9 Commits

Author	SHA1	Message	Date
David Dworken	83a0beff43	Bump go version, remove the vendored slsa library, and depend on a newer copy with a different API. Updates now work.	2022-09-02 00:15:58 -07:00
David Dworken	c918c5042e	Fix test on incorrect update output + prevent downgrades	2022-06-04 21:42:40 -07:00
David Dworken	de15305fb5	Patch vendored slsa verifier and fix updates	2022-06-04 21:31:16 -07:00
David Dworken	e638b9795b	Manually vendor the slsa_verifier lib so we can make tweaks to it	2022-06-04 21:21:49 -07:00
David Dworken	dd4e2e9278	Add TODO + better error messages	2022-06-04 20:35:47 -07:00
David Dworken	1da703e9c2	Working update code for macos	2022-05-26 23:45:08 -07:00
David Dworken	65bbb40732	Disable SLSA verification of the branch to fix update flow	2022-04-17 12:53:06 -07:00
David Dworken	cf55805578	Verify the version tag in SLSA too	2022-04-17 10:29:48 -07:00
David Dworken	3d7af0cd4b	Add SLSA verification of updated binary ... Currently the SLSA verifier is meant to be used a standalone binary. I copied a bit of code from their main (and imported the rest of their code as a library) in order to support embedding it as a library. This ensures that the updated hishtory passes SLSA L3.	2022-04-16 16:02:07 -07:00