/slsa-framework/slsa-verifier/pull/664)
- [@&#8203;enteraga6](https://github.com/enteraga6) made their first
contribution in
[https://github.com/slsa-framework/slsa-verifier/pull/674](https://github.com/slsa-framework/slsa-verifier/pull/674)

**Full Changelog**:
v2.3.0...v2.4.0

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "every weekend" (UTC), Automerge - At
any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config help](https://github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://developer.mend.io/github/slsa-framework/slsa-verifier).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNi40My4yIiwidXBkYXRlZEluVmVyIjoiMzcuOC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiJ9-->

Signed-off-by: Mend Renovate <bot@renovateapp.com>
Co-authored-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>
ramonpetgrave64 referenced this pull request in ramonpetgrave64/slsa-verifier Apr 10, 2024
@renovate-bot @laurentsimon @ramonpetgrave64
chore(deps): update github-actions (slsa-framework#695)
9481f89 
[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [actions/checkout](https://github.com/actions/checkout) | action |
minor | `v3.5.3` -> `v3.6.0` |
|
[actions/dependency-review-action](https://github.com/actions/dependency-review-action)
| action | minor | `v3.0.7` -> `v3.1.0` |
| [actions/setup-node](https://github.com/actions/setup-node) | action
| patch | `v3.8.0` -> `v3.8.1` |
|
[actions/upload-artifact](https://github.com/actions/upload-artifact)
| action | patch | `v3.1.2` -> `v3.1.3` |
| [github/codeql-action](https://github.com/github/codeql-action) |
action | minor | `v2.21.4` -> `v2.22.1` |
| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) |
action | minor | `v2.2.0` -> `v2.3.0` |
|
[slsa-framework/slsa-github-generator](https://github.com/slsa-framework/slsa-github-generator)
| action | minor | `v1.8.0` -> `v1.9.0` |
|
[slsa-framework/slsa-verifier](https://github.com/slsa-framework/slsa-verifier)
| action | minor | `v2.3.0` -> `v2.4.0` |

---

### ⚠ Dependency Lookup Warnings ⚠

Warnings were logged while processing this repo. Please check the
Dependency Dashboard for more information.

---

### Release Notes

<details>
<summary>actions/checkout (actions/checkout)</summary>

###
[`v3.6.0`](https://github.com/actions/checkout/blob/HEAD/CHANGELOG.md#v360)

[Compare
Source](https://github.com/actions/checkout/compare/v3.5.3...v3.6.0)

- [Fix: Mark test scripts with Bash'isms to be run via
Bash](https://github.com/actions/checkout/pull/1377)
- [Add option to fetch tags even if fetch-depth >
0](https://github.com/actions/checkout/pull/579)

</details>

<details>
<summary>actions/dependency-review-action
(actions/dependency-review-action)</summary>

###
[`v3.1.0`](https://github.com/actions/dependency-review-action/releases/tag/v3.1.0):
3.1.0

[Compare
Source](https://github.com/actions/dependency-review-action/compare/v3.0.8...v3.1.0)

#### What's New

Added support for dependencies submitted through the [dependency
submission
API](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review#best-practices-for-using-the-dependency-review-api-and-the-dependency-submission-api-together).
This includes two new configuration parameters:
`retry-on-snapshot-warnings` and `retry-on-snapshot-warnings-timeout`.

#### What's Changed

- Fix(docs): Correct action input name by
[@&#8203;oerd](https://github.com/oerd) in
[https://github.com/actions/dependency-review-action/pull/551](https://github.com/actions/dependency-review-action/pull/551)

#### New Contributors

- [@&#8203;oerd](https://github.com/oerd) made their first
contribution in
[https://github.com/actions/dependency-review-action/pull/551](https://github.com/actions/dependency-review-action/pull/551)

**Full Changelog**:
actions/dependency-review-action@v3...v3.1.0

###
[`v3.0.8`](https://github.com/actions/dependency-review-action/releases/tag/v3.0.8):
3.0.8

[Compare
Source](https://github.com/actions/dependency-review-action/compare/v3.0.7...v3.0.8)

#### What's Changed

Added `on-failure` option to `comment-summary-in-pr` setting by
[@&#8203;sgmurphy](https://github.com/sgmurphy) in
[https://github.com/actions/dependency-review-action/pull/540](https://github.com/actions/dependency-review-action/pull/540)

Previous configuration files using `true`/`false` for
`comment-summary-in-pr` will be mapped automatically to the new values,
but we encourage you to update to `always`/`on-failure`/`never`.

