diff --git a/cmd/kosli/attestInToto.go b/cmd/kosli/attestInToto.go index 030ef181e..f9e5f1a77 100644 --- a/cmd/kosli/attestInToto.go +++ b/cmd/kosli/attestInToto.go @@ -1,6 +1,7 @@ package main import ( + "errors" "fmt" "io" "net/http" @@ -109,10 +110,17 @@ type attestInTotoOptions struct { githubToken string githubBaseURL string githubOrg string + githubOrgGiven bool repository string + repositoryGiven bool annotations map[string]string externalURLs map[string]string externalFingerprints map[string]string + + // github is the repository --source github reads, in the GitHub Actions + // run this command is part of. validate settles both once, so that the + // default signer is pinned to the repository and run actually read. + github intoto.GitHubRepository } const attestInTotoShortDesc = `Record an in-toto attestation, such as SLSA provenance or an SBOM, that a build already produced. ` @@ -137,12 +145,12 @@ Recording provenance and an SBOM takes two commands. ^--source^ chooses where the attestation is read from: - ^github^ reads the attestations GitHub holds for the artifact, where ^actions/attest^ - stores them, in the repository given with ^--github-org^ and ^--repository^. It needs - ^--github-token^, with the ^attestations: read^ permission. It is the default when - running in GitHub Actions. GitHub holds them by the digest that was attested, so name - an image by the digest the build pushed, as ^yourImageName@sha256:...^ with - ^--artifact-type oci^, or give that digest with ^--fingerprint^: a tag may since have - moved to another image. + stores them, in the repository given with ^--github-org^ and ^--repository^, or with + ^--repository^ alone as ^owner/name^. It needs ^--github-token^, with the + ^attestations: read^ permission. It is the default when running in GitHub Actions. + GitHub holds them by the digest that was attested, so name an image by the digest the + build pushed, as ^yourImageName@sha256:...^ with ^--artifact-type oci^, or give that + digest with ^--fingerprint^: a tag may since have moved to another image. - ^bundle^ reads the file given with ^--bundle^: a Sigstore bundle (^.sigstore.json^), a DSSE envelope, an in-toto statement, or an ^.intoto.jsonl^ file with one of these per line. It is the default elsewhere, and whenever ^--bundle^ is given. @@ -154,16 +162,23 @@ part of, then one made by any attempt of that run, then the newest. The statement must list the artifact as its subject. A signed attestation is verified with Sigstore against a signer you pin: ^--certificate-identity^ (or ^--certificate-identity-regexp^) with ^--certificate-oidc-issuer^, or ^--key^. There is no -way to accept any valid certificate. With ^--source github^ in GitHub Actions, a signer you -do not pin defaults to a workflow in the repository itself: the issuer -^https://token.actions.githubusercontent.com^ and an identity starting -^https://github.com///.github/workflows/^. Pin the signer yourself -when a reusable workflow in another repository did the signing. There is no default -outside GitHub Actions, when ^--github-base-url^ is given, or when the run is on a server -other than github.com, and the command stops before reading anything unless a signer is -pinned. An unsigned attestation is refused unless +way to accept any valid certificate. An unsigned attestation is refused unless ^--allow-unsigned^ is given, and is then recorded as unverified. +With ^--source github^ in GitHub Actions, a signer you do not pin defaults to a workflow in +the repository itself, for an attestation made by the run this command is part of: the +issuer ^https://token.actions.githubusercontent.com^, an identity starting +^https://github.com///.github/workflows/^, and a certificate issued +to that run, in any of its attempts. The identity alone is not enough to trust. It matches +the workflow file on any branch or pull request, so anyone who can push a branch could +attest the artifact with a predicate of their own. When the run made no attestation of +the artifact, the command fails and names the flags that pin a signer. Pin the signer +yourself, to the workflow file and the ref it runs on, to record an attestation another run +made, such as from a deployment workflow, or one a reusable workflow in another repository +signed. There is no default outside GitHub Actions, when ^--github-base-url^ is given, or +when the run is on a server other than github.com, and the command stops before reading +anything unless a signer is pinned. + In a file, an attestation that fails verification, because another signer made it or it was changed after signing, fails the command and nothing is recorded, even when another attestation in the file would qualify. So does a signed attestation whose signature cannot @@ -180,8 +195,10 @@ The record is annotated with ^verified^ and, for a signed attestation, ^signer_i ^signer_issuer^, ^log_index^, ^integrated_time^ and ^signed_timestamp^ where they apply. Provenance adds ^builder_id^, ^build_type^ and ^workflow^, and an SBOM adds ^sbom_format^ and ^sbom_sha256^. The ^attestation^ external URL links the attestation's transparency -log entry or, for one read from GitHub that has none, GitHub's listing of the artifact's -attestations. It is pinned by the SHA-256 of the attestation's bytes. +log entry, pinned by the SHA-256 of the attestation's bytes. An attestation read from +GitHub that has no entry in a public log, as in a private repository, links GitHub's API +listing of the artifact's attestations instead. Reading that listing needs a token, and it +holds every attestation of the artifact, so it is recorded without a fingerprint. For provenance, the commit's message, author and time are looked up on GitHub with ^--github-token^ when the statement names a GitHub repository, or else read from the git @@ -194,8 +211,9 @@ carry can be given with ^--build-url^ and ^--commit-url^. ` + fingerprintDesc + kosliIgnoreDesc const attestInTotoExample = ` -# in GitHub Actions, record the SLSA provenance actions/attest stored for an image, as the artifact named app. -# The image is named by the digest the build pushed, such as ghcr.io/yourOrg/yourImage@sha256:0123...: +# in the GitHub Actions run that built an image, record the SLSA provenance actions/attest stored for it, +# as the artifact named app. The image is named by the digest the build pushed, such as +# ghcr.io/yourOrg/yourImage@sha256:0123...: kosli attest in-toto yourImageName@yourImageDigest \ --artifact-type oci \ --predicate-type provenance \ @@ -217,7 +235,8 @@ kosli attest in-toto yourImageName@yourImageDigest \ --api-token yourAPIToken \ --org yourOrgName -# outside GitHub Actions, read a repository's attestations and pin the workflow that signed them. +# in another run, such as a deployment, or outside GitHub Actions, read a repository's attestations +# and pin the workflow that signed them, with the ref it ran on. # Giving the digest as the fingerprint skips reading it from the registry: kosli attest in-toto \ --fingerprint yourArtifactFingerprint \ @@ -227,7 +246,7 @@ kosli attest in-toto \ --github-token yourGithubToken \ --predicate-type provenance \ --name app \ - --certificate-identity-regexp '^https://github.com/yourGithubOrg/yourGithubRepo/.github/workflows/' \ + --certificate-identity https://github.com/yourGithubOrg/yourGithubRepo/.github/workflows/build.yml@refs/heads/main \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ --flow yourFlowName \ --trail yourTrailName \ @@ -311,6 +330,8 @@ func newAttestInTotoCmd(out io.Writer) *cobra.Command { if err := cmd.ValidateRequiredFlags(); err != nil { return err } + o.githubOrgGiven = cmd.Flags().Changed("github-org") + o.repositoryGiven = cmd.Flags().Changed("repository") if err := o.validate(); err != nil { return err } @@ -337,9 +358,8 @@ func newAttestInTotoCmd(out io.Writer) *cobra.Command { cmd.Flags().StringVar(&o.repoRoot, "repo-root", ".", intotoRepoRootFlag) cmd.Flags().StringVar(&o.githubToken, "github-token", "", intotoGithubTokenFlag) cmd.Flags().StringVar(&o.githubBaseURL, "github-base-url", "", intotoGithubBaseURLFlag) - ci := WhichCI() - cmd.Flags().StringVar(&o.githubOrg, "github-org", DefaultValue(ci, "org"), intotoGithubOrgFlag) - cmd.Flags().StringVar(&o.repository, "repository", DefaultValue(ci, "repository"), intotoRepositoryFlag) + cmd.Flags().StringVar(&o.githubOrg, "github-org", githubActionsDefault("org"), intotoGithubOrgFlag) + cmd.Flags().StringVar(&o.repository, "repository", githubActionsDefault("repository"), intotoRepositoryFlag) cmd.Flags().StringToStringVar(&o.annotations, "annotate", map[string]string{}, annotationFlag) cmd.Flags().StringToStringVar(&o.externalURLs, "external-url", map[string]string{}, externalURLFlag) cmd.Flags().StringToStringVar(&o.externalFingerprints, "external-fingerprint", map[string]string{}, externalFingerprintFlag) @@ -354,6 +374,16 @@ func newAttestInTotoCmd(out io.Writer) *cobra.Command { return cmd } +// githubActionsDefault is a flag's default in GitHub Actions and nothing in any +// other CI, whose project is not a GitHub repository to read attestations +// from. +func githubActionsDefault(flag string) string { + if ci := WhichCI(); ci == github { + return DefaultValue(ci, flag) + } + return "" +} + // addSignerPolicyFlags adds the flags that pin who must have signed an // attestation. They mirror cosign verify-attestation and gh attestation // verify, so a policy written for either carries across. @@ -367,7 +397,8 @@ func addSignerPolicyFlags(cmd *cobra.Command, policy *intoto.Policy) { // validate checks everything that needs nothing from the attestation, so a // mistake costs neither a fingerprint calculation nor a file read. func (o *attestInTotoOptions) validate() error { - if err := o.validateSource(); err != nil { + runURI, inActions := currentGitHubRun() + if err := o.validateSource(runURI, inActions); err != nil { return err } @@ -380,8 +411,10 @@ func (o *attestInTotoOptions) validate() error { if err := o.policy.Validate(); err != nil { return err } - if err := o.pinDefaultSigner(); err != nil { - return err + if o.source == intotoSourceGitHub { + if err := o.pinDefaultSigner(inActions); err != nil { + return err + } } if kind == intoto.KindProvenance && !templateArtifactNamePattern.MatchString(o.name) { @@ -409,11 +442,12 @@ func (o *attestInTotoOptions) validate() error { // validateSource settles which source the attestation is read from and // checks the flags that source needs. With no --source, a --bundle means the -// file; otherwise GitHub Actions means GitHub's attestations. -func (o *attestInTotoOptions) validateSource() error { +// file; otherwise GitHub Actions means GitHub's attestations. runURI is the +// GitHub Actions run this command is part of, when inActions. +func (o *attestInTotoOptions) validateSource(runURI string, inActions bool) error { if o.source == "" { o.source = intotoSourceBundle - if _, inActions := currentGitHubRun(); inActions && o.bundlePath == "" { + if inActions && o.bundlePath == "" { o.source = intotoSourceGitHub } } @@ -427,12 +461,24 @@ func (o *attestInTotoOptions) validateSource() error { if o.bundlePath != "" { return fmt.Errorf("--bundle cannot be used with --source %s", intotoSourceGitHub) } - if o.githubOrg == "" || o.repository == "" { + owner, name, err := githubOwnerAndName(o.githubOrg, o.githubOrgGiven, o.repository, o.repositoryGiven) + if err != nil { + return err + } + if owner == "" || name == "" { return fmt.Errorf("--github-org and --repository are required with --source %s", intotoSourceGitHub) } if o.githubToken == "" { return fmt.Errorf("--github-token is required with --source %s", intotoSourceGitHub) } + o.github = intoto.GitHubRepository{ + Owner: owner, + Name: name, + Token: o.githubToken, + BaseURL: o.githubAPI(), + Debug: global.Debug, + RunURI: runURI, + } default: return fmt.Errorf("--source %q is not supported. Must be one of: %s", o.source, strings.Join(intotoSources, ", ")) } @@ -440,54 +486,68 @@ func (o *attestInTotoOptions) validateSource() error { } // pinDefaultSigner gives --source github a signer when the caller pinned -// none: in GitHub Actions, a workflow in the repository itself. Everything -// GitHub holds is signed, so with no signer at all nothing could be recorded, -// and saying so here saves fetching attestations to find that out. -func (o *attestInTotoOptions) pinDefaultSigner() error { - if o.source != intotoSourceGitHub || o.policy.PinsSigner() { +// none: in GitHub Actions, a workflow in the repository itself, in the run +// this command is part of. Everything GitHub holds is signed, so with no +// signer at all nothing could be recorded, and saying so here saves fetching +// attestations to find that out. +func (o *attestInTotoOptions) pinDefaultSigner(inActions bool) error { + if o.policy.PinsSigner() { return nil } - runURI, inActions := currentGitHubRun() if !inActions { - return fmt.Errorf("--source %s needs a signer to verify attestations against. Pass --certificate-identity or --certificate-identity-regexp with --certificate-oidc-issuer, or --key. In GitHub Actions the signer defaults to a workflow in the repository itself", intotoSourceGitHub) + return fmt.Errorf("--source %s needs a signer to verify attestations against. Pass --certificate-identity or --certificate-identity-regexp with --certificate-oidc-issuer, or --key. In GitHub Actions the signer defaults to a workflow in the repository itself, for an attestation the same run made", intotoSourceGitHub) } // The default names github.com, which another server's workflows do not // sign as, so every attestation would fail on a mismatched identity. if o.githubBaseURL != "" { return fmt.Errorf("--source %s has no default signer when --github-base-url is given: the default is a workflow on github.com. Pass --certificate-identity or --certificate-identity-regexp with --certificate-oidc-issuer, or --key", intotoSourceGitHub) } - if !strings.HasPrefix(runURI, "https://github.com/") { + if !strings.HasPrefix(o.github.RunURI, "https://github.com/") { return fmt.Errorf("--source %s has no default signer in a GitHub Actions run on a server other than github.com: the default is a workflow on github.com. Name the server with --github-base-url, and pass --certificate-identity or --certificate-identity-regexp with --certificate-oidc-issuer, or --key", intotoSourceGitHub) } - signer := o.githubRepository().WorkflowSigner() - o.policy.CertificateOIDCIssuer = signer.CertificateOIDCIssuer - o.policy.CertificateIdentityRegexp = signer.CertificateIdentityRegexp - logger.Debug("no signer is pinned, so attestations must be signed by a workflow in the repository: issuer %s, identity matching %s", - signer.CertificateOIDCIssuer, signer.CertificateIdentityRegexp) + signer, err := o.github.DefaultSigner() + if err != nil { + return err + } + signer.AllowUnsigned = o.policy.AllowUnsigned + o.policy = signer + logger.Debug("no signer is pinned, so attestations must be signed by a workflow in the repository, in the run %s: issuer %s, identity matching %s", + signer.RunInvocationURI, signer.CertificateOIDCIssuer, signer.CertificateIdentityRegexp) return nil } // attestationSource is where --source says to read the attestation from. func (o *attestInTotoOptions) attestationSource() intoto.Source { if o.source == intotoSourceGitHub { - return o.githubRepository() + return o.github } return intoto.BundleFile{Path: o.bundlePath} } -func (o *attestInTotoOptions) githubRepository() intoto.GitHubRepository { - // NewGithubConfig strips the owner from --repository, which GitHub Actions - // defaults to owner/name. - config := ghUtils.NewGithubConfig(o.githubToken, o.githubAPI(), o.githubOrg, o.repository, global.Debug) - runURI, _ := currentGitHubRun() - return intoto.GitHubRepository{ - Owner: config.Org, - Name: config.Repository, - Token: config.Token, - BaseURL: config.BaseURL, - Debug: config.Debug, - RunURI: runURI, +// githubOwnerAndName settles which repository --github-org and --repository +// name. --repository may carry its owner, as the default GitHub Actions gives +// it does, and that owner is the one read. A --github-org the caller gave, +// rather than one GitHub Actions defaulted, must then name the same owner: +// reading either one's repository would silently ignore the other flag. That +// holds for a --repository GitHub Actions defaulted too, where the refusal +// says so. +func githubOwnerAndName(org string, orgGiven bool, repository string, repositoryGiven bool) (owner, name string, err error) { + owner, name, hasOwner := strings.Cut(repository, "/") + if !hasOwner { + return org, repository, nil + } + if owner == "" || name == "" || strings.Contains(name, "/") { + return "", "", fmt.Errorf("--repository '%s' is not a GitHub repository's name, or its owner and name as owner/name", repository) + } + // GitHub treats owner names as case-insensitive. + if orgGiven && !strings.EqualFold(org, owner) { + if !repositoryGiven { + // The caller never passed the --repository this is about. + return "", "", fmt.Errorf("--github-org '%s' is not the owner of '%s', which --repository defaulted to from GITHUB_REPOSITORY in this GitHub Actions run. Pass --repository as well to read another repository", org, repository) + } + return "", "", fmt.Errorf("--github-org '%s' is not the owner in --repository '%s'. Name the owner in one of them, or the same owner in both", org, repository) } + return owner, name, nil } // githubAPI is the base URL of the GitHub server the token is sent to. @@ -514,6 +574,10 @@ func (o *attestInTotoOptions) run(args []string) error { source := o.attestationSource() found, err := intoto.Find(source, o.kind, o.fingerprint, intoto.NewVerifier(o.policy, intotoTrustRoots())) + if errors.Is(err, intoto.ErrOtherRun) { + // Only the default signer is tied to a run. + return fmt.Errorf("%w. No signer is pinned, and the default only accepts an attestation made by the run this command is part of (%s). To record one made by another run, pin its signer: pass --certificate-identity or --certificate-identity-regexp with --certificate-oidc-issuer, or --key", err, o.policy.RunInvocationURI) + } if err != nil { return err } @@ -541,14 +605,18 @@ func (o *attestInTotoOptions) run(args []string) error { } // attestationLink points a reader at the attestation: its transparency log -// entry, which anyone can read, or failing that where its source holds it. -// The link is pinned by the SHA-256 of the attestation's bytes. +// entry, which anyone can read, pinned by the SHA-256 of the attestation's +// bytes, or failing that where its source holds it. What a source holds there +// is not the attestation alone, as GitHub's listing covers every attestation +// of the artifact, so that link carries no fingerprint. func attestationLink(found *intoto.Found) *URLInfo { - href := firstNonEmpty(found.Evidence.LogEntryURL, found.URL) - if href == "" { + if found.Evidence.LogEntryURL != "" { + return &URLInfo{Href: found.Evidence.LogEntryURL, Fingerprint: found.Evidence.RawSHA256} + } + if found.URL == "" { return nil } - return &URLInfo{Href: href, Fingerprint: found.Evidence.RawSHA256} + return &URLInfo{Href: found.URL} } func (o *attestInTotoOptions) recordProvenance(args []string, found *intoto.Found, externalURLs map[string]*URLInfo, annotations map[string]string) error { diff --git a/cmd/kosli/attestInToto_test.go b/cmd/kosli/attestInToto_test.go index 806ab911c..1ac93fa87 100644 --- a/cmd/kosli/attestInToto_test.go +++ b/cmd/kosli/attestInToto_test.go @@ -5,6 +5,7 @@ import ( "crypto/sha256" "encoding/json" "fmt" + "io" "net/http" "net/http/httptest" "os" @@ -21,13 +22,22 @@ import ( ) const ( - intotoFixtures = "../../internal/intoto/testdata" - intotoArtifact = intotoFixtures + "/artifact.bin" - intotoDigest = "e88951291bca0807a41f3c0144009bfff5c6c77dc1310d52e8c6d62feee960a8" - intotoCommit = "4f9d2a7c1e6b8a3d5f0e2c9b7a1d4e6f8c3b5a70" - intotoSigner = "--certificate-identity https://github.com/acme/widget/.github/workflows/build.yml@refs/heads/main --certificate-oidc-issuer https://token.actions.githubusercontent.com" - intotoBuildURL = "https://github.com/acme/widget/actions/runs/1234567890/attempts/1" - intotoRerunURL = "https://github.com/acme/widget/actions/runs/1234567890/attempts/2" + intotoFixtures = "../../internal/intoto/testdata" + intotoArtifact = intotoFixtures + "/artifact.bin" + intotoDigest = "e88951291bca0807a41f3c0144009bfff5c6c77dc1310d52e8c6d62feee960a8" + intotoCommit = "4f9d2a7c1e6b8a3d5f0e2c9b7a1d4e6f8c3b5a70" + intotoSigner = "--certificate-identity https://github.com/acme/widget/.github/workflows/build.yml@refs/heads/main --certificate-oidc-issuer https://token.actions.githubusercontent.com" + intotoBuildURL = "https://github.com/acme/widget/actions/runs/1234567890/attempts/1" + intotoRerunURL = "https://github.com/acme/widget/actions/runs/1234567890/attempts/2" + // intotoDeployURL is another run in the repository, such as a deployment + // of what the build at intotoBuildURL made. + intotoDeployURL = "https://github.com/acme/widget/actions/runs/77/attempts/1" + intotoBranchURL = "https://github.com/acme/widget/actions/runs/2222222222/attempts/1" + intotoBranchSigner = "https://github.com/acme/widget/.github/workflows/build.yml@refs/heads/feature-x" + intotoPullURL = "https://github.com/acme/widget/actions/runs/3333333333/attempts/1" + intotoPullSigner = "https://github.com/acme/widget/.github/workflows/build.yml@refs/pull/12/merge" + intotoMainSigner = "https://github.com/acme/widget/.github/workflows/build.yml@refs/heads/main" + intotoPinTheSigner = "No signer is pinned, and the default only accepts an attestation made by the run this command is part of (%s). To record one made by another run, pin its signer: pass --certificate-identity or --certificate-identity-regexp with --certificate-oidc-issuer, or --key" intotoListingPath = "/api/v3/repos/acme/widget/attestations/sha256:" + intotoDigest intotoCommitURL = "https://github.com/acme/widget/commit/" + intotoCommit intotoLogEntryURL = "https://rekor.localhost/api/v1/log/entries?logIndex=0" @@ -60,7 +70,7 @@ func (suite *AttestInTotoCommandTestSuite) SetupSuite() { // artifact, and the one commit the provenance fixtures name. suite.github = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { if r.URL.Path == intotoListingPath { - suite.listAttestations(w) + suite.listAttestations(w, r.URL.Query().Get("predicate_type")) return } if r.URL.Path != "/api/v3/repos/acme/widget/commits/"+intotoCommit { @@ -85,7 +95,10 @@ func (suite *AttestInTotoCommandTestSuite) TearDownSuite() { suite.github.Close() } -func (suite *AttestInTotoCommandTestSuite) listAttestations(w http.ResponseWriter) { +// listAttestations answers the listing as github.com was seen to in November +// 2026: a predicate type narrows it to the attestations whose predicate type +// starts with it, and one that matches nothing is answered with 404. +func (suite *AttestInTotoCommandTestSuite) listAttestations(w http.ResponseWriter, predicateType string) { suite.attestationsMu.Lock() defer suite.attestationsMu.Unlock() @@ -95,6 +108,9 @@ func (suite *AttestInTotoCommandTestSuite) listAttestations(w http.ResponseWrite } attestations := []listed{} for _, name := range suite.attestations { + if !strings.HasPrefix(suite.listedAs(name), predicateType) { + continue + } if name == intotoGoneBundle { attestations = append(attestations, listed{BundleURL: suite.github.URL + "/blobs/gone?sig=a-secret"}) continue @@ -105,9 +121,38 @@ func (suite *AttestInTotoCommandTestSuite) listAttestations(w http.ResponseWrite require.NoError(suite.T(), json.Compact(&bundle, content)) attestations = append(attestations, listed{Bundle: bundle.Bytes()}) } + if predicateType != "" && len(attestations) == 0 { + w.WriteHeader(http.StatusNotFound) + _, _ = fmt.Fprint(w, `{"message": "Not Found"}`) + return + } require.NoError(suite.T(), json.NewEncoder(w).Encode(map[string]any{"attestations": attestations})) } +// listedAs is the predicate type GitHub filters a stored attestation by: the +// one its statement states. What cannot be downloaded, or is not an +// attestation at all, is listed among the provenance. +func (suite *AttestInTotoCommandTestSuite) listedAs(name string) string { + const provenance = "https://slsa.dev/provenance/v1" + if name == intotoGoneBundle { + return provenance + } + content, err := os.ReadFile(filepath.Join(intotoFixtures, name)) + require.NoError(suite.T(), err) + var bundle struct { + DSSEEnvelope struct { + Payload []byte `json:"payload"` + } `json:"dsseEnvelope"` + } + var statement struct { + PredicateType string `json:"predicateType"` + } + if json.Unmarshal(content, &bundle) != nil || json.Unmarshal(bundle.DSSEEnvelope.Payload, &statement) != nil { + return provenance + } + return statement.PredicateType +} + // githubHolds sets the attestations GitHub lists for the artifact. func (suite *AttestInTotoCommandTestSuite) githubHolds(fixtures ...string) { suite.attestationsMu.Lock() @@ -489,6 +534,16 @@ func (suite *AttestInTotoCommandTestSuite) TestGitHubSourceRecordsWhatGitHubHold cmd: suite.command("--source github --github-org acme --repository acme/widget --predicate-type provenance --name app --dry-run " + intotoSigner + suite.githubArguments), goldenRegex: `(?s)"git_commit": "` + intotoCommit + `".*"verified": "true"`, }, + { + name: "takes the owner from --repository when it names one and --github-org is not given", + cmd: suite.command("--source github --repository acme/widget --predicate-type provenance --name app --dry-run " + intotoSigner + suite.githubArguments), + goldenRegex: `(?s)"git_commit": "` + intotoCommit + `".*"verified": "true"`, + }, + { + name: "takes a --github-org that names the owner in --repository in another case", + cmd: suite.command("--source github --github-org ACME --repository acme/widget --predicate-type provenance --name app --dry-run " + intotoSigner + suite.githubArguments), + goldenRegex: `(?s)"git_commit": "` + intotoCommit + `".