diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml index 4be1a55d2..9b22701a7 100644 --- a/.github/workflows/go.yml +++ b/.github/workflows/go.yml @@ -29,7 +29,7 @@ jobs: - name: Build run: go build -v ./cmd/gh - + integration-tests: env: GH_TOKEN: ${{ github.token }} diff --git a/go.mod b/go.mod index bb50fba67..a4c973df1 100644 --- a/go.mod +++ b/go.mod @@ -60,7 +60,6 @@ require ( google.golang.org/protobuf v1.36.6 gopkg.in/h2non/gock.v1 v1.1.2 gopkg.in/yaml.v3 v3.0.1 - gotest.tools/v3 v3.0.3 ) require ( diff --git a/go.sum b/go.sum index 1835a69b2..718e0ca67 100644 --- a/go.sum +++ b/go.sum @@ -245,7 +245,6 @@ github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM= github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q= github.com/google/certificate-transparency-go v1.3.1 h1:akbcTfQg0iZlANZLn0L9xOeWtyCIdeoYhKrqi5iH3Go= github.com/google/certificate-transparency-go v1.3.1/go.mod h1:gg+UQlx6caKEDQ9EElFOujyxEQEfOiQzAt6782Bvi8k= -github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= github.com/google/go-containerregistry v0.20.3 h1:oNx7IdTI936V8CQRveCjaxOiegWwvM7kqkbXTpyiovI= @@ -411,7 +410,6 @@ github.com/pelletier/go-toml/v2 v2.2.3 h1:YmeHyLY8mFWbdkNWwpr+qIL2bEqT0o95WSdkNH github.com/pelletier/go-toml/v2 v2.2.3/go.mod h1:MfCQTFTvCcUyyvvwm1+G6H/jORL20Xlb6rzQu9GuUkc= github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ= github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU= -github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= @@ -485,7 +483,6 @@ github.com/spf13/cast v1.7.1 h1:cuNEagBQEHWN1FnbGEjCXL2szYEXqfJPbP2HNUaca9Y= github.com/spf13/cast v1.7.1/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo= github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo= github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0= -github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4= github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o= github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/spf13/viper v1.20.1 h1:ZMi+z/lvLyPSCoNtFCpqjy0S4kPbirhpTMwl8BkW9X4= @@ -565,7 +562,6 @@ golang.org/x/exp v0.0.0-20240531132922-fd00a4e0eefc/go.mod h1:XtvwrStGgqGPLc4cjQ golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= golang.org/x/mod v0.24.0 h1:ZfthKaKaT4NrhGVZHO1/WDTwGES4De8KtWO0SIbNJMU= golang.org/x/mod v0.24.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww= -golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= @@ -603,13 +599,11 @@ golang.org/x/text v0.25.0/go.mod h1:WEdwpYrmk1qmdHvhkSTNPm3app7v4rsT8F2UD6+VHIA= golang.org/x/time v0.11.0 h1:/bpjEDfN9tkoN/ryeYHnv5hcMlc8ncjMcM4XBk5NWV0= golang.org/x/time v0.11.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= -golang.org/x/tools v0.0.0-20190624222133-a101b041ded4/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc= golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc= golang.org/x/tools v0.29.0 h1:Xx0h3TtM9rzQpQuR4dKLrdglAmCEN5Oi+P74JdhdzXE= golang.org/x/tools v0.29.0/go.mod h1:KMQVMRsVxU6nHCFXrBPhDB8XncLNLM0lIy/F14RP588= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= -golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= google.golang.org/api v0.230.0 h1:2u1hni3E+UXAXrONrrkfWpi/V6cyKVAbfGVeGtC3OxM= google.golang.org/api v0.230.0/go.mod h1:aqvtoMk7YkiXx+6U12arQFExiRV9D/ekvMCwCd/TksQ= google.golang.org/genproto v0.0.0-20250303144028-a0af3efb3deb h1:ITgPrl429bc6+2ZraNSzMDk3I95nmQln2fuPstKwFDE= diff --git a/pkg/cmd/release/shared/fetch.go b/pkg/cmd/release/shared/fetch.go index 6d6d16473..322f33c17 100644 --- a/pkg/cmd/release/shared/fetch.go +++ b/pkg/cmd/release/shared/fetch.go @@ -146,7 +146,7 @@ func FetchRefSHA(ctx context.Context, httpClient *http.Client, repo ghrepo.Inter } defer resp.Body.Close() - if resp.StatusCode == 404 { + if resp.StatusCode == http.StatusNotFound { _, _ = io.Copy(io.Discard, resp.Body) // ErrRefNotFound return "", ErrReleaseNotFound @@ -248,7 +248,7 @@ func fetchReleasePath(ctx context.Context, httpClient *http.Client, host string, } defer resp.Body.Close() - if