diff --git a/.github/workflows/slsa-releaser.yml b/.github/workflows/slsa-releaser.yml index 50e7513..f356bd9 100644 --- a/.github/workflows/slsa-releaser.yml +++ b/.github/workflows/slsa-releaser.yml @@ -214,7 +214,7 @@ jobs: run: | go build; ./hishtory install # curl https://hishtory.dev/install.py | python3 - - ./hishtory validate-binary v0.`cat VERSION` hishtory-linux-amd64 hishtory-linux-amd64.intoto.jsonl + ./hishtory validate-binary hishtory-linux-amd64 hishtory-linux-amd64.intoto.jsonl # hishtory validate-binary v0.`cat VERSION` hishtory-linux-amd64 hishtory-linux-amd64.intoto.jsonl # TODO: Validate other binaries here \ No newline at end of file diff --git a/client/cmd/update.go b/client/cmd/update.go index 4d61a29..68646db 100644 --- a/client/cmd/update.go +++ b/client/cmd/update.go @@ -19,7 +19,6 @@ import ( "github.com/ddworken/hishtory/client/lib" "github.com/ddworken/hishtory/shared" "github.com/spf13/cobra" - "golang.org/x/mod/semver" ) var updateCmd = &cobra.Command{ @@ -34,23 +33,19 @@ var validateBinaryCmd = &cobra.Command{ Use: "validate-binary", Hidden: true, Short: "[Test Only] Validate the given binary for SLSA compliance", - Args: cobra.ExactArgs(3), + Args: cobra.ExactArgs(2), Run: func(cmd *cobra.Command, args []string) { ctx := hctx.MakeContext() - version := strings.TrimSpace(args[0]) - if !semver.IsValid(version) { - lib.CheckFatalError(fmt.Errorf("specified version %#v is not a valid version", version)) - } - binaryPath := args[1] - attestationPath := args[2] + binaryPath := args[0] + attestationPath := args[1] isMacOs, err := cmd.Flags().GetBool("is_macos") lib.CheckFatalError(err) if isMacOs { macOsUnsignedBinaryPath, err := cmd.Flags().GetString("macos_unsigned_binary") lib.CheckFatalError(err) - lib.CheckFatalError(verifyBinaryAgainstUnsignedBinaryForMac(ctx, binaryPath, macOsUnsignedBinaryPath, attestationPath, version)) + lib.CheckFatalError(verifyBinaryAgainstUnsignedBinaryForMac(ctx, binaryPath, macOsUnsignedBinaryPath, attestationPath, "")) } else { - lib.CheckFatalError(lib.VerifyBinary(ctx, binaryPath, attestationPath, version)) + lib.CheckFatalError(lib.VerifyBinary(ctx, binaryPath, attestationPath, "")) } }, } diff --git a/client/lib/slsa.go b/client/lib/slsa.go index d16fe1c..c485e60 100644 --- a/client/lib/slsa.go +++ b/client/lib/slsa.go @@ -17,10 +17,12 @@ import ( func verify(ctx context.Context, provenance []byte, artifactHash, source, branch, versionTag string) error { provenanceOpts := &options.ProvenanceOpts{ - ExpectedSourceURI: source, - ExpectedBranch: &branch, - ExpectedDigest: artifactHash, - ExpectedVersionedTag: &versionTag, + ExpectedSourceURI: source, + ExpectedBranch: &branch, + ExpectedDigest: artifactHash, + } + if versionTag != "" { + provenanceOpts.ExpectedVersionedTag = &versionTag } builderOpts := &options.BuilderOpts{} _, _, err := verifiers.Verify(ctx, provenance, artifactHash, provenanceOpts, builderOpts)