STACKITGit/cli
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Hidden trusted root flag for release verify

Browse source
This commit is contained in:
ejahnGithub 2025-08-14 14:00:55 -04:00
parent 1b083c2005
commit 79888378d8
3 changed files with 22 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

8
pkg/cmd/release/shared/attestation.go
View file

@ -25,9 +25,10 @@ type Verifier interface {
}
type AttestationVerifier struct {
AttClient api.Client
HttpClient *http.Client
IO *iostreams.IOStreams
AttClient api.Client
HttpClient *http.Client
IO *iostreams.IOStreams
TrustedRoot string
}
func (v *AttestationVerifier) VerifyAttestation(art *artifact.DigestedArtifact, att *api.Attestation) (*verification.AttestationProcessingResult, error) {
@ -41,6 +42,7 @@ func (v *AttestationVerifier) VerifyAttestation(art *artifact.DigestedArtifact,
Logger: att_io.NewHandler(v.IO),
NoPublicGood: true,
TrustDomain: td,
TrustedRoot: v.TrustedRoot,
})
if err != nil {
return nil, err

10
pkg/cmd/release/verify-asset/verify_asset.go
View file

@ -24,6 +24,7 @@ type VerifyAssetOptions struct {
BaseRepo ghrepo.Interface
Exporter cmdutil.Exporter
AssetFilePath string
TrustedRoot string
}
type VerifyAssetConfig struct {
@ -93,9 +94,10 @@ func NewCmdVerifyAsset(f *cmdutil.Factory, runF func(*VerifyAssetConfig) error)
attClient := api.NewLiveClient(httpClient, baseRepo.RepoHost(), att_io.NewHandler(io))
attVerifier := &shared.AttestationVerifier{
AttClient: attClient,
HttpClient: httpClient,
IO: io,
AttClient: attClient,
HttpClient: httpClient,
IO: io,
TrustedRoot: opts.TrustedRoot,
}
config := &VerifyAssetConfig{
@ -114,6 +116,8 @@ func NewCmdVerifyAsset(f *cmdutil.Factory, runF func(*VerifyAssetConfig) error)
},
}
cmdutil.AddFormatFlags(cmd, &opts.Exporter)
cmd.Flags().StringVarP(&opts.TrustedRoot, "custom-trusted-root", "", "", "Path to a trusted_root.jsonl file; likely for offline verification")
cmd.Flags().MarkHidden("custom-trusted-root")
return cmd
}

16
pkg/cmd/release/verify/verify.go
View file

@ -23,9 +23,10 @@ import (
)
type VerifyOptions struct {
TagName string
BaseRepo ghrepo.Interface
Exporter cmdutil.Exporter
TagName string
BaseRepo ghrepo.Interface
Exporter cmdutil.Exporter
TrustedRoot string
}
type VerifyConfig struct {
@ -87,9 +88,10 @@ func NewCmdVerify(f *cmdutil.Factory, runF func(config *VerifyConfig) error) *co
attClient := api.NewLiveClient(httpClient, baseRepo.RepoHost(), att_io.NewHandler(io))
attVerifier := &shared.AttestationVerifier{
AttClient: attClient,
HttpClient: httpClient,
IO: io,
AttClient: attClient,
HttpClient: httpClient,
IO: io,
TrustedRoot: opts.TrustedRoot,
}
config := &VerifyConfig{
@ -107,6 +109,8 @@ func NewCmdVerify(f *cmdutil.Factory, runF func(config *VerifyConfig) error) *co
},
}
cmdutil.AddFormatFlags(cmd, &opts.Exporter)
cmd.Flags().StringVarP(&opts.TrustedRoot, "custom-trusted-root", "", "", "Path to a trusted_root.jsonl file; likely for offline verification")
cmd.Flags().MarkHidden("custom-trusted-root")
return cmd
}