resp.StatusCode == 404 { + if resp.StatusCode == http.StatusNotFound { _, _ = io.Copy(io.Discard, resp.Body) return nil, ErrReleaseNotFound } else if resp.StatusCode > 299 { diff --git a/pkg/cmd/release/verify-asset/verify-asset.go b/pkg/cmd/release/verify-asset/verify-asset.go index e2b45f7f1..8890d8a0d 100644 --- a/pkg/cmd/release/verify-asset/verify-asset.go +++ b/pkg/cmd/release/verify-asset/verify-asset.go @@ -84,35 +84,23 @@ func NewCmdVerifyAsset(f *cmdutil.Factory, runF func(*attestation.AttestOptions) return err } + opts.TrustedRoot = td + ec, err := attestation.NewEnforcementCriteria(opts) if err != nil { opts.Logger.Println(opts.Logger.ColorScheme.Red("✗ Failed to build policy information")) return err } + opts.EC = ec + + opts.Clean() + // Avoid creating a Sigstore verifier if the runF function is provided for testing purposes if runF != nil { return runF(opts) } - config := verification.SigstoreConfig{ - HttpClient: opts.HttpClient, - Logger: opts.Logger, - NoPublicGood: true, - TrustDomain: td, - } - - sigstoreVerifier, err := verification.NewLiveSigstoreVerifier(config) - if err != nil { - opts.Logger.Println(opts.Logger.ColorScheme.Red("✗ Failed to create Sigstore verifier")) - return err - } - - opts.SigstoreVerifier = sigstoreVerifier - opts.EC = ec - - opts.Clean() - return verifyAssetRun(opts) }, } @@ -124,6 +112,23 @@ func NewCmdVerifyAsset(f *cmdutil.Factory, runF func(*attestation.AttestOptions) func verifyAssetRun(opts *attestation.AttestOptions) error { ctx := context.Background() + if opts.SigstoreVerifier == nil { + config := verification.SigstoreConfig{ + HttpClient: opts.HttpClient, + Logger: opts.Logger, + NoPublicGood: true, + TrustDomain: opts.TrustedRoot, + } + + sigstoreVerifier, err := verification.NewLiveSigstoreVerifier(config) + if err != nil { + opts.Logger.Println(opts.Logger.ColorScheme.Red("✗ Failed to create Sigstore verifier")) + return err + } + + opts.SigstoreVerifier = sigstoreVerifier + } + if opts.TagName == "" { release, err := shared.FetchLatestRelease(ctx, opts.HttpClient, opts.BaseRepo) if err != nil { diff --git a/pkg/cmd/release/verify/verify.go b/pkg/cmd/release/verify/verify.go index c6579f825..2b0fd8907 100644 --- a/pkg/cmd/release/verify/verify.go +++ b/pkg/cmd/release/verify/verify.go @@ -77,34 +77,19 @@ func NewCmdVerify(f *cmdutil.Factory, runF func(*attestation.AttestOptions) erro opts.Logger.Println(opts.Logger.ColorScheme.Red("✗ Failed to get trust domain")) return err } + opts.TrustedRoot = td ec, err := attestation.NewEnforcementCriteria(opts) if err != nil { opts.Logger.Println(opts.Logger.ColorScheme.Red("✗ Failed to build policy information")) return err } + opts.EC = ec // Avoid creating a Sigstore verifier if the runF function is provided for testing purposes if runF != nil { return runF(opts) } - - config := verification.SigstoreConfig{ - HttpClient: opts.HttpClient, - Logger: opts.Logger, - NoPublicGood: true, - TrustDomain: td, - } - - sigstoreVerifier, err := verification.NewLiveSigstoreVerifier(config) - if err != nil { - opts.Logger.Println(opts.Logger.ColorScheme.Red("✗ Failed to create Sigstore verifier")) - return err - } - - opts.SigstoreVerifier = sigstoreVerifier - opts.EC = ec - return verifyRun(opts) }, } @@ -116,6 +101,23 @@ func NewCmdVerify(f *cmdutil.Factory, runF func(*attestation.AttestOptions) erro func verifyRun(opts *attestation.AttestOptions) error { ctx := context.Background() + if opts.SigstoreVerifier == nil { + config := verification.SigstoreConfig{ + HttpClient: opts.HttpClient, + Logger: opts.Logger, + NoPublicGood: true, + TrustDomain: opts.TrustedRoot, + } + + sigstoreVerifier, err := verification.NewLiveSigstoreVerifier(config) + if err != nil { + opts.Logger.Println(opts.Logger.ColorScheme.Red("✗ Failed to create Sigstore verifier")) + return err + } + + opts.SigstoreVerifier = sigstoreVerifier + } + if opts.TagName == "" { release, err := shared.FetchLatestRelease(ctx, opts.HttpClient, opts.BaseRepo) if err != nil {