#### New Contributors

- [@&#8203;sgmurphy](https://github.com/sgmurphy) made their first
contribution in
[https://github.com/actions/dependency-review-action/pull/540](https://github.com/actions/dependency-review-action/pull/540)

**Full Changelog**:
actions/dependency-review-action@v3...v3.0.8

</details>

<details>
<summary>actions/setup-node (actions/setup-node)</summary>

###
[`v3.8.1`](https://github.com/actions/setup-node/releases/tag/v3.8.1)

[Compare
Source](https://github.com/actions/setup-node/compare/v3.8.0...v3.8.1)

#### What's Changed

In scope of this release, the filter was removed within the cache-save
step by [@&#8203;dmitry-shibanov](https://github.com/dmitry-shibanov)
in
[https://github.com/actions/setup-node/pull/831](https://github.com/actions/setup-node/pull/831).
It is filtered and checked in the toolkit/cache library.

**Full Changelog**:
actions/setup-node@v3...v3.8.1

</details>

<details>
<summary>actions/upload-artifact (actions/upload-artifact)</summary>

###
[`v3.1.3`](https://github.com/actions/upload-artifact/releases/tag/v3.1.3)

[Compare
Source](https://github.com/actions/upload-artifact/compare/v3.1.2...v3.1.3)

#### What's Changed

- chore(github): remove trailing whitespaces by
[@&#8203;ljmf00](https://github.com/ljmf00) in
[https://github.com/actions/upload-artifact/pull/313](https://github.com/actions/upload-artifact/pull/313)
- Bump [@&#8203;actions/artifact](https://github.com/actions/artifact)
version to v1.1.2 by
[@&#8203;bethanyj28](https://github.com/bethanyj28) in
[https://github.com/actions/upload-artifact/pull/436](https://github.com/actions/upload-artifact/pull/436)

**Full Changelog**:
actions/upload-artifact@v3...v3.1.3

</details>

<details>
<summary>github/codeql-action (github/codeql-action)</summary>

###
[`v2.22.1`](https://github.com/github/codeql-action/compare/v2.22.0...v2.22.1)

[Compare
Source](https://github.com/github/codeql-action/compare/v2.22.0...v2.22.1)

###
[`v2.22.0`](https://github.com/github/codeql-action/compare/v2.21.9...v2.22.0)

[Compare
Source](https://github.com/github/codeql-action/compare/v2.21.9...v2.22.0)

###
[`v2.21.9`](https://github.com/github/codeql-action/compare/v2.21.8...v2.21.9)

[Compare
Source](https://github.com/github/codeql-action/compare/v2.21.8...v2.21.9)

###
[`v2.21.8`](https://github.com/github/codeql-action/compare/v2.21.7...v2.21.8)

[Compare
Source](https://github.com/github/codeql-action/compare/v2.21.7...v2.21.8)

###
[`v2.21.7`](https://github.com/github/codeql-action/compare/v2.21.6...v2.21.7)

[Compare
Source](https://github.com/github/codeql-action/compare/v2.21.6...v2.21.7)

###
[`v2.21.6`](https://github.com/github/codeql-action/compare/v2.21.5...v2.21.6)

[Compare
Source](https://github.com/github/codeql-action/compare/v2.21.5...v2.21.6)

###
[`v2.21.5`](https://github.com/github/codeql-action/compare/v2.21.4...v2.21.5)

[Compare
Source](https://github.com/github/codeql-action/compare/v2.21.4...v2.21.5)