*"verified": "true"`, + }, { name: "has the server accept the artifact", cmd: suite.fromGitHub("--source github --predicate-type provenance --name app " + intotoSigner), @@ -497,6 +552,24 @@ func (suite *AttestInTotoCommandTestSuite) TestGitHubSourceRecordsWhatGitHubHold }) } +func (suite *AttestInTotoCommandTestSuite) TestGitHubSourceReadsOnlyThePredicateTypeAskedFor() { + suite.githubHolds(intotoGoneBundle, "cyclonedx-sbom.sigstore.json", "spdx-sbom.sigstore.json") + + runTestCmd(suite.T(), []cmdTestCase{ + { + name: "records an SBOM without downloading the provenance GitHub holds too", + cmd: suite.fromGitHub("--source github --predicate-type sbom --name app.sbom --dry-run " + intotoSigner), + goldenRegex: `(?s)^[^\[].*"attestation_name": "sbom".*"verified": "true"`, + }, + { + wantError: true, + name: "still names the provenance it cannot download when provenance is asked for", + cmd: suite.fromGitHub("--source github --predicate-type provenance --name app " + intotoSigner), + goldenRegex: `^Error: GitHub repository acme/widget: the attestation: its bundle could not be downloaded from `, + }, + }) +} + func (suite *AttestInTotoCommandTestSuite) TestGitHubSourceInGitHubActions() { suite.githubHolds("github-provenance.sigstore.json") suite.inGitHubActions("https://github.com/acme/deploy/actions/runs/77/attempts/1") @@ -507,14 +580,9 @@ func (suite *AttestInTotoCommandTestSuite) TestGitHubSourceInGitHubActions() { cmd: suite.fromGitHub("--predicate-type provenance --name app --dry-run " + intotoSigner), goldenRegex: `(?s)"git_commit": "` + intotoCommit + `".*"verified": "true"`, }, - { - name: "pins the signer to a workflow in the repository when none is given", - cmd: suite.fromGitHub("--predicate-type provenance --name app --dry-run"), - goldenRegex: `(?s)"signer_identity": "https://github.com/acme/widget/.github/workflows/build.yml@refs/heads/main",\s+"signer_issuer": "https://token.actions.githubusercontent.com",\s+"verified": "true"`, - }, { name: "records the build's commit and run, not this job's, when run from another workflow", - cmd: suite.fromGitHub("--predicate-type provenance --name app --dry-run"), + cmd: suite.fromGitHub("--predicate-type provenance --name app --dry-run " + intotoSigner), goldenRegex: `(?s)"git_commit": "` + intotoCommit + `".*"build_url": "` + intotoBuildURL + `",\s+"commit_url": "` + intotoCommitURL + `"`, }, { @@ -523,18 +591,103 @@ func (suite *AttestInTotoCommandTestSuite) TestGitHubSourceInGitHubActions() { goldenRegex: `"build_url": "` + intotoRerunURL + `"`, }, }) +} + +func (suite *AttestInTotoCommandTestSuite) TestGitHubSourceDefaultSigner() { + // Newest last. The repository's own workflow file signed all three: on + // main in the build, then on a branch and in a pull request, which anyone + // who can push a branch can have attest the same artifact. + suite.githubHolds("github-provenance.sigstore.json", "branch-provenance.sigstore.json", "pull-request-provenance.sigstore.json") + defaultSigner := suite.fromGitHub("--predicate-type provenance --name app") + otherRuns := func(runURI string, madeBy ...string) string { + named := make([]string, len(madeBy)/2) + for i := range named { + described := "the attestation" + if len(named) > 1 { + described = fmt.Sprintf("attestation %d", i+1) + } + named[i] = fmt.Sprintf("%s was made by another run: %s, signed as %s", described, madeBy[2*i], madeBy[2*i+1]) + } + refused := named[0] + if len(named) > 1 { + refused = fmt.Sprintf("%d attestations could not be accepted: %s", len(named), strings.Join(named, "; ")) + } + return "Error: GitHub repository acme/widget: " + refused + ". " + fmt.Sprintf(intotoPinTheSigner, runURI) + "\n" + } + + suite.inGitHubActions(intotoBuildURL) + runTestCmd(suite.T(), []cmdTestCase{ + { + name: "is a workflow in the repository, for what the run this command is part of attested", + cmd: defaultSigner + " --dry-run", + goldenRegex: `(?s)^[^\[].*"build_url": "` + intotoBuildURL + `".*"signer_identity": "` + intotoMainSigner + `",\s+"signer_issuer": "https://token.actions.githubusercontent.com",\s+"verified": "true"`, + }, + }) + + runTestCmd(suite.T(), []cmdTestCase{ + { + name: "is a workflow in the repository --repository names with its owner", + cmd: suite.command("--repository acme/widget --predicate-type provenance --name app --dry-run --github-token a-token"), + goldenRegex: `(?s)"signer_identity": "` + intotoMainSigner + `",.*"verified": "true"`, + }, + }) + + suite.inGitHubActions(intotoRerunURL) + runTestCmd(suite.T(), []cmdTestCase{ + { + name: "accepts what an earlier attempt of the run attested", + cmd: defaultSigner + " --dry-run", + goldenRegex: `(?s)"build_url": "` + intotoBuildURL + `".*"verified": "true"`, + }, + }) + + suite.inGitHubActions(intotoDeployURL) + runTestCmd(suite.T(), []cmdTestCase{ + { + wantError: true, + name: "records nothing from outside the run that attested, naming each attestation and the flags that pin a signer", + cmd: defaultSigner, + golden: otherRuns(intotoDeployURL, intotoBuildURL, intotoMainSigner, intotoBranchURL, intotoBranchSigner, intotoPullURL, intotoPullSigner), + }, + { + name: "records main's attestation from outside its run once that signer is pinned, warning about the other two", + cmd: defaultSigner + " --dry-run " + intotoSigner, + goldenRegex: `(?s)^\[warning\] another attestation was not recorded: attestation 2 failed verification: .*refs/heads/feature-x.*\[warning\] another attestation was not recorded: attestation 3 failed verification: .*refs/pull/12/merge.*"build_url": "` + intotoBuildURL + `".*"signer_identity": "` + intotoMainSigner + `"`, + }, + }) + + suite.githubHolds("branch-provenance.sigstore.json") + runTestCmd(suite.T(), []cmdTestCase{ + { + wantError: true, + name: "does not accept an attestation a branch made in another run", + cmd: defaultSigner, + golden: otherRuns(intotoDeployURL, intotoBranchURL, intotoBranchSigner), + }, + }) + + suite.githubHolds("pull-request-provenance.sigstore.json") + runTestCmd(suite.T(), []cmdTestCase{ + { + wantError: true, + name: "does not accept an attestation a pull request made in another run", + cmd: defaultSigner, + golden: otherRuns(intotoDeployURL, intotoPullURL, intotoPullSigner), + }, + }) suite.githubHolds("wrong-signer-provenance.sigstore.json") + suite.inGitHubActions(intotoBuildURL) runTestCmd(suite.T(), []cmdTestCase{ { wantError: true, - name: "refuses an attestation signed by a workflow in another repository under the default signer", - cmd: suite.fromGitHub("--predicate-type provenance --name app"), - goldenRegex: `^Error: GitHub repository acme/widget: the attestation failed verification: .*https://github.com/mallory/widget`, + name: "refuses an attestation signed by a workflow in another repository", + cmd: defaultSigner, + goldenRegex: `^Error: GitHub repository acme/widget: the attestation failed verification: .*https://github.com/mallory/widget[^\n]*"\n$`, }, { name: "accepts it when that workflow is pinned explicitly", - cmd: suite.fromGitHub("--predicate-type provenance --name app --dry-run --certificate-identity-regexp ^https://github.com/mallory/ --certificate-oidc-issuer https://token.actions.githubusercontent.com"), + cmd: defaultSigner + " --dry-run --certificate-identity-regexp ^https://github.com/mallory/ --certificate-oidc-issuer https://token.actions.githubusercontent.com", goldenRegex: `"signer_identity": "https://github.com/mallory/widget/.github/workflows/build.yml@refs/heads/main"`, }, }) @@ -591,15 +744,16 @@ func (suite *AttestInTotoCommandTestSuite) TestGitHubSourceChoosesAmongSeveral() }, }) - suite.inGitHubActions("https://github.com/acme/deploy/actions/runs/77/attempts/1") + suite.inGitHubActions(intotoDeployURL) runTestCmd(suite.T(), []cmdTestCase{ { - name: "takes the newest when none was made by the run it is part of", - cmd: suite.fromGitHub("--predicate-type provenance --name app --dry-run"), + name: "takes the newest by the pinned signer when none was made by the run it is part of", + cmd: suite.fromGitHub("--predicate-type provenance --name app --dry-run " + intotoSigner), goldenRegex: `"build_url": "` + intotoRerunURL + `"`, }, }) + suite.inGitHubActions(intotoBuildURL) suite.githubHolds("wrong-signer-provenance.sigstore.json", "github-provenance.sigstore.json") runTestCmd(suite.T(), []cmdTestCase{ { @@ -670,7 +824,7 @@ func (suite *AttestInTotoCommandTestSuite) TestGitHubSourceWhenItCannotRecord() wantError: true, name: "no signer is pinned outside GitHub Actions, naming the flags that pin one", cmd: suite.fromGitHub("--source github --predicate-type provenance --name app"), - golden: "Error: --source github needs a signer to verify attestations against. Pass --certificate-identity or --certificate-identity-regexp with --certificate-oidc-issuer, or --key. In GitHub Actions the signer defaults to a workflow in the repository itself\n", + golden: "Error: --source github needs a signer to verify attestations against. Pass --certificate-identity or --certificate-identity-regexp with --certificate-oidc-issuer, or --key. In GitHub Actions the signer defaults to a workflow in the repository itself, for an attestation the same run made\n", }, { wantError: true, @@ -684,6 +838,24 @@ func (suite *AttestInTotoCommandTestSuite) TestGitHubSourceWhenItCannotRecord() cmd: suite.command("--source github --predicate-type provenance --name app " + intotoSigner + suite.githubArguments), golden: "Error: --github-org and --repository are required with --source github\n", }, + { + wantError: true, + name: "a --github-org that is not the owner in --repository, rather than reading either's repository", + cmd: suite.command("--source github --github-org acme --repository platform/widget --predicate-type provenance --name app " + intotoSigner + suite.githubArguments), + golden: "Error: --github-org 'acme' is not the owner in --repository 'platform/widget'. Name the owner in one of them, or the same owner in both\n", + }, + { + wantError: true, + name: "a --repository that is neither a name nor an owner and a name", + cmd: suite.command("--source github --repository https://github.com/acme/widget --predicate-type provenance --name app " + intotoSigner + suite.githubArguments), + golden: "Error: --repository 'https://github.com/acme/widget' is not a GitHub repository's name, or its owner and name as owner/name\n", + }, + { + wantError: true, + name: "a --repository without its owner and no --github-org, naming both", + cmd: suite.command("--source github --repository widget --predicate-type provenance --name app " + intotoSigner + suite.githubArguments), + golden: "Error: --github-org and --repository are required with --source github\n", + }, { wantError: true, name: "a --bundle as well", @@ -756,6 +928,119 @@ func (suite *AttestInTotoCommandTestSuite) TestRejectsBadFlags() { }) } +func TestGitHubOwnerAndName(t *testing.T) { + for name, tc := range map[string]struct { + org string + orgGiven bool + repository string + owner string + repo string + }{ + "takes the owner from --github-org and the name from --repository": {"acme", true, "widget", "acme", "widget"}, + "takes the owner from --repository when --github-org is not given": {"", false, "acme/widget", "acme", "widget"}, + "takes the owner from --repository over a --github-org that GitHub Actions only defaulted": {"acme", false, "platform/app", "platform", "app"}, + "takes a --github-org that agrees with the owner in --repository, as GitHub Actions gives": {"acme", true, "acme/widget", "acme", "widget"}, + "takes a --github-org that differs from the owner in --repository only in its letters' case": {"Acme", true, "acme/widget", "acme", "widget"}, + } { + t.Run(name, func(t *testing.T) { + owner, repo, err := githubOwnerAndName(tc.org, tc.orgGiven, tc.repository, true) + require.NoError(t, err) + require.Equal(t, tc.owner, owner) + require.Equal(t, tc.repo, repo) + }) + } + + t.Run("refuses a --github-org the caller gave that is not the owner in --repository", func(t *testing.T) { + _, _, err := githubOwnerAndName("acme", true, "platform/app", true) + require.EqualError(t, err, "--github-org 'acme' is not the owner in --repository 'platform/app'. Name the owner in one of them, or the same owner in both") + }) + + t.Run("refuses a --github-org the caller gave that is not the owner of the repository GitHub Actions defaulted, saying where the repository came from", func(t *testing.T) { + _, _, err := githubOwnerAndName("platform", true, "acme/widget", false) + require.EqualError(t, err, intotoNotTheRunsOwner) + }) + + for _, repository := range []string{"acme/widget/extra", "/widget", "acme/", "https://github.com/acme/widget"} { + t.Run("refuses --repository "+repository, func(t *testing.T) { + _, _, err := githubOwnerAndName("acme", true, repository, true) + require.EqualError(t, err, "--repository '"+repository+"' is not a GitHub repository's name, or its owner and name as owner/name") + }) + } +} + +// intotoNotTheRunsOwner refuses --github-org platform in a run of acme/widget +// that gave no --repository. +const intotoNotTheRunsOwner = "--github-org 'platform' is not the owner of 'acme/widget', which --repository defaulted to from GITHUB_REPOSITORY in this GitHub Actions run. Pass --repository as well to read another repository" + +func TestAttestInTotoGitHubOrgInARunOfAnotherOwnersRepository(t *testing.T) { + clearCIEnv(t) + // DefaultValue gives no default at all under either of these. + for _, name := range []string{"KOSLI_TESTS", "DOCS"} { + t.Setenv(name, "") + require.NoError(t, os.Unsetenv(name)) + } + for name, value := range map[string]string{ + "GITHUB_RUN_NUMBER": "7", "GITHUB_SERVER_URL": "https://github.com", "GITHUB_REPOSITORY_OWNER": "acme", + "GITHUB_REPOSITORY": "acme/widget", "GITHUB_RUN_ID": "1234567890", "GITHUB_RUN_ATTEMPT": "1", + } { + t.Setenv(name, value) + } + command := "attest in-toto --fingerprint " + intotoDigest + " --predicate-type provenance --name app --github-token a-token" + + " --flow attest-in-toto --trail test-123 --host http://localhost:8001 --org docs-cmd-test-user --api-token a-token " + + t.Run("refuses a --github-org given without --repository, saying the repository was defaulted and how to name another", func(t *testing.T) { + _, output, _, _, err := executeCommandC(command + "--github-org platform") + require.Error(t, err) + require.Equal(t, "Error: "+intotoNotTheRunsOwner+"\n", output) + }) + + t.Run("names both flags when the caller gave --repository too", func(t *testing.T) { + _, output, _, _, err := executeCommandC(command + "--github-org platform --repository acme/widget") + require.Error(t, err) + require.Equal(t, "Error: --github-org 'platform' is not the owner in --repository 'acme/widget'. Name the owner in one of them, or the same owner in both\n", output) + }) +} + +func TestAttestInTotoGitHubRepositoryDefaults(t *testing.T) { + defaults := func(t *testing.T, env map[string]string) (githubOrg, repository string) { + t.Helper() + clearCIEnv(t) + // DefaultValue gives no default at all under either of these. + for _, name := range []string{"KOSLI_TESTS", "DOCS"} { + t.Setenv(name, "") + require.NoError(t, os.Unsetenv(name)) + } + for name, value := range env { + t.Setenv(name, value) + } + saved := global + global = &GlobalOpts{} + t.Cleanup(func() { global = saved }) + flags := newAttestInTotoCmd(io.Discard).Flags() + return flags.Lookup("github-org").DefValue, flags.Lookup("repository").DefValue + } + + t.Run("are the run's repository and its owner in GitHub Actions", func(t *testing.T) { + githubOrg, repository := defaults(t, map[string]string{ + "GITHUB_RUN_NUMBER": "7", "GITHUB_REPOSITORY_OWNER": "acme", "GITHUB_REPOSITORY": "acme/widget"}) + require.Equal(t, "acme", githubOrg) + require.Equal(t, "acme/widget", repository) + }) + + for ci, env := range map[string]map[string]string{ + "GitLab CI": {"GITLAB_CI": "true", "CI_PROJECT_NAME": "widget", "CI_PROJECT_NAMESPACE": "acme"}, + "Bitbucket Pipelines": {"BITBUCKET_BUILD_NUMBER": "7", "BITBUCKET_REPO_SLUG": "widget", "BITBUCKET_WORKSPACE": "acme"}, + "Azure DevOps": {"TF_BUILD": "True", "BUILD_REPOSITORY_NAME": "widget"}, + "CircleCI": {"CIRCLECI": "true", "CIRCLE_PROJECT_REPONAME": "widget"}, + } { + t.Run("are nothing in "+ci+", whose project is not a GitHub repository", func(t *testing.T) { + githubOrg, repository := defaults(t, env) + require.Empty(t, githubOrg) + require.Empty(t, repository) + }) + } +} + func TestAttestationLink(t *testing.T) { found := func(logEntryURL, heldAt string) *intoto.Found { return &intoto.Found{ @@ -769,8 +1054,8 @@ func TestAttestationLink(t *testing.T) { require.Equal(t, &URLInfo{Href: intotoLogEntryURL, Fingerprint: "abc123"}, attestationLink(found(intotoLogEntryURL, listing))) }) - t.Run("links where the source holds the attestation when it has no log entry", func(t *testing.T) { - require.Equal(t, &URLInfo{Href: listing, Fingerprint: "abc123"}, attestationLink(found("", listing))) + t.Run("links where the source holds the attestation when it has no log entry, without a fingerprint that what is held there would not match", func(t *testing.T) { + require.Equal(t, &URLInfo{Href: listing}, attestationLink(found("", listing))) }) t.Run("links nothing for an attestation read from a file with no log entry", func(t *testing.T) { diff --git a/cmd/kosli/root.go b/cmd/kosli/root.go index 8d3051c86..920605fd1 100644 --- a/cmd/kosli/root.go +++ b/cmd/kosli/root.go @@ -358,8 +358,8 @@ Paths the list already matches stay excluded whatever is later added there, so k intotoRepoRootFlag = "[defaulted] The git checkout to read the commit's details from when they cannot be looked up. Provenance only." intotoGithubTokenFlag = "[conditional] A GitHub token. Required with --source github, to read the repository's attestations, which needs the 'attestations: read' permission. Also used to look up the commit's message, author and time when the provenance names a GitHub repository." intotoGithubBaseURLFlag = "[optional] The GitHub Enterprise Server to read attestations from with --source github, and to look the commit up on when the provenance names a repository there, such as https://github.example.com. Without it github.com is used, never a host taken from the provenance. With --source github the signer has no default on such a server and must be pinned." - intotoGithubOrgFlag = "[conditional] The GitHub organization or user owning the repository to read attestations from, with --source github. (defaulted if you are running in GitHub Actions: https://docs.kosli.com/integrations/ci_cd )." - intotoRepositoryFlag = "[conditional] The GitHub repository to read attestations from, with --source github. (defaulted if you are running in GitHub Actions: https://docs.kosli.com/integrations/ci_cd )." + intotoGithubOrgFlag = "[conditional] The GitHub organization or user owning the repository to read attestations from, with --source github. Not needed when --repository names the owner; when both do, they must name the same one. (defaulted if you are running in GitHub Actions: https://docs.kosli.com/integrations/ci_cd )." + intotoRepositoryFlag = "[conditional] The GitHub repository to read attestations from, with --source github: its name, or its owner and name as owner/name. (defaulted if you are running in GitHub Actions: https://docs.kosli.com/integrations/ci_cd )." excludeScalingFlag = "[optional] Exclude scaling events for snapshots. Snapshots with scaling changes will not result in new environment records." includeScalingFlag = "[optional] Include scaling events for snapshots. Snapshots with scaling changes will result in new environment records." includedEnvironments = "[optional] Comma separated list of environments to include in logical environment" diff --git a/docs/sample-workflows/attest-in-toto-github.yml b/docs/sample-workflows/attest-in-toto-github.yml index 4a5ab11ce..7f2530e6c 100644 --- a/docs/sample-workflows/attest-in-toto-github.yml +++ b/docs/sample-workflows/attest-in-toto-github.yml @@ -16,10 +16,19 @@ # --source defaults to github # --github-org defaults to this repository's owner # --repository defaults to this repository -# the signer defaults to a workflow in this repository +# the signer defaults to a workflow in this repository, for an +# attestation this run made # -# A reusable workflow in another repository signs as that repository, so pin it: -# --certificate-identity-regexp '^https://github.com/yourOrg/shared-workflows/' \ +# The default goes no further than this run, because a workflow file signs as +# this repository on any branch or pull request. To record the attestation from +# another run, such as a deployment workflow, pin the workflow that signed it +# and the ref it ran on: +# --certificate-identity https://github.com/yourOrg/yourRepo/.github/workflows/build.yml@refs/heads/main \ +# --certificate-oidc-issuer https://token.actions.githubusercontent.com +# +# A reusable workflow in another repository signs as that repository, so pin it +# too: +# --certificate-identity https://github.com/yourOrg/shared-workflows/.github/workflows/build.yml@refs/heads/main \ # --certificate-oidc-issuer https://token.actions.githubusercontent.com # # The flow's template is expected to declare an artifact named `app` with an @@ -98,8 +107,9 @@ jobs: run: kosli begin trail "${KOSLI_TRAIL}" # The commit, branch, repository and build URL recorded are the ones the - # provenance states, so this step could equally run in a later job or in - # another workflow, such as a deployment. + # provenance states, so this step could equally run in a later job of + # this run. In another workflow, such as a deployment, it also needs the + # signer pinned, as described at the top of this file. - name: Record the provenance in Kosli, as the artifact named app env: DIGEST: ${{ steps.build.outputs.digest }} diff --git a/internal/intoto/find.go b/internal/intoto/find.go index 575db8b5f..bc1fdf021 100644 --- a/internal/intoto/find.go +++ b/internal/intoto/find.go @@ -11,9 +11,10 @@ import ( // Source supplies the attestations held about an artifact. A source with its // own rules for choosing among them is also a Selector. type Source interface { - // Attestations returns every attestation the source holds that may be - // about the artifact with SHA-256 digest. Find checks each one. - Attestations(digest string) ([]*Attestation, error) + // Attestations returns the attestations the source holds that may be of + // kind and about the artifact with SHA-256 digest. Find checks each one, + // so a source that cannot narrow by either returns everything it holds. + Attestations(kind PredicateKind, digest string) ([]*Attestation, error) // String names the source in messages. String() string } @@ -24,9 +25,9 @@ type BundleFile struct { Path string } -// Attestations reads every attestation in the file; the digest selects -// nothing here. -func (f BundleFile) Attestations(string) ([]*Attestation, error) { +// Attestations reads every attestation in the file; the kind and the digest +// select nothing here. +func (f BundleFile) Attestations(PredicateKind, string) ([]*Attestation, error) { content, err := os.ReadFile(f.Path) if err != nil { return nil, err @@ -43,10 +44,10 @@ func (f BundleFile) String() string { // file, where every attestation is expected to verify. type Selection struct { // SkipFailed passes over an attestation that fails verification, whose - // signature cannot be checked, or that the source marked Unreadable, when - // another one verifies. It suits a store that several signers write to, - // where an attestation by another workflow says nothing against the one - // the policy pins. + // signature cannot be checked, that a run other than the policy's made, + // or that the source marked Unreadable, when another one verifies. It + // suits a store that several signers write to, where an attestation by + // another workflow says nothing against the one the policy pins. SkipFailed bool // PreferredRun is the run-invocation URI of the CI run the caller is part // of. An attestation whose certificate names it is chosen ahead of a newer @@ -70,7 +71,8 @@ type Found struct { // Rejected holds why other attestations of the same kind about the same // artifact were not chosen, such as being unsigned or, from a source that // skips them, failing verification, and why any the source holds could not - // be read, so a caller can report them. + // be read, so a caller can report them. One passed over only because + // another run made it is left out. Rejected []error } @@ -83,9 +85,10 @@ type Found struct { // If any signed one fails verification, or its signature cannot be checked, // Find returns that and chooses none: a signature that is bad, or that nobody // could check, is a stronger signal than a missing one, so an unsigned or -// verified alternative is not recorded in its place. An attestation of any -// kind that the source marked Unreadable counts the same way. A source whose -// Selection skips failures relaxes this only when another attestation +// verified alternative is not recorded in its place. One made by a run other +// than the one the verifier's policy is tied to counts the same way, and so +// does an attestation of any kind that the source marked Unreadable. A source +// whose Selection skips failures relaxes this only when another attestation // verifies; an unsigned one still does not stand in for one that failed. func Find(source Source, kind PredicateKind, digest string, verifier *Verifier) (*Found, error) { var selection Selection @@ -93,7 +96,7 @@ func Find(source Source, kind PredicateKind, digest string, verifier *Verifier) selection = selector.Selection() } - attestations, err := source.Attestations(digest) + attestations, err := source.Attestations(kind, digest) if err != nil { return nil, fmt.Errorf("%s: %w", source, err) } @@ -124,7 +127,7 @@ func Find(source Source, kind PredicateKind, digest string, verifier *Verifier) for _, candidate := range candidates { evidence, err := verifier.Verify(candidate, digest) switch { - case errors.Is(err, ErrFailedVerification), errors.Is(err, ErrCannotVerify): + case errors.Is(err, ErrFailedVerification), errors.Is(err, ErrCannotVerify), errors.Is(err, ErrOtherRun): unverifiable = append(unverifiable, err) case