Commit graph

3530 commits

Author SHA1 Message Date
Brian DeHamer
cbe8525321
enforce auth for tenancy
Signed-off-by: Brian DeHamer <bdehamer@github.com>
2024-09-16 13:52:57 -07:00
Brian DeHamer
8e8fc696f1
disable auth check for att trusted-root cmd
Signed-off-by: Brian DeHamer <bdehamer@github.com>
2024-09-16 12:55:18 -07:00
Brian DeHamer
2e13ec5d80
Merge pull request #9616 from cli/bdehamer/custom-issuer-error
Better messaging for `attestation verify` custom issuer mismatch error
2024-09-16 12:52:12 -07:00
Brian DeHamer
8c8423aa3d
better error for att verify custom issuer mismatch
Signed-off-by: Brian DeHamer <bdehamer@github.com>
Co-authored-by: Zach Steindler <steiza@github.com>
Co-authored-by: Phill MV <phillmv@github.com>
2024-09-16 12:38:12 -07:00
Andy Feller
d108784d7f
Merge pull request #9618 from cli/wm/tenant-api
Use api subdomains for tenant hosts
2024-09-16 09:53:44 -04:00
Meredith Lancaster
0f42ee46f0
Merge pull request #9612 from cli/bdehamer/attest-verify-no-tty
Suppress `attestation verify` output when no TTY present
2024-09-13 10:01:02 -06:00
Meredith Lancaster
e381d54511
Merge pull request #9564 from malancas/verification-err-output
Update `gh attestation verify` bundle parsing and validation errors
2024-09-13 09:27:07 -06:00
William Martin
352737cb60 Use api subdomains for commands using ghinstance package 2024-09-13 15:03:36 +02:00
William Martin
4430c40298
Merge pull request #9599 from timrogers/timrogers/extension-arm64
Suggest installing Rosetta when extension installation fails due to missing `darwin-arm64` binary, but a `darwin-amd64` binary is available
2024-09-13 13:52:09 +02:00
William Martin
99b789e745 Add test for extension install fallback to amd64 on darwin 2024-09-13 11:59:54 +02:00
William Martin
e0fb793b44 Stub hasRosetta for tests 2024-09-12 13:56:19 -06:00
Tim Rogers
5296d60832
Refactor conditions
Co-authored-by: Andy Feller <andyfeller@github.com>
2024-09-12 18:53:24 +01:00
Brian DeHamer
677edbac77
suppress att verify output when no tty
Signed-off-by: Brian DeHamer <bdehamer@github.com>
2024-09-12 09:40:47 -07:00
Brian DeHamer
f128ae8349
add att verify test for custom OIDC issuer
Signed-off-by: Brian DeHamer <bdehamer@github.com>
2024-09-11 12:49:06 -07:00
Andy Feller
22c1da07a2
Merge pull request #9520 from velumuruganr/auth-status-active
Added `--active` flag to the `gh auth status` command
2024-09-11 10:35:39 -04:00
Tim Rogers
a0a2567354
Suggest installing Rosetta when extension installation fails due to missing darwin-arm64 binary, but a darwin-amd64 binary is available
When installing an extension, the CLI must to select the correct
binary to download for the machine (see the
[`installBin` function](78c1d00ecc/pkg/cmd/extension/manager.go (L240))).

By default, the CLI will download a binary matching the current
machine's architecture.

However, to provide better support for Macs running on Apple
Silicon, it will
[fall back](78c1d00ecc/pkg/cmd/extension/manager.go (L267-L274))
from `darwin-arm64` to `darwin-amd64` if
[Rosetta](https://support.apple.com/en-gb/102527) (Apple's
compatibility layer) is installed.

If Rosetta isn't installed, this fallback doesn't happen, which
can lead to surprising and confusing results when one Mac has
Rosetta and another doesn't, because the extension will install
on one machine but not another.

In the situation where a `darwin-arm64` binary isn't available
but the CLI can't fall back to `amd64` because Rosetta isn't
installed, this updates our error message to suggest installing
Rosetta.

Closes https://github.com/cli/cli/issues/9592.
2024-09-11 11:50:05 +01:00
Fredrik Skogman
1b59ec8ad0
This commit introduces tenancy aware attestation policy building.
This is done by inspecting the current hostname to determine if
tenancy is enabled.

The attestation commands also accepts a --hostname parameter, that
is used to pick the current host, similar to how the GH_HOST variable
can be used.