</details>

<details>
<summary>ossf/scorecard-action (ossf/scorecard-action)</summary>

###
[`v2.3.0`](https://github.com/ossf/scorecard-action/releases/tag/v2.3.0)

[Compare
Source](https://github.com/ossf/scorecard-action/compare/v2.2.0...v2.3.0)

#### What's Changed

- 🌱 Bump github.com/ossf/scorecard/v4 from v4.11.0 to v4.13.0
by [@&#8203;spencerschrock](https://github.com/spencerschrock) in
[https://github.com/ossf/scorecard-action/pull/1270](https://github.com/ossf/scorecard-action/pull/1270)
- For a full changelist of what this includes, see the
[v4.12.0](https://github.com/ossf/scorecard/releases/tag/v4.12.0) and
[v4.13.0](https://github.com/ossf/scorecard/releases/tag/v4.13.0)
release notes
- ✨ Send rekor tlog index to webapp when publishing results by
[@&#8203;spencerschrock](https://github.com/spencerschrock) in
[https://github.com/ossf/scorecard-action/pull/1169](https://github.com/ossf/scorecard-action/pull/1169)
- 🐛 Prevent url clipping for GHES instances by
[@&#8203;rajbos](https://github.com/rajbos) in
[https://github.com/ossf/scorecard-action/pull/1225](https://github.com/ossf/scorecard-action/pull/1225)

##### Documentation

- 📖 Update access rights needed to see the results in code scanning
by [@&#8203;rajbos](https://github.com/rajbos) in
[https://github.com/ossf/scorecard-action/pull/1229](https://github.com/ossf/scorecard-action/pull/1229)
- 📖 Add package comments. by
[@&#8203;spencerschrock](https://github.com/spencerschrock) in
[https://github.com/ossf/scorecard-action/pull/1221](https://github.com/ossf/scorecard-action/pull/1221)
- 📖 Add SECURITY.md file by
[@&#8203;david-a-wheeler](https://github.com/david-a-wheeler) in
[https://github.com/ossf/scorecard-action/pull/1250](https://github.com/ossf/scorecard-action/pull/1250)
- 📖 Fix typo in token input docs by
[@&#8203;aabouzaid](https://github.com/aabouzaid) in
[https://github.com/ossf/scorecard-action/pull/1258](https://github.com/ossf/scorecard-action/pull/1258)

#### New Contributors

- [@&#8203;david-a-wheeler](https://github.com/david-a-wheeler) made
their first contribution in
[https://github.com/ossf/scorecard-action/pull/1250](https://github.com/ossf/scorecard-action/pull/1250)
- [@&#8203;aabouzaid](https://github.com/aabouzaid) made their first
contribution in
[https://github.com/ossf/scorecard-action/pull/1258](https://github.com/ossf/scorecard-action/pull/1258)

**Full Changelog**:
ossf/scorecard-action@v2.2.0...v2.3.0

</details>

<details>
<summary>slsa-framework/slsa-github-generator
(slsa-framework/slsa-github-generator)</summary>

###
[`v1.9.0`](https://github.com/slsa-framework/slsa-github-generator/blob/HEAD/CHANGELOG.md#v190)

[Compare
Source](https://github.com/slsa-framework/slsa-github-generator/compare/v1.8.0...v1.9.0)

Release \[v1.9.0] includes bug fixes and new features.

See the [full change
list](https://github.com/slsa-framework/slsa-github-generator/compare/v1.8.0...v1.9.0).

##### v1.9.0: BYOB framework (beta)

- **New**: A [new
framework](https://github.com/slsa-framework/slsa-github-generator/blob/main/BYOB.md)
to turn GitHub Actions into SLSA compliant builders.

##### v1.9.0: Maven builder (beta)

- **New**: A [Maven
builder](https://github.com/slsa-framework/slsa-github-generator/tree/main/internal/builders/maven)
to build Java projects and publish to Maven central.

##### v1.9.0: Gradle builder (beta)

- **New**: A [Gradle
builder](https://github.com/slsa-framework/slsa-github-generator/tree/main/internal/builders/gradle)
to build Java projects and publish to Maven central.