Signed-off-by: Fredrik Skogman <kommendorkapten@github.com>
2024-09-11 10:49:17 +02:00
Meredith Lancaster
50d335566d check specific err
Signed-off-by: Meredith Lancaster <malancas@github.com>
2024-09-10 10:47:06 -06:00
Meredith Lancaster
3814e82f9b check err in GetLocalAttestations
Signed-off-by: Meredith Lancaster <malancas@github.com>
2024-09-10 10:32:46 -06:00
Meredith Lancaster
f748f9e65f Merge remote-tracking branch 'upstream/trunk' into verification-err-output 2024-09-10 09:04:57 -06:00
Meredith Lancaster
83519e4e92 check for sigstore-go validation errs
Signed-off-by: Meredith Lancaster <malancas@github.com>
2024-09-10 07:54:45 -06:00
William Martin
78c1d00ecc
Merge pull request #9577 from cli/move-non-integration-test
Move non-integration tests to different test file
2024-09-10 15:43:25 +02:00
Meredith Lancaster
bbefc5b24f handle os.PathError in GetLocalAttestations
Signed-off-by: Meredith Lancaster <malancas@github.com>
2024-09-09 08:53:11 -06:00
Meredith Lancaster
945e2b7eee
Merge branch 'trunk' into verification-err-output 2024-09-09 08:23:01 -06:00
Cody Soyland
b14e430441
Check for nil values to prevent nil dereference panic
Signed-off-by: Cody Soyland <codysoyland@github.com>
2024-09-06 15:22:43 -04:00
Cody Soyland
500b619a5e
Move non-integration test to different test file
Signed-off-by: Cody Soyland <codysoyland@github.com>
2024-09-06 13:55:25 -04:00
Meredith Lancaster
668706ccf5 print verify err
Signed-off-by: Meredith Lancaster <malancas@github.com>
2024-09-05 13:29:22 -06:00
Meredith Lancaster
57b20291bd check for os.PathError
Signed-off-by: Meredith Lancaster <malancas@github.com>
2024-09-05 13:20:13 -06:00
Meredith Lancaster
7c405e8b6e dont print err content
Signed-off-by: Meredith Lancaster <malancas@github.com>
2024-09-05 08:16:34 -06:00
Cody Soyland
ea1a3da1eb
Rename ProtobufBundle to Bundle
Signed-off-by: Cody Soyland <codysoyland@github.com>
2024-09-04 16:45:02 -04:00
Cody Soyland
8446079656
Upgrade to sigstore-go v0.6.1
Signed-off-by: Cody Soyland <codysoyland@github.com>
2024-09-04 16:38:13 -04:00
Meredith Lancaster
1b67b354a9 update bundle file parsing err messages
Signed-off-by: Meredith Lancaster <malancas@github.com>
2024-09-04 13:30:30 -06:00
Meredith Lancaster
34d7ef7a0e
gh attestation verify handles empty JSONL files (#9541)
* handle empty jsonl files

Signed-off-by: Meredith Lancaster <malancas@github.com>

* check processed attestations slice length

Signed-off-by: Meredith Lancaster <malancas@github.com>

* update err name and message

Signed-off-by: Meredith Lancaster <malancas@github.com>

---------

Signed-off-by: Meredith Lancaster <malancas@github.com>
2024-09-04 10:31:41 -06:00
Aryan Bhosale
9a0a7d427e
verify 2nd artifact without swapping order (#9532)
* verify 2nd artifact without swapping order

possible solution to https://github.com/cli/cli/issues/9521#issuecomment-2310686619?

* copy the mentioned test file and adds some extra lines

* rm unnecessary import

* Update pkg/cmd/attestation/verification/attestation_test.go

Co-authored-by: Meredith Lancaster <malancas@users.noreply.github.com>

* gofmt

---------

Co-authored-by: Meredith Lancaster <malancas@users.noreply.github.com>
2024-09-04 08:57:56 -06:00
crystalstall
5562c1489f chore: fix some function names
Signed-off-by: crystalstall <crystalruby@qq.com>
2024-09-02 15:18:42 +08:00
Andy Feller
03c34e71f9 Expand active test cases 2024-08-30 10:57:51 -04:00
Zongle Wang
192f57ef42
Improve the help message for -F (#9525)
Changing to `release-notes.md` from `changelog.md` may help users better contextually understand usage.

Co-authored-by: Tyler McGoffin <jtmcg@github.com>
2024-08-28 11:00:46 -07:00
Velmurugan
db9c76310d
Merge branch 'trunk' into auth-status-active 2024-08-28 21:33:38 +05:30
Andy Feller
327451627c
Merge pull request #9509 from muzimuzhi/typo/repo-sync
Fix doc typo for `repo sync`
2024-08-28 09:29:24 -04:00
Velmurugan
e6cbfaa690
Merge branch 'trunk' into auth-status-active 2024-08-27 19:42:27 +05:30
Aryan Bhosale
8305a49c3f
"offline" verification using the bundle of attestations without any additional handling of the file (#9523) 2024-08-26 09:58:29 -06:00
Velmurugan
1eecfd4530 Added --active flag to the gh auth status command 2024-08-24 16:24:51 +05:30
Andy Feller
19daa35c81
Merge pull request #9482 from benebsiny/cli-9153
fix the trimming of log filenames for `gh run view`
2024-08-22 15:23:06 -04:00
Tyler McGoffin
91eb34011c
Remove Internal from gh repo create prompt when owner is not an org (#9465)
* Remove `Internal` from `gh repo create` prompt when owner is not an org

Closes #9464

Internal repos only exist for organizations, so when a user selects their
personal namespace to create a repo using `gh repo create`, `Internal`
should not be an option in the `Visibility` prompt.

This should avoid the additional quirk where if the user selects
`Internal` while creating a personal repo and then proceeds to add any
of the README, .gitignore, or LICENSE files prompted for later, the repo
will not error and instead get created as a `Public` repo. This has the
potential for a user to unknowingly leak sensitive info intended to go
into a non-public repo.

* Refactor prompter with test coverage

By extracting the repo visibility options to its own function,
getRepoVisibilityOptions, we're able to directly test the behavior
introduced with this change. This breaks the testing pattern established
here thus far, but may be a good example of the direction we should
explore for a future refactor.

* Add failing tests to check for error with internal vis in non-org repos

There is a bug in the code, currently, where a user repo can attempt to be
created as with `--internal` visibility flag  when that is not an option
for non-org repos. It fails at the API level if the --gitignore,
--license, or --add-readme flags are not included, but silently falls back
to Public visibility if one of them is included.

Because this bug already existed, this commit adds the tests to ensure
that both scenarios described above are captured accurately by the test
suite. A fix for the latter scenario will be coming in a future commit

* Add Exclude to httpmock registry and implement in Test_repoCreate

Upon attempting to make the previous commit pass, I realized that it was
actually impossible to test what I wanted to. The tests in the previous
commit were behaving as expected given the bug that commit described, but
upon attempting to implement a solution I realized that the tests were
only testing the mocks and not the code functionality itself.

Essentially, when the code to fix the bug was implemented, the tests were
failing because the mocks required to test the buggy behavior were no
longer being called. To make the tests pass, I'd have to rewrite them, but
were I to remove the bug fix, the tests would no longer fail.

This pointed me to a gap in our httpmocks - the ability to intentionally
exclude api calls. The behavior I'm trying to test, here, is that we stop
executing when a certain condition is met, and therefore won't make any
subsequent api calls down the chain.

This implements the Exclude method on the registry such that it will fail
if an excluded api pattern is called. I have refactored the tests in
Test_repoCreate to use the Exclude mock for testing.

* Add error if user attempts to create repo with --internal flag

This was previously failing at either the API if no other flags were
included or falling back to creating a public repo if one of gitignore,
license, or add-readme were included.

* Add testing for error messages in gh repo create

In the previous commits, we've introduced a new error when a user tries to
create an Internal repo not owned by an organization. This adds tests to
verify that the error we are getting is, in fact, the one associated with
this use case and not some random error.
2024-08-22 10:01:16 -07:00
Yukai Chou
2374e82633 Fix doc typo for repo sync 2024-08-23 00:17:31 +08:00
Eugene
ef9069a1b0
Merge pull request #9421 from cli/eugene/attestation/fetch-oci-bundle
Fetch bundle from OCI registry for verify
2024-08-22 09:54:03 -04:00
Yukai Chou
c81ccab4b8
Quote repo names consistently in gh repo sync stdout (#9491)
* Quote repo names consistently in `gh repo sync` stdout

* Update tests
2024-08-21 12:20:45 -07:00
Andy Feller
779a1203b6
Merge pull request #9471 from heaths/issue9470
Always print URL scheme to stdout
2024-08-21 14:46:52 -04:00
Eugene
e21d053faf
Merge branch 'trunk' into eugene/attestation/fetch-oci-bundle 2024-08-21 12:24:08 -04:00
ejahnGithub
0d38a2fd8e fixed the test 2024-08-21 10:52:42 -04:00