##### v1.9.0: JReleaser builder

- **New**: A [JReleaser
builder](https://github.com/jreleaser/release-action/tree/v1.0.0-java)
that wraps the official [JReleaser
Action](https://github.com/jreleaser/release-action/tree/v1.0.0-java).

</details>

<details>
<summary>slsa-framework/slsa-verifier
(slsa-framework/slsa-verifier)</summary>

###
[`v2.4.0`](https://github.com/slsa-framework/slsa-verifier/releases/tag/v2.4.0)

[Compare
Source](https://github.com/slsa-framework/slsa-verifier/compare/v2.3.0...v2.4.0)

#### Summary

Support for BYOB-based builders released in
https://github.com/slsa-framework/slsa-github-generator/releases/tag/v1.9.0

#### What's Changed

- chore: Update SHA256SUM.md for v2.3.0 by
[@&#8203;ianlewis](https://github.com/ianlewis) in
[https://github.com/slsa-framework/slsa-verifier/pull/592](https://github.com/slsa-framework/slsa-verifier/pull/592)
- docs: Make npm package version and name non-optional by
[@&#8203;laurentsimon](https://github.com/laurentsimon) in
[https://github.com/slsa-framework/slsa-verifier/pull/591](https://github.com/slsa-framework/slsa-verifier/pull/591)
- docs: npm provenance verification from GitHub runner by
[@&#8203;laurentsimon](https://github.com/laurentsimon) in
[https://github.com/slsa-framework/slsa-verifier/pull/595](https://github.com/slsa-framework/slsa-verifier/pull/595)
- chore(deps): update dependency
[@&#8203;types/node](https://github.com/types/node) to v18.16.9 by
[@&#8203;renovate-bot](https://github.com/renovate-bot) in
[https://github.com/slsa-framework/slsa-verifier/pull/596](https://github.com/slsa-framework/slsa-verifier/pull/596)
- chore(deps): update github-actions by
[@&#8203;renovate-bot](https://github.com/renovate-bot) in
[https://github.com/slsa-framework/slsa-verifier/pull/597](https://github.com/slsa-framework/slsa-verifier/pull/597)
- chore(deps): update dependency jasmine to v5 by
[@&#8203;renovate-bot](https://github.com/renovate-bot) in
[https://github.com/slsa-framework/slsa-verifier/pull/598](https://github.com/slsa-framework/slsa-verifier/pull/598)
- feat: BYOB verification support by
[@&#8203;laurentsimon](https://github.com/laurentsimon) in
[https://github.com/slsa-framework/slsa-verifier/pull/604](https://github.com/slsa-framework/slsa-verifier/pull/604)
- feat: Support for v1.0 verification in BYOB by
[@&#8203;laurentsimon](https://github.com/laurentsimon) in
[https://github.com/slsa-framework/slsa-verifier/pull/609](https://github.com/slsa-framework/slsa-verifier/pull/609)
- feat: Use env variable to retrieve trigger workflow by
[@&#8203;laurentsimon](https://github.com/laurentsimon) in
[https://github.com/slsa-framework/slsa-verifier/pull/615](https://github.com/slsa-framework/slsa-verifier/pull/615)
- test: Add test data for v1.6.0 by
[@&#8203;ianlewis](https://github.com/ianlewis) in
[https://github.com/slsa-framework/slsa-verifier/pull/612](https://github.com/slsa-framework/slsa-verifier/pull/612)
- fix: Verify the TRW tag is a semver tag by
[@&#8203;laurentsimon](https://github.com/laurentsimon) in
[https://github.com/slsa-framework/slsa-verifier/pull/619](https://github.com/slsa-framework/slsa-verifier/pull/619)
- chore: Don't be verbose with tests locally by
[@&#8203;ianlewis](https://github.com/ianlewis) in
[https://github.com/slsa-framework/slsa-verifier/pull/620](https://github.com/slsa-framework/slsa-verifier/pull/620)
- fix: use ExternalParameters\["source"] for the Source URI for SLSA
v1.0 provenance by [@&#8203;asraa](https://github.com/asraa) in
[https://github.com/slsa-framework/slsa-verifier/pull/621](https://github.com/slsa-framework/slsa-verifier/pull/621)
- test: re-generate container-based tests by
[@&#8203;asraa](https://github.com/asraa) in
[https://github.com/slsa-framework/slsa-verifier/pull/627](https://github.com/slsa-framework/slsa-verifier/pull/627)
- fix: revert to using resolvedDepdendencies for source verification by
[@&#8203;asraa](https://github.com/asraa) in
[https://github.com/slsa-framework/slsa-verifier/pull/629](https://github.com/slsa-framework/slsa-verifier/pull/629)
- refactor: Provenance tests by
[@&#8203;ianlewis](https://github.com/ianlewis) in
[https://github.com/slsa-framework/slsa-verifier/pull/628](https://github.com/slsa-framework/slsa-verifier/pull/628)
- fix(deps): update module github.com/sigstore/rekor to v1.2.0
\[security] by [@&#8203;renovate-bot](https://github.com/renovate-bot)
in
[https://github.com/slsa-framework/slsa-verifier/pull/622](https://github.com/slsa-framework/slsa-verifier/pull/622)
- fix: only allow hashes of 256 bits or more by
[@&#8203;laurentsimon](https://github.com/laurentsimon) in
[https://github.com/slsa-framework/slsa-verifier/pull/633](https://github.com/slsa-framework/slsa-verifier/pull/633)
- fix: builder ID verification for testing by
[@&#8203;ianlewis](https://github.com/ianlewis) in
[https://github.com/slsa-framework/slsa-verifier/pull/635](https://github.com/slsa-framework/slsa-verifier/pull/635)
- feat: remove experimental on Sigstore bundle and v1.0 SLSA provenance
format by [@&#8203;asraa](https://github.com/asraa) in
[https://github.com/slsa-framework/slsa-verifier/pull/634](https://github.com/slsa-framework/slsa-verifier/pull/634)
- chore: update toc in README.md by
[@&#8203;asraa](https://github.com/asraa) in
[https://github.com/slsa-framework/slsa-verifier/pull/636](https://github.com/slsa-framework/slsa-verifier/pull/636)
- fix: allow workflow_dispatch to trigger release.yml by
[@&#8203;ianlewis](https://github.com/ianlewis) in
[https://github.com/slsa-framework/slsa-verifier/pull/637](https://github.com/slsa-framework/slsa-verifier/pull/637)
- test: add tests for v1.7.0 builders by
[@&#8203;asraa](https://github.com/asraa) in
[https://github.com/slsa-framework/slsa-verifier/pull/638](https://github.com/slsa-framework/slsa-verifier/pull/638)
- chore(deps): update github-actions by
[@&#8203;renovate-bot](https://github.com/renovate-bot) in
[https://github.com/slsa-framework/slsa-verifier/pull/607](https://github.com/slsa-framework/slsa-verifier/pull/607)
- chore(deps): update gcr.io/distroless/base:nonroot docker digest to
[`c623859`](https://github.com/slsa-framework/slsa-verifier/commit/c623859)
by [@&#8203;renovate-bot](https://github.com/renovate-bot) in
[https://github.com/slsa-framework/slsa-verifier/pull/567](https://github.com/slsa-framework/slsa-verifier/pull/567)
- fix(deps): update github.com/sigstore/protobuf-specs digest to
[`5ef5406`](https://github.com/slsa-framework/slsa-verifier/commit/5ef5406)
by [@&#8203;renovate-bot](https://github.com/renovate-bot) in
[https://github.com/slsa-framework/slsa-verifier/pull/606](https://github.com/slsa-framework/slsa-verifier/pull/606)
- chore(deps): update npm dev by
[@&#8203;renovate-bot](https://github.com/renovate-bot) in
[https://github.com/slsa-framework/slsa-verifier/pull/608](https://github.com/slsa-framework/slsa-verifier/pull/608)
- chore(deps): update golang:1.19 docker digest to
[`83f9f84`](https://github.com/slsa-framework/slsa-verifier/commit/83f9f84)
by [@&#8203;renovate-bot](https://github.com/renovate-bot) in
[https://github.com/slsa-framework/slsa-verifier/pull/583](https://github.com/slsa-framework/slsa-verifier/pull/583)
- feat: Verify provenance by build type by
[@&#8203;ianlewis](https://github.com/ianlewis) in
[https://github.com/slsa-framework/slsa-verifier/pull/632](https://github.com/slsa-framework/slsa-verifier/pull/632)
- refactor: Use Go 1.20 by
[@&#8203;ianlewis](https://github.com/ianlewis) in
[https://github.com/slsa-framework/slsa-verifier/pull/643](https://github.com/slsa-framework/slsa-verifier/pull/643)
- test: Add more ProvenanceFromEnvelope tests by
[@&#8203;ianlewis](https://github.com/ianlewis) in
[https://github.com/slsa-framework/slsa-verifier/pull/640](https://github.com/slsa-framework/slsa-verifier/pull/640)
- fix: pre-submit: e2e-cli.sh artifact download by
[@&#8203;ianlewis](https://github.com/ianlewis) in
[https://github.com/slsa-framework/slsa-verifier/pull/646](https://github.com/slsa-framework/slsa-verifier/pull/646)
- refactor: Add more git utils by
[@&#8203;ianlewis](https://github.com/ianlewis) in
[https://github.com/slsa-framework/slsa-verifier/pull/645](https://github.com/slsa-framework/slsa-verifier/pull/645)
- refactor: Use full builder id by
[@&#8203;ianlewis](https://github.com/ianlewis) in
[https://github.com/slsa-framework/slsa-verifier/pull/648](https://github.com/slsa-framework/slsa-verifier/pull/648)
- feat: Use tags `vX.Y.Z-<language>` for JReleaser builders by
[@&#8203;laurentsimon](https://github.com/laurentsimon) in
[https://github.com/slsa-framework/slsa-verifier/pull/644](https://github.com/slsa-framework/slsa-verifier/pull/644)
- chore(deps): update github-actions by
[@&#8203;renovate-bot](https://github.com/renovate-bot) in
[https://github.com/slsa-framework/slsa-verifier/pull/651](https://github.com/slsa-framework/slsa-verifier/pull/651)
- feat: move maven-plugin from slsa-github-generator by
[@&#8203;AdamKorcz](https://github.com/AdamKorcz) in
[https://github.com/slsa-framework/slsa-verifier/pull/664](https://github.com/slsa-framework/slsa-verifier/pull/664)
- docs: Fix maven-plugin README by
[@&#8203;laurentsimon](https://github.com/laurentsimon) in
[https://github.com/slsa-framework/slsa-verifier/pull/671](https://github.com/slsa-framework/slsa-verifier/pull/671)
- feat: Verification for when sha1 is specified in BYOB TRW by
[@&#8203;ianlewis](https://github.com/ianlewis) in
[https://github.com/slsa-framework/slsa-verifier/pull/641](https://github.com/slsa-framework/slsa-verifier/pull/641)
- docs: Add example for maven verification plugin by
[@&#8203;laurentsimon](https://github.com/laurentsimon) in
[https://github.com/slsa-framework/slsa-verifier/pull/676](https://github.com/slsa-framework/slsa-verifier/pull/676)
- chore: Add Kris to codeowners by
[@&#8203;laurentsimon](https://github.com/laurentsimon) in
[https://github.com/slsa-framework/slsa-verifier/pull/678](https://github.com/slsa-framework/slsa-verifier/pull/678)
- feat: Print byob builder by
[@&#8203;laurentsimon](https://github.com/laurentsimon) in
[https://github.com/slsa-framework/slsa-verifier/pull/677](https://github.com/slsa-framework/slsa-verifier/pull/677)
- test: Add test data for v1.8.0 by
[@&#8203;ianlewis](https://github.com/ianlewis) in
[https://github.com/slsa-framework/slsa-verifier/pull/681](https://github.com/slsa-framework/slsa-verifier/pull/681)
- chore(deps): update github-actions by
[@&#8203;renovate-bot](https://github.com/renovate-bot) in
[https://github.com/slsa-framework/slsa-verifier/pull/666](https://github.com/slsa-framework/slsa-verifier/pull/666)
- feat: Non-compulsory BuilderID for BYOB Builders by
[@&#8203;enteraga6](https://github.com/enteraga6) in
[https://github.com/slsa-framework/slsa-verifier/pull/674](https://github.com/slsa-framework/slsa-verifier/pull/674)
- chore(deps): update golang docker tag to v1.21 by
[@&#8203;renovate-bot](https://github.com/renovate-bot) in
[https://github.com/slsa-framework/slsa-verifier/pull/687](https://github.com/slsa-framework/slsa-verifier/pull/687)
- chore(deps): update github-actions by
[@&#8203;renovate-bot](https://github.com/renovate-bot) in
[https://github.com/slsa-framework/slsa-verifier/pull/686](https://github.com/slsa-framework/slsa-verifier/pull/686)
- feat: GCB refactor for v1.0 support by
[@&#8203;laurentsimon](https://github.com/laurentsimon) in
[https://github.com/slsa-framework/slsa-verifier/pull/682](https://github.com/slsa-framework/slsa-verifier/pull/682)
- feat: Allow byob builders ref at main for e2e tests by
[@&#8203;laurentsimon](https://github.com/laurentsimon) in
[https://github.com/slsa-framework/slsa-verifier/pull/689](https://github.com/slsa-framework/slsa-verifier/pull/689)
- feat: Update doc and code for Maven plugin by
[@&#8203;laurentsimon](https://github.com/laurentsimon) in
[https://github.com/slsa-framework/slsa-verifier/pull/680](https://github.com/slsa-framework/slsa-verifier/pull/680)
- feat: gcb v1.0 support by
[@&#8203;laurentsimon](https://github.com/laurentsimon) in
[https://github.com/slsa-framework/slsa-verifier/pull/691](https://github.com/slsa-framework/slsa-verifier/pull/691)
- feat: v1.9.0 regression tests by
[@&#8203;laurentsimon](https://github.com/laurentsimon) in
[https://github.com/slsa-framework/slsa-verifier/pull/696](https://github.com/slsa-framework/slsa-verifier/pull/696)
- fix: release failure by
[@&#8203;laurentsimon](https://github.com/laurentsimon) in
[https://github.com/slsa-framework/slsa-verifier/pull/697](https://github.com/slsa-framework/slsa-verifier/pull/697)

#### New Contributors

- [@&#8203;AdamKorcz](https://github.com/AdamKorcz) made their first
contribution in
[https://github.com/slsa-framework/slsa-verifier/pull/664](https://github.com/slsa-framework/slsa-verifier/pull/664)
- [@&#8203;enteraga6](https://github.com/enteraga6) made their first
contribution in
[https://github.com/slsa-framework/slsa-verifier/pull/674](https://github.com/slsa-framework/slsa-verifier/pull/674)

**Full Changelog**:
slsa-framework/slsa-verifier@v2.3.0...v2.4.0

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "every weekend" (UTC), Automerge - At
any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config help](https://github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://developer.mend.io/github/slsa-framework/slsa-verifier).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNi40My4yIiwidXBkYXRlZEluVmVyIjoiMzcuOC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiJ9-->

Signed-off-by: Mend Renovate <bot@renovateapp.com>
Co-authored-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>
Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@laurentsimon laurentsimon laurentsimon approved these changes

@ianlewis ianlewis ianlewis left review comments

@asraa asraa Awaiting requested review from asraa

@kpk47 kpk47 Awaiting requested review from kpk47

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Make builder ID not compulsory for BYOB builders hosted on our repo
3 participants
@enteraga6 @ianlewis @laurentsimon