err != nil: rejected = append(rejected, err) @@ -134,7 +137,13 @@ func Find(source Source, kind PredicateKind, digest string, verifier *Verifier) } } if selection.SkipFailed && anyVerified { - rejected = append(rejected, unverifiable...) + for _, err := range unverifiable { + // A store holds what every earlier run attested about the artifact + // too, which is not worth a report on each later run. + if !errors.Is(err, ErrOtherRun) { + rejected = append(rejected, err) + } + } unverifiable = nil } if len(unverifiable) == 1 { @@ -156,7 +165,7 @@ func Find(source Source, kind PredicateKind, digest string, verifier *Verifier) return 0 case e.RunInvocationURI == selection.PreferredRun: return 2 - case withoutAttempt(e.RunInvocationURI) == withoutAttempt(selection.PreferredRun): + case sameRun(e.RunInvocationURI, selection.PreferredRun): return 1 } return 0 @@ -186,6 +195,13 @@ func withoutAttempt(runURI string) string { return runURI } +// sameRun reports whether two run-invocation URIs name the same GitHub +// Actions run, in whichever attempts. GitHub treats the owner and repository +// names in them as case-insensitive. +func sameRun(runURI, otherRunURI string) bool { + return strings.EqualFold(withoutAttempt(runURI), withoutAttempt(otherRunURI)) +} + // joinedErrors reports several errors on one line, which reads best on a // terminal, while errors.Is still finds each of them. type joinedErrors []error diff --git a/internal/intoto/fixtures_test.go b/internal/intoto/fixtures_test.go index c4e968aff..4ae8fbea0 100644 --- a/internal/intoto/fixtures_test.go +++ b/internal/intoto/fixtures_test.go @@ -50,6 +50,12 @@ const ( fixtureOtherIdentity = "https://github.com/mallory/widget/.github/workflows/build.yml@refs/heads/main" fixtureRunURI = "https://github.com/acme/widget/actions/runs/1234567890/attempts/1" fixtureRerunURI = "https://github.com/acme/widget/actions/runs/1234567890/attempts/2" + // A workflow file on a branch or a pull request signs as the repository + // too, in a run of its own. + fixtureBranchIdentity = "https://github.com/acme/widget/.github/workflows/build.yml@refs/heads/feature-x" + fixtureBranchRunURI = "https://github.com/acme/widget/actions/runs/2222222222/attempts/1" + fixturePullRequestIdentity = "https://github.com/acme/widget/.github/workflows/build.yml@refs/pull/12/merge" + fixturePullRequestRunURI = "https://github.com/acme/widget/actions/runs/3333333333/attempts/1" ) var ( @@ -269,6 +275,10 @@ func TestRegenerateFixtures(t *testing.T) { indent(t, s.bundle(statement("github-provenance.json"), fixtureOtherIdentity, time.Minute))) writeFixture(t, "rerun-provenance.sigstore.json", indent(t, s.bundleFromRun(statement("rerun-provenance.json"), fixtureIdentity, fixtureRerunURI, 2*time.Minute))) + writeFixture(t, "branch-provenance.sigstore.json", + indent(t, s.bundleFromRun(statement("github-provenance.json"), fixtureBranchIdentity, fixtureBranchRunURI, 3*time.Minute))) + writeFixture(t, "pull-request-provenance.sigstore.json", + indent(t, s.bundleFromRun(statement("github-provenance.json"), fixturePullRequestIdentity, fixturePullRequestRunURI, 4*time.Minute))) writeFixture(t, "tampered-provenance.sigstore.json", indent(t, tamper(t, s.bundle(statement("github-provenance.json"), fixtureIdentity, time.Minute), "4f9d2a7c1e6b8a3d5f0e2c9b7a1d4e6f8c3b5a70", "0000000000000000000000000000000000000000"))) diff --git a/internal/intoto/github.go b/internal/intoto/github.go index 9cda5d36c..d3e006526 100644 --- a/internal/intoto/github.go +++ b/internal/intoto/github.go @@ -65,16 +65,22 @@ func (g GitHubRepository) Selection() Selection { return Selection{SkipFailed: true, PreferredRun: g.RunURI} } -// WorkflowSigner pins the signer to a GitHub Actions workflow in the -// repository itself, on github.com. It is a safe default for a caller with no -// policy of its own; a reusable workflow in another repository signs as that -// repository and needs pinning explicitly. -func (g GitHubRepository) WorkflowSigner() Policy { +// DefaultSigner is the signer to trust for a caller with no policy of its own: +// a GitHub Actions workflow in the repository itself, on github.com, in the +// run the caller is part of. The identity matches a workflow file on any +// branch, tag or pull request, which anyone who can push a branch controls, so +// it is tied to that run; there is no default outside one. A reusable workflow +// in another repository signs as that repository and needs pinning explicitly. +func (g GitHubRepository) DefaultSigner() (Policy, error) { + if g.RunURI == "" { + return Policy{}, fmt.Errorf("%s has no default signer outside a GitHub Actions run to tie it to", g) + } // GitHub treats owner and repository names as case-insensitive. return Policy{ CertificateOIDCIssuer: GitHubActionsIssuer, CertificateIdentityRegexp: `(?i)^https://github\.com/` + regexp.QuoteMeta(g.Owner+"/"+g.Name) + `/\.github/workflows/`, - } + RunInvocationURI: g.RunURI, + }, nil } // githubAttestation is one entry of the attestations API's listing. GitHub @@ -85,10 +91,31 @@ type githubAttestation struct { BundleURL string `json:"bundle_url"` } -// Attestations returns every attestation GitHub holds in the repository for -// the artifact with SHA-256 digest. One whose bundle cannot be downloaded or -// does not parse is returned Unreadable. -func (g GitHubRepository) Attestations(digest string) ([]*Attestation, error) { +// identity recognises an attestation that another listing gave too: by where +// its bundle is downloaded from, or failing that by the bundle itself. It is +// empty for an entry with neither. A download URL is signed afresh for each +// listing, so its query is no part of it, which leaves two attestations in +// one listing free to share an identity. +func (a githubAttestation) identity() string { + if a.BundleURL == "" { + if string(a.Bundle) == "null" { + return "" + } + return string(a.Bundle) + } + if parsed, err := url.Parse(a.BundleURL); err == nil { + parsed.RawQuery = "" + return parsed.String() + } + return a.BundleURL +} + +// Attestations returns the attestations of kind that GitHub holds in the +// repository for the artifact with SHA-256 digest, without fetching the ones +// of other kinds. When it holds none of kind it returns them all, so that a +// caller can say what GitHub holds instead. One whose bundle cannot be +// downloaded or does not parse is returned Unreadable. +func (g GitHubRepository) Attestations(kind PredicateKind, digest string) ([]*Attestation, error) { digest = normaliseDigest(digest) ctx := context.Background() client, err := ghUtils.NewGithubClientFromToken(ctx, g.Token, g.BaseURL, g.Debug) @@ -97,14 +124,47 @@ func (g GitHubRepository) Attestations(digest string) ([]*Attestation, error) { } path := fmt.Sprintf("repos/%s/%s/attestations/sha256:%s", url.PathEscape(g.Owner), url.PathEscape(g.Name), digest) - listed, err := listGitHubAttestations(ctx, client, path) - if err != nil { - return nil, err + // A server that ignores the filter, as an older GitHub Enterprise Server + // may, answers each of these listings with everything it holds. An entry + // is skipped only when an earlier listing gave it: the entries of one + // listing are different attestations, however alike they look. + var listed []githubAttestation + inEarlierListing := map[string]bool{} + for _, predicateType := range kind.predicateTypes() { + ofType, err := listGitHubAttestations(ctx, client, path, predicateType) + if err != nil { + return nil, describeListError(err) + } + for _, entry := range ofType { + if identity := entry.identity(); identity == "" || !inEarlierListing[identity] { + listed = append(listed, entry) + } + } + for _, entry := range ofType { + if identity := entry.identity(); identity != "" { + inEarlierListing[identity] = true + } + } + } + if len(listed) == 0 { + // GitHub answers 404 both when nothing matches the filter and when the + // token cannot read the repository, and does not document how the + // filter matches. The whole listing tells the two apart. + // + // Every bundle in it is then downloaded, whatever its kind, so that the + // error can name the predicate types GitHub holds instead. That cost is + // a deliberate trade-off: it is paid only here, where no filter found + // anything, which ends in an error unless a filter missed an attestation. + listed, err = listGitHubAttestations(ctx, client, path, "") + if err != nil { + return nil, describeListError(err) + } } if len(listed) == 0 { return nil, fmt.Errorf("it holds no attestation for the artifact (sha256:%s)", digest) } + blobStore := newBundleClient() bundles := make([]json.RawMessage, len(listed)) missing := make([]error, len(listed)) for i, entry := range listed { @@ -112,7 +172,7 @@ func (g GitHubRepository) Attestations(digest string) ([]*Attestation, error) { case len(entry.Bundle) > 0 && string(entry.Bundle) != "null": bundles[i] = entry.Bundle case entry.BundleURL != "": - bundles[i], missing[i] = downloadBundle(ctx, entry.BundleURL) + bundles[i], missing[i] = downloadBundle(ctx, blobStore, entry.BundleURL) default: missing[i] = errors.New("GitHub lists neither a bundle nor a URL to download one from") } @@ -130,9 +190,16 @@ func (g GitHubRepository) Attestations(digest string) ([]*Attestation, error) { return attestations, nil } -func listGitHubAttestations(ctx context.Context, client *gh.Client, path string) ([]githubAttestation, error) { +// listGitHubAttestations lists what GitHub holds at path, through every page. +// A predicateType narrows the listing to the attestations whose predicate +// type starts with it, and is empty to list them all. GitHub answers a filter +// that matches nothing with 404, which is returned here as an empty listing. +func listGitHubAttestations(ctx context.Context, client *gh.Client, path, predicateType string) ([]githubAttestation, error) { var listed []githubAttestation query := url.Values{"per_page": {fmt.Sprint(githubAttestationsPerPage)}} + if predicateType != "" { + query.Set("predicate_type", predicateType) + } for { request, err := client.NewRequest(ctx, http.MethodGet, path+"?"+query.Encode(), nil) if err != nil { @@ -143,7 +210,11 @@ func listGitHubAttestations(ctx context.Context, client *gh.Client, path string) } response, err := client.Do(request, &page) if err != nil { - return nil, describeListError(err) + var refused *gh.ErrorResponse + if predicateType != "" && errors.As(err, &refused) && refused.Response != nil && refused.Response.StatusCode == http.StatusNotFound { + return listed, nil + } + return nil, err } listed = append(listed, page.Attestations...) @@ -168,10 +239,24 @@ func describeListError(err error) error { return fmt.Errorf("failed to list its attestations: %w", err) } +// newBundleClient returns the client that downloads the bundles GitHub stores +// apart from its API. One is shared by every download of a listing, so that +// they reuse its connections. +func newBundleClient() *retryablehttp.Client { + client := retryablehttp.NewClient() + client.Logger = nil + client.HTTPClient.Timeout = bundleDownloadTimeout + client.RetryMax = bundleRetries + client.RetryWaitMin = bundleRetryWait + client.RetryWaitMax = bundleRetryWait + client.ErrorHandler = retryablehttp.PassthroughErrorHandler + return client +} + // downloadBundle fetches a bundle GitHub stores apart from its API. The URL // is signed and points at blob storage, so the request carries no token. The // body is the bundle's JSON, snappy-compressed. -func downloadBundle(ctx context.Context, bundleURL string) ([]byte, error) { +func downloadBundle(ctx context.Context, client *retryablehttp.Client, bundleURL string) ([]byte, error) { // The URL's query is its signature, which does not belong in a message. shown := bundleURL if parsed, err := url.Parse(bundleURL); err == nil { @@ -182,14 +267,6 @@ func downloadBundle(ctx context.Context, bundleURL string) ([]byte, error) { return nil, fmt.Errorf("its bundle could not be downloaded from %s: %s", shown, fmt.Sprintf(format, args...)) } - client := retryablehttp.NewClient() - client.Logger = nil - client.HTTPClient.Timeout = bundleDownloadTimeout - client.RetryMax = bundleRetries - client.RetryWaitMin = bundleRetryWait - client.RetryWaitMax = bundleRetryWait - client.ErrorHandler = retryablehttp.PassthroughErrorHandler - request, err := retryablehttp.NewRequestWithContext(ctx, http.MethodGet, bundleURL, nil) if err != nil { return fail("the URL is not valid") diff --git a/internal/intoto/github_test.go b/internal/intoto/github_test.go index 5bfe8fdf5..c18a59bc6 100644 --- a/internal/intoto/github_test.go +++ b/internal/intoto/github_test.go @@ -28,14 +28,36 @@ type stored struct { blob bool // gone lists a download URL the blob store no longer answers. gone bool + // listedAs is the predicate type GitHub filters the attestation by, for a + // fixture that is not an attestation and so states none. + listedAs string } func inline(fixture string) stored { return stored{fixture: fixture, inline: true} } func blob(fixture string) stored { return stored{fixture: fixture, blob: true} } func gone(fixture string) stored { return stored{fixture: fixture, blob: true, gone: true} } +// notABundle is listed among the provenance attestations, though what GitHub +// returns for it is not an attestation. +func notABundle() stored { + return stored{fixture: "trusted_root.json", inline: true, listedAs: slsaProvenanceV1} +} + +const ( + listsProvenanceV1 = "per_page=100&predicate_type=https%3A%2F%2Fslsa.dev%2Fprovenance%2Fv1" + listsProvenanceV02 = "per_page=100&predicate_type=https%3A%2F%2Fslsa.dev%2Fprovenance%2Fv0.2" + listsSPDX = "per_page=100&predicate_type=https%3A%2F%2Fspdx.dev%2FDocument" + listsCycloneDX = "per_page=100&predicate_type=https%3A%2F%2Fcyclonedx.org%2Fbom" + listsEverything = "per_page=100" +) + // fakeGitHub serves the attestations API for acme/widget, one page of the // listing per element of pages, and the blob store bundles are downloaded from. +// +// It filters by predicate_type as github.com was seen to in November 2026, +// which GitHub's documentation does not describe: the filter matches an +// attestation whose predicate type starts with it, and a filter matching +// nothing is answered with 404 rather than an empty listing. type fakeGitHub struct { t *testing.T server *httptest.Server @@ -45,6 +67,12 @@ type fakeGitHub struct { blobBody func(bundle []byte) []byte // blobFailures is how many downloads fail with a 503 before one succeeds. blobFailures int + // ignoresFilter answers every listing with everything held, as a server + // that does not know the predicate_type parameter would. + ignoresFilter bool + // blobsByQuery names each bundle in the query of its download URL, so + // that the URLs of two bundles differ in nothing else. + blobsByQuery bool mu sync.Mutex listAuth []string @@ -73,6 +101,9 @@ func (f *fakeGitHub) serve(w http.ResponseWriter, r *http.Request) { defer f.mu.Unlock() if name, ok := strings.CutPrefix(r.URL.Path, "/blobs/"); ok { + if f.blobsByQuery { + name = r.URL.Query().Get("bundle") + } f.blobAuth = append(f.blobAuth, r.Header.Get("Authorization")) if f.blobFailures > 0 { f.blobFailures-- @@ -101,12 +132,22 @@ func (f *fakeGitHub) serve(w http.ResponseWriter, r *http.Request) { f.listAuth = append(f.listAuth, r.Header.Get("Authorization")) f.listQuery = append(f.listQuery, r.URL.RawQuery) + pages := f.pages + if filter := r.URL.Query().Get("predicate_type"); filter != "" && !f.ignoresFilter { + pages = f.matching(filter) + if len(pages) == 0 { + w.WriteHeader(http.StatusNotFound) + _, _ = fmt.Fprint(w, `{"message": "Not Found"}`) + return + } + } + page := 0 if after := r.URL.Query().Get("after"); after != "" { _, err := fmt.Sscanf(after, "cursor-%d", &page) require.NoError(f.t, err) } - if page+1 < len(f.pages) { + if page+1 < len(pages) { w.Header().Set("Link", fmt.Sprintf(`<%s%s?per_page=100&after=cursor-%d>; rel="next"`, f.server.URL, githubListPath, page+1)) } @@ -116,14 +157,18 @@ func (f *fakeGitHub) serve(w http.ResponseWriter, r *http.Request) { RepositoryID int64 `json:"repository_id"` } attestations := []listed{} - if page < len(f.pages) { - for _, s := range f.pages[page] { + if page < len(pages) { + for _, s := range pages[page] { entry := listed{RepositoryID: 123456789} if s.inline { entry.Bundle = f.bundle(s.fixture) } if s.blob { - entry.BundleURL = f.server.URL + "/blobs/" + s.fixture + "?sig=a-secret" + // Each listing signs its download URLs afresh. + entry.BundleURL = fmt.Sprintf("%s/blobs/%s?sig=a-secret-%d", f.server.URL, s.fixture, len(f.listQuery)) + if f.blobsByQuery { + entry.BundleURL = fmt.Sprintf("%s/blobs/?bundle=%s&sig=a-secret-%d", f.server.URL, s.fixture, len(f.listQuery)) + } } attestations = append(attestations, entry) } @@ -131,6 +176,44 @@ func (f *fakeGitHub) serve(w http.ResponseWriter, r *http.Request) { require.NoError(f.t, json.NewEncoder(w).Encode(map[string]any{"attestations": attestations})) } +// matching is the pages of the listing left when it is filtered by a predicate +// type. +func (f *fakeGitHub) matching(filter string) [][]stored { + var pages [][]stored + for _, page := range f.pages { + var matched []stored + for _, s := range page { + if strings.HasPrefix(f.predicateType(s), filter) { + matched = append(matched, s) + } + } + if len(matched) > 0 { + pages = append(pages, matched) + } + } + return pages +} + +// predicateType is the type GitHub filters an attestation by: the one its +// statement states. +func (f *fakeGitHub) predicateType(s stored) string { + if s.listedAs != "" { + return s.listedAs + } + var bundle struct { + DSSEEnvelope struct { + Payload []byte `json:"payload"` + } `json:"dsseEnvelope"` + } + var statement struct { + PredicateType string `json:"predicateType"` + } + if json.Unmarshal(f.bundle(s.fixture), &bundle) != nil || json.Unmarshal(bundle.DSSEEnvelope.Payload, &statement) != nil { + return "" + } + return statement.PredicateType +} + // blobFixture is the fixture the blob store holds under name, so a download // reads only what a test stored rather than whatever path the request names. func (f *fakeGitHub) blobFixture(name string) (string, bool) { @@ -151,23 +234,87 @@ func (f *fakeGitHub) bundle(fixture string) []byte { } func TestGitHubRepositoryAttestations(t *testing.T) { - t.Run("lists the artifact's attestations with the token and reads the bundles inline", func(t *testing.T) { - fake := newFakeGitHub(t, []stored{inline("github-provenance.sigstore.json"), inline("spdx-sbom.sigstore.json")}) + t.Run("lists the artifact's attestations of the kind wanted with the token and reads the bundles inline", func(t *testing.T) { + fake := newFakeGitHub(t, []stored{inline("spdx-sbom.sigstore.json"), inline("github-provenance.sigstore.json"), inline("slsa-v0.2-provenance.sigstore.json")}) - attestations, err := fake.repository().Attestations(artifactDigest) + attestations, err := fake.repository().Attestations(KindProvenance, artifactDigest) require.NoError(t, err) require.Len(t, attestations, 2) require.Equal(t, "https://slsa.dev/provenance/v1", attestations[0].Statement.GetPredicateType()) - require.Equal(t, "https://spdx.dev/Document/v2.3", attestations[1].Statement.GetPredicateType()) + require.Equal(t, "https://slsa.dev/provenance/v0.2", attestations[1].Statement.GetPredicateType()) require.True(t, attestations[0].Signed()) - require.Equal(t, []string{"Bearer a-token"}, fake.listAuth) - require.Equal(t, []string{"per_page=100"}, fake.listQuery) + require.Equal(t, []string{"Bearer a-token", "Bearer a-token"}, fake.listAuth) + require.Equal(t, []string{listsProvenanceV1, listsProvenanceV02}, fake.listQuery) + }) + + t.Run("lists SBOMs by the predicate type each format starts with, whatever version follows", func(t *testing.T) { + fake := newFakeGitHub(t, []stored{inline("cyclonedx-sbom.sigstore.json"), inline("github-provenance.sigstore.json"), inline("spdx-sbom.sigstore.json")}) + + attestations, err := fake.repository().Attestations(KindSBOM, artifactDigest) + require.NoError(t, err) + require.Len(t, attestations, 2) + require.Equal(t, "https://spdx.dev/Document/v2.3", attestations[0].Statement.GetPredicateType()) + require.Equal(t, "https://cyclonedx.org/bom", attestations[1].Statement.GetPredicateType()) + require.Equal(t, []string{listsSPDX, listsCycloneDX}, fake.listQuery) + }) + + t.Run("downloads no bundle of another kind", func(t *testing.T) { + fake := newFakeGitHub(t, []stored{blob("github-provenance.sigstore.json"), blob("rerun-provenance.sigstore.json"), blob("spdx-sbom.sigstore.json")}) + + attestations, err := fake.repository().Attestations(KindSBOM, artifactDigest) + require.NoError(t, err) + require.Len(t, attestations, 1) + require.Len(t, fake.blobAuth, 1) + }) + + t.Run("lists everything GitHub holds when it holds none of the kind, so that a caller can say what it holds instead", func(t *testing.T) { + fake := newFakeGitHub(t, []stored{inline("spdx-sbom.sigstore.json")}) + + attestations, err := fake.repository().Attestations(KindProvenance, artifactDigest) + require.NoError(t, err) + require.Len(t, attestations, 1) + require.Equal(t, "https://spdx.dev/Document/v2.3", attestations[0].Statement.GetPredicateType()) + require.Equal(t, []string{listsProvenanceV1, listsProvenanceV02, listsEverything}, fake.listQuery) + }) + + t.Run("reads each attestation once from a server that ignores the filter and lists everything for each predicate type", func(t *testing.T) { + fake := newFakeGitHub(t, []stored{blob("github-provenance.sigstore.json"), inline("spdx-sbom.sigstore.json"), blob("rerun-provenance.sigstore.json")}) + fake.ignoresFilter = true + + attestations, err := fake.repository().Attestations(KindProvenance, artifactDigest) + require.NoError(t, err) + require.Len(t, attestations, 3) + require.Equal(t, 3, attestations[2].Position) + require.Equal(t, []string{listsProvenanceV1, listsProvenanceV02}, fake.listQuery) + require.Len(t, fake.blobAuth, 2) + }) + + t.Run("reads both of two attestations in one listing whose download URLs differ only in the query", func(t *testing.T) { + fake := newFakeGitHub(t, []stored{blob("github-provenance.sigstore.json"), blob("rerun-provenance.sigstore.json")}) + fake.blobsByQuery = true + + attestations, err := fake.repository().Attestations(KindProvenance, artifactDigest) + require.NoError(t, err) + require.Len(t, attestations, 2) + require.Equal(t, fake.bundle("github-provenance.sigstore.json"), attestations[0].Raw) + require.Equal(t, fake.bundle("rerun-provenance.sigstore.json"), attestations[1].Raw) + }) + + t.Run("still reads each of them once from a server that ignores the filter", func(t *testing.T) { + fake := newFakeGitHub(t, []stored{blob("github-provenance.sigstore.json"), blob("rerun-provenance.sigstore.json")}) + fake.blobsByQuery = true + fake.ignoresFilter = true + + attestations, err := fake.repository().Attestations(KindProvenance, artifactDigest) + require.NoError(t, err) + require.Len(t, attestations, 2) + require.Len(t, fake.blobAuth, 2) }) t.Run("keeps each bundle's bytes, numbers them, and says where GitHub holds them", func(t *testing.T) { - fake := newFakeGitHub(t, []stored{inline("github-provenance.sigstore.json"), inline("spdx-sbom.sigstore.json")}) + fake := newFakeGitHub(t, []stored{inline("github-provenance.sigstore.json"), inline("rerun-provenance.sigstore.json")}) - attestations, err := fake.repository().Attestations(artifactDigest) + attestations, err := fake.repository().Attestations(KindProvenance, artifactDigest) require.NoError(t, err) require.Equal(t, fake.bundle("github-provenance.sigstore.json"), attestations[0].Raw) require.Equal(t, 1, attestations[0].Position) @@ -178,7 +325,7 @@ func TestGitHubRepositoryAttestations(t *testing.T) { t.Run("does not number the only attestation", func(t *testing.T) { fake := newFakeGitHub(t, []stored{inline("github-provenance.sigstore.json")}) - attestations, err := fake.repository().Attestations(artifactDigest) + attestations, err := fake.repository().Attestations(KindProvenance, artifactDigest) require.NoError(t, err) require.Len(t, attestations, 1) require.Equal(t, 0, attestations[0].Position) @@ -187,27 +334,27 @@ func TestGitHubRepositoryAttestations(t *testing.T) { t.Run("accepts a digest with its algorithm prefix", func(t *testing.T) { fake := newFakeGitHub(t, []stored{inline("github-provenance.sigstore.json")}) - attestations, err := fake.repository().Attestations("sha256:" + strings.ToUpper(artifactDigest)) + attestations, err := fake.repository().Attestations(KindProvenance, "sha256:"+strings.ToUpper(artifactDigest)) require.NoError(t, err) require.Len(t, attestations, 1) }) t.Run("follows the listing through every page", func(t *testing.T) { fake := newFakeGitHub(t, - []stored{inline("cyclonedx-sbom.sigstore.json")}, []stored{inline("github-provenance.sigstore.json")}, - []stored{inline("spdx-sbom.sigstore.json")}) + []stored{inline("rerun-provenance.sigstore.json")}, + []stored{inline("branch-provenance.sigstore.json")}) - attestations, err := fake.repository().Attestations(artifactDigest) + attestations, err := fake.repository().Attestations(KindProvenance, artifactDigest) require.NoError(t, err) require.Len(t, attestations, 3) - require.Equal(t, []string{"per_page=100", "after=cursor-1&per_page=100", "after=cursor-2&per_page=100"}, fake.listQuery) + require.Equal(t, []string{listsProvenanceV1, "after=cursor-1&" + listsProvenanceV1, "after=cursor-2&" + listsProvenanceV1, listsProvenanceV02}, fake.listQuery) }) t.Run("downloads a bundle GitHub lists by URL, without sending the token there", func(t *testing.T) { fake := newFakeGitHub(t, []stored{blob("github-provenance.sigstore.json")}) - attestations, err := fake.repository().Attestations(artifactDigest) + attestations, err := fake.repository().Attestations(KindProvenance, artifactDigest) require.NoError(t, err) require.Len(t, attestations, 1) require.Equal(t, fake.bundle("github-provenance.sigstore.json"), attestations[0].Raw) @@ -217,7 +364,7 @@ func TestGitHubRepositoryAttestations(t *testing.T) { t.Run("uses the inline bundle when GitHub gives both", func(t *testing.T) { fake := newFakeGitHub(t, []stored{{fixture: "github-provenance.sigstore.json", inline: true, blob: true}}) - _, err := fake.repository().Attestations(artifactDigest) + _, err := fake.repository().Attestations(KindProvenance, artifactDigest) require.NoError(t, err) require.Empty(t, fake.blobAuth) }) @@ -226,7 +373,7 @@ func TestGitHubRepositoryAttestations(t *testing.T) { fake := newFakeGitHub(t, []stored{blob("github-provenance.sigstore.json")}) fake.blobBody = func(bundle []byte) []byte { return bundle } - attestations, err := fake.repository().Attestations(artifactDigest) + attestations, err := fake.repository().Attestations(KindProvenance, artifactDigest) require.NoError(t, err) require.Len(t, attestations, 1) require.EqualError(t, attestations[0].Unreadable, "the attestation: its bundle could not be downloaded from "+fake.server.URL+"/blobs/github-provenance.sigstore.json: it is not snappy-compressed") @@ -236,7 +383,7 @@ func TestGitHubRepositoryAttestations(t *testing.T) { fake := newFakeGitHub(t, []stored{blob("github-provenance.sigstore.json")}) fake.blobBody = func([]byte) []byte { return make([]byte, 32<<20+1) } - attestations, err := fake.repository().Attestations(artifactDigest) + attestations, err := fake.repository().Attestations(KindProvenance, artifactDigest) require.NoError(t, err) require.ErrorContains(t, attestations[0].Unreadable, "/blobs/github-provenance.sigstore.json: it is larger than the 32 MiB a bundle may be") }) @@ -245,7 +392,7 @@ func TestGitHubRepositoryAttestations(t *testing.T) { fake := newFakeGitHub(t, []stored{blob("github-provenance.sigstore.json")}) fake.blobBody = func([]byte) []byte { return snappy.Encode(nil, make([]byte, 32<<20+1)) } - attestations, err := fake.repository().Attestations(artifactDigest) + attestations, err := fake.repository().Attestations(KindProvenance, artifactDigest) require.NoError(t, err) require.ErrorContains(t, attestations[0].Unreadable, "/blobs/github-provenance.sigstore.json: it would decompress to more than the 32 MiB a bundle may be") }) @@ -254,7 +401,7 @@ func TestGitHubRepositoryAttestations(t *testing.T) { fake := newFakeGitHub(t, []stored{blob("github-provenance.sigstore.json")}) fake.blobFailures = 2 - attestations, err := fake.repository().Attestations(artifactDigest) + attestations, err := fake.repository().Attestations(KindProvenance, artifactDigest) require.NoError(t, err) require.Len(t, attestations, 1) require.Len(t, fake.blobAuth, 3) @@ -264,7 +411,7 @@ func TestGitHubRepositoryAttestations(t *testing.T) { fake := newFakeGitHub(t, []stored{blob("github-provenance.sigstore.json")}) fake.blobFailures = 10 - attestations, err := fake.repository().Attestations(artifactDigest) + attestations, err := fake.repository().Attestations(KindProvenance, artifactDigest) require.NoError(t, err) require.Len(t, attestations, 1) require.ErrorContains(t, attestations[0].Unreadable, "its bundle could not be downloaded from "+fake.server.URL+"/blobs/github-provenance.sigstore.json: ") @@ -273,20 +420,20 @@ func TestGitHubRepositoryAttestations(t *testing.T) { }) t.Run("keeps an attestation whose bundle it cannot download, saying why, beside the ones it can", func(t *testing.T) { - fake := newFakeGitHub(t, []stored{gone("spdx-sbom.sigstore.json"), blob("github-provenance.sigstore.json")}) + fake := newFakeGitHub(t, []stored{gone("rerun-provenance.sigstore.json"), blob("github-provenance.sigstore.json")}) - attestations, err := fake.repository().Attestations(artifactDigest) + attestations, err := fake.repository().Attestations(KindProvenance, artifactDigest) require.NoError(t, err) require.Len(t, attestations, 2) - require.EqualError(t, attestations[0].Unreadable, "attestation 1: its bundle could not be downloaded from "+fake.server.URL+"/blobs/spdx-sbom.sigstore.json: 404 Not Found") + require.EqualError(t, attestations[0].Unreadable, "attestation 1: its bundle could not be downloaded from "+fake.server.URL+"/blobs/rerun-provenance.sigstore.json: 404 Not Found") require.NoError(t, attestations[1].Unreadable) require.Equal(t, fake.bundle("github-provenance.sigstore.json"), attestations[1].Raw) }) t.Run("keeps an attestation GitHub lists with neither a bundle nor a URL, beside the ones it can read", func(t *testing.T) { - fake := newFakeGitHub(t, []stored{inline("github-provenance.sigstore.json"), {fixture: "spdx-sbom.sigstore.json"}}) + fake := newFakeGitHub(t, []stored{inline("github-provenance.sigstore.json"), {fixture: "rerun-provenance.sigstore.json"}}) - attestations, err := fake.repository().Attestations(artifactDigest) + attestations, err := fake.repository().Attestations(KindProvenance, artifactDigest) require.NoError(t, err) require.Len(t, attestations, 2) require.NoError(t, attestations[0].Unreadable) @@ -296,7 +443,7 @@ func TestGitHubRepositoryAttestations(t *testing.T) { t.Run("says when GitHub holds no attestation for the artifact", func(t *testing.T) { fake := newFakeGitHub(t, []stored{}) - _, err := fake.repository().Attestations(artifactDigest) + _, err := fake.repository().Attestations(KindProvenance, artifactDigest) require.EqualError(t, err, "it holds no attestation for the artifact (sha256:"+artifactDigest+")") }) @@ -305,16 +452,16 @@ func TestGitHubRepositoryAttestations(t *testing.T) { repository := fake.repository() repository.Name = "gadget" - _, err := repository.Attestations(artifactDigest) + _, err := repository.Attestations(KindProvenance, artifactDigest) require.ErrorContains(t, err, "failed to list its attestations: ") require.ErrorContains(t, err, "404 Not Found") require.ErrorContains(t, err, "Either GitHub holds no attestation for the artifact, or the token cannot read the repository and its attestations (the attestations: read permission)") }) t.Run("keeps an attestation whose bundle it cannot read, saying why, beside the ones it can", func(t *testing.T) { - fake := newFakeGitHub(t, []stored{inline("github-provenance.sigstore.json"), inline("trusted_root.json")}) + fake := newFakeGitHub(t, []stored{inline("github-provenance.sigstore.json"), notABundle()}) - attestations, err := fake.repository().Attestations(artifactDigest) + attestations, err := fake.repository().Attestations(KindProvenance, artifactDigest) require.NoError(t, err) require.Len(t, attestations, 2) require.NoError(t, attestations[0].Unreadable) @@ -349,6 +496,17 @@ func TestFindInGitHubRepository(t *testing.T) { require.Len(t, found.Rejected, 1) }) + t.Run("reports another signer's attestation once from a server that ignores the filter", func(t *testing.T) { + fake := newFakeGitHub(t, []stored{inline("wrong-signer-provenance.sigstore.json"), blob("github-provenance.sigstore.json")}) + fake.ignoresFilter = true + + found, err := find(t, fake.repository(), KindProvenance) + require.NoError(t, err) + require.Equal(t, 2, found.Position) + require.Len(t, found.Rejected, 1) + require.ErrorContains(t, found.Rejected[0], "attestation 1 failed verification: ") + }) + t.Run("prefers the attestation made by the run it is part of", func(t *testing.T) { fake := newFakeGitHub(t, []stored{inline("github-provenance.sigstore.json"), inline("rerun-provenance.sigstore.json")}) repository := fake.repository() @@ -360,7 +518,7 @@ func TestFindInGitHubRepository(t *testing.T) { }) t.Run("passes over an attestation it cannot read when another verifies, and reports it", func(t *testing.T) { - fake := newFakeGitHub(t, []stored{inline("trusted_root.json"), inline("github-provenance.sigstore.json")}) + fake := newFakeGitHub(t, []stored{notABundle(), inline("github-provenance.sigstore.json")}) found, err := find(t, fake.repository(), KindProvenance) require.NoError(t, err) @@ -390,7 +548,7 @@ func TestFindInGitHubRepository(t *testing.T) { }) t.Run("names every attestation it cannot read or verify when none verifies", func(t *testing.T) { - fake := newFakeGitHub(t, []stored{inline("trusted_root.json"), inline("wrong-signer-provenance.sigstore.json")}) + fake := newFakeGitHub(t, []stored{notABundle(), inline("wrong-signer-provenance.sigstore.json")}) _, err := find(t, fake.repository(), KindProvenance) require.ErrorIs(t, err, ErrFailedVerification) @@ -419,18 +577,37 @@ func TestFindInGitHubRepository(t *testing.T) { }) } -func TestGitHubWorkflowSigner(t *testing.T) { - repository := GitHubRepository{Owner: "acme", Name: "widget.js"} +func TestGitHubDefaultSigner(t *testing.T) { + repository := GitHubRepository{Owner: "acme", Name: "widget.js", RunURI: "https://github.com/acme/widget.js/actions/runs/77/attempts/1"} + identityRegexp := func(t *testing.T) string { + policy, err := repository.DefaultSigner() + require.NoError(t, err) + return policy.CertificateIdentityRegexp + } t.Run("pins the GitHub Actions issuer and the repository's own workflows", func(t *testing.T) { - policy := repository.WorkflowSigner() + policy, err := repository.DefaultSigner() + require.NoError(t, err) require.Equal(t, "https://token.actions.githubusercontent.com", policy.CertificateOIDCIssuer) require.Regexp(t, policy.CertificateIdentityRegexp, "https://github.com/acme/widget.js/.github/workflows/build.yml@refs/heads/main") require.NoError(t, policy.Validate()) }) + t.Run("is tied to the run the caller is part of, as the identity matches a workflow on any branch or pull request", func(t *testing.T) { + policy, err := repository.DefaultSigner() + require.NoError(t, err) + require.Regexp(t, policy.CertificateIdentityRegexp, "https://github.com/acme/widget.js/.github/workflows/build.yml@refs/heads/feature-x") + require.Regexp(t, policy.CertificateIdentityRegexp, "https://github.com/acme/widget.js/.github/workflows/build.yml@refs/pull/12/merge") + require.Equal(t, repository.RunURI, policy.RunInvocationURI) + }) + + t.Run("does not exist for a caller that is part of no run", func(t *testing.T) { + _, err := GitHubRepository{Owner: "acme", Name: "widget.js"}.DefaultSigner() + require.EqualError(t, err, "GitHub repository acme/widget.js has no default signer outside a GitHub Actions run to tie it to") + }) + t.Run("matches the repository's name in any case, as GitHub does", func(t *testing.T) { - require.Regexp(t, repository.WorkflowSigner().CertificateIdentityRegexp, "https://github.com/Acme/Widget.JS/.github/workflows/build.yml@refs/heads/main") + require.Regexp(t, identityRegexp(t), "https://github.com/Acme/Widget.JS/.github/workflows/build.yml@refs/heads/main") }) for name, identity := range map[string]string{ @@ -440,7 +617,40 @@ func TestGitHubWorkflowSigner(t *testing.T) { "the repository's name later in another URL": "https://example.com/https://github.com/acme/widget.js/.github/workflows/build.yml", } { t.Run("does not match "+name, func(t *testing.T) { - require.NotRegexp(t, repository.WorkflowSigner().CertificateIdentityRegexp, identity) + require.NotRegexp(t, identityRegexp(t), identity) }) } } + +func TestFindInGitHubRepositoryUnderTheDefaultSigner(t *testing.T) { + // Newest last: the build on main, then what a branch and a pull request + // attested about the same artifact afterwards. + held := []stored{inline("github-provenance.sigstore.json"), inline("branch-provenance.sigstore.json"), inline("pull-request-provenance.sigstore.json")} + find := func(t *testing.T, runURI string) (*Found, error) { + repository := newFakeGitHub(t, held).repository() + repository.RunURI = runURI + signer, err := repository.DefaultSigner() + require.NoError(t, err) + return Find(repository, KindProvenance, artifactDigest, NewVerifier(signer, fixtureTrust(t))) + } + + t.Run("records what the run it is part of attested, not the newer attestations other runs made", func(t *testing.T) { + found, err := find(t, fixtureRunURI) + require.NoError(t, err) + require.Equal(t, fixtureIdentity, found.Evidence.SignerIdentity) + require.Equal(t, fixtureRunURI, found.Evidence.RunInvocationURI) + require.Empty(t, found.Rejected) + }) + + t.Run("records what an earlier attempt of the run attested", func(t *testing.T) { + found, err := find(t, fixtureRerunURI) + require.NoError(t, err) + require.Equal(t, fixtureRunURI, found.Evidence.RunInvocationURI) + }) + + t.Run("records nothing from another run, such as a deployment, though the repository's own workflows signed all three", func(t *testing.T) { + _, err := find(t, "https://github.com/acme/widget/actions/runs/77/attempts/1") + require.ErrorIs(t, err, ErrOtherRun) + require.ErrorContains(t, err, "GitHub repository acme/widget: 3 attestations could not be accepted: attestation 1 was made by another run: "+fixtureRunURI+", signed as "+fixtureIdentity+"; attestation 2 was made by another run: ") + }) +} diff --git a/internal/intoto/match.go b/internal/intoto/match.go index 9a7924d59..eef2eda31 100644 --- a/internal/intoto/match.go +++ b/internal/intoto/match.go @@ -56,6 +56,19 @@ func (k PredicateKind) Matches(predicateType string) bool { return false } +// predicateTypes lists the predicate types of this kind, each without the +// version a producer may append, for a source that can narrow what it returns +// to the predicate types starting with one. +func (k PredicateKind) predicateTypes() []string { + switch k { + case KindProvenance: + return []string{slsaProvenanceV1, slsaProvenanceV02} + case KindSBOM: + return []string{spdxDocument, cycloneDXBOM} + } + return nil +} + func hasVersionedPrefix(predicateType, base string) bool { return predicateType == base || strings.HasPrefix(predicateType, base+"/") } diff --git a/internal/intoto/testdata/README.md b/internal/intoto/testdata/README.md index e77909f74..f09eebb43 100644 --- a/internal/intoto/testdata/README.md +++ b/internal/intoto/testdata/README.md @@ -28,6 +28,8 @@ Sigstore signature is checked against the time Rekor logged it. | `trusted_root.json` | The trust root the signed fixtures verify against. | | `github-provenance.sigstore.json` | SLSA v1 provenance from GitHub Actions (`actions/attest-build-provenance`), signed by `https://github.com/acme/widget/.github/workflows/build.yml@refs/heads/main`. | | `rerun-provenance.sigstore.json` | The same build's provenance from attempt 2 of the run, logged a minute after attempt 1's. Its certificate names attempt 2 as the run. | +| `branch-provenance.sigstore.json` | The same provenance statement, signed by that workflow file on a branch (`@refs/heads/feature-x`) in another run, and logged after both attempts of the build. It is what anyone who can push a branch can make. | +| `pull-request-provenance.sigstore.json` | The same again from a pull request (`@refs/pull/12/merge`), in a third run, logged last. | | `buildkit-provenance.sigstore.json` | SLSA v1 provenance from BuildKit, signed by the same workflow. | | `slsa-v0.2-provenance.sigstore.json` | SLSA v0.2 provenance from the SLSA GitHub generator. | | `spdx-sbom.sigstore.json`, `cyclonedx-sbom.sigstore.json` | SBOM attestations (`actions/attest-sbom`). | diff --git a/internal/intoto/testdata/attestations.intoto.jsonl b/internal/intoto/testdata/attestations.intoto.jsonl index a57ef0ce1..c68018d73 100644 --- a/internal/intoto/testdata/attestations.intoto.jsonl +++ b/internal/intoto/testdata/attestations.intoto.jsonl @@ -1,3 +1,3 @@ -{"mediaType":"application/vnd.dev.sigstore.bundle.v0.3+json","verificationMaterial":{"certificate":{"rawBytes":"MIICzTCCAnSgAwIBAgIIOkuBkO5x9TUwCgYIKoZIzj0EAwIwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYxMTEyMDgxNjU1WhcNMjYxMTEyMDgyNzU1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyErm1D9aF6Fx1KugFF6TF/m7JZUEVDgz09uxwr7YSlg+tVatcEWlOaajnn5sStzRmBfjBtU92j4QFYaobJmos6OCAZ8wggGbMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAfBgNVHSMEGDAWgBSZpSIKVYxSQzu1jBpx0BTIUS5kPjBYBgNVHREBAf8ETjBMhkpodHRwczovL2dpdGh1Yi5jb20vYWNtZS93aWRnZXQvLmdpdGh1Yi93b3JrZmxvd3MvYnVpbGQueW1sQHJlZnMvaGVhZHMvbWFpbjA5BgorBgEEAYO/MAEBBCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAuBgorBgEEAYO/MAEMBCAMHmh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldDBRBgorBgEEAYO/MAEVBEMMQWh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldC9hY3Rpb25zL3J1bnMvMTIzNDU2Nzg5MC9hdHRlbXB0cy8xMAoGCCqGSM49BAMCA0cAMEQCIDG7hQAddvTvvhyh4sr5gBPbrhRNWy/mSQVK7DpYMesZAiApCUt1+va3VvrWk0+lCnulS51GzVtR+ONoDK4hOKJhGA=="},"tlogEntries":[{"logId":{"keyId":"VbgJJh1uXk4PvCPZ3fIjaxUep33R8Z6T6wAJfVjz+BA="},"kindVersion":{"kind":"dsse","version":"0.0.1"},"integratedTime":"1794471535","inclusionPromise":{"signedEntryTimestamp":"MEUCIDe06ot2s4+9pXJwZHiCHq8uDrkcgCfx5Yropdy9B16YAiEA/O9F9DPxEd5RO7mwtEpWaDpJDPlcW33g20Bg8m+Vsvo="},"inclusionProof":{"rootHash":"YGg+zrubIuKUrDKM48xAhdG9s/W9c/rnlJX6s/MKCF0=","treeSize":"1","checkpoint":{"envelope":"rekor.localhost - 123\n42\nYGg+zrubIuKUrDKM48xAhdG9s/W9c/rnlJX6s/MKCF0=\n\n— rekor.localhost VbgJJjBEAiB1hXrrNNw0P1IFSWbqt7RdPmysdpbrmbyRkuNnG3lu0wIgLY2hT5S9b3reLS2AbblmxqqfLvOJvt5yN+nUC2sWQQU=\n"}},"canonicalizedBody":"eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJzcGVjIjp7ImVudmVsb3BlSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjZlZTJlYzhmOTk3YzE0Yjk5YjllNjhhZDAyYzQ5NjYwNzY1NWJlYTUzMWY1M2FkY2Q5N2U5YmJhMWUxMWFhZTYifSwicGF5bG9hZEhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJiM2Q0NTk3OWYwMTRjNTAwNDdmOTMyZWM4NWYxYzFlZGQ1YjY4YWRiMmRiYTMwMzUxMDYzNTFjMzZjNWRhNmZmIn0sInNpZ25hdHVyZXMiOlt7InNpZ25hdHVyZSI6Ik1FVUNJUURaSVoxMENZb1FiUjZjQUdTekRHL3AwTmlrbGN1bnMyUEFDOS9hL3VVZTJRSWdDeXBBOFpCQ3NJekxGTkJlRjJSOUk1aG9ackRFNFVVb25iUzJPdlI4QmI4PSIsInZlcmlmaWVyIjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTjZWRU5EUVc1VFowRjNTVUpCWjBsSlQydDFRbXRQTlhnNVZGVjNRMmRaU1V0dldrbDZhakJGUVhkSmQwNTZSVlpOUWsxSFFURlZSVU5vVFUwS1l6SnNibU16VW5aamJWVjFXa2RXTWsxU05IZElRVmxFVmxGUlJFVjRWbnBoVjJSNlpFYzVlVnBUTVhCaWJsSnNZMjB4YkZwSGJHaGtSMVYzU0doalRncE5hbGw0VFZSRmVVMUVaM2hPYWxVeFYyaGpUazFxV1hoTlZFVjVUVVJuZVU1NlZURlhha0ZCVFVacmQwVjNXVWhMYjFwSmVtb3dRMEZSV1VsTGIxcEpDbnBxTUVSQlVXTkVVV2RCUlhsRmNtMHhSRGxoUmpaR2VERkxkV2RHUmpaVVJpOXROMHBhVlVWV1JHZDZNRGwxZUhkeU4xbFRiR2NyZEZaaGRHTkZWMndLVDJGaGFtNXVOWE5UZEhwU2JVSm1ha0owVlRreWFqUlJSbGxoYjJKS2JXOXpOazlEUVZvNGQyZG5SMkpOUVRSSFFURlZaRVIzUlVJdmQxRkZRWGRKU0FwblJFRlVRbWRPVmtoVFZVVkVSRUZMUW1kbmNrSm5SVVpDVVdORVFYcEJaa0puVGxaSVUwMUZSMFJCVjJkQ1UxcHdVMGxMVmxsNFUxRjZkVEZxUW5CNENqQkNWRWxWVXpWclVHcENXVUpuVGxaSVVrVkNRV1k0UlZScVFrMW9hM0J2WkVoU2QyTjZiM1pNTW1Sd1pFZG9NVmxwTldwaU1qQjJXVmRPZEZwVE9UTUtZVmRTYmxwWVVYWk1iV1J3WkVkb01WbHBPVE5pTTBweVdtMTRkbVF6VFhaWmJsWndZa2RSZFdWWE1YTlJTRXBzV201TmRtRkhWbWhhU0UxMllsZEdjQXBpYWtFMVFtZHZja0puUlVWQldVOHZUVUZGUWtKRGRHOWtTRkozWTNwdmRrd3pVblpoTWxaMVRHMUdhbVJIYkhaaWJrMTFXakpzTUdGSVZtbGtXRTVzQ21OdFRuWmlibEpzWW01UmRWa3lPWFJOUkhOSFEybHpSMEZSVVVKbk56aDNRVkZuUlV4UmQzSmhTRkl3WTBoTk5reDVPVEJpTW5Sc1ltazFhRmt6VW5BS1lqSTFla3h0WkhCa1IyZ3hXVzVXZWxwWVNtcGlNalV3V2xjMU1FeHRUblppVkVGMVFtZHZja0puUlVWQldVOHZUVUZGVFVKRFFVMUliV2d3WkVoQ2VncFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVhRmt5TVd4TU0yUndXa2RrYkdSRVFsSkNaMjl5UW1kRlJVRlpUeTlOUVVWV1FrVk5UVkZYYURCa1NFSjZDazlwT0haYU1td3dZVWhXYVV4dFRuWmlVemxvV1RJeGJFd3paSEJhUjJSc1pFTTVhRmt6VW5CaU1qVjZURE5LTVdKdVRYWk5WRWw2VGtSVk1rNTZaelVLVFVNNWFHUklVbXhpV0VJd1kzazRlRTFCYjBkRFEzRkhVMDAwT1VKQlRVTkJNR05CVFVWUlEwbEVSemRvVVVGa1pIWlVkblpvZVdnMGMzSTFaMEpRWWdweWFGSk9WM2t2YlZOUlZrczNSSEJaVFdWeldrRnBRWEJEVlhReEszWmhNMVoyY2xkck1DdHNRMjUxYkZNMU1VZDZWblJTSzA5T2IwUkxOR2hQUzBwb0NrZEJQVDBLTFMwdExTMUZUa1FnUTBWU1ZFbEdTVU5CVkVVdExTMHRMUW89In1dfSwia2luZCI6ImRzc2UifQ=="}],"timestampVerificationData":{"rfc3161Timestamps":[{"signedTimestamp":"MIICUTADAgEAMIICSAYJKoZIhvcNAQcCoIICOTCCAjUCAQMxDTALBglghkgBZQMEAgEwgYIGCyqGSIb3DQEJEAEEoHMEcTBvAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQg/2ShIBUqda2yrNAVMD2AL2n/hBwfDDuE9P80I/cGbYcCFQDL2mHf72FWG4I1vnqWkMi6+KM9/BgPMjAyNjExMTIwODE3NTVaoASkAjAAoAAxggGYMIIBlAIBATBAMDsxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEiMCAGA1UEAxMZc2lnc3RvcmUtdHNhLWludGVybWVkaWF0ZQIBATALBglghkgBZQMEAgGggeowGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEEMBwGCSqGSIb3DQEJBTEPFw0yNjExMTIwODE3NTVaMC8GCSqGSIb3DQEJBDEiBCBJ6gbFGF/m4EhIJGrrDyMxoGJu5pxiksPoAS4G6HHkYDB9BgsqhkiG9w0BCRACLzFuMGwwajBoBCBxsTcCVWXweYqyR+Mv0qEyQNFC6h3MFA0BmrBEHVH9tDBEMD+kPTA7MRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxIjAgBgNVBAMTGXNpZ3N0b3JlLXRzYS1pbnRlcm1lZGlhdGUCAQEwCgYIKoZIzj0EAwIERzBFAiAfW86RVnnPc0pZNU6/mX7eOFgxQ37mrXB5ds33u/VP5AIhAKlq6WzebIfA1WCp1qWcqsuDAVS8qsnrCKnhrUHv3xYm"}]}},"dsseEnvelope":{"payload":"eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoiYXJ0aWZhY3QuYmluIiwiZGlnZXN0Ijp7InNoYTI1NiI6ImU4ODk1MTI5MWJjYTA4MDdhNDFmM2MwMTQ0MDA5YmZmZjVjNmM3N2RjMTMxMGQ1MmU4YzZkNjJmZWVlOTYwYTgifX1dLCJwcmVkaWNhdGVUeXBlIjoiaHR0cHM6Ly9jb3NpZ24uc2lnc3RvcmUuZGV2L2F0dGVzdGF0aW9uL3Z1bG4vdjEiLCJwcmVkaWNhdGUiOnsiaW52b2NhdGlvbiI6eyJ1cmkiOiJodHRwczovL2dpdGh1Yi5jb20vYWNtZS93aWRnZXQvYWN0aW9ucy9ydW5zLzEyMzQ1Njc4OTAifSwic2Nhbm5lciI6eyJ1cmkiOiJwa2c6Z2l0aHViL2FxdWFzZWN1cml0eS90cml2eUAwLjUwLjAiLCJ2ZXJzaW9uIjoiMC41MC4wIiwicmVzdWx0Ijp7fX0sIm1ldGFkYXRhIjp7InNjYW5TdGFydGVkT24iOiIyMDI2LTExLTAxVDA5OjAwOjAwWiIsInNjYW5GaW5pc2hlZE9uIjoiMjAyNi0xMS0wMVQwOTowMTowMFoifX19","payloadType":"application/vnd.in-toto+json","signatures":[{"sig":"MEUCIQDZIZ10CYoQbR6cAGSzDG/p0Niklcuns2PAC9/a/uUe2QIgCypA8ZBCsIzLFNBeF2R9I5hoZrDE4UUonbS2OvR8Bb8="}]}} -{"mediaType":"application/vnd.dev.sigstore.bundle.v0.3+json","verificationMaterial":{"certificate":{"rawBytes":"MIICzzCCAnSgAwIBAgIIOfz7bYyETd0wCgYIKoZIzj0EAwIwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYxMTEyMDgxNjU1WhcNMjYxMTEyMDgyNzU1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEW6V762NfeV17RZFb1Qunj7n+MKLe9n+b42HzF1dlUUmkDaQezPBKJCCD65Kcvg5D3XA0DncPGTxbSs2TttSQEqOCAZ8wggGbMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAfBgNVHSMEGDAWgBSZpSIKVYxSQzu1jBpx0BTIUS5kPjBYBgNVHREBAf8ETjBMhkpodHRwczovL2dpdGh1Yi5jb20vYWNtZS93aWRnZXQvLmdpdGh1Yi93b3JrZmxvd3MvYnVpbGQueW1sQHJlZnMvaGVhZHMvbWFpbjA5BgorBgEEAYO/MAEBBCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAuBgorBgEEAYO/MAEMBCAMHmh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldDBRBgorBgEEAYO/MAEVBEMMQWh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldC9hY3Rpb25zL3J1bnMvMTIzNDU2Nzg5MC9hdHRlbXB0cy8xMAoGCCqGSM49BAMCA0kAMEYCIQD1YZ+pVhh3AOhf8fHAhFkVUncC4+8+bJZuQ73vfXotaQIhAL1Bo3BpnTmw1MHI+HxjYYlcLbNXGDRrsmo0yd3EMmII"},"tlogEntries":[{"logId":{"keyId":"VbgJJh1uXk4PvCPZ3fIjaxUep33R8Z6T6wAJfVjz+BA="},"kindVersion":{"kind":"dsse","version":"0.0.1"},"integratedTime":"1794471535","inclusionPromise":{"signedEntryTimestamp":"MEYCIQD8zvl2JTBf2I6G4uWL/L5NZCWBC5A6oZdAwF6GWUwmpAIhAK4Ssn4LuRKYECCguCSl+q0pR6x+TLLXNoX7I2OLC0en"},"inclusionProof":{"rootHash":"UCU50g6ykQuk3AwRnwJGQpsLJpuBMrocI8o/oxnt08k=","treeSize":"1","checkpoint":{"envelope":"rekor.localhost - 123\n42\nUCU50g6ykQuk3AwRnwJGQpsLJpuBMrocI8o/oxnt08k=\n\n— rekor.localhost VbgJJjBFAiA0uZnK7RKPVuBNd5RYmgHJSCoxC2Cu607xQAPyncu84gIhAIozGR1zFtJlpp5vsRtxWmiyKrdY85Eet4qRV7x22yC5\n"}},"canonicalizedBody":"eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJzcGVjIjp7ImVudmVsb3BlSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImQ2NWY5YTU5NjgzMDlmZjE0ODVhYzRhNjZmYmVlNmVlZTkzNjg3M2RmMmNhMmZlYmE3OWNmNzBlNzNmMGQ1ZWYifSwicGF5bG9hZEhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJmOTZjNDY3Y2I2Y2MzYmU1ZGRlMGE0YzZkYTFhZDQ5NTA3NGEzYjRiZTcyMDc2NDQyYzBmNGI4NzFjMTNhMWVlIn0sInNpZ25hdHVyZXMiOlt7InNpZ25hdHVyZSI6Ik1FVUNJQlNHbmZnM1dYcHpOa3ZUNDZtRGJXOVFobHc3ME5KdSs5djlDMVltVDFJM0FpRUE0SmJocHdIaEZWSHMrcjBRZXdJalFnQllxQWYrcGFONjMwUGJyTnlwa2FFPSIsInZlcmlmaWVyIjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTjZla05EUVc1VFowRjNTVUpCWjBsSlQyWjZOMkpaZVVWVVpEQjNRMmRaU1V0dldrbDZhakJGUVhkSmQwNTZSVlpOUWsxSFFURlZSVU5vVFUwS1l6SnNibU16VW5aamJWVjFXa2RXTWsxU05IZElRVmxFVmxGUlJFVjRWbnBoVjJSNlpFYzVlVnBUTVhCaWJsSnNZMjB4YkZwSGJHaGtSMVYzU0doalRncE5hbGw0VFZSRmVVMUVaM2hPYWxVeFYyaGpUazFxV1hoTlZFVjVUVVJuZVU1NlZURlhha0ZCVFVacmQwVjNXVWhMYjFwSmVtb3dRMEZSV1VsTGIxcEpDbnBxTUVSQlVXTkVVV2RCUlZjMlZqYzJNazVtWlZZeE4xSmFSbUl4VVhWdWFqZHVLMDFMVEdVNWJpdGlOREpJZWtZeFpHeFZWVzFyUkdGUlpYcFFRa3NLU2tORFJEWTFTMk4yWnpWRU0xaEJNRVJ1WTFCSFZIaGlVM015VkhSMFUxRkZjVTlEUVZvNGQyZG5SMkpOUVRSSFFURlZaRVIzUlVJdmQxRkZRWGRKU0FwblJFRlVRbWRPVmtoVFZVVkVSRUZMUW1kbmNrSm5SVVpDVVdORVFYcEJaa0puVGxaSVUwMUZSMFJCVjJkQ1UxcHdVMGxMVmxsNFUxRjZkVEZxUW5CNENqQkNWRWxWVXpWclVHcENXVUpuVGxaSVVrVkNRV1k0UlZScVFrMW9hM0J2WkVoU2QyTjZiM1pNTW1Sd1pFZG9NVmxwTldwaU1qQjJXVmRPZEZwVE9UTUtZVmRTYmxwWVVYWk1iV1J3WkVkb01WbHBPVE5pTTBweVdtMTRkbVF6VFhaWmJsWndZa2RSZFdWWE1YTlJTRXBzV201TmRtRkhWbWhhU0UxMllsZEdjQXBpYWtFMVFtZHZja0puUlVWQldVOHZUVUZGUWtKRGRHOWtTRkozWTNwdmRrd3pVblpoTWxaMVRHMUdhbVJIYkhaaWJrMTFXakpzTUdGSVZtbGtXRTVzQ21OdFRuWmlibEpzWW01UmRWa3lPWFJOUkhOSFEybHpSMEZSVVVKbk56aDNRVkZuUlV4UmQzSmhTRkl3WTBoTk5reDVPVEJpTW5Sc1ltazFhRmt6VW5BS1lqSTFla3h0WkhCa1IyZ3hXVzVXZWxwWVNtcGlNalV3V2xjMU1FeHRUblppVkVGMVFtZHZja0puUlVWQldVOHZUVUZGVFVKRFFVMUliV2d3WkVoQ2VncFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVhRmt5TVd4TU0yUndXa2RrYkdSRVFsSkNaMjl5UW1kRlJVRlpUeTlOUVVWV1FrVk5UVkZYYURCa1NFSjZDazlwT0haYU1td3dZVWhXYVV4dFRuWmlVemxvV1RJeGJFd3paSEJhUjJSc1pFTTVhRmt6VW5CaU1qVjZURE5LTVdKdVRYWk5WRWw2VGtSVk1rNTZaelVLVFVNNWFHUklVbXhpV0VJd1kzazRlRTFCYjBkRFEzRkhVMDAwT1VKQlRVTkJNR3RCVFVWWlEwbFJSREZaV2l0d1ZtaG9NMEZQYUdZNFpraEJhRVpyVmdwVmJtTkROQ3M0SzJKS1duVlJOek4yWmxodmRHRlJTV2hCVERGQ2J6TkNjRzVVYlhjeFRVaEpLMGg0YWxsWmJHTk1ZazVZUjBSU2NuTnRiekI1WkRORkNrMXRTVWtLTFMwdExTMUZUa1FnUTBWU1ZFbEdTVU5CVkVVdExTMHRMUW89In1dfSwia2luZCI6ImRzc2UifQ=="}],"timestampVerificationData":{"rfc3161Timestamps":[{"signedTimestamp":"MIICUDADAgEAMIICRwYJKoZIhvcNAQcCoIICODCCAjQCAQMxDTALBglghkgBZQMEAgEwgYEGCyqGSIb3DQEJEAEEoHIEcDBuAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQgeXmElBTa3aXZSS0gGu/VoGpZgPflk8dSUBn3owzk0U4CFEegf4TUAB0o6e0WzWPA/+AMy092GA8yMDI2MTExMjA4MTc1NVqgBKQCMACgADGCAZgwggGUAgEBMEAwOzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MSIwIAYDVQQDExlzaWdzdG9yZS10c2EtaW50ZXJtZWRpYXRlAgEBMAsGCWCGSAFlAwQCAaCB6jAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQAQQwHAYJKoZIhvcNAQkFMQ8XDTI2MTExMjA4MTc1NVowLwYJKoZIhvcNAQkEMSIEIFbZOF0BVe7kzgv3kKji2RzAyYa2yHUVV8pbjAKdP8H8MH0GCyqGSIb3DQEJEAIvMW4wbDBqMGgEIHGxNwJVZfB5irJH4y/SoTJA0ULqHcwUDQGasEQdUf20MEQwP6Q9MDsxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEiMCAGA1UEAxMZc2lnc3RvcmUtdHNhLWludGVybWVkaWF0ZQIBATAKBggqhkjOPQQDAgRHMEUCIH9xzvbEWxKNlpmOKLSWK90sUYZpR15RlJmXVdsD5M35AiEA+UJNspIvAT27IZXXDlkVaLY93rYyLiybPviLFNXsUMg="}]}},"dsseEnvelope":{"payload":"eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoiYXJ0aWZhY3QuYmluIiwiZGlnZXN0Ijp7InNoYTI1NiI6ImU4ODk1MTI5MWJjYTA4MDdhNDFmM2MwMTQ0MDA5YmZmZjVjNmM3N2RjMTMxMGQ1MmU4YzZkNjJmZWVlOTYwYTgifX1dLCJwcmVkaWNhdGVUeXBlIjoiaHR0cHM6Ly9zbHNhLmRldi9wcm92ZW5hbmNlL3YxIiwicHJlZGljYXRlIjp7ImJ1aWxkRGVmaW5pdGlvbiI6eyJidWlsZFR5cGUiOiJodHRwczovL2FjdGlvbnMuZ2l0aHViLmlvL2J1aWxkdHlwZXMvd29ya2Zsb3cvdjEiLCJleHRlcm5hbFBhcmFtZXRlcnMiOnsid29ya2Zsb3ciOnsicmVmIjoicmVmcy9oZWFkcy9tYWluIiwicmVwb3NpdG9yeSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldCIsInBhdGgiOiIuZ2l0aHViL3dvcmtmbG93cy9idWlsZC55bWwifX0sImludGVybmFsUGFyYW1ldGVycyI6eyJnaXRodWIiOnsiZXZlbnRfbmFtZSI6InB1c2giLCJyZXBvc2l0b3J5X2lkIjoiMTIzNDU2Nzg5IiwicmVwb3NpdG9yeV9vd25lcl9pZCI6Ijk4NzY1NDMyMSIsInJ1bm5lcl9lbnZpcm9ubWVudCI6ImdpdGh1Yi1ob3N0ZWQifX0sInJlc29sdmVkRGVwZW5kZW5jaWVzIjpbeyJ1cmkiOiJnaXQraHR0cHM6Ly9naXRodWIuY29tL2FjbWUvd2lkZ2V0QHJlZnMvaGVhZHMvbWFpbiIsImRpZ2VzdCI6eyJnaXRDb21taXQiOiI0ZjlkMmE3YzFlNmI4YTNkNWYwZTJjOWI3YTFkNGU2ZjhjM2I1YTcwIn19XX0sInJ1bkRldGFpbHMiOnsiYnVpbGRlciI6eyJpZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9hY3Rpb25zL3J1bm5lci9naXRodWItaG9zdGVkIn0sIm1ldGFkYXRhIjp7Imludm9jYXRpb25JZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldC9hY3Rpb25zL3J1bnMvMTIzNDU2Nzg5MC9hdHRlbXB0cy8xIn19fX0=","payloadType":"application/vnd.in-toto+json","signatures":[{"sig":"MEUCIBSGnfg3WXpzNkvT46mDbW9Qhlw70NJu+9v9C1YmT1I3AiEA4JbhpwHhFVHs+r0QewIjQgBYqAf+paN630PbrNypkaE="}]}} -{"mediaType":"application/vnd.dev.sigstore.bundle.v0.3+json","verificationMaterial":{"certificate":{"rawBytes":"MIICzjCCAnSgAwIBAgIIPwJywUVnVU4wCgYIKoZIzj0EAwIwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYxMTEyMDgxNjU1WhcNMjYxMTEyMDgyNzU1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEMFp4YlX0Kcz1cf6YRhcH1JG6gidBh3ikywoUzZkEpjzBmvyn+ycaFAgecQzEXiJJgBOSW/+TjpVzPragfrbVY6OCAZ8wggGbMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAfBgNVHSMEGDAWgBSZpSIKVYxSQzu1jBpx0BTIUS5kPjBYBgNVHREBAf8ETjBMhkpodHRwczovL2dpdGh1Yi5jb20vYWNtZS93aWRnZXQvLmdpdGh1Yi93b3JrZmxvd3MvYnVpbGQueW1sQHJlZnMvaGVhZHMvbWFpbjA5BgorBgEEAYO/MAEBBCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAuBgorBgEEAYO/MAEMBCAMHmh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldDBRBgorBgEEAYO/MAEVBEMMQWh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldC9hY3Rpb25zL3J1bnMvMTIzNDU2Nzg5MC9hdHRlbXB0cy8xMAoGCCqGSM49BAMCA0gAMEUCIF9lsHuKC0Ectz8FCe9g9ZjreDkpRuqgPrCDH8QRoCizAiEA7qQk/Sa5qI7P3HcxJN4e/8ZnFQHoAR4Zt/8wABpKm/4="},"tlogEntries":[{"logId":{"keyId":"VbgJJh1uXk4PvCPZ3fIjaxUep33R8Z6T6wAJfVjz+BA="},"kindVersion":{"kind":"dsse","version":"0.0.1"},"integratedTime":"1794471535","inclusionPromise":{"signedEntryTimestamp":"MEYCIQCt/Y+6bJ6XmxLwgLkJK/lX8MrTrmsne0DGuyNS7DC5AQIhAIz6DcpGj1NcyYLqVL3fDwBbCd8a1FlwZPaSZgMaZSfc"},"inclusionProof":{"rootHash":"8ndZ0HdSVBmzGTJarTDxllwLmKtFsqUbj8n77eNGByI=","treeSize":"1","checkpoint":{"envelope":"rekor.localhost - 123\n42\n8ndZ0HdSVBmzGTJarTDxllwLmKtFsqUbj8n77eNGByI=\n\n— rekor.localhost VbgJJjBFAiBH77VlKaZ2uOnl8SZqluSD9p1bzkQnOa1JdJlCkGU/eAIhAJ6cWoiw9dBe12zKqIPAsTtIfEC0m2xFmxqnJ9VYrphP\n"}},"canonicalizedBody":"eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJzcGVjIjp7ImVudmVsb3BlSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjhjNmE0ZWY3ZGY5NTQ3ZTFkYmI0ZWIzNjY0NjIzMDk4OWRiMGUwZDcwNDk4OGE0NmRhYjQ3ZGVlNzdlNGM5MjUifSwicGF5bG9hZEhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiIyMmQ2OGMxNmVhMTg2ZDIwNjk1YzVhMGY2NTgzYTNhNTM5NDVmMDg2YjU1OWUzZDE1Yjg1YjQ5NjVhOGIyZTk1In0sInNpZ25hdHVyZXMiOlt7InNpZ25hdHVyZSI6Ik1FVUNJUUQzYTRVUDdKb0RBcGZIaTlkVmU2R3hGdzUvRUVHZGViYVhxc0lBUzhLbFhRSWdMbjVJb1JSNGFXakVTUlQ0MkdMRzZ0UDk4aVZwTFdKUElZdXcwaFpsYm44PSIsInZlcmlmaWVyIjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTjZha05EUVc1VFowRjNTVUpCWjBsSlVIZEtlWGRWVm01V1ZUUjNRMmRaU1V0dldrbDZhakJGUVhkSmQwNTZSVlpOUWsxSFFURlZSVU5vVFUwS1l6SnNibU16VW5aamJWVjFXa2RXTWsxU05IZElRVmxFVmxGUlJFVjRWbnBoVjJSNlpFYzVlVnBUTVhCaWJsSnNZMjB4YkZwSGJHaGtSMVYzU0doalRncE5hbGw0VFZSRmVVMUVaM2hPYWxVeFYyaGpUazFxV1hoTlZFVjVUVVJuZVU1NlZURlhha0ZCVFVacmQwVjNXVWhMYjFwSmVtb3dRMEZSV1VsTGIxcEpDbnBxTUVSQlVXTkVVV2RCUlUxR2NEUlpiRmd3UzJONk1XTm1ObGxTYUdOSU1VcEhObWRwWkVKb00ybHJlWGR2VlhwYWEwVndhbnBDYlhaNWJpdDVZMkVLUmtGblpXTlJla1ZZYVVwS1owSlBVMWN2SzFScWNGWjZVSEpoWjJaeVlsWlpOazlEUVZvNGQyZG5SMkpOUVRSSFFURlZaRVIzUlVJdmQxRkZRWGRKU0FwblJFRlVRbWRPVmtoVFZVVkVSRUZMUW1kbmNrSm5SVVpDVVdORVFYcEJaa0puVGxaSVUwMUZSMFJCVjJkQ1UxcHdVMGxMVmxsNFUxRjZkVEZxUW5CNENqQkNWRWxWVXpWclVHcENXVUpuVGxaSVVrVkNRV1k0UlZScVFrMW9hM0J2WkVoU2QyTjZiM1pNTW1Sd1pFZG9NVmxwTldwaU1qQjJXVmRPZEZwVE9UTUtZVmRTYmxwWVVYWk1iV1J3WkVkb01WbHBPVE5pTTBweVdtMTRkbVF6VFhaWmJsWndZa2RSZFdWWE1YTlJTRXBzV201TmRtRkhWbWhhU0UxMllsZEdjQXBpYWtFMVFtZHZja0puUlVWQldVOHZUVUZGUWtKRGRHOWtTRkozWTNwdmRrd3pVblpoTWxaMVRHMUdhbVJIYkhaaWJrMTFXakpzTUdGSVZtbGtXRTVzQ21OdFRuWmlibEpzWW01UmRWa3lPWFJOUkhOSFEybHpSMEZSVVVKbk56aDNRVkZuUlV4UmQzSmhTRkl3WTBoTk5reDVPVEJpTW5Sc1ltazFhRmt6VW5BS1lqSTFla3h0WkhCa1IyZ3hXVzVXZWxwWVNtcGlNalV3V2xjMU1FeHRUblppVkVGMVFtZHZja0puUlVWQldVOHZUVUZGVFVKRFFVMUliV2d3WkVoQ2VncFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVhRmt5TVd4TU0yUndXa2RrYkdSRVFsSkNaMjl5UW1kRlJVRlpUeTlOUVVWV1FrVk5UVkZYYURCa1NFSjZDazlwT0haYU1td3dZVWhXYVV4dFRuWmlVemxvV1RJeGJFd3paSEJhUjJSc1pFTTVhRmt6VW5CaU1qVjZURE5LTVdKdVRYWk5WRWw2VGtSVk1rNTZaelVLVFVNNWFHUklVbXhpV0VJd1kzazRlRTFCYjBkRFEzRkhVMDAwT1VKQlRVTkJNR2RCVFVWVlEwbEdPV3h6U0hWTFF6QkZZM1I2T0VaRFpUbG5PVnBxY2dwbFJHdHdVblZ4WjFCeVEwUklPRkZTYjBOcGVrRnBSVUUzY1ZGckwxTmhOWEZKTjFBelNHTjRTazQwWlM4NFdtNUdVVWh2UVZJMFduUXZPSGRCUW5CTENtMHZORDBLTFMwdExTMUZUa1FnUTBWU1ZFbEdTVU5CVkVVdExTMHRMUW89In1dfSwia2luZCI6ImRzc2UifQ=="}],"timestampVerificationData":{"rfc3161Timestamps":[{"signedTimestamp":"MIICUTADAgEAMIICSAYJKoZIhvcNAQcCoIICOTCCAjUCAQMxDTALBglghkgBZQMEAgEwgYIGCyqGSIb3DQEJEAEEoHMEcTBvAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQgxLkI0QWhGnVVAUXyJjeLZiCQujwIzFsDaO6N4qO4ok8CFQCK89FxxnzMcLCku3K5g2Ut/fLtLBgPMjAyNjExMTIwODE3NTVaoASkAjAAoAAxggGYMIIBlAIBATBAMDsxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEiMCAGA1UEAxMZc2lnc3RvcmUtdHNhLWludGVybWVkaWF0ZQIBATALBglghkgBZQMEAgGggeowGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEEMBwGCSqGSIb3DQEJBTEPFw0yNjExMTIwODE3NTVaMC8GCSqGSIb3DQEJBDEiBCBsL+SQ48j9G71NGitG+ABs+6qXOQ1wQ8ZA5OGOHAGbGDB9BgsqhkiG9w0BCRACLzFuMGwwajBoBCBxsTcCVWXweYqyR+Mv0qEyQNFC6h3MFA0BmrBEHVH9tDBEMD+kPTA7MRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxIjAgBgNVBAMTGXNpZ3N0b3JlLXRzYS1pbnRlcm1lZGlhdGUCAQEwCgYIKoZIzj0EAwIERzBFAiEApm5p5pr02EyESxudoZ5UcLmy1V7D1FnY2Iw50ObJVUACIFZM89KchhfZSxyU/HM/zLJIt66MQy3C82RNn8+YGf4o"}]}},"dsseEnvelope":{"payload":"eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoiYXJ0aWZhY3QuYmluIiwiZGlnZXN0Ijp7InNoYTI1NiI6ImU4ODk1MTI5MWJjYTA4MDdhNDFmM2MwMTQ0MDA5YmZmZjVjNmM3N2RjMTMxMGQ1MmU4YzZkNjJmZWVlOTYwYTgifX1dLCJwcmVkaWNhdGVUeXBlIjoiaHR0cHM6Ly9jeWNsb25lZHgub3JnL2JvbSIsInByZWRpY2F0ZSI6eyJib21Gb3JtYXQiOiJDeWNsb25lRFgiLCJzcGVjVmVyc2lvbiI6IjEuNiIsInZlcnNpb24iOjEsIm1ldGFkYXRhIjp7InRpbWVzdGFtcCI6IjIwMjYtMTEtMDFUMDk6MDA6MDBaIiwidG9vbHMiOnsiY29tcG9uZW50cyI6W3sidHlwZSI6ImFwcGxpY2F0aW9uIiwibmFtZSI6ImV4YW1wbGUtc2JvbS10b29sIiwidmVyc2lvbiI6IjEuMCJ9XX0sImNvbXBvbmVudCI6eyJ0eXBlIjoiYXBwbGljYXRpb24iLCJuYW1lIjoiYXJ0aWZhY3QuYmluIiwidmVyc2lvbiI6IjEuMi4zIn19LCJjb21wb25lbnRzIjpbeyJ0eXBlIjoibGlicmFyeSIsIm5hbWUiOiJsZWZ0LXBhZCIsInZlcnNpb24iOiIxLjMuMCIsInB1cmwiOiJwa2c6bnBtL2xlZnQtcGFkQDEuMy4wIn1dfX0=","payloadType":"application/vnd.in-toto+json","signatures":[{"sig":"MEUCIQD3a4UP7JoDApfHi9dVe6GxFw5/EEGdebaXqsIAS8KlXQIgLn5IoRR4aWjESRT42GLG6tP98iVpLWJPIYuw0hZlbn8="}]}} +{"mediaType":"application/vnd.dev.sigstore.bundle.v0.3+json","verificationMaterial":{"certificate":{"rawBytes":"MIICzTCCAnSgAwIBAgIIBQx7MElZo+gwCgYIKoZIzj0EAwIwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYxMTEzMTQzNDU1WhcNMjYxMTEzMTQ0NTU1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEZRy8OuMDjHBMEYr+pnqEkmUrQnbC4v8KNSlMqKpd/lL0dT+Gom+ucrjahl5Wa+QtuQkLo289933cQFVijkxtX6OCAZ8wggGbMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAfBgNVHSMEGDAWgBQin5D6vOEQoe/EaGQlwHLhwEDhUTBYBgNVHREBAf8ETjBMhkpodHRwczovL2dpdGh1Yi5jb20vYWNtZS93aWRnZXQvLmdpdGh1Yi93b3JrZmxvd3MvYnVpbGQueW1sQHJlZnMvaGVhZHMvbWFpbjA5BgorBgEEAYO/MAEBBCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAuBgorBgEEAYO/MAEMBCAMHmh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldDBRBgorBgEEAYO/MAEVBEMMQWh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldC9hY3Rpb25zL3J1bnMvMTIzNDU2Nzg5MC9hdHRlbXB0cy8xMAoGCCqGSM49BAMCA0cAMEQCIA4UAzjivbp9wUncXANxovfQk70dgKV14FR/7e/3fViCAiAE611BQYeCu/7KqgaeH72GErmGyxo7lJmV2P2jhUybNA=="},"tlogEntries":[{"logId":{"keyId":"45EjT1abdD2MKrnHGSnayLaGvLNDQ4SRtMzNbF54fBc="},"kindVersion":{"kind":"dsse","version":"0.0.1"},"integratedTime":"1794580615","inclusionPromise":{"signedEntryTimestamp":"MEUCIQCkUdGzPBAy9URjHRz6mwaML5eNoj8SFlcYw1FNvlJijAIgaYKQQ0gJP/ojqbXstDEb5RJffpEay8RX+tCZKnkz+oI="},"inclusionProof":{"rootHash":"Codi4Wwu81aOT+dcakHrrJ3Z8c+ndkx/nxoV9WEPlI4=","treeSize":"1","checkpoint":{"envelope":"rekor.localhost - 123\n42\nCodi4Wwu81aOT+dcakHrrJ3Z8c+ndkx/nxoV9WEPlI4=\n\n— rekor.localhost 45EjTzBFAiEAqAHxPL5qNJK6PMbe1QGmhhxJS7XAG72wftlukXX5uBACIF6XXDC+47snoTAa09Y+6nJ+TT+TJkHIM/LDU7P7yYXe\n"}},"canonicalizedBody":"eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJzcGVjIjp7ImVudmVsb3BlSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjE0Njg2YTJlMzJjODg4NjJiOTZjYjEzYTU5ZjNmMGUzNGFlYTZiYTExZTM5MDUxN2Q5MWI3NTQ4ZWMxMjkwODkifSwicGF5bG9hZEhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJiM2Q0NTk3OWYwMTRjNTAwNDdmOTMyZWM4NWYxYzFlZGQ1YjY4YWRiMmRiYTMwMzUxMDYzNTFjMzZjNWRhNmZmIn0sInNpZ25hdHVyZXMiOlt7InNpZ25hdHVyZSI6Ik1FVUNJRkRRUGlHd1JFeE04NC9tcDllMktkMHdZMC94dUphRWl1NW5qb3B0b2h6VkFpRUFva2JIR1hiN2lzZXBFaXh5dVZTMzg0Szc3L2pnQVB2TWFlZUQxUW5Qems4PSIsInZlcmlmaWVyIjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTjZWRU5EUVc1VFowRjNTVUpCWjBsSlFsRjROMDFGYkZwdksyZDNRMmRaU1V0dldrbDZhakJGUVhkSmQwNTZSVlpOUWsxSFFURlZSVU5vVFUwS1l6SnNibU16VW5aamJWVjFXa2RXTWsxU05IZElRVmxFVmxGUlJFVjRWbnBoVjJSNlpFYzVlVnBUTVhCaWJsSnNZMjB4YkZwSGJHaGtSMVYzU0doalRncE5hbGw0VFZSRmVrMVVVWHBPUkZVeFYyaGpUazFxV1hoTlZFVjZUVlJSTUU1VVZURlhha0ZCVFVacmQwVjNXVWhMYjFwSmVtb3dRMEZSV1VsTGIxcEpDbnBxTUVSQlVXTkVVV2RCUlZwU2VUaFBkVTFFYWtoQ1RVVlpjaXR3Ym5GRmEyMVZjbEZ1WWtNMGRqaExUbE5zVFhGTGNHUXZiRXd3WkZRclIyOXRLM1VLWTNKcVlXaHNOVmRoSzFGMGRWRnJURzh5T0RrNU16TmpVVVpXYVdwcmVIUllOazlEUVZvNGQyZG5SMkpOUVRSSFFURlZaRVIzUlVJdmQxRkZRWGRKU0FwblJFRlVRbWRPVmtoVFZVVkVSRUZMUW1kbmNrSm5SVVpDVVdORVFYcEJaa0puVGxaSVUwMUZSMFJCVjJkQ1VXbHVOVVEyZGs5RlVXOWxMMFZoUjFGc0NuZElUR2gzUlVSb1ZWUkNXVUpuVGxaSVVrVkNRV1k0UlZScVFrMW9hM0J2WkVoU2QyTjZiM1pNTW1Sd1pFZG9NVmxwTldwaU1qQjJXVmRPZEZwVE9UTUtZVmRTYmxwWVVYWk1iV1J3WkVkb01WbHBPVE5pTTBweVdtMTRkbVF6VFhaWmJsWndZa2RSZFdWWE1YTlJTRXBzV201TmRtRkhWbWhhU0UxMllsZEdjQXBpYWtFMVFtZHZja0puUlVWQldVOHZUVUZGUWtKRGRHOWtTRkozWTNwdmRrd3pVblpoTWxaMVRHMUdhbVJIYkhaaWJrMTFXakpzTUdGSVZtbGtXRTVzQ21OdFRuWmlibEpzWW01UmRWa3lPWFJOUkhOSFEybHpSMEZSVVVKbk56aDNRVkZuUlV4UmQzSmhTRkl3WTBoTk5reDVPVEJpTW5Sc1ltazFhRmt6VW5BS1lqSTFla3h0WkhCa1IyZ3hXVzVXZWxwWVNtcGlNalV3V2xjMU1FeHRUblppVkVGMVFtZHZja0puUlVWQldVOHZUVUZGVFVKRFFVMUliV2d3WkVoQ2VncFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVhRmt5TVd4TU0yUndXa2RrYkdSRVFsSkNaMjl5UW1kRlJVRlpUeTlOUVVWV1FrVk5UVkZYYURCa1NFSjZDazlwT0haYU1td3dZVWhXYVV4dFRuWmlVemxvV1RJeGJFd3paSEJhUjJSc1pFTTVhRmt6VW5CaU1qVjZURE5LTVdKdVRYWk5WRWw2VGtSVk1rNTZaelVLVFVNNWFHUklVbXhpV0VJd1kzazRlRTFCYjBkRFEzRkhVMDAwT1VKQlRVTkJNR05CVFVWUlEwbEJORlZCZW1wcGRtSndPWGRWYm1OWVFVNTRiM1ptVVFwck56QmtaMHRXTVRSR1VpODNaUzh6WmxacFEwRnBRVVUyTVRGQ1VWbGxRM1V2TjB0eFoyRmxTRGN5UjBWeWJVZDVlRzgzYkVwdFZqSlFNbXBvVlhsaUNrNUJQVDBLTFMwdExTMUZUa1FnUTBWU1ZFbEdTVU5CVkVVdExTMHRMUW89In1dfSwia2luZCI6ImRzc2UifQ=="}],"timestampVerificationData":{"rfc3161Timestamps":[{"signedTimestamp":"MIICTzADAgEAMIICRgYJKoZIhvcNAQcCoIICNzCCAjMCAQMxDTALBglghkgBZQMEAgEwgYAGCyqGSIb3DQEJEAEEoHEEbzBtAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQgP0AhBgEI0/8lOj1EggBCb+0Ir9cVT9YEqSfW4bgvhMkCExL3Vw6ZA+TaqiixLXmOzibeAOsYDzIwMjYxMTEzMTQzNTU1WqAEpAIwAKAAMYIBmDCCAZQCAQEwQDA7MRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxIjAgBgNVBAMTGXNpZ3N0b3JlLXRzYS1pbnRlcm1lZGlhdGUCAQEwCwYJYIZIAWUDBAIBoIHqMBoGCSqGSIb3DQEJAzENBgsqhkiG9w0BCRABBDAcBgkqhkiG9w0BCQUxDxcNMjYxMTEzMTQzNTU1WjAvBgkqhkiG9w0BCQQxIgQgPapDJ9eguQuuoQx51QU/i2lX+viEQ9nhyccze/r+flswfQYLKoZIhvcNAQkQAi8xbjBsMGowaAQgerMU7mPVHWFH9pkdzeuulZ+igIFX8mO6yui8f46EBWUwRDA/pD0wOzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MSIwIAYDVQQDExlzaWdzdG9yZS10c2EtaW50ZXJtZWRpYXRlAgEBMAoGCCqGSM49BAMCBEcwRQIgZTxzIQCiWSpV4hDNIgU+ElZy6WO7Ko9WxVCE0FLKbwACIQCcuGeTkQuQs4xsAvPaTwJNaFQV4rwrIzBE85VJ2+cWaA=="}]}},"dsseEnvelope":{"payload":"eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoiYXJ0aWZhY3QuYmluIiwiZGlnZXN0Ijp7InNoYTI1NiI6ImU4ODk1MTI5MWJjYTA4MDdhNDFmM2MwMTQ0MDA5YmZmZjVjNmM3N2RjMTMxMGQ1MmU4YzZkNjJmZWVlOTYwYTgifX1dLCJwcmVkaWNhdGVUeXBlIjoiaHR0cHM6Ly9jb3NpZ24uc2lnc3RvcmUuZGV2L2F0dGVzdGF0aW9uL3Z1bG4vdjEiLCJwcmVkaWNhdGUiOnsiaW52b2NhdGlvbiI6eyJ1cmkiOiJodHRwczovL2dpdGh1Yi5jb20vYWNtZS93aWRnZXQvYWN0aW9ucy9ydW5zLzEyMzQ1Njc4OTAifSwic2Nhbm5lciI6eyJ1cmkiOiJwa2c6Z2l0aHViL2FxdWFzZWN1cml0eS90cml2eUAwLjUwLjAiLCJ2ZXJzaW9uIjoiMC41MC4wIiwicmVzdWx0Ijp7fX0sIm1ldGFkYXRhIjp7InNjYW5TdGFydGVkT24iOiIyMDI2LTExLTAxVDA5OjAwOjAwWiIsInNjYW5GaW5pc2hlZE9uIjoiMjAyNi0xMS0wMVQwOTowMTowMFoifX19","payloadType":"application/vnd.in-toto+json","signatures":[{"sig":"MEUCIFDQPiGwRExM84/mp9e2Kd0wY0/xuJaEiu5njoptohzVAiEAokbHGXb7isepEixyuVS384K77/jgAPvMaeeD1QnPzk8="}]}} +{"mediaType":"application/vnd.dev.sigstore.bundle.v0.3+json","verificationMaterial":{"certificate":{"rawBytes":"MIICzTCCAnSgAwIBAgIIKfTkQXzPlTcwCgYIKoZIzj0EAwIwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYxMTEzMTQzNDU1WhcNMjYxMTEzMTQ0NTU1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEVQkLYCAstJK1dsFfZ/s1b7GRJxqOQTlocv02w/ZomrREfu/VZG+lAERh1fxp3UO9eNShjIxsQfc7X5/3UpWmOKOCAZ8wggGbMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAfBgNVHSMEGDAWgBQin5D6vOEQoe/EaGQlwHLhwEDhUTBYBgNVHREBAf8ETjBMhkpodHRwczovL2dpdGh1Yi5jb20vYWNtZS93aWRnZXQvLmdpdGh1Yi93b3JrZmxvd3MvYnVpbGQueW1sQHJlZnMvaGVhZHMvbWFpbjA5BgorBgEEAYO/MAEBBCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAuBgorBgEEAYO/MAEMBCAMHmh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldDBRBgorBgEEAYO/MAEVBEMMQWh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldC9hY3Rpb25zL3J1bnMvMTIzNDU2Nzg5MC9hdHRlbXB0cy8xMAoGCCqGSM49BAMCA0cAMEQCIEkahf5qYgtOzim90ohcZMUH8kNZc7UzzP0Ij+BTeyUBAiA8WzSU8Yaz38IWnScKBRyK3wHMu4qTQa/bQH+XdijIgQ=="},"tlogEntries":[{"logId":{"keyId":"45EjT1abdD2MKrnHGSnayLaGvLNDQ4SRtMzNbF54fBc="},"kindVersion":{"kind":"dsse","version":"0.0.1"},"integratedTime":"1794580615","inclusionPromise":{"signedEntryTimestamp":"MEQCIDyGrqp0X/dyWQmPjmpgXbj16Hy7OaAXkYRNDY4B0yVSAiB1ElSggmknnUkWEng6+qaltPM1ppI/0OSXPmSBR1Udmw=="},"inclusionProof":{"rootHash":"FLeScBWw8j1xDIDSoe7GinhWfsa2VbFjMoEC/vlMWTA=","treeSize":"1","checkpoint":{"envelope":"rekor.localhost - 123\n42\nFLeScBWw8j1xDIDSoe7GinhWfsa2VbFjMoEC/vlMWTA=\n\n— rekor.localhost 45EjTzBFAiATKfcdiSKXt1GkLwGY8flbJvokCnGneTEB/SrX7MgntQIhANAsWhUkZECkyDvSQTE2vMvJEkwwdR1WGGf/zE4fFDDQ\n"}},"canonicalizedBody":"eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJzcGVjIjp7ImVudmVsb3BlSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjM2ZWI2NDA4OWQ0MjlhNGNiNjU5MTBkOGY4YmIzMWI4ZmZiMThiYmM4M2RmZDY0NGYxY2U4MzlmNDU4OTc2ZDMifSwicGF5bG9hZEhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJmOTZjNDY3Y2I2Y2MzYmU1ZGRlMGE0YzZkYTFhZDQ5NTA3NGEzYjRiZTcyMDc2NDQyYzBmNGI4NzFjMTNhMWVlIn0sInNpZ25hdHVyZXMiOlt7InNpZ25hdHVyZSI6Ik1FVUNJUUNWUXlrazdrdTlxaGF0ZnVuOGsyQXRVNG40dVQ3VklFQk96UUdnOTBNTWlRSWdOU1RZQ2pwRTQycXltSWh2akExZkQ4YUZ1NlBwNlc0UndrMmx2dkFJNXBRPSIsInZlcmlmaWVyIjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTjZWRU5EUVc1VFowRjNTVUpCWjBsSlMyWlVhMUZZZWxCc1ZHTjNRMmRaU1V0dldrbDZhakJGUVhkSmQwNTZSVlpOUWsxSFFURlZSVU5vVFUwS1l6SnNibU16VW5aamJWVjFXa2RXTWsxU05IZElRVmxFVmxGUlJFVjRWbnBoVjJSNlpFYzVlVnBUTVhCaWJsSnNZMjB4YkZwSGJHaGtSMVYzU0doalRncE5hbGw0VFZSRmVrMVVVWHBPUkZVeFYyaGpUazFxV1hoTlZFVjZUVlJSTUU1VVZURlhha0ZCVFVacmQwVjNXVWhMYjFwSmVtb3dRMEZSV1VsTGIxcEpDbnBxTUVSQlVXTkVVV2RCUlZaUmEweFpRMEZ6ZEVwTE1XUnpSbVphTDNNeFlqZEhVa3A0Y1U5UlZHeHZZM1l3TW5jdldtOXRjbEpGWm5VdlZscEhLMndLUVVWU2FERm1lSEF6VlU4NVpVNVRhR3BKZUhOUlptTTNXRFV2TTFWd1YyMVBTMDlEUVZvNGQyZG5SMkpOUVRSSFFURlZaRVIzUlVJdmQxRkZRWGRKU0FwblJFRlVRbWRPVmtoVFZVVkVSRUZMUW1kbmNrSm5SVVpDVVdORVFYcEJaa0puVGxaSVUwMUZSMFJCVjJkQ1VXbHVOVVEyZGs5RlVXOWxMMFZoUjFGc0NuZElUR2gzUlVSb1ZWUkNXVUpuVGxaSVVrVkNRV1k0UlZScVFrMW9hM0J2WkVoU2QyTjZiM1pNTW1Sd1pFZG9NVmxwTldwaU1qQjJXVmRPZEZwVE9UTUtZVmRTYmxwWVVYWk1iV1J3WkVkb01WbHBPVE5pTTBweVdtMTRkbVF6VFhaWmJsWndZa2RSZFdWWE1YTlJTRXBzV201TmRtRkhWbWhhU0UxMllsZEdjQXBpYWtFMVFtZHZja0puUlVWQldVOHZUVUZGUWtKRGRHOWtTRkozWTNwdmRrd3pVblpoTWxaMVRHMUdhbVJIYkhaaWJrMTFXakpzTUdGSVZtbGtXRTVzQ21OdFRuWmlibEpzWW01UmRWa3lPWFJOUkhOSFEybHpSMEZSVVVKbk56aDNRVkZuUlV4UmQzSmhTRkl3WTBoTk5reDVPVEJpTW5Sc1ltazFhRmt6VW5BS1lqSTFla3h0WkhCa1IyZ3hXVzVXZWxwWVNtcGlNalV3V2xjMU1FeHRUblppVkVGMVFtZHZja0puUlVWQldVOHZUVUZGVFVKRFFVMUliV2d3WkVoQ2VncFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVhRmt5TVd4TU0yUndXa2RrYkdSRVFsSkNaMjl5UW1kRlJVRlpUeTlOUVVWV1FrVk5UVkZYYURCa1NFSjZDazlwT0haYU1td3dZVWhXYVV4dFRuWmlVemxvV1RJeGJFd3paSEJhUjJSc1pFTTVhRmt6VW5CaU1qVjZURE5LTVdKdVRYWk5WRWw2VGtSVk1rNTZaelVLVFVNNWFHUklVbXhpV0VJd1kzazRlRTFCYjBkRFEzRkhVMDAwT1VKQlRVTkJNR05CVFVWUlEwbEZhMkZvWmpWeFdXZDBUM3BwYlRrd2IyaGpXazFWU0FvNGEwNWFZemRWZW5wUU1FbHFLMEpVWlhsVlFrRnBRVGhYZWxOVk9GbGhlak00U1ZkdVUyTkxRbEo1U3pOM1NFMTFOSEZVVVdFdllsRklLMWhrYVdwSkNtZFJQVDBLTFMwdExTMUZUa1FnUTBWU1ZFbEdTVU5CVkVVdExTMHRMUW89In1dfSwia2luZCI6ImRzc2UifQ=="}],"timestampVerificationData":{"rfc3161Timestamps":[{"signedTimestamp":"MIICUjADAgEAMIICSQYJKoZIhvcNAQcCoIICOjCCAjYCAQMxDTALBglghkgBZQMEAgEwgYIGCyqGSIb3DQEJEAEEoHMEcTBvAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQghD30w4NQ5a00Elr59mWVWjwqcfpD7WmU6gVDOa0/lxACFQCRIgGpI2S5xKJNV6TFhHzEFbld2RgPMjAyNjExMTMxNDM1NTVaoASkAjAAoAAxggGZMIIBlQIBATBAMDsxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEiMCAGA1UEAxMZc2lnc3RvcmUtdHNhLWludGVybWVkaWF0ZQIBATALBglghkgBZQMEAgGggeowGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEEMBwGCSqGSIb3DQEJBTEPFw0yNjExMTMxNDM1NTVaMC8GCSqGSIb3DQEJBDEiBCCRlWm5eBbv4c83q81sJGeXOQNc0pfV68ymSyywQqGQfzB9BgsqhkiG9w0BCRACLzFuMGwwajBoBCB6sxTuY9UdYUf2mR3N666Vn6KAgVfyY7rK6Lx/joQFZTBEMD+kPTA7MRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxIjAgBgNVBAMTGXNpZ3N0b3JlLXRzYS1pbnRlcm1lZGlhdGUCAQEwCgYIKoZIzj0EAwIESDBGAiEAgrxbCXEQNXFjCHSmME7UIvo07zn70mAf+UcQhzKmAXMCIQCU4brmK32/Kmky+XTdJHYMyVbYvDufkVMUm9svtLjYoQ=="}]}},"dsseEnvelope":{"payload":"eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoiYXJ0aWZhY3QuYmluIiwiZGlnZXN0Ijp7InNoYTI1NiI6ImU4ODk1MTI5MWJjYTA4MDdhNDFmM2MwMTQ0MDA5YmZmZjVjNmM3N2RjMTMxMGQ1MmU4YzZkNjJmZWVlOTYwYTgifX1dLCJwcmVkaWNhdGVUeXBlIjoiaHR0cHM6Ly9zbHNhLmRldi9wcm92ZW5hbmNlL3YxIiwicHJlZGljYXRlIjp7ImJ1aWxkRGVmaW5pdGlvbiI6eyJidWlsZFR5cGUiOiJodHRwczovL2FjdGlvbnMuZ2l0aHViLmlvL2J1aWxkdHlwZXMvd29ya2Zsb3cvdjEiLCJleHRlcm5hbFBhcmFtZXRlcnMiOnsid29ya2Zsb3ciOnsicmVmIjoicmVmcy9oZWFkcy9tYWluIiwicmVwb3NpdG9yeSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldCIsInBhdGgiOiIuZ2l0aHViL3dvcmtmbG93cy9idWlsZC55bWwifX0sImludGVybmFsUGFyYW1ldGVycyI6eyJnaXRodWIiOnsiZXZlbnRfbmFtZSI6InB1c2giLCJyZXBvc2l0b3J5X2lkIjoiMTIzNDU2Nzg5IiwicmVwb3NpdG9yeV9vd25lcl9pZCI6Ijk4NzY1NDMyMSIsInJ1bm5lcl9lbnZpcm9ubWVudCI6ImdpdGh1Yi1ob3N0ZWQifX0sInJlc29sdmVkRGVwZW5kZW5jaWVzIjpbeyJ1cmkiOiJnaXQraHR0cHM6Ly9naXRodWIuY29tL2FjbWUvd2lkZ2V0QHJlZnMvaGVhZHMvbWFpbiIsImRpZ2VzdCI6eyJnaXRDb21taXQiOiI0ZjlkMmE3YzFlNmI4YTNkNWYwZTJjOWI3YTFkNGU2ZjhjM2I1YTcwIn19XX0sInJ1bkRldGFpbHMiOnsiYnVpbGRlciI6eyJpZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9hY3Rpb25zL3J1bm5lci9naXRodWItaG9zdGVkIn0sIm1ldGFkYXRhIjp7Imludm9jYXRpb25JZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldC9hY3Rpb25zL3J1bnMvMTIzNDU2Nzg5MC9hdHRlbXB0cy8xIn19fX0=","payloadType":"application/vnd.in-toto+json","signatures":[{"sig":"MEUCIQCVQykk7ku9qhatfun8k2AtU4n4uT7VIEBOzQGg90MMiQIgNSTYCjpE42qymIhvjA1fD8aFu6Pp6W4Rwk2lvvAI5pQ="}]}} +{"mediaType":"application/vnd.dev.sigstore.bundle.v0.3+json","verificationMaterial":{"certificate":{"rawBytes":"MIICzTCCAnSgAwIBAgIIFl3gOf7tJzUwCgYIKoZIzj0EAwIwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYxMTEzMTQzNDU1WhcNMjYxMTEzMTQ0NTU1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEuknIA/yb0X+LNrJJHXYYDhmGsTAgLNdFIwBZ/LoOL3Vg4aOtH3njDI764iJqx43mIyrcS/OW2OtbUBVS1a7VtaOCAZ8wggGbMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAfBgNVHSMEGDAWgBQin5D6vOEQoe/EaGQlwHLhwEDhUTBYBgNVHREBAf8ETjBMhkpodHRwczovL2dpdGh1Yi5jb20vYWNtZS93aWRnZXQvLmdpdGh1Yi93b3JrZmxvd3MvYnVpbGQueW1sQHJlZnMvaGVhZHMvbWFpbjA5BgorBgEEAYO/MAEBBCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAuBgorBgEEAYO/MAEMBCAMHmh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldDBRBgorBgEEAYO/MAEVBEMMQWh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldC9hY3Rpb25zL3J1bnMvMTIzNDU2Nzg5MC9hdHRlbXB0cy8xMAoGCCqGSM49BAMCA0cAMEQCICjN0TUIezaFPCE77Hm7rN8VfbhePm1u5vZsDNAOM/3aAiAKS93j+7ikstBi/ElpE40WGHiHKceXg8lqK7m4OrJeXg=="},"tlogEntries":[{"logId":{"keyId":"45EjT1abdD2MKrnHGSnayLaGvLNDQ4SRtMzNbF54fBc="},"kindVersion":{"kind":"dsse","version":"0.0.1"},"integratedTime":"1794580615","inclusionPromise":{"signedEntryTimestamp":"MEYCIQClKCEC/B4PYbPF8d8XGE5cMWK3aqKW8TT8xWY+JhFg3wIhAI5pY2Fgti8RGGle0A8ssh7EL8HfoeSvabUeBlh/gRAR"},"inclusionProof":{"rootHash":"yY6aY23Ek8Z4XC1OOaXhVjdBFJyTdt33xpLHrO1AJbI=","treeSize":"1","checkpoint":{"envelope":"rekor.localhost - 123\n42\nyY6aY23Ek8Z4XC1OOaXhVjdBFJyTdt33xpLHrO1AJbI=\n\n— rekor.localhost 45EjTzBFAiAsg9bYN2RaSS0r/YKSYGeCG4br9Ji1In6xiYmp7Jp2CAIhALLwwlmFCVaMWGsL27hWsqxe9LLpAK/yeSA/nYRvE8/Y\n"}},"canonicalizedBody":"eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJzcGVjIjp7ImVudmVsb3BlSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6Ijk2OTExZDlkNjlhMDJhMzNkYzI5ZTYyZWYyMDk2MDQ3MDE2NjYwYTdmMjVjZmI4NDgxZWFlMGUzZGJjYzU2Y2EifSwicGF5bG9hZEhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiIyMmQ2OGMxNmVhMTg2ZDIwNjk1YzVhMGY2NTgzYTNhNTM5NDVmMDg2YjU1OWUzZDE1Yjg1YjQ5NjVhOGIyZTk1In0sInNpZ25hdHVyZXMiOlt7InNpZ25hdHVyZSI6Ik1FWUNJUURZNDdJNzlqOElaUHJMdnI0VlRxOUp5WkFsRnZKNnZFRUxDMXBpWTI3RHFBSWhBTzNnTjVxdHRVNjhXSjVCUzNVS2tXR2lOcnBRTWJrMVBzWDBUcHhBZm5rUiIsInZlcmlmaWVyIjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTjZWRU5EUVc1VFowRjNTVUpCWjBsSlJtd3paMDltTjNSS2VsVjNRMmRaU1V0dldrbDZhakJGUVhkSmQwNTZSVlpOUWsxSFFURlZSVU5vVFUwS1l6SnNibU16VW5aamJWVjFXa2RXTWsxU05IZElRVmxFVmxGUlJFVjRWbnBoVjJSNlpFYzVlVnBUTVhCaWJsSnNZMjB4YkZwSGJHaGtSMVYzU0doalRncE5hbGw0VFZSRmVrMVVVWHBPUkZVeFYyaGpUazFxV1hoTlZFVjZUVlJSTUU1VVZURlhha0ZCVFVacmQwVjNXVWhMYjFwSmVtb3dRMEZSV1VsTGIxcEpDbnBxTUVSQlVXTkVVV2RCUlhWcmJrbEJMM2xpTUZnclRFNXlTa3BJV0ZsWlJHaHRSM05VUVdkTVRtUkdTWGRDV2k5TWIwOU1NMVpuTkdGUGRFZ3pibW9LUkVrM05qUnBTbkY0TkROdFNYbHlZMU12VDFjeVQzUmlWVUpXVXpGaE4xWjBZVTlEUVZvNGQyZG5SMkpOUVRSSFFURlZaRVIzUlVJdmQxRkZRWGRKU0FwblJFRlVRbWRPVmtoVFZVVkVSRUZMUW1kbmNrSm5SVVpDVVdORVFYcEJaa0puVGxaSVUwMUZSMFJCVjJkQ1VXbHVOVVEyZGs5RlVXOWxMMFZoUjFGc0NuZElUR2gzUlVSb1ZWUkNXVUpuVGxaSVVrVkNRV1k0UlZScVFrMW9hM0J2WkVoU2QyTjZiM1pNTW1Sd1pFZG9NVmxwTldwaU1qQjJXVmRPZEZwVE9UTUtZVmRTYmxwWVVYWk1iV1J3WkVkb01WbHBPVE5pTTBweVdtMTRkbVF6VFhaWmJsWndZa2RSZFdWWE1YTlJTRXBzV201TmRtRkhWbWhhU0UxMllsZEdjQXBpYWtFMVFtZHZja0puUlVWQldVOHZUVUZGUWtKRGRHOWtTRkozWTNwdmRrd3pVblpoTWxaMVRHMUdhbVJIYkhaaWJrMTFXakpzTUdGSVZtbGtXRTVzQ21OdFRuWmlibEpzWW01UmRWa3lPWFJOUkhOSFEybHpSMEZSVVVKbk56aDNRVkZuUlV4UmQzSmhTRkl3WTBoTk5reDVPVEJpTW5Sc1ltazFhRmt6VW5BS1lqSTFla3h0WkhCa1IyZ3hXVzVXZWxwWVNtcGlNalV3V2xjMU1FeHRUblppVkVGMVFtZHZja0puUlVWQldVOHZUVUZGVFVKRFFVMUliV2d3WkVoQ2VncFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVhRmt5TVd4TU0yUndXa2RrYkdSRVFsSkNaMjl5UW1kRlJVRlpUeTlOUVVWV1FrVk5UVkZYYURCa1NFSjZDazlwT0haYU1td3dZVWhXYVV4dFRuWmlVemxvV1RJeGJFd3paSEJhUjJSc1pFTTVhRmt6VW5CaU1qVjZURE5LTVdKdVRYWk5WRWw2VGtSVk1rNTZaelVLVFVNNWFHUklVbXhpV0VJd1kzazRlRTFCYjBkRFEzRkhVMDAwT1VKQlRVTkJNR05CVFVWUlEwbERhazR3VkZWSlpYcGhSbEJEUlRjM1NHMDNjazQ0VmdwbVltaGxVRzB4ZFRWMlduTkVUa0ZQVFM4ellVRnBRVXRUT1ROcUt6ZHBhM04wUW1rdlJXeHdSVFF3VjBkSWFVaExZMlZZWnpoc2NVczNiVFJQY2twbENsaG5QVDBLTFMwdExTMUZUa1FnUTBWU1ZFbEdTVU5CVkVVdExTMHRMUW89In1dfSwia2luZCI6ImRzc2UifQ=="}],"timestampVerificationData":{"rfc3161Timestamps":[{"signedTimestamp":"MIICUTADAgEAMIICSAYJKoZIhvcNAQcCoIICOTCCAjUCAQMxDTALBglghkgBZQMEAgEwgYIGCyqGSIb3DQEJEAEEoHMEcTBvAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQg4YzrB32w88FdxKAjm/UnLzMIM99hkc+brCjVVxsBVrICFQC11dZowP0kZXJRy8BlEiXO7o0+XRgPMjAyNjExMTMxNDM1NTVaoASkAjAAoAAxggGYMIIBlAIBATBAMDsxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEiMCAGA1UEAxMZc2lnc3RvcmUtdHNhLWludGVybWVkaWF0ZQIBATALBglghkgBZQMEAgGggeowGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEEMBwGCSqGSIb3DQEJBTEPFw0yNjExMTMxNDM1NTVaMC8GCSqGSIb3DQEJBDEiBCDIJ42C16cNw2pWR51chU0NQtoZBzWZj2Ikw3Y8PGE6YzB9BgsqhkiG9w0BCRACLzFuMGwwajBoBCB6sxTuY9UdYUf2mR3N666Vn6KAgVfyY7rK6Lx/joQFZTBEMD+kPTA7MRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxIjAgBgNVBAMTGXNpZ3N0b3JlLXRzYS1pbnRlcm1lZGlhdGUCAQEwCgYIKoZIzj0EAwIERzBFAiASyMacB2A6LnW/rSb/YGeudZMf8iPaclSdZ8Sa2T3dAgIhAJMogEv++Z9gXhrQafALpduCknbFaewkQS1MbyqCQaEn"}]}},"dsseEnvelope":{"payload":"eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoiYXJ0aWZhY3QuYmluIiwiZGlnZXN0Ijp7InNoYTI1NiI6ImU4ODk1MTI5MWJjYTA4MDdhNDFmM2MwMTQ0MDA5YmZmZjVjNmM3N2RjMTMxMGQ1MmU4YzZkNjJmZWVlOTYwYTgifX1dLCJwcmVkaWNhdGVUeXBlIjoiaHR0cHM6Ly9jeWNsb25lZHgub3JnL2JvbSIsInByZWRpY2F0ZSI6eyJib21Gb3JtYXQiOiJDeWNsb25lRFgiLCJzcGVjVmVyc2lvbiI6IjEuNiIsInZlcnNpb24iOjEsIm1ldGFkYXRhIjp7InRpbWVzdGFtcCI6IjIwMjYtMTEtMDFUMDk6MDA6MDBaIiwidG9vbHMiOnsiY29tcG9uZW50cyI6W3sidHlwZSI6ImFwcGxpY2F0aW9uIiwibmFtZSI6ImV4YW1wbGUtc2JvbS10b29sIiwidmVyc2lvbiI6IjEuMCJ9XX0sImNvbXBvbmVudCI6eyJ0eXBlIjoiYXBwbGljYXRpb24iLCJuYW1lIjoiYXJ0aWZhY3QuYmluIiwidmVyc2lvbiI6IjEuMi4zIn19LCJjb21wb25lbnRzIjpbeyJ0eXBlIjoibGlicmFyeSIsIm5hbWUiOiJsZWZ0LXBhZCIsInZlcnNpb24iOiIxLjMuMCIsInB1cmwiOiJwa2c6bnBtL2xlZnQtcGFkQDEuMy4wIn1dfX0=","payloadType":"application/vnd.in-toto+json","signatures":[{"sig":"MEYCIQDY47I79j8IZPrLvr4VTq9JyZAlFvJ6vEELC1piY27DqAIhAO3gN5qttU68WJ5BS3UKkWGiNrpQMbk1PsX0TpxAfnkR"}]}} diff --git a/internal/intoto/testdata/branch-provenance.sigstore.json b/internal/intoto/testdata/branch-provenance.sigstore.json new file mode 100644 index 000000000..b81ba011f --- /dev/null +++ b/internal/intoto/testdata/branch-provenance.sigstore.json @@ -0,0 +1,47 @@ +{ + "dsseEnvelope": { + "payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoiYXJ0aWZhY3QuYmluIiwiZGlnZXN0Ijp7InNoYTI1NiI6ImU4ODk1MTI5MWJjYTA4MDdhNDFmM2MwMTQ0MDA5YmZmZjVjNmM3N2RjMTMxMGQ1MmU4YzZkNjJmZWVlOTYwYTgifX1dLCJwcmVkaWNhdGVUeXBlIjoiaHR0cHM6Ly9zbHNhLmRldi9wcm92ZW5hbmNlL3YxIiwicHJlZGljYXRlIjp7ImJ1aWxkRGVmaW5pdGlvbiI6eyJidWlsZFR5cGUiOiJodHRwczovL2FjdGlvbnMuZ2l0aHViLmlvL2J1aWxkdHlwZXMvd29ya2Zsb3cvdjEiLCJleHRlcm5hbFBhcmFtZXRlcnMiOnsid29ya2Zsb3ciOnsicmVmIjoicmVmcy9oZWFkcy9tYWluIiwicmVwb3NpdG9yeSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldCIsInBhdGgiOiIuZ2l0aHViL3dvcmtmbG93cy9idWlsZC55bWwifX0sImludGVybmFsUGFyYW1ldGVycyI6eyJnaXRodWIiOnsiZXZlbnRfbmFtZSI6InB1c2giLCJyZXBvc2l0b3J5X2lkIjoiMTIzNDU2Nzg5IiwicmVwb3NpdG9yeV9vd25lcl9pZCI6Ijk4NzY1NDMyMSIsInJ1bm5lcl9lbnZpcm9ubWVudCI6ImdpdGh1Yi1ob3N0ZWQifX0sInJlc29sdmVkRGVwZW5kZW5jaWVzIjpbeyJ1cmkiOiJnaXQraHR0cHM6Ly9naXRodWIuY29tL2FjbWUvd2lkZ2V0QHJlZnMvaGVhZHMvbWFpbiIsImRpZ2VzdCI6eyJnaXRDb21taXQiOiI0ZjlkMmE3YzFlNmI4YTNkNWYwZTJjOWI3YTFkNGU2ZjhjM2I1YTcwIn19XX0sInJ1bkRldGFpbHMiOnsiYnVpbGRlciI6eyJpZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9hY3Rpb25zL3J1bm5lci9naXRodWItaG9zdGVkIn0sIm1ldGFkYXRhIjp7Imludm9jYXRpb25JZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldC9hY3Rpb25zL3J1bnMvMTIzNDU2Nzg5MC9hdHRlbXB0cy8xIn19fX0=", + "payloadType": "application/vnd.in-toto+json", + "signatures": [ + { + "sig": "MEQCIFjIeFaqpQozfFOeg7yeG/qPtIpDStjlnIUFBbECbz0yAiBfHqZQVuA2riVHnX8kxdE7R0WGw4ZbPSpssT0qkbkVfQ==" + } + ] + }, + "mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json", + "verificationMaterial": { + "certificate": { + "rawBytes": "MIIC0zCCAnmgAwIBAgIII4B19oxEodAwCgYIKoZIzj0EAwIwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYxMTEzMTQzNDU1WhcNMjYxMTEzMTQ0NTU1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEt27W6c/3tsfILxyM+F2rXRuWK69A0iE3a45e0zgywTPoZsosLUcxZLmdeb5aEy6WzDLgEcr/u74laAks1IxTHqOCAaQwggGgMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAfBgNVHSMEGDAWgBQin5D6vOEQoe/EaGQlwHLhwEDhUTBdBgNVHREBAf8EUzBRhk9odHRwczovL2dpdGh1Yi5jb20vYWNtZS93aWRnZXQvLmdpdGh1Yi93b3JrZmxvd3MvYnVpbGQueW1sQHJlZnMvaGVhZHMvZmVhdHVyZS14MDkGCisGAQQBg78wAQEEK2h0dHBzOi8vdG9rZW4uYWN0aW9ucy5naXRodWJ1c2VyY29udGVudC5jb20wOwYKKwYBBAGDvzABCAQtDCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMC4GCisGAQQBg78wAQwEIAweaHR0cHM6Ly9naXRodWIuY29tL2FjbWUvd2lkZ2V0MFEGCisGAQQBg78wARUEQwxBaHR0cHM6Ly9naXRodWIuY29tL2FjbWUvd2lkZ2V0L2FjdGlvbnMvcnVucy8yMjIyMjIyMjIyL2F0dGVtcHRzLzEwCgYIKoZIzj0EAwIDSAAwRQIhAI8ctX4hzOcXFW0i0QyBvbeLzyW4X3kwZ0tRIUga7ocAAiAP0ko2Pffdaf4pWWUqHqPP/fWbm+7vCzXL23VL6aXfrw==" + }, + "timestampVerificationData": { + "rfc3161Timestamps": [ + { + "signedTimestamp": "MIICUTADAgEAMIICSAYJKoZIhvcNAQcCoIICOTCCAjUCAQMxDTALBglghkgBZQMEAgEwgYIGCyqGSIb3DQEJEAEEoHMEcTBvAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQgUdxBr5FS7jiHUPbV1fUF5VKeCohwhHcDlequB7tM88QCFQC576JmV2WYtUvsdd0EYY1nHwRkmRgPMjAyNjExMTMxNDM1NTVaoASkAjAAoAAxggGYMIIBlAIBATBAMDsxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEiMCAGA1UEAxMZc2lnc3RvcmUtdHNhLWludGVybWVkaWF0ZQIBATALBglghkgBZQMEAgGggeowGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEEMBwGCSqGSIb3DQEJBTEPFw0yNjExMTMxNDM1NTVaMC8GCSqGSIb3DQEJBDEiBCCBuUuRqE4dzWw3uSJcLkN9ahjGnM/3FA0HWLq7g6w4dDB9BgsqhkiG9w0BCRACLzFuMGwwajBoBCB6sxTuY9UdYUf2mR3N666Vn6KAgVfyY7rK6Lx/joQFZTBEMD+kPTA7MRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxIjAgBgNVBAMTGXNpZ3N0b3JlLXRzYS1pbnRlcm1lZGlhdGUCAQEwCgYIKoZIzj0EAwIERzBFAiEA17fge2O6/onGh2HibmKG716o9Sf1hN9E3k28c7KJsY4CIGVn+bA49snf50QJN413pTnnftAlbdRZmF9d93aCeKl4" + } + ] + }, + "tlogEntries": [ + { + "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJzcGVjIjp7ImVudmVsb3BlSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjNlMzUzMTEyYzYzYjA3NDljMGU2MzEzYzZlZDM3NWQwNjAzODlkZmE1MTRmNTQwOGRhYmVhYmM5YWRjNjNkYjcifSwicGF5bG9hZEhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJmOTZjNDY3Y2I2Y2MzYmU1ZGRlMGE0YzZkYTFhZDQ5NTA3NGEzYjRiZTcyMDc2NDQyYzBmNGI4NzFjMTNhMWVlIn0sInNpZ25hdHVyZXMiOlt7InNpZ25hdHVyZSI6Ik1FUUNJRmpJZUZhcXBRb3pmRk9lZzd5ZUcvcVB0SXBEU3RqbG5JVUZCYkVDYnoweUFpQmZIcVpRVnVBMnJpVkhuWDhreGRFN1IwV0d3NFpiUFNwc3NUMHFrYmtWZlE9PSIsInZlcmlmaWVyIjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTXdla05EUVc1dFowRjNTVUpCWjBsSlNUUkNNVGx2ZUVWdlpFRjNRMmRaU1V0dldrbDZhakJGUVhkSmQwNTZSVlpOUWsxSFFURlZSVU5vVFUwS1l6SnNibU16VW5aamJWVjFXa2RXTWsxU05IZElRVmxFVmxGUlJFVjRWbnBoVjJSNlpFYzVlVnBUTVhCaWJsSnNZMjB4YkZwSGJHaGtSMVYzU0doalRncE5hbGw0VFZSRmVrMVVVWHBPUkZVeFYyaGpUazFxV1hoTlZFVjZUVlJSTUU1VVZURlhha0ZCVFVacmQwVjNXVWhMYjFwSmVtb3dRMEZSV1VsTGIxcEpDbnBxTUVSQlVXTkVVV2RCUlhReU4xYzJZeTh6ZEhObVNVeDRlVTByUmpKeVdGSjFWMHMyT1VFd2FVVXpZVFExWlRCNlozbDNWRkJ2V25OdmMweFZZM2dLV2t4dFpHVmlOV0ZGZVRaWGVrUk1aMFZqY2k5MU56UnNZVUZyY3pGSmVGUkljVTlEUVdGUmQyZG5SMmROUVRSSFFURlZaRVIzUlVJdmQxRkZRWGRKU0FwblJFRlVRbWRPVmtoVFZVVkVSRUZMUW1kbmNrSm5SVVpDVVdORVFYcEJaa0puVGxaSVUwMUZSMFJCVjJkQ1VXbHVOVVEyZGs5RlVXOWxMMFZoUjFGc0NuZElUR2gzUlVSb1ZWUkNaRUpuVGxaSVVrVkNRV1k0UlZWNlFsSm9hemx2WkVoU2QyTjZiM1pNTW1Sd1pFZG9NVmxwTldwaU1qQjJXVmRPZEZwVE9UTUtZVmRTYmxwWVVYWk1iV1J3WkVkb01WbHBPVE5pTTBweVdtMTRkbVF6VFhaWmJsWndZa2RSZFdWWE1YTlJTRXBzV201TmRtRkhWbWhhU0UxMldtMVdhQXBrU0ZaNVdsTXhORTFFYTBkRGFYTkhRVkZSUW1jM09IZEJVVVZGU3pKb01HUklRbnBQYVRoMlpFYzVjbHBYTkhWWlYwNHdZVmM1ZFdONU5XNWhXRkp2Q21SWFNqRmpNbFo1V1RJNWRXUkhWblZrUXpWcVlqSXdkMDkzV1V0TGQxbENRa0ZIUkhaNlFVSkRRVkYwUkVOMGIyUklVbmRqZW05MlRETlNkbUV5Vm5VS1RHMUdhbVJIYkhaaWJrMTFXakpzTUdGSVZtbGtXRTVzWTIxT2RtSnVVbXhpYmxGMVdUSTVkRTFETkVkRGFYTkhRVkZSUW1jM09IZEJVWGRGU1VGM1pRcGhTRkl3WTBoTk5reDVPVzVoV0ZKdlpGZEpkVmt5T1hSTU1rWnFZbGRWZG1ReWJHdGFNbFl3VFVaRlIwTnBjMGRCVVZGQ1p6YzRkMEZTVlVWUmQzaENDbUZJVWpCalNFMDJUSGs1Ym1GWVVtOWtWMGwxV1RJNWRFd3lSbXBpVjFWMlpESnNhMW95VmpCTU1rWnFaRWRzZG1KdVRYWmpibFoxWTNrNGVVMXFTWGtLVFdwSmVVMXFTWGxNTWtZd1pFZFdkR05JVW5wTWVrVjNRMmRaU1V0dldrbDZhakJGUVhkSlJGTkJRWGRTVVVsb1FVazRZM1JZTkdoNlQyTllSbGN3YVFvd1VYbENkbUpsVEhwNVZ6UllNMnQzV2pCMFVrbFZaMkUzYjJOQlFXbEJVREJyYnpKUVptWmtZV1kwY0ZkWFZYRkljVkJRTDJaWFltMHJOM1pEZWxoTUNqSXpWa3cyWVZobWNuYzlQUW90TFMwdExVVk9SQ0JEUlZKVVNVWkpRMEZVUlMwdExTMHRDZz09In1dfSwia2luZCI6ImRzc2UifQ==", + "inclusionPromise": { + "signedEntryTimestamp": "MEQCIFWWoluIQVqMDEmcW1w9ZfoN1Y1KlRVxNL0vd7mqloP0AiBgtCviq35Q86Q0cwj3C4gOh/kbfreP8wQXxfio2xtQjw==" + }, + "inclusionProof": { + "checkpoint": { + "envelope": "rekor.localhost - 123\n42\nNN1jcBAnNzWlR9zZ/1Mk2ItMMrrgLl/t12cK5q+iHbE=\n\n— rekor.localhost 45EjTzBFAiEAuyGBgLP03rR5vMth6a0t6wbJtE806Z/yjFIJ/7VHrvYCIAzgHrSMqT4O0hGZoQb0q5h5pLepDTd3orPY4ga0tSQm\n" + }, + "rootHash": "NN1jcBAnNzWlR9zZ/1Mk2ItMMrrgLl/t12cK5q+iHbE=", + "treeSize": "1" + }, + "integratedTime": "1794580735", + "kindVersion": { + "kind": "dsse", + "version": "0.0.1" + }, + "logId": { + "keyId": "45EjT1abdD2MKrnHGSnayLaGvLNDQ4SRtMzNbF54fBc=" + } + } + ] + } +} diff --git a/internal/intoto/testdata/buildkit-provenance.sigstore.json b/internal/intoto/testdata/buildkit-provenance.sigstore.json index 9c6283674..760a30e01 100644 --- a/internal/intoto/testdata/buildkit-provenance.sigstore.json +++ b/internal/intoto/testdata/buildkit-provenance.sigstore.json @@ -4,42 +4,42 @@ "payloadType": "application/vnd.in-toto+json", "signatures": [ { - "sig": "MEUCIQDxzcHWJGGnoi/N0uJvXnl6BMVb2zq/iuX07yJsi3aZVAIgMIlwtIFKGDHyH0hL1WQiAC0J8DV0/VvkRsOJaVjJBWQ=" + "sig": "MEUCIQDrCQA7RinEtSR5ZhPxgj++XzfyztvFqrqJsr7WMOY2ZwIgUOq4QnTodiervwJox2Tuhi6bSa9id8x55SdInf/Cq80=" } ] }, "mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json", "verificationMaterial": { "certificate": { - "rawBytes": "MIICzjCCAnSgAwIBAgIIFqzEOkd96PMwCgYIKoZIzj0EAwIwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYxMTEyMDgxNjU1WhcNMjYxMTEyMDgyNzU1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE5cM/O1fnTv6FXufyEYXlrzt4RSJBLGt/YT1SXzj/Yk78SJjcCkWlBvvk2Z+jexbuQHPGNQ1BnBto4+EGyd9A0KOCAZ8wggGbMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAfBgNVHSMEGDAWgBSZpSIKVYxSQzu1jBpx0BTIUS5kPjBYBgNVHREBAf8ETjBMhkpodHRwczovL2dpdGh1Yi5jb20vYWNtZS93aWRnZXQvLmdpdGh1Yi93b3JrZmxvd3MvYnVpbGQueW1sQHJlZnMvaGVhZHMvbWFpbjA5BgorBgEEAYO/MAEBBCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAuBgorBgEEAYO/MAEMBCAMHmh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldDBRBgorBgEEAYO/MAEVBEMMQWh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldC9hY3Rpb25zL3J1bnMvMTIzNDU2Nzg5MC9hdHRlbXB0cy8xMAoGCCqGSM49BAMCA0gAMEUCIB6RHqkm+NdOnQ65Yg4M1tKXzP0gTdKN/kPYsGdyrWgJAiEAscfHoIocq06Z3yzohTFsast2ZWNr1C5dsdsGmE38UII=" + "rawBytes": "MIICzTCCAnSgAwIBAgIICOWX3yIh08EwCgYIKoZIzj0EAwIwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYxMTEzMTQzNDU1WhcNMjYxMTEzMTQ0NTU1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEI6KS4xQD3FUtLPD3Sdgv6432isDOe/tEGrOdVJxtWfaif94QiNuBjy6//ckxQH9dLRCbjW28ykrZFjCbNQQIjaOCAZ8wggGbMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAfBgNVHSMEGDAWgBQin5D6vOEQoe/EaGQlwHLhwEDhUTBYBgNVHREBAf8ETjBMhkpodHRwczovL2dpdGh1Yi5jb20vYWNtZS93aWRnZXQvLmdpdGh1Yi93b3JrZmxvd3MvYnVpbGQueW1sQHJlZnMvaGVhZHMvbWFpbjA5BgorBgEEAYO/MAEBBCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAuBgorBgEEAYO/MAEMBCAMHmh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldDBRBgorBgEEAYO/MAEVBEMMQWh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldC9hY3Rpb25zL3J1bnMvMTIzNDU2Nzg5MC9hdHRlbXB0cy8xMAoGCCqGSM49BAMCA0cAMEQCIFDPHjgnsZw16X3poF5jjRIblMN6JXLPsG5lQrZQKnSTAiAetipFyOKviEKco8nYthB0sMZzu4brUllPLH+i7IAq5g==" }, "timestampVerificationData": { "rfc3161Timestamps": [ { - "signedTimestamp": "MIICUjADAgEAMIICSQYJKoZIhvcNAQcCoIICOjCCAjYCAQMxDTALBglghkgBZQMEAgEwgYIGCyqGSIb3DQEJEAEEoHMEcTBvAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQg4N5HUZth8kZjZMvkHlOYUiBgjhayiZ4W2gOTozn9mUICFQC6ssMDEKe1xgebxgzSL0sW4u4ZYxgPMjAyNjExMTIwODE3NTVaoASkAjAAoAAxggGZMIIBlQIBATBAMDsxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEiMCAGA1UEAxMZc2lnc3RvcmUtdHNhLWludGVybWVkaWF0ZQIBATALBglghkgBZQMEAgGggeowGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEEMBwGCSqGSIb3DQEJBTEPFw0yNjExMTIwODE3NTVaMC8GCSqGSIb3DQEJBDEiBCCdAmxzQzj+FOh61sXPWOpin6HTZqJ0ZoO74jEyW+RUVTB9BgsqhkiG9w0BCRACLzFuMGwwajBoBCBxsTcCVWXweYqyR+Mv0qEyQNFC6h3MFA0BmrBEHVH9tDBEMD+kPTA7MRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxIjAgBgNVBAMTGXNpZ3N0b3JlLXRzYS1pbnRlcm1lZGlhdGUCAQEwCgYIKoZIzj0EAwIESDBGAiEArA2H7KcFMG1seegBYkZ/Xrym14BDouXF5MykbbjBnAYCIQDBNfbWyP5b6JLYCVyZbNux3Fj70Gt0vBQmrta2E50dHA==" + "signedTimestamp": "MIICUDADAgEAMIICRwYJKoZIhvcNAQcCoIICODCCAjQCAQMxDTALBglghkgBZQMEAgEwgYIGCyqGSIb3DQEJEAEEoHMEcTBvAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQgBoCvu0aaIGAXuPP6qBp49TuX3/km5wIdeZ9jHWx+Y8wCFQCSTP7ivuS+F5h8QLHFAUTiY/k1oBgPMjAyNjExMTMxNDM1NTVaoASkAjAAoAAxggGXMIIBkwIBATBAMDsxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEiMCAGA1UEAxMZc2lnc3RvcmUtdHNhLWludGVybWVkaWF0ZQIBATALBglghkgBZQMEAgGggeowGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEEMBwGCSqGSIb3DQEJBTEPFw0yNjExMTMxNDM1NTVaMC8GCSqGSIb3DQEJBDEiBCDumX1NSE7+0DeTqeMkU7e2CI7AuxTumgcNyHf8aUNftDB9BgsqhkiG9w0BCRACLzFuMGwwajBoBCB6sxTuY9UdYUf2mR3N666Vn6KAgVfyY7rK6Lx/joQFZTBEMD+kPTA7MRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxIjAgBgNVBAMTGXNpZ3N0b3JlLXRzYS1pbnRlcm1lZGlhdGUCAQEwCgYIKoZIzj0EAwIERjBEAiBWUSUgmi0UN5wtmdUMfwzD0Xfcop0CLhXk7zIPJZWACAIge7kUOwt2KuZf/JBhrDZ02ATUyFqVQaUx8h0r2jNOnDI=" } ] }, "tlogEntries": [ { - "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJzcGVjIjp7ImVudmVsb3BlSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImIxYTFjZGE0MmRlNWNjNWIwZDNmYzJkYzcwZGI4YWNlZjlkNWZkNGU3N2E2MzZlZTRiOWE2MGYxMjllM2Y4NzcifSwicGF5bG9hZEhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiIyZmY0MzYzYzU1NmQ0YmNiYTdkOTEwMjBlNTMyNTY0NDc3N2E1MmJlMGIwZjQwZWEzMmU1YWIwMTkzM2E3MTI1In0sInNpZ25hdHVyZXMiOlt7InNpZ25hdHVyZSI6Ik1FVUNJUUR4emNIV0pHR25vaS9OMHVKdlhubDZCTVZiMnpxL2l1WDA3eUpzaTNhWlZBSWdNSWx3dElGS0dESHlIMGhMMVdRaUFDMEo4RFYwL1Z2a1JzT0phVmpKQldRPSIsInZlcmlmaWVyIjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTjZha05EUVc1VFowRjNTVUpCWjBsSlJuRjZSVTlyWkRrMlVFMTNRMmRaU1V0dldrbDZhakJGUVhkSmQwNTZSVlpOUWsxSFFURlZSVU5vVFUwS1l6SnNibU16VW5aamJWVjFXa2RXTWsxU05IZElRVmxFVmxGUlJFVjRWbnBoVjJSNlpFYzVlVnBUTVhCaWJsSnNZMjB4YkZwSGJHaGtSMVYzU0doalRncE5hbGw0VFZSRmVVMUVaM2hPYWxVeFYyaGpUazFxV1hoTlZFVjVUVVJuZVU1NlZURlhha0ZCVFVacmQwVjNXVWhMYjFwSmVtb3dRMEZSV1VsTGIxcEpDbnBxTUVSQlVXTkVVV2RCUlRWalRTOVBNV1p1VkhZMlJsaDFabmxGV1Zoc2NucDBORkpUU2tKTVIzUXZXVlF4VTFoNmFpOVphemM0VTBwcVkwTnJWMndLUW5aMmF6SmFLMnBsZUdKMVVVaFFSMDVSTVVKdVFuUnZOQ3RGUjNsa09VRXdTMDlEUVZvNGQyZG5SMkpOUVRSSFFURlZaRVIzUlVJdmQxRkZRWGRKU0FwblJFRlVRbWRPVmtoVFZVVkVSRUZMUW1kbmNrSm5SVVpDVVdORVFYcEJaa0puVGxaSVUwMUZSMFJCVjJkQ1UxcHdVMGxMVmxsNFUxRjZkVEZxUW5CNENqQkNWRWxWVXpWclVHcENXVUpuVGxaSVVrVkNRV1k0UlZScVFrMW9hM0J2WkVoU2QyTjZiM1pNTW1Sd1pFZG9NVmxwTldwaU1qQjJXVmRPZEZwVE9UTUtZVmRTYmxwWVVYWk1iV1J3WkVkb01WbHBPVE5pTTBweVdtMTRkbVF6VFhaWmJsWndZa2RSZFdWWE1YTlJTRXBzV201TmRtRkhWbWhhU0UxMllsZEdjQXBpYWtFMVFtZHZja0puUlVWQldVOHZUVUZGUWtKRGRHOWtTRkozWTNwdmRrd3pVblpoTWxaMVRHMUdhbVJIYkhaaWJrMTFXakpzTUdGSVZtbGtXRTVzQ21OdFRuWmlibEpzWW01UmRWa3lPWFJOUkhOSFEybHpSMEZSVVVKbk56aDNRVkZuUlV4UmQzSmhTRkl3WTBoTk5reDVPVEJpTW5Sc1ltazFhRmt6VW5BS1lqSTFla3h0WkhCa1IyZ3hXVzVXZWxwWVNtcGlNalV3V2xjMU1FeHRUblppVkVGMVFtZHZja0puUlVWQldVOHZUVUZGVFVKRFFVMUliV2d3WkVoQ2VncFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVhRmt5TVd4TU0yUndXa2RrYkdSRVFsSkNaMjl5UW1kRlJVRlpUeTlOUVVWV1FrVk5UVkZYYURCa1NFSjZDazlwT0haYU1td3dZVWhXYVV4dFRuWmlVemxvV1RJeGJFd3paSEJhUjJSc1pFTTVhRmt6VW5CaU1qVjZURE5LTVdKdVRYWk5WRWw2VGtSVk1rNTZaelVLVFVNNWFHUklVbXhpV0VJd1kzazRlRTFCYjBkRFEzRkhVMDAwT1VKQlRVTkJNR2RCVFVWVlEwbENObEpJY1d0dEswNWtUMjVSTmpWWlp6Uk5NWFJMV0FwNlVEQm5WR1JMVGk5clVGbHpSMlI1Y2xkblNrRnBSVUZ6WTJaSWIwbHZZM0V3TmxvemVYcHZhRlJHYzJGemRESmFWMDV5TVVNMVpITmtjMGR0UlRNNENsVkpTVDBLTFMwdExTMUZUa1FnUTBWU1ZFbEdTVU5CVkVVdExTMHRMUW89In1dfSwia2luZCI6ImRzc2UifQ==", + "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJzcGVjIjp7ImVudmVsb3BlSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjczY2E2OGQxZGJhMTYzNjM1NTllOTIwY2VhYjFmM2UxMDdiZTliMWMxZGZkNTQzMTgzZmU3MmJjYmZkZjJiY2EifSwicGF5bG9hZEhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiIyZmY0MzYzYzU1NmQ0YmNiYTdkOTEwMjBlNTMyNTY0NDc3N2E1MmJlMGIwZjQwZWEzMmU1YWIwMTkzM2E3MTI1In0sInNpZ25hdHVyZXMiOlt7InNpZ25hdHVyZSI6Ik1FVUNJUURyQ1FBN1JpbkV0U1I1WmhQeGdqKytYemZ5enR2RnFycUpzcjdXTU9ZMlp3SWdVT3E0UW5Ub2RpZXJ2d0pveDJUdWhpNmJTYTlpZDh4NTVTZEluZi9DcTgwPSIsInZlcmlmaWVyIjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTjZWRU5EUVc1VFowRjNTVUpCWjBsSlEwOVhXRE41U1dnd09FVjNRMmRaU1V0dldrbDZhakJGUVhkSmQwNTZSVlpOUWsxSFFURlZSVU5vVFUwS1l6SnNibU16VW5aamJWVjFXa2RXTWsxU05IZElRVmxFVmxGUlJFVjRWbnBoVjJSNlpFYzVlVnBUTVhCaWJsSnNZMjB4YkZwSGJHaGtSMVYzU0doalRncE5hbGw0VFZSRmVrMVVVWHBPUkZVeFYyaGpUazFxV1hoTlZFVjZUVlJSTUU1VVZURlhha0ZCVFVacmQwVjNXVWhMYjFwSmVtb3dRMEZSV1VsTGIxcEpDbnBxTUVSQlVXTkVVV2RCUlVrMlMxTTBlRkZFTTBaVmRFeFFSRE5UWkdkMk5qUXpNbWx6UkU5bEwzUkZSM0pQWkZaS2VIUlhabUZwWmprMFVXbE9kVUlLYW5rMkx5OWphM2hSU0Rsa1RGSkRZbXBYTWpoNWEzSmFSbXBEWWs1UlVVbHFZVTlEUVZvNGQyZG5SMkpOUVRSSFFURlZaRVIzUlVJdmQxRkZRWGRKU0FwblJFRlVRbWRPVmtoVFZVVkVSRUZMUW1kbmNrSm5SVVpDVVdORVFYcEJaa0puVGxaSVUwMUZSMFJCVjJkQ1VXbHVOVVEyZGs5RlVXOWxMMFZoUjFGc0NuZElUR2gzUlVSb1ZWUkNXVUpuVGxaSVVrVkNRV1k0UlZScVFrMW9hM0J2WkVoU2QyTjZiM1pNTW1Sd1pFZG9NVmxwTldwaU1qQjJXVmRPZEZwVE9UTUtZVmRTYmxwWVVYWk1iV1J3WkVkb01WbHBPVE5pTTBweVdtMTRkbVF6VFhaWmJsWndZa2RSZFdWWE1YTlJTRXBzV201TmRtRkhWbWhhU0UxMllsZEdjQXBpYWtFMVFtZHZja0puUlVWQldVOHZUVUZGUWtKRGRHOWtTRkozWTNwdmRrd3pVblpoTWxaMVRHMUdhbVJIYkhaaWJrMTFXakpzTUdGSVZtbGtXRTVzQ21OdFRuWmlibEpzWW01UmRWa3lPWFJOUkhOSFEybHpSMEZSVVVKbk56aDNRVkZuUlV4UmQzSmhTRkl3WTBoTk5reDVPVEJpTW5Sc1ltazFhRmt6VW5BS1lqSTFla3h0WkhCa1IyZ3hXVzVXZWxwWVNtcGlNalV3V2xjMU1FeHRUblppVkVGMVFtZHZja0puUlVWQldVOHZUVUZGVFVKRFFVMUliV2d3WkVoQ2VncFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVhRmt5TVd4TU0yUndXa2RrYkdSRVFsSkNaMjl5UW1kRlJVRlpUeTlOUVVWV1FrVk5UVkZYYURCa1NFSjZDazlwT0haYU1td3dZVWhXYVV4dFRuWmlVemxvV1RJeGJFd3paSEJhUjJSc1pFTTVhRmt6VW5CaU1qVjZURE5LTVdKdVRYWk5WRWw2VGtSVk1rNTZaelVLVFVNNWFHUklVbXhpV0VJd1kzazRlRTFCYjBkRFEzRkhVMDAwT1VKQlRVTkJNR05CVFVWUlEwbEdSRkJJYW1kdWMxcDNNVFpZTTNCdlJqVnFhbEpKWWdwc1RVNDJTbGhNVUhOSE5XeFJjbHBSUzI1VFZFRnBRV1YwYVhCR2VVOUxkbWxGUzJOdk9HNVpkR2hDTUhOTlducDFOR0p5Vld4c1VFeElLMmszU1VGeENqVm5QVDBLTFMwdExTMUZUa1FnUTBWU1ZFbEdTVU5CVkVVdExTMHRMUW89In1dfSwia2luZCI6ImRzc2UifQ==", "inclusionPromise": { - "signedEntryTimestamp": "MEUCIQCkn6aZvlbmX7j/th6CjdPZHcxqAetSKc0PfyN81ew0BwIgbx4auRehK6CuZElKPq/rhVtaEWqxlnAVVBU68+8+iE4=" + "signedEntryTimestamp": "MEQCIH2c14qbSkX0O3KLRrfHlFjjRd9KEFDW1qTsmknaIfSMAiAsQzQ3OZvSIAAtbSitDlHvTxlKruEXD9TGpPuUqr9RDg==" }, "inclusionProof": { "checkpoint": { - "envelope": "rekor.localhost - 123\n42\nhferuuXYxtteV1Ue3sNxRWVp19v/DujCTv/KjIdDIUU=\n\n— rekor.localhost VbgJJjBFAiEAtniHH3CRXNmPb/9G8vtFmcNf/QYyRK5sIjV96xZYpPICIH2D4YMIsDMiSIWl0ry/DrEmJPXwvjzFL3sQtgxeGc6W\n" + "envelope": "rekor.localhost - 123\n42\nIO3QH/GmHhJDGgZY8VjNVfuIda+jEJLYIGIoSqclpzo=\n\n— rekor.localhost 45EjTzBGAiEA+OmgPnGXIgJ31PN6Pl9F6yuUyJI9zz+P2HrrYlcTMloCIQC/bhlfnPU6eZY2IcZ4S38rO0E8FiitddNbJNr3a8lyqQ==\n" }, - "rootHash": "hferuuXYxtteV1Ue3sNxRWVp19v/DujCTv/KjIdDIUU=", + "rootHash": "IO3QH/GmHhJDGgZY8VjNVfuIda+jEJLYIGIoSqclpzo=", "treeSize": "1" }, - "integratedTime": "1794471535", + "integratedTime": "1794580615", "kindVersion": { "kind": "dsse", "version": "0.0.1" }, "logId": { - "keyId": "VbgJJh1uXk4PvCPZ3fIjaxUep33R8Z6T6wAJfVjz+BA=" + "keyId": "45EjT1abdD2MKrnHGSnayLaGvLNDQ4SRtMzNbF54fBc=" } } ] diff --git a/internal/intoto/testdata/cyclonedx-sbom.sigstore.json b/internal/intoto/testdata/cyclonedx-sbom.sigstore.json index 5d4867067..8e281fa47 100644 --- a/internal/intoto/testdata/cyclonedx-sbom.sigstore.json +++ b/internal/intoto/testdata/cyclonedx-sbom.sigstore.json @@ -4,42 +4,42 @@ "payloadType": "application/vnd.in-toto+json", "signatures": [ { - "sig": "MEUCIQC/l0gO1SLMrci+mJCIbe70sBGmhCa9m1L6IwOa3aB6XAIgJeROrTNN4TkXhWxQ+rKMRBrdxXA52tVq+Od5Hod/BXU=" + "sig": "MEYCIQDFLxyYEgCHD58k7aEKkoayaGlAKb3i8+3pRpmCsABi0AIhAMfKsSmrZLLVIO9aJMRrNsGG3l8TtSFBPH/WlmZAcoa1" } ] }, "mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json", "verificationMaterial": { "certificate": { - "rawBytes": "MIICzTCCAnSgAwIBAgIIOcZ0rSHOHbcwCgYIKoZIzj0EAwIwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYxMTEyMDgxNjU1WhcNMjYxMTEyMDgyNzU1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEClyoY3ZngG8DMtYXrJKIZu+ebosQ09/nB52Tbqal/22bp/z+P158DMffyduYf83zoGiSzO800gnPs7KnIC+vWqOCAZ8wggGbMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAfBgNVHSMEGDAWgBSZpSIKVYxSQzu1jBpx0BTIUS5kPjBYBgNVHREBAf8ETjBMhkpodHRwczovL2dpdGh1Yi5jb20vYWNtZS93aWRnZXQvLmdpdGh1Yi93b3JrZmxvd3MvYnVpbGQueW1sQHJlZnMvaGVhZHMvbWFpbjA5BgorBgEEAYO/MAEBBCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAuBgorBgEEAYO/MAEMBCAMHmh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldDBRBgorBgEEAYO/MAEVBEMMQWh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldC9hY3Rpb25zL3J1bnMvMTIzNDU2Nzg5MC9hdHRlbXB0cy8xMAoGCCqGSM49BAMCA0cAMEQCIEM8Wfp/pC+mz8/W74DP6CRCcVY4EIJwdk3RVEVk9FpHAiBWCwSnETCa5XINg430dBmOPjj8x7HV6Od2vIAn9f+YZg==" + "rawBytes": "MIICzTCCAnSgAwIBAgIIHZAM8jem6CkwCgYIKoZIzj0EAwIwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYxMTEzMTQzNDU1WhcNMjYxMTEzMTQ0NTU1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEnQ1xsjYPZMjPScLsTj80EDWm5htLTuCUcmLvdyKQP4RjxAFwo/EJ1PKnxd89C8SnI5uJCHQoQ+T4k9jEQ+lo+KOCAZ8wggGbMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAfBgNVHSMEGDAWgBQin5D6vOEQoe/EaGQlwHLhwEDhUTBYBgNVHREBAf8ETjBMhkpodHRwczovL2dpdGh1Yi5jb20vYWNtZS93aWRnZXQvLmdpdGh1Yi93b3JrZmxvd3MvYnVpbGQueW1sQHJlZnMvaGVhZHMvbWFpbjA5BgorBgEEAYO/MAEBBCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAuBgorBgEEAYO/MAEMBCAMHmh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldDBRBgorBgEEAYO/MAEVBEMMQWh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldC9hY3Rpb25zL3J1bnMvMTIzNDU2Nzg5MC9hdHRlbXB0cy8xMAoGCCqGSM49BAMCA0cAMEQCIHULVx/DI4kfbeQDX6ihRLWrGe4sDzcMRX6RTOH7NiH3AiAvRQdkzvXiz8YavAEF6om96dzkVB6eKylfiE/mdh18jg==" }, "timestampVerificationData": { "rfc3161Timestamps": [ { - "signedTimestamp": "MIICUDADAgEAMIICRwYJKoZIhvcNAQcCoIICODCCAjQCAQMxDTALBglghkgBZQMEAgEwgYEGCyqGSIb3DQEJEAEEoHIEcDBuAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQgxAiUwi+X0EVUryxcB8YBrfZC9g3iQP4dzhAj9j4vh/gCFHM+Y+PdIASqAwjiof1SfWw7XwZ3GA8yMDI2MTExMjA4MTc1NVqgBKQCMACgADGCAZgwggGUAgEBMEAwOzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MSIwIAYDVQQDExlzaWdzdG9yZS10c2EtaW50ZXJtZWRpYXRlAgEBMAsGCWCGSAFlAwQCAaCB6jAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQAQQwHAYJKoZIhvcNAQkFMQ8XDTI2MTExMjA4MTc1NVowLwYJKoZIhvcNAQkEMSIEILQC+7peK72PHDtA+tpt2VsdLPHyIRRM8AvnOJBmor/uMH0GCyqGSIb3DQEJEAIvMW4wbDBqMGgEIHGxNwJVZfB5irJH4y/SoTJA0ULqHcwUDQGasEQdUf20MEQwP6Q9MDsxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEiMCAGA1UEAxMZc2lnc3RvcmUtdHNhLWludGVybWVkaWF0ZQIBATAKBggqhkjOPQQDAgRHMEUCIFD7fyjMs/BnUQz0d6LVWaAuAMUif+NdA2DQGgoc40+cAiEAjFtglTGU/DAZfJs18O+CutUDJVMRsPQQFqwaGD8SSQc=" + "signedTimestamp": "MIICUDADAgEAMIICRwYJKoZIhvcNAQcCoIICODCCAjQCAQMxDTALBglghkgBZQMEAgEwgYEGCyqGSIb3DQEJEAEEoHIEcDBuAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQgyFTcUqYtCynlAiq3rYstGFpO9H3WB5L0rwOickkxf9sCFHp+48mK6ILmmaqcM7z/YKlJ0BA/GA8yMDI2MTExMzE0MzU1NVqgBKQCMACgADGCAZgwggGUAgEBMEAwOzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MSIwIAYDVQQDExlzaWdzdG9yZS10c2EtaW50ZXJtZWRpYXRlAgEBMAsGCWCGSAFlAwQCAaCB6jAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQAQQwHAYJKoZIhvcNAQkFMQ8XDTI2MTExMzE0MzU1NVowLwYJKoZIhvcNAQkEMSIEICLsRMukcz7YwMXc7sOHjxM3PbUqBZUtY/3Agi0gpd5RMH0GCyqGSIb3DQEJEAIvMW4wbDBqMGgEIHqzFO5j1R1hR/aZHc3rrpWfooCBV/JjusrovH+OhAVlMEQwP6Q9MDsxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEiMCAGA1UEAxMZc2lnc3RvcmUtdHNhLWludGVybWVkaWF0ZQIBATAKBggqhkjOPQQDAgRHMEUCID10ISv2m0rKbjTJYTCy21tvEh/O/4ZijM1aeHhBkhudAiEAqxQV80yp1K0IgwzJZzTnymce7Dst1oFjEDpqQuQhxEE=" } ] }, "tlogEntries": [ { - "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJzcGVjIjp7ImVudmVsb3BlSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImIyYjI5YjRhZDZiZmZiZGE0MmFhOWI2ODY4ZjgzNzIzYmY0MjczYWFkNmZjYzI0ZjE0NjFlZmY3OTFhMDg3YjUifSwicGF5bG9hZEhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiIyMmQ2OGMxNmVhMTg2ZDIwNjk1YzVhMGY2NTgzYTNhNTM5NDVmMDg2YjU1OWUzZDE1Yjg1YjQ5NjVhOGIyZTk1In0sInNpZ25hdHVyZXMiOlt7InNpZ25hdHVyZSI6Ik1FVUNJUUMvbDBnTzFTTE1yY2krbUpDSWJlNzBzQkdtaENhOW0xTDZJd09hM2FCNlhBSWdKZVJPclROTjRUa1hoV3hRK3JLTVJCcmR4WEE1MnRWcStPZDVIb2QvQlhVPSIsInZlcmlmaWVyIjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTjZWRU5EUVc1VFowRjNTVUpCWjBsSlQyTmFNSEpUU0U5SVltTjNRMmRaU1V0dldrbDZhakJGUVhkSmQwNTZSVlpOUWsxSFFURlZSVU5vVFUwS1l6SnNibU16VW5aamJWVjFXa2RXTWsxU05IZElRVmxFVmxGUlJFVjRWbnBoVjJSNlpFYzVlVnBUTVhCaWJsSnNZMjB4YkZwSGJHaGtSMVYzU0doalRncE5hbGw0VFZSRmVVMUVaM2hPYWxVeFYyaGpUazFxV1hoTlZFVjVUVVJuZVU1NlZURlhha0ZCVFVacmQwVjNXVWhMYjFwSmVtb3dRMEZSV1VsTGIxcEpDbnBxTUVSQlVXTkVVV2RCUlVOc2VXOVpNMXB1WjBjNFJFMTBXVmh5U2t0SlduVXJaV0p2YzFFd09TOXVRalV5VkdKeFlXd3ZNakppY0M5NksxQXhOVGdLUkUxbVpubGtkVmxtT0RONmIwZHBVM3BQT0RBd1oyNVFjemRMYmtsREszWlhjVTlEUVZvNGQyZG5SMkpOUVRSSFFURlZaRVIzUlVJdmQxRkZRWGRKU0FwblJFRlVRbWRPVmtoVFZVVkVSRUZMUW1kbmNrSm5SVVpDVVdORVFYcEJaa0puVGxaSVUwMUZSMFJCVjJkQ1UxcHdVMGxMVmxsNFUxRjZkVEZxUW5CNENqQkNWRWxWVXpWclVHcENXVUpuVGxaSVVrVkNRV1k0UlZScVFrMW9hM0J2WkVoU2QyTjZiM1pNTW1Sd1pFZG9NVmxwTldwaU1qQjJXVmRPZEZwVE9UTUtZVmRTYmxwWVVYWk1iV1J3WkVkb01WbHBPVE5pTTBweVdtMTRkbVF6VFhaWmJsWndZa2RSZFdWWE1YTlJTRXBzV201TmRtRkhWbWhhU0UxMllsZEdjQXBpYWtFMVFtZHZja0puUlVWQldVOHZUVUZGUWtKRGRHOWtTRkozWTNwdmRrd3pVblpoTWxaMVRHMUdhbVJIYkhaaWJrMTFXakpzTUdGSVZtbGtXRTVzQ21OdFRuWmlibEpzWW01UmRWa3lPWFJOUkhOSFEybHpSMEZSVVVKbk56aDNRVkZuUlV4UmQzSmhTRkl3WTBoTk5reDVPVEJpTW5Sc1ltazFhRmt6VW5BS1lqSTFla3h0WkhCa1IyZ3hXVzVXZWxwWVNtcGlNalV3V2xjMU1FeHRUblppVkVGMVFtZHZja0puUlVWQldVOHZUVUZGVFVKRFFVMUliV2d3WkVoQ2VncFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVhRmt5TVd4TU0yUndXa2RrYkdSRVFsSkNaMjl5UW1kRlJVRlpUeTlOUVVWV1FrVk5UVkZYYURCa1NFSjZDazlwT0haYU1td3dZVWhXYVV4dFRuWmlVemxvV1RJeGJFd3paSEJhUjJSc1pFTTVhRmt6VW5CaU1qVjZURE5LTVdKdVRYWk5WRWw2VGtSVk1rNTZaelVLVFVNNWFHUklVbXhpV0VJd1kzazRlRTFCYjBkRFEzRkhVMDAwT1VKQlRVTkJNR05CVFVWUlEwbEZUVGhYWm5BdmNFTXJiWG80TDFjM05FUlFOa05TUXdwalZsazBSVWxLZDJSck0xSldSVlpyT1Vad1NFRnBRbGREZDFOdVJWUkRZVFZZU1U1bk5ETXdaRUp0VDFCcWFqaDROMGhXTms5a01uWkpRVzQ1Wml0WkNscG5QVDBLTFMwdExTMUZUa1FnUTBWU1ZFbEdTVU5CVkVVdExTMHRMUW89In1dfSwia2luZCI6ImRzc2UifQ==", + "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJzcGVjIjp7ImVudmVsb3BlSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjI1NDUzZTZkNDAzMGFhMjA5ZjA3N2NhZjFiZTViNmY2ZWU0Y2YxOTM0YWEwOTBlYTZlZjQ5YWFhM2ZjMWZmNTIifSwicGF5bG9hZEhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiIyMmQ2OGMxNmVhMTg2ZDIwNjk1YzVhMGY2NTgzYTNhNTM5NDVmMDg2YjU1OWUzZDE1Yjg1YjQ5NjVhOGIyZTk1In0sInNpZ25hdHVyZXMiOlt7InNpZ25hdHVyZSI6Ik1FWUNJUURGTHh5WUVnQ0hENThrN2FFS2tvYXlhR2xBS2IzaTgrM3BScG1Dc0FCaTBBSWhBTWZLc1NtclpMTFZJTzlhSk1Sck5zR0czbDhUdFNGQlBIL1dsbVpBY29hMSIsInZlcmlmaWVyIjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTjZWRU5EUVc1VFowRjNTVUpCWjBsSlNGcEJUVGhxWlcwMlEydDNRMmRaU1V0dldrbDZhakJGUVhkSmQwNTZSVlpOUWsxSFFURlZSVU5vVFUwS1l6SnNibU16VW5aamJWVjFXa2RXTWsxU05IZElRVmxFVmxGUlJFVjRWbnBoVjJSNlpFYzVlVnBUTVhCaWJsSnNZMjB4YkZwSGJHaGtSMVYzU0doalRncE5hbGw0VFZSRmVrMVVVWHBPUkZVeFYyaGpUazFxV1hoTlZFVjZUVlJSTUU1VVZURlhha0ZCVFVacmQwVjNXVWhMYjFwSmVtb3dRMEZSV1VsTGIxcEpDbnBxTUVSQlVXTkVVV2RCUlc1Uk1YaHphbGxRV2sxcVVGTmpUSE5VYWpnd1JVUlhiVFZvZEV4VWRVTlZZMjFNZG1SNVMxRlFORkpxZUVGR2QyOHZSVW9LTVZCTGJuaGtPRGxET0ZOdVNUVjFTa05JVVc5UksxUTBhemxxUlZFcmJHOHJTMDlEUVZvNGQyZG5SMkpOUVRSSFFURlZaRVIzUlVJdmQxRkZRWGRKU0FwblJFRlVRbWRPVmtoVFZVVkVSRUZMUW1kbmNrSm5SVVpDVVdORVFYcEJaa0puVGxaSVUwMUZSMFJCVjJkQ1VXbHVOVVEyZGs5RlVXOWxMMFZoUjFGc0NuZElUR2gzUlVSb1ZWUkNXVUpuVGxaSVVrVkNRV1k0UlZScVFrMW9hM0J2WkVoU2QyTjZiM1pNTW1Sd1pFZG9NVmxwTldwaU1qQjJXVmRPZEZwVE9UTUtZVmRTYmxwWVVYWk1iV1J3WkVkb01WbHBPVE5pTTBweVdtMTRkbVF6VFhaWmJsWndZa2RSZFdWWE1YTlJTRXBzV201TmRtRkhWbWhhU0UxMllsZEdjQXBpYWtFMVFtZHZja0puUlVWQldVOHZUVUZGUWtKRGRHOWtTRkozWTNwdmRrd3pVblpoTWxaMVRHMUdhbVJIYkhaaWJrMTFXakpzTUdGSVZtbGtXRTVzQ21OdFRuWmlibEpzWW01UmRWa3lPWFJOUkhOSFEybHpSMEZSVVVKbk56aDNRVkZuUlV4UmQzSmhTRkl3WTBoTk5reDVPVEJpTW5Sc1ltazFhRmt6VW5BS1lqSTFla3h0WkhCa1IyZ3hXVzVXZWxwWVNtcGlNalV3V2xjMU1FeHRUblppVkVGMVFtZHZja0puUlVWQldVOHZUVUZGVFVKRFFVMUliV2d3WkVoQ2VncFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVhRmt5TVd4TU0yUndXa2RrYkdSRVFsSkNaMjl5UW1kRlJVRlpUeTlOUVVWV1FrVk5UVkZYYURCa1NFSjZDazlwT0haYU1td3dZVWhXYVV4dFRuWmlVemxvV1RJeGJFd3paSEJhUjJSc1pFTTVhRmt6VW5CaU1qVjZURE5LTVdKdVRYWk5WRWw2VGtSVk1rNTZaelVLVFVNNWFHUklVbXhpV0VJd1kzazRlRTFCYjBkRFEzRkhVMDAwT1VKQlRVTkJNR05CVFVWUlEwbElWVXhXZUM5RVNUUnJabUpsVVVSWU5tbG9Va3hYY2dwSFpUUnpSSHBqVFZKWU5sSlVUMGczVG1sSU0wRnBRWFpTVVdScmVuWllhWG80V1dGMlFVVkdObTl0T1Raa2VtdFdRalpsUzNsc1ptbEZMMjFrYURFNENtcG5QVDBLTFMwdExTMUZUa1FnUTBWU1ZFbEdTVU5CVkVVdExTMHRMUW89In1dfSwia2luZCI6ImRzc2UifQ==", "inclusionPromise": { - "signedEntryTimestamp": "MEQCIBeo3Kn3EGUQkCMcjScycyuJXqxzQ1EwTRLkRErsyXwqAiBfJYh1kF13HqlY1rmsQ8Z4Z4X5WtDI69Sb0Vx5jN2Ffw==" + "signedEntryTimestamp": "MEQCICGAhwexln4PxHQRkXUqoxCDgLDSRQh8STvIO5oWEB3aAiBmvkzrTwDiMsv3jXU/XSBi1hs7NFRlY7/qYwRQLqwmFg==" }, "inclusionProof": { "checkpoint": { - "envelope": "rekor.localhost - 123\n42\n5TSA8YdtihH1dOoxPydB+abGnQRbi3e43XKJ9bCBrpA=\n\n— rekor.localhost VbgJJjBFAiEApir2FAkZJs0OJ3rH231GIek9/zpX3SKLdyLdlS0iK/QCICYabYI3KPuIVRNvebkwyY81F+FkQ3+A9t4QX8pzIVAi\n" + "envelope": "rekor.localhost - 123\n42\nfGJ1k8RAx8UioL/MT1xRdQyw7CI+11cTt4m3wH+LDj0=\n\n— rekor.localhost 45EjTzBGAiEAtGT4HiKJK6gG4A+bwATuNoQES2qgLOrLlESrGRG9CjUCIQCp0sLDBs7UArqTGmTM0sUYh5/xtFzjEfuJYzZKljNzXw==\n" }, - "rootHash": "5TSA8YdtihH1dOoxPydB+abGnQRbi3e43XKJ9bCBrpA=", + "rootHash": "fGJ1k8RAx8UioL/MT1xRdQyw7CI+11cTt4m3wH+LDj0=", "treeSize": "1" }, - "integratedTime": "1794471535", + "integratedTime": "1794580615", "kindVersion": { "kind": "dsse", "version": "0.0.1" }, "logId": { - "keyId": "VbgJJh1uXk4PvCPZ3fIjaxUep33R8Z6T6wAJfVjz+BA=" + "keyId": "45EjT1abdD2MKrnHGSnayLaGvLNDQ4SRtMzNbF54fBc=" } } ] diff --git a/internal/intoto/testdata/github-provenance.sigstore.json b/internal/intoto/testdata/github-provenance.sigstore.json index 75ee1d0ba..ff9042e51 100644 --- a/internal/intoto/testdata/github-provenance.sigstore.json +++ b/internal/intoto/testdata/github-provenance.sigstore.json @@ -4,42 +4,42 @@ "payloadType": "application/vnd.in-toto+json", "signatures": [ { - "sig": "MEYCIQCazKG0026by+uSAixpHlF90VcvvdCgsNDnXRRMSyZHegIhAPrykzwxya6vmEfsFoEIbf3yPDgTpYJZmLxmLLJV+YX3" + "sig": "MEQCIBpaY+QZUXK+JPZkJG3DMN55K/TNGpOMK1j7mCrccKUMAiA9xCyL+iVBHHq5J5qXsQVva6ZpXTztkk8AYUCYIX78vA==" } ] }, "mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json", "verificationMaterial": { "certificate": { - "rawBytes": "MIICzjCCAnSgAwIBAgIIAy60CX6Nbr0wCgYIKoZIzj0EAwIwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYxMTEyMDgxNjU1WhcNMjYxMTEyMDgyNzU1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEiQp+t0MRgvK4R67EsGdNC+5+4c3n24z8mxr+nyx+gQJcZYoy9weri41rJ1sA85IV0QFivDd2WqtD6JKB+Nw9eKOCAZ8wggGbMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAfBgNVHSMEGDAWgBSZpSIKVYxSQzu1jBpx0BTIUS5kPjBYBgNVHREBAf8ETjBMhkpodHRwczovL2dpdGh1Yi5jb20vYWNtZS93aWRnZXQvLmdpdGh1Yi93b3JrZmxvd3MvYnVpbGQueW1sQHJlZnMvaGVhZHMvbWFpbjA5BgorBgEEAYO/MAEBBCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAuBgorBgEEAYO/MAEMBCAMHmh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldDBRBgorBgEEAYO/MAEVBEMMQWh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldC9hY3Rpb25zL3J1bnMvMTIzNDU2Nzg5MC9hdHRlbXB0cy8xMAoGCCqGSM49BAMCA0gAMEUCIQDE8M0uAz2/CzUGspF/+X1Vj+wchsZqpKBmuPiPgsu6wQIgHusm9sCp1O3lioovByUDjcpb2X8lu1FGHOX1P586hic=" + "rawBytes": "MIICzzCCAnSgAwIBAgIILvCC04ziDhwwCgYIKoZIzj0EAwIwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYxMTEzMTQzNDU1WhcNMjYxMTEzMTQ0NTU1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEJ7wrqEYgerq3nJFCeNHa90b+XPedq6eSlxyCYUj0kPjspQEOd3wFwHt7kszIad1QwMtPYgK/FJO2u323KKz0nKOCAZ8wggGbMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAfBgNVHSMEGDAWgBQin5D6vOEQoe/EaGQlwHLhwEDhUTBYBgNVHREBAf8ETjBMhkpodHRwczovL2dpdGh1Yi5jb20vYWNtZS93aWRnZXQvLmdpdGh1Yi93b3JrZmxvd3MvYnVpbGQueW1sQHJlZnMvaGVhZHMvbWFpbjA5BgorBgEEAYO/MAEBBCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAuBgorBgEEAYO/MAEMBCAMHmh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldDBRBgorBgEEAYO/MAEVBEMMQWh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldC9hY3Rpb25zL3J1bnMvMTIzNDU2Nzg5MC9hdHRlbXB0cy8xMAoGCCqGSM49BAMCA0kAMEYCIQC4MZLSgNIalLYbH37SpeoM0FVvthkCQJfHGkwleXVNjQIhAJnTqx9nqj3/trDVAU8nC6CDDBf9bE2Vj8VRKFB0TSIb" }, "timestampVerificationData": { "rfc3161Timestamps": [ { - "signedTimestamp": "MIICTzADAgEAMIICRgYJKoZIhvcNAQcCoIICNzCCAjMCAQMxDTALBglghkgBZQMEAgEwgYEGCyqGSIb3DQEJEAEEoHIEcDBuAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQgorFZojQPe5ls9Us7+hHysDqyiBMRJATsszxsLETrQ8kCFCt8HoX4DFmvpO9Cpt7DHLB9aXu1GA8yMDI2MTExMjA4MTc1NVqgBKQCMACgADGCAZcwggGTAgEBMEAwOzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MSIwIAYDVQQDExlzaWdzdG9yZS10c2EtaW50ZXJtZWRpYXRlAgEBMAsGCWCGSAFlAwQCAaCB6jAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQAQQwHAYJKoZIhvcNAQkFMQ8XDTI2MTExMjA4MTc1NVowLwYJKoZIhvcNAQkEMSIEIH42DyVwJKntW7aMJM0mWjhE1DFTxYHcwk5dVRmKROstMH0GCyqGSIb3DQEJEAIvMW4wbDBqMGgEIHGxNwJVZfB5irJH4y/SoTJA0ULqHcwUDQGasEQdUf20MEQwP6Q9MDsxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEiMCAGA1UEAxMZc2lnc3RvcmUtdHNhLWludGVybWVkaWF0ZQIBATAKBggqhkjOPQQDAgRGMEQCICVMvy+VGJ9wvMFC4iDy6usWtzNCVFa+ZsVZQ733fFlpAiBUZpaRaahv/0ZRx8OaSOu4NheY8bEAYvpqqrVCB3hivw==" + "signedTimestamp": "MIICUjADAgEAMIICSQYJKoZIhvcNAQcCoIICOjCCAjYCAQMxDTALBglghkgBZQMEAgEwgYIGCyqGSIb3DQEJEAEEoHMEcTBvAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQg5CaZ4U6vZmT4CjPu+uStwgO03VaaCvyfcIvSS+6taLkCFQC/03oCtbz+cmrWkd6R86OddDAGihgPMjAyNjExMTMxNDM1NTVaoASkAjAAoAAxggGZMIIBlQIBATBAMDsxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEiMCAGA1UEAxMZc2lnc3RvcmUtdHNhLWludGVybWVkaWF0ZQIBATALBglghkgBZQMEAgGggeowGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEEMBwGCSqGSIb3DQEJBTEPFw0yNjExMTMxNDM1NTVaMC8GCSqGSIb3DQEJBDEiBCBZubVc2ROotEocu1UeXNSvPJ/iPFPl7ZN380vqH1JzwzB9BgsqhkiG9w0BCRACLzFuMGwwajBoBCB6sxTuY9UdYUf2mR3N666Vn6KAgVfyY7rK6Lx/joQFZTBEMD+kPTA7MRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxIjAgBgNVBAMTGXNpZ3N0b3JlLXRzYS1pbnRlcm1lZGlhdGUCAQEwCgYIKoZIzj0EAwIESDBGAiEAsLqbIG638vHCvK3Mf7zkjVTvql6eDcVUeBgShHHo6EECIQC59mCXENzOASuoXPtCRNsmSGZsAhTj6PEdP7Dw2lEaNg==" } ] }, "tlogEntries": [ { - "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJzcGVjIjp7ImVudmVsb3BlSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjJlNWIwZDQyNjgxOTUxZDk0YjI1MjNlZjNjYzViZmY4ZDRjZDA5MGVkYmRhMDUyYTE5OGI1NzJjMTY1ZGQ2ZDUifSwicGF5bG9hZEhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJmOTZjNDY3Y2I2Y2MzYmU1ZGRlMGE0YzZkYTFhZDQ5NTA3NGEzYjRiZTcyMDc2NDQyYzBmNGI4NzFjMTNhMWVlIn0sInNpZ25hdHVyZXMiOlt7InNpZ25hdHVyZSI6Ik1FWUNJUUNhektHMDAyNmJ5K3VTQWl4cEhsRjkwVmN2dmRDZ3NORG5YUlJNU3laSGVnSWhBUHJ5a3p3eHlhNnZtRWZzRm9FSWJmM3lQRGdUcFlKWm1MeG1MTEpWK1lYMyIsInZlcmlmaWVyIjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTjZha05EUVc1VFowRjNTVUpCWjBsSlFYazJNRU5ZTms1aWNqQjNRMmRaU1V0dldrbDZhakJGUVhkSmQwNTZSVlpOUWsxSFFURlZSVU5vVFUwS1l6SnNibU16VW5aamJWVjFXa2RXTWsxU05IZElRVmxFVmxGUlJFVjRWbnBoVjJSNlpFYzVlVnBUTVhCaWJsSnNZMjB4YkZwSGJHaGtSMVYzU0doalRncE5hbGw0VFZSRmVVMUVaM2hPYWxVeFYyaGpUazFxV1hoTlZFVjVUVVJuZVU1NlZURlhha0ZCVFVacmQwVjNXVWhMYjFwSmVtb3dRMEZSV1VsTGIxcEpDbnBxTUVSQlVXTkVVV2RCUldsUmNDdDBNRTFTWjNaTE5GSTJOMFZ6UjJST1F5czFLelJqTTI0eU5IbzRiWGh5SzI1NWVDdG5VVXBqV2xsdmVUbDNaWElLYVRReGNrb3hjMEU0TlVsV01GRkdhWFpFWkRKWGNYUkVOa3BMUWl0T2R6bGxTMDlEUVZvNGQyZG5SMkpOUVRSSFFURlZaRVIzUlVJdmQxRkZRWGRKU0FwblJFRlVRbWRPVmtoVFZVVkVSRUZMUW1kbmNrSm5SVVpDVVdORVFYcEJaa0puVGxaSVUwMUZSMFJCVjJkQ1UxcHdVMGxMVmxsNFUxRjZkVEZxUW5CNENqQkNWRWxWVXpWclVHcENXVUpuVGxaSVVrVkNRV1k0UlZScVFrMW9hM0J2WkVoU2QyTjZiM1pNTW1Sd1pFZG9NVmxwTldwaU1qQjJXVmRPZEZwVE9UTUtZVmRTYmxwWVVYWk1iV1J3WkVkb01WbHBPVE5pTTBweVdtMTRkbVF6VFhaWmJsWndZa2RSZFdWWE1YTlJTRXBzV201TmRtRkhWbWhhU0UxMllsZEdjQXBpYWtFMVFtZHZja0puUlVWQldVOHZUVUZGUWtKRGRHOWtTRkozWTNwdmRrd3pVblpoTWxaMVRHMUdhbVJIYkhaaWJrMTFXakpzTUdGSVZtbGtXRTVzQ21OdFRuWmlibEpzWW01UmRWa3lPWFJOUkhOSFEybHpSMEZSVVVKbk56aDNRVkZuUlV4UmQzSmhTRkl3WTBoTk5reDVPVEJpTW5Sc1ltazFhRmt6VW5BS1lqSTFla3h0WkhCa1IyZ3hXVzVXZWxwWVNtcGlNalV3V2xjMU1FeHRUblppVkVGMVFtZHZja0puUlVWQldVOHZUVUZGVFVKRFFVMUliV2d3WkVoQ2VncFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVhRmt5TVd4TU0yUndXa2RrYkdSRVFsSkNaMjl5UW1kRlJVRlpUeTlOUVVWV1FrVk5UVkZYYURCa1NFSjZDazlwT0haYU1td3dZVWhXYVV4dFRuWmlVemxvV1RJeGJFd3paSEJhUjJSc1pFTTVhRmt6VW5CaU1qVjZURE5LTVdKdVRYWk5WRWw2VGtSVk1rNTZaelVLVFVNNWFHUklVbXhpV0VJd1kzazRlRTFCYjBkRFEzRkhVMDAwT1VKQlRVTkJNR2RCVFVWVlEwbFJSRVU0VFRCMVFYb3lMME42VlVkemNFWXZLMWd4VmdwcUszZGphSE5hY1hCTFFtMTFVR2xRWjNOMU5uZFJTV2RJZFhOdE9YTkRjREZQTTJ4cGIyOTJRbmxWUkdwamNHSXlXRGhzZFRGR1IwaFBXREZRTlRnMkNtaHBZejBLTFMwdExTMUZUa1FnUTBWU1ZFbEdTVU5CVkVVdExTMHRMUW89In1dfSwia2luZCI6ImRzc2UifQ==", + "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJzcGVjIjp7ImVudmVsb3BlSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImE1NTI1MTQ5MzA5OWM5YTE2MWIzZTE0NDlhZmRiOGMzOTljMmEyNTNjN2YzZDUxMmI5NjZlNmNkNWZhZDQ2NTIifSwicGF5bG9hZEhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJmOTZjNDY3Y2I2Y2MzYmU1ZGRlMGE0YzZkYTFhZDQ5NTA3NGEzYjRiZTcyMDc2NDQyYzBmNGI4NzFjMTNhMWVlIn0sInNpZ25hdHVyZXMiOlt7InNpZ25hdHVyZSI6Ik1FUUNJQnBhWStRWlVYSytKUFprSkczRE1ONTVLL1ROR3BPTUsxajdtQ3JjY0tVTUFpQTl4Q3lMK2lWQkhIcTVKNXFYc1FWdmE2WnBYVHp0a2s4QVlVQ1lJWDc4dkE9PSIsInZlcmlmaWVyIjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTjZla05EUVc1VFowRjNTVUpCWjBsSlRIWkRRekEwZW1sRWFIZDNRMmRaU1V0dldrbDZhakJGUVhkSmQwNTZSVlpOUWsxSFFURlZSVU5vVFUwS1l6SnNibU16VW5aamJWVjFXa2RXTWsxU05IZElRVmxFVmxGUlJFVjRWbnBoVjJSNlpFYzVlVnBUTVhCaWJsSnNZMjB4YkZwSGJHaGtSMVYzU0doalRncE5hbGw0VFZSRmVrMVVVWHBPUkZVeFYyaGpUazFxV1hoTlZFVjZUVlJSTUU1VVZURlhha0ZCVFVacmQwVjNXVWhMYjFwSmVtb3dRMEZSV1VsTGIxcEpDbnBxTUVSQlVXTkVVV2RCUlVvM2QzSnhSVmxuWlhKeE0yNUtSa05sVGtoaE9UQmlLMWhRWldSeE5tVlRiSGg1UTFsVmFqQnJVR3B6Y0ZGRlQyUXpkMFlLZDBoME4ydHpla2xoWkRGUmQwMTBVRmxuU3k5R1NrOHlkVE15TTB0TGVqQnVTMDlEUVZvNGQyZG5SMkpOUVRSSFFURlZaRVIzUlVJdmQxRkZRWGRKU0FwblJFRlVRbWRPVmtoVFZVVkVSRUZMUW1kbmNrSm5SVVpDVVdORVFYcEJaa0puVGxaSVUwMUZSMFJCVjJkQ1VXbHVOVVEyZGs5RlVXOWxMMFZoUjFGc0NuZElUR2gzUlVSb1ZWUkNXVUpuVGxaSVVrVkNRV1k0UlZScVFrMW9hM0J2WkVoU2QyTjZiM1pNTW1Sd1pFZG9NVmxwTldwaU1qQjJXVmRPZEZwVE9UTUtZVmRTYmxwWVVYWk1iV1J3WkVkb01WbHBPVE5pTTBweVdtMTRkbVF6VFhaWmJsWndZa2RSZFdWWE1YTlJTRXBzV201TmRtRkhWbWhhU0UxMllsZEdjQXBpYWtFMVFtZHZja0puUlVWQldVOHZUVUZGUWtKRGRHOWtTRkozWTNwdmRrd3pVblpoTWxaMVRHMUdhbVJIYkhaaWJrMTFXakpzTUdGSVZtbGtXRTVzQ21OdFRuWmlibEpzWW01UmRWa3lPWFJOUkhOSFEybHpSMEZSVVVKbk56aDNRVkZuUlV4UmQzSmhTRkl3WTBoTk5reDVPVEJpTW5Sc1ltazFhRmt6VW5BS1lqSTFla3h0WkhCa1IyZ3hXVzVXZWxwWVNtcGlNalV3V2xjMU1FeHRUblppVkVGMVFtZHZja0puUlVWQldVOHZUVUZGVFVKRFFVMUliV2d3WkVoQ2VncFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVhRmt5TVd4TU0yUndXa2RrYkdSRVFsSkNaMjl5UW1kRlJVRlpUeTlOUVVWV1FrVk5UVkZYYURCa1NFSjZDazlwT0haYU1td3dZVWhXYVV4dFRuWmlVemxvV1RJeGJFd3paSEJhUjJSc1pFTTVhRmt6VW5CaU1qVjZURE5LTVdKdVRYWk5WRWw2VGtSVk1rNTZaelVLVFVNNWFHUklVbXhpV0VJd1kzazRlRTFCYjBkRFEzRkhVMDAwT1VKQlRVTkJNR3RCVFVWWlEwbFJRelJOV2t4VFowNUpZV3hNV1dKSU16ZFRjR1Z2VFFvd1JsWjJkR2hyUTFGS1praEhhM2RzWlZoV1RtcFJTV2hCU201VWNYZzVibkZxTXk5MGNrUldRVlU0YmtNMlEwUkVRbVk1WWtVeVZtbzRWbEpMUmtJd0NsUlRTV0lLTFMwdExTMUZUa1FnUTBWU1ZFbEdTVU5CVkVVdExTMHRMUW89In1dfSwia2luZCI6ImRzc2UifQ==", "inclusionPromise": { - "signedEntryTimestamp": "MEUCIQCQZMbYdJVrkLHWRzFxbt2cNS//bLRAacfivB9BLK5lgQIgQIq4epHvl2ImK9msTZyx1xHEgZfDCw9eIuxlfqsHmM0=" + "signedEntryTimestamp": "MEYCIQCrgowYAh6eLU5NgnfuTc82ORffISmyE+9bE896U1hkAwIhAP8ZYzV+yBtMcKOZUfRkPbbeujhVeWXNbzmpab62zRE7" }, "inclusionProof": { "checkpoint": { - "envelope": "rekor.localhost - 123\n42\n+cwlo1c9YesTN+f7fIomUOAu36Tooy7jzqNO4wue5XA=\n\n— rekor.localhost VbgJJjBFAiBIIEY/uItn4D3QdavqQRkauviBlwebWhU+WuDBLW0CpgIhAJU4c3pbnJnTmK7tdiELG++nM77xOwTaZ/CiD+7hzDte\n" + "envelope": "rekor.localhost - 123\n42\nL0oP33h+JuxJ+BB+alU93fx8twxItfKawleiOK/++sE=\n\n— rekor.localhost 45EjTzBEAiBnG6i8sxing1CG/QHZgUCjkdm3j+lQS8s45huyvK8QiAIgUoEx7zIsBu1PKzrr9YsiF6b/1Jzw/5+5XvYSGP4aePE=\n" }, - "rootHash": "+cwlo1c9YesTN+f7fIomUOAu36Tooy7jzqNO4wue5XA=", + "rootHash": "L0oP33h+JuxJ+BB+alU93fx8twxItfKawleiOK/++sE=", "treeSize": "1" }, - "integratedTime": "1794471535", + "integratedTime": "1794580615", "kindVersion": { "kind": "dsse", "version": "0.0.1" }, "logId": { - "keyId": "VbgJJh1uXk4PvCPZ3fIjaxUep33R8Z6T6wAJfVjz+BA=" + "keyId": "45EjT1abdD2MKrnHGSnayLaGvLNDQ4SRtMzNbF54fBc=" } } ] diff --git a/internal/intoto/testdata/key-signed-provenance.dsse.json b/internal/intoto/testdata/key-signed-provenance.dsse.json index b788dacf5..9eee82701 100644 --- a/internal/intoto/testdata/key-signed-provenance.dsse.json +++ b/internal/intoto/testdata/key-signed-provenance.dsse.json @@ -4,7 +4,7 @@ "signatures": [ { "keyid": "", - "sig": "MEUCIAImnlMe6/TBALBq3IyJtsXRc067joI9UccLK/D8lsJXAiEAqYtqMRgFA+6F82UF2gUdocHeQkJ+xmN4qIwWqJeaEQk=" + "sig": "MEQCICV/gqio8oxLidYq10aL56809/sFgRbfMgQ8yjXbmf8EAiAvHh9PQ/ItoTHnYFx4/NxgCGq7kmnji9F1RY2ofwq+Iw==" } ] } diff --git a/internal/intoto/testdata/key.pub b/internal/intoto/testdata/key.pub index 4083c6813..5e6c7ef95 100644 --- a/internal/intoto/testdata/key.pub +++ b/internal/intoto/testdata/key.pub @@ -1,4 +1,4 @@ -----BEGIN PUBLIC KEY----- -MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEmSqnwtsNI4bUAW/xl3o+xdmDYJUt -wDpj3cgSs4CERLwbU2DU4tpyXMnCy5Kd5bQBJvGjsfupPiMKahKVRf3qjg== +MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEPRrC+V1I5FsqfA13WXofkYi/ZFd8 +VEL6b1106724ZGYmnXM6ZHh78LkkNQBLdI70vvvuClFfctOMkCe7ei55fg== -----END PUBLIC KEY----- diff --git a/internal/intoto/testdata/newest-first.intoto.jsonl b/internal/intoto/testdata/newest-first.intoto.jsonl index 476a5caff..fb80d2773 100644 --- a/internal/intoto/testdata/newest-first.intoto.jsonl +++ b/internal/intoto/testdata/newest-first.intoto.jsonl @@ -1,2 +1,2 @@ -{"mediaType":"application/vnd.dev.sigstore.bundle.v0.3+json","verificationMaterial":{"certificate":{"rawBytes":"MIICzjCCAnSgAwIBAgIIGy7X8UrFi+AwCgYIKoZIzj0EAwIwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYxMTEyMDgxNjU1WhcNMjYxMTEyMDgyNzU1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAERLVkhQBXOPm16iOJD4EQJ0MAfccmcj4RCMK1N7TDBanqk12eJ1cNZOdTY3g2WAJzWeLi97UsN1ty+7mnLfSk9KOCAZ8wggGbMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAfBgNVHSMEGDAWgBSZpSIKVYxSQzu1jBpx0BTIUS5kPjBYBgNVHREBAf8ETjBMhkpodHRwczovL2dpdGh1Yi5jb20vYWNtZS93aWRnZXQvLmdpdGh1Yi93b3JrZmxvd3MvYnVpbGQueW1sQHJlZnMvaGVhZHMvbWFpbjA5BgorBgEEAYO/MAEBBCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAuBgorBgEEAYO/MAEMBCAMHmh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldDBRBgorBgEEAYO/MAEVBEMMQWh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldC9hY3Rpb25zL3J1bnMvMTIzNDU2Nzg5MC9hdHRlbXB0cy8xMAoGCCqGSM49BAMCA0gAMEUCIAzUhKt70hM2kxxSkReTUaaoYAHi5TLSpt1iaL/bikefAiEAgx2o6ZFOSM2WnjTTCAFC8dshprpFdp00r/wlBhUma3U="},"tlogEntries":[{"logId":{"keyId":"VbgJJh1uXk4PvCPZ3fIjaxUep33R8Z6T6wAJfVjz+BA="},"kindVersion":{"kind":"dsse","version":"0.0.1"},"integratedTime":"1794471655","inclusionPromise":{"signedEntryTimestamp":"MEUCIAa7P50PDdBF4Hf3Ptm9lxImOWppQQqHKSJLSLifXbg0AiEAkor+xfYNoiosgE1kBY6LtZOylsNycLKoGJYgnaeHH/Q="},"inclusionProof":{"rootHash":"XqZaQJoy4akmFcl4n25ouvcphcEfsocPtUdMZO5lsp8=","treeSize":"1","checkpoint":{"envelope":"rekor.localhost - 123\n42\nXqZaQJoy4akmFcl4n25ouvcphcEfsocPtUdMZO5lsp8=\n\n— rekor.localhost VbgJJjBEAiB4rcs3BMScbkTwwid+wOk4wgTLwj09XMaJdTtyAYqCfAIgfC7VsYw9Uyk3121LGDHeH1gnKtLcQF1J5J3GH4WtBeg=\n"}},"canonicalizedBody":"eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJzcGVjIjp7ImVudmVsb3BlSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6Ijk4MWUxYmM0ODMzYjZjNzc3YTdkZWUyMTA3NWI0MzU0YWExNDQ2Y2U5OTkxYzA0MzljNDQ2Mzc2MjhkNTlkZjcifSwicGF5bG9hZEhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJmOTZjNDY3Y2I2Y2MzYmU1ZGRlMGE0YzZkYTFhZDQ5NTA3NGEzYjRiZTcyMDc2NDQyYzBmNGI4NzFjMTNhMWVlIn0sInNpZ25hdHVyZXMiOlt7InNpZ25hdHVyZSI6Ik1FVUNJUUREMjMyTDRiM0NmSDByWEVkY3RIcUpVUDlmM0tzRVFiMmdNL25rbEdtSitnSWdIQjkrWHNFd0ZSVjNleHFDajlMZFI3akh3a3ZjbEtIK3Z6UkIwS3FQWjRFPSIsInZlcmlmaWVyIjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTjZha05EUVc1VFowRjNTVUpCWjBsSlIzazNXRGhWY2tacEswRjNRMmRaU1V0dldrbDZhakJGUVhkSmQwNTZSVlpOUWsxSFFURlZSVU5vVFUwS1l6SnNibU16VW5aamJWVjFXa2RXTWsxU05IZElRVmxFVmxGUlJFVjRWbnBoVjJSNlpFYzVlVnBUTVhCaWJsSnNZMjB4YkZwSGJHaGtSMVYzU0doalRncE5hbGw0VFZSRmVVMUVaM2hPYWxVeFYyaGpUazFxV1hoTlZFVjVUVVJuZVU1NlZURlhha0ZCVFVacmQwVjNXVWhMYjFwSmVtb3dRMEZSV1VsTGIxcEpDbnBxTUVSQlVXTkVVV2RCUlZKTVZtdG9VVUpZVDFCdE1UWnBUMHBFTkVWUlNqQk5RV1pqWTIxamFqUlNRMDFMTVU0M1ZFUkNZVzV4YXpFeVpVb3hZMDRLV2s5a1ZGa3paekpYUVVwNlYyVk1hVGszVlhOT01YUjVLemR0Ymt4bVUyczVTMDlEUVZvNGQyZG5SMkpOUVRSSFFURlZaRVIzUlVJdmQxRkZRWGRKU0FwblJFRlVRbWRPVmtoVFZVVkVSRUZMUW1kbmNrSm5SVVpDVVdORVFYcEJaa0puVGxaSVUwMUZSMFJCVjJkQ1UxcHdVMGxMVmxsNFUxRjZkVEZxUW5CNENqQkNWRWxWVXpWclVHcENXVUpuVGxaSVVrVkNRV1k0UlZScVFrMW9hM0J2WkVoU2QyTjZiM1pNTW1Sd1pFZG9NVmxwTldwaU1qQjJXVmRPZEZwVE9UTUtZVmRTYmxwWVVYWk1iV1J3WkVkb01WbHBPVE5pTTBweVdtMTRkbVF6VFhaWmJsWndZa2RSZFdWWE1YTlJTRXBzV201TmRtRkhWbWhhU0UxMllsZEdjQXBpYWtFMVFtZHZja0puUlVWQldVOHZUVUZGUWtKRGRHOWtTRkozWTNwdmRrd3pVblpoTWxaMVRHMUdhbVJIYkhaaWJrMTFXakpzTUdGSVZtbGtXRTVzQ21OdFRuWmlibEpzWW01UmRWa3lPWFJOUkhOSFEybHpSMEZSVVVKbk56aDNRVkZuUlV4UmQzSmhTRkl3WTBoTk5reDVPVEJpTW5Sc1ltazFhRmt6VW5BS1lqSTFla3h0WkhCa1IyZ3hXVzVXZWxwWVNtcGlNalV3V2xjMU1FeHRUblppVkVGMVFtZHZja0puUlVWQldVOHZUVUZGVFVKRFFVMUliV2d3WkVoQ2VncFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVhRmt5TVd4TU0yUndXa2RrYkdSRVFsSkNaMjl5UW1kRlJVRlpUeTlOUVVWV1FrVk5UVkZYYURCa1NFSjZDazlwT0haYU1td3dZVWhXYVV4dFRuWmlVemxvV1RJeGJFd3paSEJhUjJSc1pFTTVhRmt6VW5CaU1qVjZURE5LTVdKdVRYWk5WRWw2VGtSVk1rNTZaelVLVFVNNWFHUklVbXhpV0VJd1kzazRlRTFCYjBkRFEzRkhVMDAwT1VKQlRVTkJNR2RCVFVWVlEwbEJlbFZvUzNRM01HaE5NbXQ0ZUZOclVtVlVWV0ZoYndwWlFVaHBOVlJNVTNCME1XbGhUQzlpYVd0bFprRnBSVUZuZURKdk5scEdUMU5OTWxkdWFsUlVRMEZHUXpoa2MyaHdjbkJHWkhBd01ISXZkMnhDYUZWdENtRXpWVDBLTFMwdExTMUZUa1FnUTBWU1ZFbEdTVU5CVkVVdExTMHRMUW89In1dfSwia2luZCI6ImRzc2UifQ=="}],"timestampVerificationData":{"rfc3161Timestamps":[{"signedTimestamp":"MIICUTADAgEAMIICSAYJKoZIhvcNAQcCoIICOTCCAjUCAQMxDTALBglghkgBZQMEAgEwgYIGCyqGSIb3DQEJEAEEoHMEcTBvAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQgJ4bgeVl1HXm8xBCM8ublVk0QAjiBuYdPQMHoOF2oeA4CFQDq+Q3S559vGfzgSvWCCDiOTU1fHhgPMjAyNjExMTIwODE3NTVaoASkAjAAoAAxggGYMIIBlAIBATBAMDsxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEiMCAGA1UEAxMZc2lnc3RvcmUtdHNhLWludGVybWVkaWF0ZQIBATALBglghkgBZQMEAgGggeowGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEEMBwGCSqGSIb3DQEJBTEPFw0yNjExMTIwODE3NTVaMC8GCSqGSIb3DQEJBDEiBCAVqZK7CLOlDeZjUyZx1NXumKi6v2Mum9JUPpRoRveVRjB9BgsqhkiG9w0BCRACLzFuMGwwajBoBCBxsTcCVWXweYqyR+Mv0qEyQNFC6h3MFA0BmrBEHVH9tDBEMD+kPTA7MRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxIjAgBgNVBAMTGXNpZ3N0b3JlLXRzYS1pbnRlcm1lZGlhdGUCAQEwCgYIKoZIzj0EAwIERzBFAiEA77K7kSp2agjbhd50bSaVwdjF/aSsZHTJF8JCTEsV+U0CIB1JZo4eTFz6aDw1vBqRQMTTi59bv/Be1ygaodLIsvj8"}]}},"dsseEnvelope":{"payload":"eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoiYXJ0aWZhY3QuYmluIiwiZGlnZXN0Ijp7InNoYTI1NiI6ImU4ODk1MTI5MWJjYTA4MDdhNDFmM2MwMTQ0MDA5YmZmZjVjNmM3N2RjMTMxMGQ1MmU4YzZkNjJmZWVlOTYwYTgifX1dLCJwcmVkaWNhdGVUeXBlIjoiaHR0cHM6Ly9zbHNhLmRldi9wcm92ZW5hbmNlL3YxIiwicHJlZGljYXRlIjp7ImJ1aWxkRGVmaW5pdGlvbiI6eyJidWlsZFR5cGUiOiJodHRwczovL2FjdGlvbnMuZ2l0aHViLmlvL2J1aWxkdHlwZXMvd29ya2Zsb3cvdjEiLCJleHRlcm5hbFBhcmFtZXRlcnMiOnsid29ya2Zsb3ciOnsicmVmIjoicmVmcy9oZWFkcy9tYWluIiwicmVwb3NpdG9yeSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldCIsInBhdGgiOiIuZ2l0aHViL3dvcmtmbG93cy9idWlsZC55bWwifX0sImludGVybmFsUGFyYW1ldGVycyI6eyJnaXRodWIiOnsiZXZlbnRfbmFtZSI6InB1c2giLCJyZXBvc2l0b3J5X2lkIjoiMTIzNDU2Nzg5IiwicmVwb3NpdG9yeV9vd25lcl9pZCI6Ijk4NzY1NDMyMSIsInJ1bm5lcl9lbnZpcm9ubWVudCI6ImdpdGh1Yi1ob3N0ZWQifX0sInJlc29sdmVkRGVwZW5kZW5jaWVzIjpbeyJ1cmkiOiJnaXQraHR0cHM6Ly9naXRodWIuY29tL2FjbWUvd2lkZ2V0QHJlZnMvaGVhZHMvbWFpbiIsImRpZ2VzdCI6eyJnaXRDb21taXQiOiI0ZjlkMmE3YzFlNmI4YTNkNWYwZTJjOWI3YTFkNGU2ZjhjM2I1YTcwIn19XX0sInJ1bkRldGFpbHMiOnsiYnVpbGRlciI6eyJpZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9hY3Rpb25zL3J1bm5lci9naXRodWItaG9zdGVkIn0sIm1ldGFkYXRhIjp7Imludm9jYXRpb25JZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldC9hY3Rpb25zL3J1bnMvMTIzNDU2Nzg5MC9hdHRlbXB0cy8xIn19fX0=","payloadType":"application/vnd.in-toto+json","signatures":[{"sig":"MEUCIQDD232L4b3CfH0rXEdctHqJUP9f3KsEQb2gM/nklGmJ+gIgHB9+XsEwFRV3exqCj9LdR7jHwkvclKH+vzRB0KqPZ4E="}]}} -{"mediaType":"application/vnd.dev.sigstore.bundle.v0.3+json","verificationMaterial":{"certificate":{"rawBytes":"MIICzTCCAnSgAwIBAgIINn9uUaUFkJgwCgYIKoZIzj0EAwIwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYxMTEyMDgxNjU1WhcNMjYxMTEyMDgyNzU1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAES/IxGhqpL4cZhdfyNOUjr++HkXqCn5NoC/Lyw7t6n3Xyl/RrlfZrMz8cJEE4savMUyMetfTuL/4wrXwbwawEMaOCAZ8wggGbMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAfBgNVHSMEGDAWgBSZpSIKVYxSQzu1jBpx0BTIUS5kPjBYBgNVHREBAf8ETjBMhkpodHRwczovL2dpdGh1Yi5jb20vYWNtZS93aWRnZXQvLmdpdGh1Yi93b3JrZmxvd3MvYnVpbGQueW1sQHJlZnMvaGVhZHMvbWFpbjA5BgorBgEEAYO/MAEBBCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAuBgorBgEEAYO/MAEMBCAMHmh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldDBRBgorBgEEAYO/MAEVBEMMQWh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldC9hY3Rpb25zL3J1bnMvMTIzNDU2Nzg5MC9hdHRlbXB0cy8xMAoGCCqGSM49BAMCA0cAMEQCIGsUAr/ZXJKSPuyifpj5iejCbGcCqPxPXzxEdD09kobtAiBmLtzmsV5fZr5fdMz/BQOS1avsdBMVEjXqcSddhM7idQ=="},"tlogEntries":[{"logId":{"keyId":"VbgJJh1uXk4PvCPZ3fIjaxUep33R8Z6T6wAJfVjz+BA="},"kindVersion":{"kind":"dsse","version":"0.0.1"},"integratedTime":"1794471595","inclusionPromise":{"signedEntryTimestamp":"MEQCIFN6BZeAdtgo/1W/ZjMSSJUkz7XVgkE787vsAQaIScW8AiB4zliR/a8Eis44sk8RE+y/G7kwK4vWglZic5G5i0T+kA=="},"inclusionProof":{"rootHash":"Th4lsdULYJntDZSSs2h8Yede+5FrLpd6a0sq5b5UEnI=","treeSize":"1","checkpoint":{"envelope":"rekor.localhost - 123\n42\nTh4lsdULYJntDZSSs2h8Yede+5FrLpd6a0sq5b5UEnI=\n\n— rekor.localhost VbgJJjBFAiEA98TD2RsI6IDRjUZ4VzbckCe9v+BZ+8r6zZxQXnpsSvwCIEhBdikzgSV7eYtoGzOsWG1jXHUAWY08ACuhJogPuFl7\n"}},"canonicalizedBody":"eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJzcGVjIjp7ImVudmVsb3BlSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6Ijc1ZDRlMzY4ZGMyNGNkMzRjYjI4YzhjMzVhM2FkNTY1NjIwODE3NTEzMzJkZTNkODZlMDFmMTNkOTUyYmY3YzgifSwicGF5bG9hZEhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJmOTZjNDY3Y2I2Y2MzYmU1ZGRlMGE0YzZkYTFhZDQ5NTA3NGEzYjRiZTcyMDc2NDQyYzBmNGI4NzFjMTNhMWVlIn0sInNpZ25hdHVyZXMiOlt7InNpZ25hdHVyZSI6Ik1FUUNJRGVnN1F0WlhadVYwNnpWRmZkQ0hzMGFXNllZTnRxWmlQT2M4RTlZbDBhUUFpQW1YR05NcmdsWEhlU3lEdzdzZTQ4L2draUdoYkI0OHRDTEoxeThpYUVqZWc9PSIsInZlcmlmaWVyIjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTjZWRU5EUVc1VFowRjNTVUpCWjBsSlRtNDVkVlZoVlVaclNtZDNRMmRaU1V0dldrbDZhakJGUVhkSmQwNTZSVlpOUWsxSFFURlZSVU5vVFUwS1l6SnNibU16VW5aamJWVjFXa2RXTWsxU05IZElRVmxFVmxGUlJFVjRWbnBoVjJSNlpFYzVlVnBUTVhCaWJsSnNZMjB4YkZwSGJHaGtSMVYzU0doalRncE5hbGw0VFZSRmVVMUVaM2hPYWxVeFYyaGpUazFxV1hoTlZFVjVUVVJuZVU1NlZURlhha0ZCVFVacmQwVjNXVWhMYjFwSmVtb3dRMEZSV1VsTGIxcEpDbnBxTUVSQlVXTkVVV2RCUlZNdlNYaEhhSEZ3VERSaldtaGtabmxPVDFWcWNpc3JTR3RZY1VOdU5VNXZReTlNZVhjM2REWnVNMWg1YkM5U2NteG1XbklLVFhvNFkwcEZSVFJ6WVhaTlZYbE5aWFJtVkhWTUx6UjNjbGgzWW5kaGQwVk5ZVTlEUVZvNGQyZG5SMkpOUVRSSFFURlZaRVIzUlVJdmQxRkZRWGRKU0FwblJFRlVRbWRPVmtoVFZVVkVSRUZMUW1kbmNrSm5SVVpDVVdORVFYcEJaa0puVGxaSVUwMUZSMFJCVjJkQ1UxcHdVMGxMVmxsNFUxRjZkVEZxUW5CNENqQkNWRWxWVXpWclVHcENXVUpuVGxaSVVrVkNRV1k0UlZScVFrMW9hM0J2WkVoU2QyTjZiM1pNTW1Sd1pFZG9NVmxwTldwaU1qQjJXVmRPZEZwVE9UTUtZVmRTYmxwWVVYWk1iV1J3WkVkb01WbHBPVE5pTTBweVdtMTRkbVF6VFhaWmJsWndZa2RSZFdWWE1YTlJTRXBzV201TmRtRkhWbWhhU0UxMllsZEdjQXBpYWtFMVFtZHZja0puUlVWQldVOHZUVUZGUWtKRGRHOWtTRkozWTNwdmRrd3pVblpoTWxaMVRHMUdhbVJIYkhaaWJrMTFXakpzTUdGSVZtbGtXRTVzQ21OdFRuWmlibEpzWW01UmRWa3lPWFJOUkhOSFEybHpSMEZSVVVKbk56aDNRVkZuUlV4UmQzSmhTRkl3WTBoTk5reDVPVEJpTW5Sc1ltazFhRmt6VW5BS1lqSTFla3h0WkhCa1IyZ3hXVzVXZWxwWVNtcGlNalV3V2xjMU1FeHRUblppVkVGMVFtZHZja0puUlVWQldVOHZUVUZGVFVKRFFVMUliV2d3WkVoQ2VncFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVhRmt5TVd4TU0yUndXa2RrYkdSRVFsSkNaMjl5UW1kRlJVRlpUeTlOUVVWV1FrVk5UVkZYYURCa1NFSjZDazlwT0haYU1td3dZVWhXYVV4dFRuWmlVemxvV1RJeGJFd3paSEJhUjJSc1pFTTVhRmt6VW5CaU1qVjZURE5LTVdKdVRYWk5WRWw2VGtSVk1rNTZaelVLVFVNNWFHUklVbXhpV0VJd1kzazRlRTFCYjBkRFEzRkhVMDAwT1VKQlRVTkJNR05CVFVWUlEwbEhjMVZCY2k5YVdFcExVMUIxZVdsbWNHbzFhV1ZxUXdwaVIyTkRjVkI0VUZoNmVFVmtSREE1YTI5aWRFRnBRbTFNZEhwdGMxWTFabHB5Tldaa1RYb3ZRbEZQVXpGaGRuTmtRazFXUldwWWNXTlRaR1JvVFRkcENtUlJQVDBLTFMwdExTMUZUa1FnUTBWU1ZFbEdTVU5CVkVVdExTMHRMUW89In1dfSwia2luZCI6ImRzc2UifQ=="}],"timestampVerificationData":{"rfc3161Timestamps":[{"signedTimestamp":"MIICUTADAgEAMIICSAYJKoZIhvcNAQcCoIICOTCCAjUCAQMxDTALBglghkgBZQMEAgEwgYEGCyqGSIb3DQEJEAEEoHIEcDBuAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQgG5I6W48T6HBJT6zHYHXHM/2+wGl22h3v7jt3uzyUklYCFBxUsRLQpBY44GYvyfg5gLrqmX7UGA8yMDI2MTExMjA4MTc1NVqgBKQCMACgADGCAZkwggGVAgEBMEAwOzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MSIwIAYDVQQDExlzaWdzdG9yZS10c2EtaW50ZXJtZWRpYXRlAgEBMAsGCWCGSAFlAwQCAaCB6jAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQAQQwHAYJKoZIhvcNAQkFMQ8XDTI2MTExMjA4MTc1NVowLwYJKoZIhvcNAQkEMSIEIFPHxOk4a5AUHwo6BRs0a9+eWwF3mBqO2EnjMjmgi4H5MH0GCyqGSIb3DQEJEAIvMW4wbDBqMGgEIHGxNwJVZfB5irJH4y/SoTJA0ULqHcwUDQGasEQdUf20MEQwP6Q9MDsxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEiMCAGA1UEAxMZc2lnc3RvcmUtdHNhLWludGVybWVkaWF0ZQIBATAKBggqhkjOPQQDAgRIMEYCIQDBClq0kmJ9KrCT4OEi1r4p+F+Dy5jFnNZSr6xV7lasvQIhAL1yMDRs/FI8H/7VwOCFRYkaH9p2+1G6aZiq51BrQEfy"}]}},"dsseEnvelope":{"payload":"eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoiYXJ0aWZhY3QuYmluIiwiZGlnZXN0Ijp7InNoYTI1NiI6ImU4ODk1MTI5MWJjYTA4MDdhNDFmM2MwMTQ0MDA5YmZmZjVjNmM3N2RjMTMxMGQ1MmU4YzZkNjJmZWVlOTYwYTgifX1dLCJwcmVkaWNhdGVUeXBlIjoiaHR0cHM6Ly9zbHNhLmRldi9wcm92ZW5hbmNlL3YxIiwicHJlZGljYXRlIjp7ImJ1aWxkRGVmaW5pdGlvbiI6eyJidWlsZFR5cGUiOiJodHRwczovL2FjdGlvbnMuZ2l0aHViLmlvL2J1aWxkdHlwZXMvd29ya2Zsb3cvdjEiLCJleHRlcm5hbFBhcmFtZXRlcnMiOnsid29ya2Zsb3ciOnsicmVmIjoicmVmcy9oZWFkcy9tYWluIiwicmVwb3NpdG9yeSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldCIsInBhdGgiOiIuZ2l0aHViL3dvcmtmbG93cy9idWlsZC55bWwifX0sImludGVybmFsUGFyYW1ldGVycyI6eyJnaXRodWIiOnsiZXZlbnRfbmFtZSI6InB1c2giLCJyZXBvc2l0b3J5X2lkIjoiMTIzNDU2Nzg5IiwicmVwb3NpdG9yeV9vd25lcl9pZCI6Ijk4NzY1NDMyMSIsInJ1bm5lcl9lbnZpcm9ubWVudCI6ImdpdGh1Yi1ob3N0ZWQifX0sInJlc29sdmVkRGVwZW5kZW5jaWVzIjpbeyJ1cmkiOiJnaXQraHR0cHM6Ly9naXRodWIuY29tL2FjbWUvd2lkZ2V0QHJlZnMvaGVhZHMvbWFpbiIsImRpZ2VzdCI6eyJnaXRDb21taXQiOiI0ZjlkMmE3YzFlNmI4YTNkNWYwZTJjOWI3YTFkNGU2ZjhjM2I1YTcwIn19XX0sInJ1bkRldGFpbHMiOnsiYnVpbGRlciI6eyJpZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9hY3Rpb25zL3J1bm5lci9naXRodWItaG9zdGVkIn0sIm1ldGFkYXRhIjp7Imludm9jYXRpb25JZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldC9hY3Rpb25zL3J1bnMvMTIzNDU2Nzg5MC9hdHRlbXB0cy8xIn19fX0=","payloadType":"application/vnd.in-toto+json","signatures":[{"sig":"MEQCIDeg7QtZXZuV06zVFfdCHs0aW6YYNtqZiPOc8E9Yl0aQAiAmXGNMrglXHeSyDw7se48/gkiGhbB48tCLJ1y8iaEjeg=="}]}} +{"mediaType":"application/vnd.dev.sigstore.bundle.v0.3+json","verificationMaterial":{"certificate":{"rawBytes":"MIICzzCCAnSgAwIBAgIIJBsJebEI8PQwCgYIKoZIzj0EAwIwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYxMTEzMTQzNDU1WhcNMjYxMTEzMTQ0NTU1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEcd7d9loUXzt1Cc2G3NOJfLsxks0v7Hbm0mx8ryOb2obO4uJfPcS8vaZgnBh804ecY/487hTHbMIWP2vf4R2QoaOCAZ8wggGbMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAfBgNVHSMEGDAWgBQin5D6vOEQoe/EaGQlwHLhwEDhUTBYBgNVHREBAf8ETjBMhkpodHRwczovL2dpdGh1Yi5jb20vYWNtZS93aWRnZXQvLmdpdGh1Yi93b3JrZmxvd3MvYnVpbGQueW1sQHJlZnMvaGVhZHMvbWFpbjA5BgorBgEEAYO/MAEBBCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAuBgorBgEEAYO/MAEMBCAMHmh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldDBRBgorBgEEAYO/MAEVBEMMQWh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldC9hY3Rpb25zL3J1bnMvMTIzNDU2Nzg5MC9hdHRlbXB0cy8xMAoGCCqGSM49BAMCA0kAMEYCIQCxPotN1DVI6vAXnjuCtZ15w9akYo4VS2veeucdsnkzdgIhAPZsAqN59KV7N1KxgLjMHVXmo/r+VdzlPJz61yeiVImT"},"tlogEntries":[{"logId":{"keyId":"45EjT1abdD2MKrnHGSnayLaGvLNDQ4SRtMzNbF54fBc="},"kindVersion":{"kind":"dsse","version":"0.0.1"},"integratedTime":"1794580735","inclusionPromise":{"signedEntryTimestamp":"MEYCIQDYN4ESDFDcBsEui0iAQWgNjTeWlVorKk016milANApLQIhALc/9Ts/H1Y7to8ctadFKbszzl4Os8m/Eb/+yeNjiCvC"},"inclusionProof":{"rootHash":"cirKgMtGqL6LKnevGjbbsoLVZVm/UPBCp8PmPbj317g=","treeSize":"1","checkpoint":{"envelope":"rekor.localhost - 123\n42\ncirKgMtGqL6LKnevGjbbsoLVZVm/UPBCp8PmPbj317g=\n\n— rekor.localhost 45EjTzBFAiEAn16YvnjJK+ZaoFqzznBIHirQxUmjTPw/Ey/exL5ZQdACIHCaPnZY9KwdXKsTJzrI98yV57JCMKyrvYLIqShYzvno\n"}},"canonicalizedBody":"eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJzcGVjIjp7ImVudmVsb3BlSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImJjMzI5NDNmZWIwYzU1NzZmNTk3YTJhMmRmYTgyOTZmNDBiY2FiYWJlNGM3ZGJmNzY3NWEyM2RhYTdlZDg2NzUifSwicGF5bG9hZEhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJmOTZjNDY3Y2I2Y2MzYmU1ZGRlMGE0YzZkYTFhZDQ5NTA3NGEzYjRiZTcyMDc2NDQyYzBmNGI4NzFjMTNhMWVlIn0sInNpZ25hdHVyZXMiOlt7InNpZ25hdHVyZSI6Ik1FWUNJUUNicTdoRXpaT1pXSE5UOHAySGd6WVYwWklmVU1vS3FzaXJsdUFYK3pWeUJ3SWhBSnh2NXlHU1lobEhKL2J1eXkxd2pXbmdPQ2hHK3I4Zm5MZUZDcDN2dG43TSIsInZlcmlmaWVyIjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTjZla05EUVc1VFowRjNTVUpCWjBsSlNrSnpTbVZpUlVrNFVGRjNRMmRaU1V0dldrbDZhakJGUVhkSmQwNTZSVlpOUWsxSFFURlZSVU5vVFUwS1l6SnNibU16VW5aamJWVjFXa2RXTWsxU05IZElRVmxFVmxGUlJFVjRWbnBoVjJSNlpFYzVlVnBUTVhCaWJsSnNZMjB4YkZwSGJHaGtSMVYzU0doalRncE5hbGw0VFZSRmVrMVVVWHBPUkZVeFYyaGpUazFxV1hoTlZFVjZUVlJSTUU1VVZURlhha0ZCVFVacmQwVjNXVWhMYjFwSmVtb3dRMEZSV1VsTGIxcEpDbnBxTUVSQlVXTkVVV2RCUldOa04yUTViRzlWV0hwME1VTmpNa2N6VGs5S1preHplR3R6TUhZM1NHSnRNRzE0T0hKNVQySXliMkpQTkhWS1psQmpVemdLZG1GYVoyNUNhRGd3TkdWaldTODBPRGRvVkVoaVRVbFhVREoyWmpSU01sRnZZVTlEUVZvNGQyZG5SMkpOUVRSSFFURlZaRVIzUlVJdmQxRkZRWGRKU0FwblJFRlVRbWRPVmtoVFZVVkVSRUZMUW1kbmNrSm5SVVpDVVdORVFYcEJaa0puVGxaSVUwMUZSMFJCVjJkQ1VXbHVOVVEyZGs5RlVXOWxMMFZoUjFGc0NuZElUR2gzUlVSb1ZWUkNXVUpuVGxaSVVrVkNRV1k0UlZScVFrMW9hM0J2WkVoU2QyTjZiM1pNTW1Sd1pFZG9NVmxwTldwaU1qQjJXVmRPZEZwVE9UTUtZVmRTYmxwWVVYWk1iV1J3WkVkb01WbHBPVE5pTTBweVdtMTRkbVF6VFhaWmJsWndZa2RSZFdWWE1YTlJTRXBzV201TmRtRkhWbWhhU0UxMllsZEdjQXBpYWtFMVFtZHZja0puUlVWQldVOHZUVUZGUWtKRGRHOWtTRkozWTNwdmRrd3pVblpoTWxaMVRHMUdhbVJIYkhaaWJrMTFXakpzTUdGSVZtbGtXRTVzQ21OdFRuWmlibEpzWW01UmRWa3lPWFJOUkhOSFEybHpSMEZSVVVKbk56aDNRVkZuUlV4UmQzSmhTRkl3WTBoTk5reDVPVEJpTW5Sc1ltazFhRmt6VW5BS1lqSTFla3h0WkhCa1IyZ3hXVzVXZWxwWVNtcGlNalV3V2xjMU1FeHRUblppVkVGMVFtZHZja0puUlVWQldVOHZUVUZGVFVKRFFVMUliV2d3WkVoQ2VncFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVhRmt5TVd4TU0yUndXa2RrYkdSRVFsSkNaMjl5UW1kRlJVRlpUeTlOUVVWV1FrVk5UVkZYYURCa1NFSjZDazlwT0haYU1td3dZVWhXYVV4dFRuWmlVemxvV1RJeGJFd3paSEJhUjJSc1pFTTVhRmt6VW5CaU1qVjZURE5LTVdKdVRYWk5WRWw2VGtSVk1rNTZaelVLVFVNNWFHUklVbXhpV0VJd1kzazRlRTFCYjBkRFEzRkhVMDAwT1VKQlRVTkJNR3RCVFVWWlEwbFJRM2hRYjNST01VUldTVFoyUVZodWFuVkRkRm94TlFwM09XRnJXVzgwVmxNeWRtVmxkV05rYzI1cmVtUm5TV2hCVUZwelFYRk9OVGxMVmpkT01VdDRaMHhxVFVoV1dHMXZMM0lyVm1SNmJGQktlall4ZVdWcENsWkpiVlFLTFMwdExTMUZUa1FnUTBWU1ZFbEdTVU5CVkVVdExTMHRMUW89In1dfSwia2luZCI6ImRzc2UifQ=="}],"timestampVerificationData":{"rfc3161Timestamps":[{"signedTimestamp":"MIICUDADAgEAMIICRwYJKoZIhvcNAQcCoIICODCCAjQCAQMxDTALBglghkgBZQMEAgEwgYEGCyqGSIb3DQEJEAEEoHIEcDBuAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQgymBnNvUDqR5otqehwqqG60fQF8MWVgxB5gJU3NhGetcCFF0c/gcguAP4vf2JBCABZyjsjJFaGA8yMDI2MTExMzE0MzU1NVqgBKQCMACgADGCAZgwggGUAgEBMEAwOzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MSIwIAYDVQQDExlzaWdzdG9yZS10c2EtaW50ZXJtZWRpYXRlAgEBMAsGCWCGSAFlAwQCAaCB6jAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQAQQwHAYJKoZIhvcNAQkFMQ8XDTI2MTExMzE0MzU1NVowLwYJKoZIhvcNAQkEMSIEILj+56nY2EU+uFZ7+ykS0rDLDCA2/QP/4fBGV2MvS+DrMH0GCyqGSIb3DQEJEAIvMW4wbDBqMGgEIHqzFO5j1R1hR/aZHc3rrpWfooCBV/JjusrovH+OhAVlMEQwP6Q9MDsxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEiMCAGA1UEAxMZc2lnc3RvcmUtdHNhLWludGVybWVkaWF0ZQIBATAKBggqhkjOPQQDAgRHMEUCIQC9OBtWjxlNmuARp998C1Xi026hZdsGbqPSvJfqgyXs6gIgTGj+Mqz/GuZALo0D0dB8uUW+KWbpKdIS+bRx4tk0wAw="}]}},"dsseEnvelope":{"payload":"eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoiYXJ0aWZhY3QuYmluIiwiZGlnZXN0Ijp7InNoYTI1NiI6ImU4ODk1MTI5MWJjYTA4MDdhNDFmM2MwMTQ0MDA5YmZmZjVjNmM3N2RjMTMxMGQ1MmU4YzZkNjJmZWVlOTYwYTgifX1dLCJwcmVkaWNhdGVUeXBlIjoiaHR0cHM6Ly9zbHNhLmRldi9wcm92ZW5hbmNlL3YxIiwicHJlZGljYXRlIjp7ImJ1aWxkRGVmaW5pdGlvbiI6eyJidWlsZFR5cGUiOiJodHRwczovL2FjdGlvbnMuZ2l0aHViLmlvL2J1aWxkdHlwZXMvd29ya2Zsb3cvdjEiLCJleHRlcm5hbFBhcmFtZXRlcnMiOnsid29ya2Zsb3ciOnsicmVmIjoicmVmcy9oZWFkcy9tYWluIiwicmVwb3NpdG9yeSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldCIsInBhdGgiOiIuZ2l0aHViL3dvcmtmbG93cy9idWlsZC55bWwifX0sImludGVybmFsUGFyYW1ldGVycyI6eyJnaXRodWIiOnsiZXZlbnRfbmFtZSI6InB1c2giLCJyZXBvc2l0b3J5X2lkIjoiMTIzNDU2Nzg5IiwicmVwb3NpdG9yeV9vd25lcl9pZCI6Ijk4NzY1NDMyMSIsInJ1bm5lcl9lbnZpcm9ubWVudCI6ImdpdGh1Yi1ob3N0ZWQifX0sInJlc29sdmVkRGVwZW5kZW5jaWVzIjpbeyJ1cmkiOiJnaXQraHR0cHM6Ly9naXRodWIuY29tL2FjbWUvd2lkZ2V0QHJlZnMvaGVhZHMvbWFpbiIsImRpZ2VzdCI6eyJnaXRDb21taXQiOiI0ZjlkMmE3YzFlNmI4YTNkNWYwZTJjOWI3YTFkNGU2ZjhjM2I1YTcwIn19XX0sInJ1bkRldGFpbHMiOnsiYnVpbGRlciI6eyJpZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9hY3Rpb25zL3J1bm5lci9naXRodWItaG9zdGVkIn0sIm1ldGFkYXRhIjp7Imludm9jYXRpb25JZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldC9hY3Rpb25zL3J1bnMvMTIzNDU2Nzg5MC9hdHRlbXB0cy8xIn19fX0=","payloadType":"application/vnd.in-toto+json","signatures":[{"sig":"MEYCIQCbq7hEzZOZWHNT8p2HgzYV0ZIfUMoKqsirluAX+zVyBwIhAJxv5yGSYhlHJ/buyy1wjWngOChG+r8fnLeFCp3vtn7M"}]}} +{"mediaType":"application/vnd.dev.sigstore.bundle.v0.3+json","verificationMaterial":{"certificate":{"rawBytes":"MIICzTCCAnSgAwIBAgIIM5vq+5rCe1MwCgYIKoZIzj0EAwIwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYxMTEzMTQzNDU1WhcNMjYxMTEzMTQ0NTU1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAED50qXNJlmw5LvT5lPdxP0Z703BwbIFEGJ4EOKYadx9ksD9ftfkFCntRQ/mO6qds+JJBGHpQBWeZ6ep9PgrFi4KOCAZ8wggGbMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAfBgNVHSMEGDAWgBQin5D6vOEQoe/EaGQlwHLhwEDhUTBYBgNVHREBAf8ETjBMhkpodHRwczovL2dpdGh1Yi5jb20vYWNtZS93aWRnZXQvLmdpdGh1Yi93b3JrZmxvd3MvYnVpbGQueW1sQHJlZnMvaGVhZHMvbWFpbjA5BgorBgEEAYO/MAEBBCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAuBgorBgEEAYO/MAEMBCAMHmh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldDBRBgorBgEEAYO/MAEVBEMMQWh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldC9hY3Rpb25zL3J1bnMvMTIzNDU2Nzg5MC9hdHRlbXB0cy8xMAoGCCqGSM49BAMCA0cAMEQCIARQEtzsld16ykKYzummJ8XEKt8Sw2+4NYVwa0RSQstiAiAYEGap1O3pr153e4rWX7iACZSruXs/f7fvqavN70FjMg=="},"tlogEntries":[{"logId":{"keyId":"45EjT1abdD2MKrnHGSnayLaGvLNDQ4SRtMzNbF54fBc="},"kindVersion":{"kind":"dsse","version":"0.0.1"},"integratedTime":"1794580675","inclusionPromise":{"signedEntryTimestamp":"MEUCICFcp2Vlt9l1z0SXYbm63d5ci2fJb2/9RDsq0JTGOxRmAiEAqwF+jz13sjThJkq9fuaBw6voq6wtqPbEmqcDDNmA7OA="},"inclusionProof":{"rootHash":"9aXTbUd6bS8hyt3d4ye+TXjoBbKwIIcfuSsWhWgi1BU=","treeSize":"1","checkpoint":{"envelope":"rekor.localhost - 123\n42\n9aXTbUd6bS8hyt3d4ye+TXjoBbKwIIcfuSsWhWgi1BU=\n\n— rekor.localhost 45EjTzBEAiBgGQo20A+M+UzwSnviQdFzQ6j2X7qXJlf7rr5oaWdyLQIgTYmz+GUXvilS2wJTDW9rpAn/8cnbUnW+e++jo9HILNA=\n"}},"canonicalizedBody":"eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJzcGVjIjp7ImVudmVsb3BlSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjVjODNlM2FiZDY2NTUxN2ViMDc2ZDgxZGNmN2QzM2NiOWZmMTNhZTc5NzE4ZmVkZTIxODg5OWE2MDZlY2M4NzMifSwicGF5bG9hZEhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJmOTZjNDY3Y2I2Y2MzYmU1ZGRlMGE0YzZkYTFhZDQ5NTA3NGEzYjRiZTcyMDc2NDQyYzBmNGI4NzFjMTNhMWVlIn0sInNpZ25hdHVyZXMiOlt7InNpZ25hdHVyZSI6Ik1FWUNJUUNkcFdYQWdjZkJSd3BnMTlZV3Z3L0dvTE04OG4yMUdpbzQrV1JuQ1NoVWJnSWhBSnQwNEVrQ0FXc0VUb2ZmNXI3cXA5aGdpU2dRTkdOZm5ralBaaEVjMmJYYiIsInZlcmlmaWVyIjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTjZWRU5EUVc1VFowRjNTVUpCWjBsSlRUVjJjU3MxY2tObE1VMTNRMmRaU1V0dldrbDZhakJGUVhkSmQwNTZSVlpOUWsxSFFURlZSVU5vVFUwS1l6SnNibU16VW5aamJWVjFXa2RXTWsxU05IZElRVmxFVmxGUlJFVjRWbnBoVjJSNlpFYzVlVnBUTVhCaWJsSnNZMjB4YkZwSGJHaGtSMVYzU0doalRncE5hbGw0VFZSRmVrMVVVWHBPUkZVeFYyaGpUazFxV1hoTlZFVjZUVlJSTUU1VVZURlhha0ZCVFVacmQwVjNXVWhMYjFwSmVtb3dRMEZSV1VsTGIxcEpDbnBxTUVSQlVXTkVVV2RCUlVRMU1IRllUa3BzYlhjMVRIWlVOV3hRWkhoUU1GbzNNRE5DZDJKSlJrVkhTalJGVDB0WllXUjRPV3R6UkRsbWRHWnJSa01LYm5SU1VTOXRUelp4WkhNclNrcENSMGh3VVVKWFpWbzJaWEE1VUdkeVJtazBTMDlEUVZvNGQyZG5SMkpOUVRSSFFURlZaRVIzUlVJdmQxRkZRWGRKU0FwblJFRlVRbWRPVmtoVFZVVkVSRUZMUW1kbmNrSm5SVVpDVVdORVFYcEJaa0puVGxaSVUwMUZSMFJCVjJkQ1VXbHVOVVEyZGs5RlVXOWxMMFZoUjFGc0NuZElUR2gzUlVSb1ZWUkNXVUpuVGxaSVVrVkNRV1k0UlZScVFrMW9hM0J2WkVoU2QyTjZiM1pNTW1Sd1pFZG9NVmxwTldwaU1qQjJXVmRPZEZwVE9UTUtZVmRTYmxwWVVYWk1iV1J3WkVkb01WbHBPVE5pTTBweVdtMTRkbVF6VFhaWmJsWndZa2RSZFdWWE1YTlJTRXBzV201TmRtRkhWbWhhU0UxMllsZEdjQXBpYWtFMVFtZHZja0puUlVWQldVOHZUVUZGUWtKRGRHOWtTRkozWTNwdmRrd3pVblpoTWxaMVRHMUdhbVJIYkhaaWJrMTFXakpzTUdGSVZtbGtXRTVzQ21OdFRuWmlibEpzWW01UmRWa3lPWFJOUkhOSFEybHpSMEZSVVVKbk56aDNRVkZuUlV4UmQzSmhTRkl3WTBoTk5reDVPVEJpTW5Sc1ltazFhRmt6VW5BS1lqSTFla3h0WkhCa1IyZ3hXVzVXZWxwWVNtcGlNalV3V2xjMU1FeHRUblppVkVGMVFtZHZja0puUlVWQldVOHZUVUZGVFVKRFFVMUliV2d3WkVoQ2VncFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVhRmt5TVd4TU0yUndXa2RrYkdSRVFsSkNaMjl5UW1kRlJVRlpUeTlOUVVWV1FrVk5UVkZYYURCa1NFSjZDazlwT0haYU1td3dZVWhXYVV4dFRuWmlVemxvV1RJeGJFd3paSEJhUjJSc1pFTTVhRmt6VW5CaU1qVjZURE5LTVdKdVRYWk5WRWw2VGtSVk1rNTZaelVLVFVNNWFHUklVbXhpV0VJd1kzazRlRTFCYjBkRFEzRkhVMDAwT1VKQlRVTkJNR05CVFVWUlEwbEJVbEZGZEhwemJHUXhObmxyUzFsNmRXMXRTamhZUlFwTGREaFRkeklyTkU1WlZuZGhNRkpUVVhOMGFVRnBRVmxGUjJGd01VOHpjSEl4TlRObE5ISlhXRGRwUVVOYVUzSjFXSE12WmpkbWRuRmhkazQzTUVacUNrMW5QVDBLTFMwdExTMUZUa1FnUTBWU1ZFbEdTVU5CVkVVdExTMHRMUW89In1dfSwia2luZCI6ImRzc2UifQ=="}],"timestampVerificationData":{"rfc3161Timestamps":[{"signedTimestamp":"MIICUDADAgEAMIICRwYJKoZIhvcNAQcCoIICODCCAjQCAQMxDTALBglghkgBZQMEAgEwgYEGCyqGSIb3DQEJEAEEoHIEcDBuAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQglvvo+e4/JNnDKJM0UcfRfbN6O/iKfVsqTMl4ZQPI+yQCFHEPsJHWcJnBNqYZJVbGi5Vt1zVVGA8yMDI2MTExMzE0MzU1NVqgBKQCMACgADGCAZgwggGUAgEBMEAwOzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MSIwIAYDVQQDExlzaWdzdG9yZS10c2EtaW50ZXJtZWRpYXRlAgEBMAsGCWCGSAFlAwQCAaCB6jAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQAQQwHAYJKoZIhvcNAQkFMQ8XDTI2MTExMzE0MzU1NVowLwYJKoZIhvcNAQkEMSIEIEiYWdProTYhDCaROsQfQg6vWJ0MgQQOxMAZ8Icyj2BmMH0GCyqGSIb3DQEJEAIvMW4wbDBqMGgEIHqzFO5j1R1hR/aZHc3rrpWfooCBV/JjusrovH+OhAVlMEQwP6Q9MDsxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEiMCAGA1UEAxMZc2lnc3RvcmUtdHNhLWludGVybWVkaWF0ZQIBATAKBggqhkjOPQQDAgRHMEUCIQC0Z0dgNICT2E5nFKzv/IiLmyLLglZLcXUPfgzuL4mERwIgPndwc7KCa0NvtWiHOdEd5FDKEbDDrM0F19XocgENra0="}]}},"dsseEnvelope":{"payload":"eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoiYXJ0aWZhY3QuYmluIiwiZGlnZXN0Ijp7InNoYTI1NiI6ImU4ODk1MTI5MWJjYTA4MDdhNDFmM2MwMTQ0MDA5YmZmZjVjNmM3N2RjMTMxMGQ1MmU4YzZkNjJmZWVlOTYwYTgifX1dLCJwcmVkaWNhdGVUeXBlIjoiaHR0cHM6Ly9zbHNhLmRldi9wcm92ZW5hbmNlL3YxIiwicHJlZGljYXRlIjp7ImJ1aWxkRGVmaW5pdGlvbiI6eyJidWlsZFR5cGUiOiJodHRwczovL2FjdGlvbnMuZ2l0aHViLmlvL2J1aWxkdHlwZXMvd29ya2Zsb3cvdjEiLCJleHRlcm5hbFBhcmFtZXRlcnMiOnsid29ya2Zsb3ciOnsicmVmIjoicmVmcy9oZWFkcy9tYWluIiwicmVwb3NpdG9yeSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldCIsInBhdGgiOiIuZ2l0aHViL3dvcmtmbG93cy9idWlsZC55bWwifX0sImludGVybmFsUGFyYW1ldGVycyI6eyJnaXRodWIiOnsiZXZlbnRfbmFtZSI6InB1c2giLCJyZXBvc2l0b3J5X2lkIjoiMTIzNDU2Nzg5IiwicmVwb3NpdG9yeV9vd25lcl9pZCI6Ijk4NzY1NDMyMSIsInJ1bm5lcl9lbnZpcm9ubWVudCI6ImdpdGh1Yi1ob3N0ZWQifX0sInJlc29sdmVkRGVwZW5kZW5jaWVzIjpbeyJ1cmkiOiJnaXQraHR0cHM6Ly9naXRodWIuY29tL2FjbWUvd2lkZ2V0QHJlZnMvaGVhZHMvbWFpbiIsImRpZ2VzdCI6eyJnaXRDb21taXQiOiI0ZjlkMmE3YzFlNmI4YTNkNWYwZTJjOWI3YTFkNGU2ZjhjM2I1YTcwIn19XX0sInJ1bkRldGFpbHMiOnsiYnVpbGRlciI6eyJpZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9hY3Rpb25zL3J1bm5lci9naXRodWItaG9zdGVkIn0sIm1ldGFkYXRhIjp7Imludm9jYXRpb25JZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldC9hY3Rpb25zL3J1bnMvMTIzNDU2Nzg5MC9hdHRlbXB0cy8xIn19fX0=","payloadType":"application/vnd.in-toto+json","signatures":[{"sig":"MEYCIQCdpWXAgcfBRwpg19YWvw/GoLM88n21Gio4+WRnCShUbgIhAJt04EkCAWsEToff5r7qp9hgiSgQNGNfnkjPZhEc2bXb"}]}} diff --git a/internal/intoto/testdata/pull-request-provenance.sigstore.json b/internal/intoto/testdata/pull-request-provenance.sigstore.json new file mode 100644 index 000000000..de9bc6f1e --- /dev/null +++ b/internal/intoto/testdata/pull-request-provenance.sigstore.json @@ -0,0 +1,47 @@ +{ + "dsseEnvelope": { + "payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoiYXJ0aWZhY3QuYmluIiwiZGlnZXN0Ijp7InNoYTI1NiI6ImU4ODk1MTI5MWJjYTA4MDdhNDFmM2MwMTQ0MDA5YmZmZjVjNmM3N2RjMTMxMGQ1MmU4YzZkNjJmZWVlOTYwYTgifX1dLCJwcmVkaWNhdGVUeXBlIjoiaHR0cHM6Ly9zbHNhLmRldi9wcm92ZW5hbmNlL3YxIiwicHJlZGljYXRlIjp7ImJ1aWxkRGVmaW5pdGlvbiI6eyJidWlsZFR5cGUiOiJodHRwczovL2FjdGlvbnMuZ2l0aHViLmlvL2J1aWxkdHlwZXMvd29ya2Zsb3cvdjEiLCJleHRlcm5hbFBhcmFtZXRlcnMiOnsid29ya2Zsb3ciOnsicmVmIjoicmVmcy9oZWFkcy9tYWluIiwicmVwb3NpdG9yeSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldCIsInBhdGgiOiIuZ2l0aHViL3dvcmtmbG93cy9idWlsZC55bWwifX0sImludGVybmFsUGFyYW1ldGVycyI6eyJnaXRodWIiOnsiZXZlbnRfbmFtZSI6InB1c2giLCJyZXBvc2l0b3J5X2lkIjoiMTIzNDU2Nzg5IiwicmVwb3NpdG9yeV9vd25lcl9pZCI6Ijk4NzY1NDMyMSIsInJ1bm5lcl9lbnZpcm9ubWVudCI6ImdpdGh1Yi1ob3N0ZWQifX0sInJlc29sdmVkRGVwZW5kZW5jaWVzIjpbeyJ1cmkiOiJnaXQraHR0cHM6Ly9naXRodWIuY29tL2FjbWUvd2lkZ2V0QHJlZnMvaGVhZHMvbWFpbiIsImRpZ2VzdCI6eyJnaXRDb21taXQiOiI0ZjlkMmE3YzFlNmI4YTNkNWYwZTJjOWI3YTFkNGU2ZjhjM2I1YTcwIn19XX0sInJ1bkRldGFpbHMiOnsiYnVpbGRlciI6eyJpZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9hY3Rpb25zL3J1bm5lci9naXRodWItaG9zdGVkIn0sIm1ldGFkYXRhIjp7Imludm9jYXRpb25JZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldC9hY3Rpb25zL3J1bnMvMTIzNDU2Nzg5MC9hdHRlbXB0cy8xIn19fX0=", + "payloadType": "application/vnd.in-toto+json", + "signatures": [ + { + "sig": "MEYCIQCLE3WV3sizuWJodGo/3IUXLOh0YMvmdiSelLdYBbFgRQIhAJm5FyT2k0+jU1pgUZnGHmOzvAJuykrJ+ebSZgrX4Zy/" + } + ] + }, + "mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json", + "verificationMaterial": { + "certificate": { + "rawBytes": "MIIC0jCCAnegAwIBAgIIA3jufW/13kwwCgYIKoZIzj0EAwIwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYxMTEzMTQzNDU1WhcNMjYxMTEzMTQ0NTU1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEjw+67/lAtWS4ulxPlS9eHd9hJr9sAS4yy46TmdcN4P4opmzo4i54FaK9h0RlaJIbHLGeuGvnETCCkyAcGawaJaOCAaIwggGeMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAfBgNVHSMEGDAWgBQin5D6vOEQoe/EaGQlwHLhwEDhUTBbBgNVHREBAf8EUTBPhk1odHRwczovL2dpdGh1Yi5jb20vYWNtZS93aWRnZXQvLmdpdGh1Yi93b3JrZmxvd3MvYnVpbGQueW1sQHJlZnMvcHVsbC8xMi9tZXJnZTA5BgorBgEEAYO/MAEBBCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAuBgorBgEEAYO/MAEMBCAMHmh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldDBRBgorBgEEAYO/MAEVBEMMQWh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldC9hY3Rpb25zL3J1bnMvMzMzMzMzMzMzMy9hdHRlbXB0cy8xMAoGCCqGSM49BAMCA0kAMEYCIQDfnEMTyods3pTIJtY4so5xwktLYhsO8kGg/4/ujOPm7AIhAOgSdi9aoW5p6X1jiMCu16XMNXWEAHtjX0iWIGNv023l" + }, + "timestampVerificationData": { + "rfc3161Timestamps": [ + { + "signedTimestamp": "MIICTzADAgEAMIICRgYJKoZIhvcNAQcCoIICNzCCAjMCAQMxDTALBglghkgBZQMEAgEwgYEGCyqGSIb3DQEJEAEEoHIEcDBuAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQgEwEDOzzTrELtdhkoEP+sj5PHlhHgpPJE4DntABJHCLECFEVUjhip22m2vvQyDwehab2bB4HvGA8yMDI2MTExMzE0MzU1NVqgBKQCMACgADGCAZcwggGTAgEBMEAwOzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MSIwIAYDVQQDExlzaWdzdG9yZS10c2EtaW50ZXJtZWRpYXRlAgEBMAsGCWCGSAFlAwQCAaCB6jAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQAQQwHAYJKoZIhvcNAQkFMQ8XDTI2MTExMzE0MzU1NVowLwYJKoZIhvcNAQkEMSIEIJ5zKsNi2OlTA+NtESVPvdM/7GUfj07t2Ry7y3WCqG7wMH0GCyqGSIb3DQEJEAIvMW4wbDBqMGgEIHqzFO5j1R1hR/aZHc3rrpWfooCBV/JjusrovH+OhAVlMEQwP6Q9MDsxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEiMCAGA1UEAxMZc2lnc3RvcmUtdHNhLWludGVybWVkaWF0ZQIBATAKBggqhkjOPQQDAgRGMEQCIF5QfHnqSDVV9xCZ9Wu12IUfpbXGcuAE2v0wSTwYLMZ0AiAtwH6s6D0OpyF7e9Lvg1X8xFbY3cFjncpv0N2QJImX+A==" + } + ] + }, + "tlogEntries": [ + { + "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJzcGVjIjp7ImVudmVsb3BlSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImM5MTFlMjVhODBkZGViOTMwZjJkZWQ1MWMzOTA3ZDJiYjUyNjUwOWIwZTJiZTdjZmZkMWRhMGU3NmUzMWZmNDUifSwicGF5bG9hZEhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJmOTZjNDY3Y2I2Y2MzYmU1ZGRlMGE0YzZkYTFhZDQ5NTA3NGEzYjRiZTcyMDc2NDQyYzBmNGI4NzFjMTNhMWVlIn0sInNpZ25hdHVyZXMiOlt7InNpZ25hdHVyZSI6Ik1FWUNJUUNMRTNXVjNzaXp1V0pvZEdvLzNJVVhMT2gwWU12bWRpU2VsTGRZQmJGZ1JRSWhBSm01RnlUMmswK2pVMXBnVVpuR0htT3p2QUp1eWtySitlYlNaZ3JYNFp5LyIsInZlcmlmaWVyIjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTXdha05EUVc1bFowRjNTVUpCWjBsSlFUTnFkV1pYTHpFemEzZDNRMmRaU1V0dldrbDZhakJGUVhkSmQwNTZSVlpOUWsxSFFURlZSVU5vVFUwS1l6SnNibU16VW5aamJWVjFXa2RXTWsxU05IZElRVmxFVmxGUlJFVjRWbnBoVjJSNlpFYzVlVnBUTVhCaWJsSnNZMjB4YkZwSGJHaGtSMVYzU0doalRncE5hbGw0VFZSRmVrMVVVWHBPUkZVeFYyaGpUazFxV1hoTlZFVjZUVlJSTUU1VVZURlhha0ZCVFVacmQwVjNXVWhMYjFwSmVtb3dRMEZSV1VsTGIxcEpDbnBxTUVSQlVXTkVVV2RCUldwM0t6WTNMMnhCZEZkVE5IVnNlRkJzVXpsbFNHUTVhRXB5T1hOQlV6UjVlVFEyVkcxa1kwNDBVRFJ2Y0cxNmJ6UnBOVFFLUm1GTE9XZ3dVbXhoU2tsaVNFeEhaWFZIZG01RlZFTkRhM2xCWTBkaGQyRktZVTlEUVdGSmQyZG5SMlZOUVRSSFFURlZaRVIzUlVJdmQxRkZRWGRKU0FwblJFRlVRbWRPVmtoVFZVVkVSRUZMUW1kbmNrSm5SVVpDVVdORVFYcEJaa0puVGxaSVUwMUZSMFJCVjJkQ1VXbHVOVVEyZGs5RlVXOWxMMFZoUjFGc0NuZElUR2gzUlVSb1ZWUkNZa0puVGxaSVVrVkNRV1k0UlZWVVFsQm9hekZ2WkVoU2QyTjZiM1pNTW1Sd1pFZG9NVmxwTldwaU1qQjJXVmRPZEZwVE9UTUtZVmRTYmxwWVVYWk1iV1J3WkVkb01WbHBPVE5pTTBweVdtMTRkbVF6VFhaWmJsWndZa2RSZFdWWE1YTlJTRXBzV201TmRtTklWbk5pUXpoNFRXazVkQXBhV0VwdVdsUkJOVUpuYjNKQ1owVkZRVmxQTDAxQlJVSkNRM1J2WkVoU2QyTjZiM1pNTTFKMllUSldkVXh0Um1wa1IyeDJZbTVOZFZveWJEQmhTRlpwQ21SWVRteGpiVTUyWW01U2JHSnVVWFZaTWpsMFRVUnpSME5wYzBkQlVWRkNaemM0ZDBGUlowVk1VWGR5WVVoU01HTklUVFpNZVRrd1lqSjBiR0pwTldnS1dUTlNjR0l5TlhwTWJXUndaRWRvTVZsdVZucGFXRXBxWWpJMU1GcFhOVEJNYlU1MllsUkJkVUpuYjNKQ1owVkZRVmxQTDAxQlJVMUNRMEZOU0cxb01BcGtTRUo2VDJrNGRsb3liREJoU0ZacFRHMU9kbUpUT1doWk1qRnNURE5rY0ZwSFpHeGtSRUpTUW1kdmNrSm5SVVZCV1U4dlRVRkZWa0pGVFUxUlYyZ3dDbVJJUW5wUGFUaDJXakpzTUdGSVZtbE1iVTUyWWxNNWFGa3lNV3hNTTJSd1drZGtiR1JET1doWk0xSndZakkxZWt3elNqRmliazEyVFhwTmVrMTZUWG9LVFhwTmVrMTVPV2hrU0ZKc1lsaENNR041T0hoTlFXOUhRME54UjFOTk5EbENRVTFEUVRCclFVMUZXVU5KVVVSbWJrVk5WSGx2WkhNemNGUkpTblJaTkFwemJ6VjRkMnQwVEZsb2MwODRhMGRuTHpRdmRXcFBVRzAzUVVsb1FVOW5VMlJwT1dGdlZ6VndObGd4YW1sTlEzVXhObGhOVGxoWFJVRklkR3BZTUdsWENrbEhUbll3TWpOc0NpMHRMUzB0UlU1RUlFTkZVbFJKUmtsRFFWUkZMUzB0TFMwSyJ9XX0sImtpbmQiOiJkc3NlIn0=", + "inclusionPromise": { + "signedEntryTimestamp": "MEYCIQDz1Jy2tVisccfsFIUxua/1np5mgOPGKsepKZlkmxeB6AIhALhU2h8VyfHTVYvGWJStR6L7Tl7Rhioi60OXDgtgE1cP" + }, + "inclusionProof": { + "checkpoint": { + "envelope": "rekor.localhost - 123\n42\nyYZCB87yTm0vRdoi1TnvMrrcLasAgsWvTYIHxQaCW2U=\n\n— rekor.localhost 45EjTzBDAiAlAoFDzTu/GxsJJJS+64fa+XMFRZLpzkzEDk6W1UA1KQIfbrllAei1EMl6iG+v1ngBEjfSGLE0IMGYab3aeKrHSA==\n" + }, + "rootHash": "yYZCB87yTm0vRdoi1TnvMrrcLasAgsWvTYIHxQaCW2U=", + "treeSize": "1" + }, + "integratedTime": "1794580795", + "kindVersion": { + "kind": "dsse", + "version": "0.0.1" + }, + "logId": { + "keyId": "45EjT1abdD2MKrnHGSnayLaGvLNDQ4SRtMzNbF54fBc=" + } + } + ] + } +} diff --git a/internal/intoto/testdata/rerun-provenance.sigstore.json b/internal/intoto/testdata/rerun-provenance.sigstore.json index 92daff930..4e9001d1e 100644 --- a/internal/intoto/testdata/rerun-provenance.sigstore.json +++ b/internal/intoto/testdata/rerun-provenance.sigstore.json @@ -4,42 +4,42 @@ "payloadType": "application/vnd.in-toto+json", "signatures": [ { - "sig": "MEUCIQCHcN06Nh7TnM7/nc/F0qrcitDDcB0gMRdUwgJP3Wv2JQIgFyhHR0rvD8jb6LkRx25ZGoCvobRvB0cLW37yClOkgtc=" + "sig": "MEUCIBExIjqnvM5ubiEEY4EzjrPqzOe65UEMdWJgN2GHskyVAiEA3BJU8bZBd5sHknnO8RG9asTm7BTc6UumdccMRLII8HY=" } ] }, "mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json", "verificationMaterial": { "certificate": { - "rawBytes": "MIICzzCCAnSgAwIBAgIIEjNzVJMtiV8wCgYIKoZIzj0EAwIwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYxMTEyMDgxNjU1WhcNMjYxMTEyMDgyNzU1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEaFqdbHvV35g6giY0al5dakEn3TrQxQkiLO5/NCfVWDkAqJVuvJy+TnHr8VtM/HKU5f+iU4jnkz3LA5TmT9J+CaOCAZ8wggGbMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAfBgNVHSMEGDAWgBSZpSIKVYxSQzu1jBpx0BTIUS5kPjBYBgNVHREBAf8ETjBMhkpodHRwczovL2dpdGh1Yi5jb20vYWNtZS93aWRnZXQvLmdpdGh1Yi93b3JrZmxvd3MvYnVpbGQueW1sQHJlZnMvaGVhZHMvbWFpbjA5BgorBgEEAYO/MAEBBCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAuBgorBgEEAYO/MAEMBCAMHmh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldDBRBgorBgEEAYO/MAEVBEMMQWh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldC9hY3Rpb25zL3J1bnMvMTIzNDU2Nzg5MC9hdHRlbXB0cy8yMAoGCCqGSM49BAMCA0kAMEYCIQDwVzi/nq7/P6lsY23T/om+oPe6vIHJyZucTRza1JxZ4QIhAPIcSVNhnKMn9u0NcOVdZTcZHiNSmquLfeMDj+8vjBCf" + "rawBytes": "MIICzjCCAnSgAwIBAgIIGKi9Q9v/82EwCgYIKoZIzj0EAwIwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYxMTEzMTQzNDU1WhcNMjYxMTEzMTQ0NTU1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEupUxhOJWlKqnP1TcdXNp7Kt7gS5FiW37yp3J7tpDD6iavo91ULMdLhEdtpMrvmdpW8ZKQlB8D+ej2pq9CvHuiKOCAZ8wggGbMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAfBgNVHSMEGDAWgBQin5D6vOEQoe/EaGQlwHLhwEDhUTBYBgNVHREBAf8ETjBMhkpodHRwczovL2dpdGh1Yi5jb20vYWNtZS93aWRnZXQvLmdpdGh1Yi93b3JrZmxvd3MvYnVpbGQueW1sQHJlZnMvaGVhZHMvbWFpbjA5BgorBgEEAYO/MAEBBCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAuBgorBgEEAYO/MAEMBCAMHmh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldDBRBgorBgEEAYO/MAEVBEMMQWh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldC9hY3Rpb25zL3J1bnMvMTIzNDU2Nzg5MC9hdHRlbXB0cy8yMAoGCCqGSM49BAMCA0gAMEUCIQD0aV/KWoLzeT1jC3PXAkRLUVVIB3LqC3hcRGd7lf0OhgIgNIzQftOJAQmUH3qD6Jb8LKVRBr2XMDDcM5stI66p6I0=" }, "timestampVerificationData": { "rfc3161Timestamps": [ { - "signedTimestamp": "MIICTzADAgEAMIICRgYJKoZIhvcNAQcCoIICNzCCAjMCAQMxDTALBglghkgBZQMEAgEwgYEGCyqGSIb3DQEJEAEEoHIEcDBuAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQgq+yMvejnUZaN2iA9nN72UQDD8leI8G8oaF4A8y+T16ICFDqB3k99qg9tyT9Ew3a02bA7QDUCGA8yMDI2MTExMjA4MTc1NVqgBKQCMACgADGCAZcwggGTAgEBMEAwOzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MSIwIAYDVQQDExlzaWdzdG9yZS10c2EtaW50ZXJtZWRpYXRlAgEBMAsGCWCGSAFlAwQCAaCB6jAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQAQQwHAYJKoZIhvcNAQkFMQ8XDTI2MTExMjA4MTc1NVowLwYJKoZIhvcNAQkEMSIEIBXz/2h8r1GblvnlYAxfGUOjqePgngyn6a4PnWoD9DL8MH0GCyqGSIb3DQEJEAIvMW4wbDBqMGgEIHGxNwJVZfB5irJH4y/SoTJA0ULqHcwUDQGasEQdUf20MEQwP6Q9MDsxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEiMCAGA1UEAxMZc2lnc3RvcmUtdHNhLWludGVybWVkaWF0ZQIBATAKBggqhkjOPQQDAgRGMEQCIG7n40lIhtJPncRr8/Ilt/lJ2qyHy6NW6S0JNm0TEbJTAiA9ZkUC+dvCblmsnALmK4P+dbOxKf2Nes9YTCsGES+Epg==" + "signedTimestamp": "MIICUDADAgEAMIICRwYJKoZIhvcNAQcCoIICODCCAjQCAQMxDTALBglghkgBZQMEAgEwgYEGCyqGSIb3DQEJEAEEoHIEcDBuAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQghlxI1S82tE9ONXRVgT+ufFsMcS1gfMrvOvJHgTz3w88CFDJJoF7P68Li7TQLmzweikk1jO4AGA8yMDI2MTExMzE0MzU1NVqgBKQCMACgADGCAZgwggGUAgEBMEAwOzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MSIwIAYDVQQDExlzaWdzdG9yZS10c2EtaW50ZXJtZWRpYXRlAgEBMAsGCWCGSAFlAwQCAaCB6jAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQAQQwHAYJKoZIhvcNAQkFMQ8XDTI2MTExMzE0MzU1NVowLwYJKoZIhvcNAQkEMSIEIOmtGkGOcaehivJapyc/ZzQ9vdqh6/TZwQJ/MC6LIpnaMH0GCyqGSIb3DQEJEAIvMW4wbDBqMGgEIHqzFO5j1R1hR/aZHc3rrpWfooCBV/JjusrovH+OhAVlMEQwP6Q9MDsxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEiMCAGA1UEAxMZc2lnc3RvcmUtdHNhLWludGVybWVkaWF0ZQIBATAKBggqhkjOPQQDAgRHMEUCIQDsVbRFwnnzNVE0V0o3pe9quwmUBvXUHGZXc3ad0oJJhwIgdkerMsBL0S6Qwp2PzfnhtumiHAuRNn0nhXgYb33iX38=" } ] }, "tlogEntries": [ { - "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJzcGVjIjp7ImVudmVsb3BlSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImQ5NTAxNjYyY2JkYjFjYTBkYmI5ZGE5MWU4ZmY3NGE3ZDA1OWE5ZjU4ZjU3YTE0NzFmNzljNDQxY2M0YzUzOWIifSwicGF5bG9hZEhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiI5ZWU5MDk3ZjU3NzFjZWY1MTMwOGMyNmU0Nzk2YTdlNzY1YzcxMDgxNGY0YTExMzk3MGRlZTdlOGE4ZjVmZDc3In0sInNpZ25hdHVyZXMiOlt7InNpZ25hdHVyZSI6Ik1FVUNJUUNIY04wNk5oN1RuTTcvbmMvRjBxcmNpdEREY0IwZ01SZFV3Z0pQM1d2MkpRSWdGeWhIUjBydkQ4amI2TGtSeDI1WkdvQ3ZvYlJ2QjBjTFczN3lDbE9rZ3RjPSIsInZlcmlmaWVyIjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTjZla05EUVc1VFowRjNTVUpCWjBsSlJXcE9lbFpLVFhScFZqaDNRMmRaU1V0dldrbDZhakJGUVhkSmQwNTZSVlpOUWsxSFFURlZSVU5vVFUwS1l6SnNibU16VW5aamJWVjFXa2RXTWsxU05IZElRVmxFVmxGUlJFVjRWbnBoVjJSNlpFYzVlVnBUTVhCaWJsSnNZMjB4YkZwSGJHaGtSMVYzU0doalRncE5hbGw0VFZSRmVVMUVaM2hPYWxVeFYyaGpUazFxV1hoTlZFVjVUVVJuZVU1NlZURlhha0ZCVFVacmQwVjNXVWhMYjFwSmVtb3dRMEZSV1VsTGIxcEpDbnBxTUVSQlVXTkVVV2RCUldGR2NXUmlTSFpXTXpWbk5tZHBXVEJoYkRWa1lXdEZiak5VY2xGNFVXdHBURTgxTDA1RFpsWlhSR3RCY1VwV2RYWktlU3NLVkc1SWNqaFdkRTB2U0V0Vk5XWXJhVlUwYW01cmVqTk1RVFZVYlZRNVNpdERZVTlEUVZvNGQyZG5SMkpOUVRSSFFURlZaRVIzUlVJdmQxRkZRWGRKU0FwblJFRlVRbWRPVmtoVFZVVkVSRUZMUW1kbmNrSm5SVVpDVVdORVFYcEJaa0puVGxaSVUwMUZSMFJCVjJkQ1UxcHdVMGxMVmxsNFUxRjZkVEZxUW5CNENqQkNWRWxWVXpWclVHcENXVUpuVGxaSVVrVkNRV1k0UlZScVFrMW9hM0J2WkVoU2QyTjZiM1pNTW1Sd1pFZG9NVmxwTldwaU1qQjJXVmRPZEZwVE9UTUtZVmRTYmxwWVVYWk1iV1J3WkVkb01WbHBPVE5pTTBweVdtMTRkbVF6VFhaWmJsWndZa2RSZFdWWE1YTlJTRXBzV201TmRtRkhWbWhhU0UxMllsZEdjQXBpYWtFMVFtZHZja0puUlVWQldVOHZUVUZGUWtKRGRHOWtTRkozWTNwdmRrd3pVblpoTWxaMVRHMUdhbVJIYkhaaWJrMTFXakpzTUdGSVZtbGtXRTVzQ21OdFRuWmlibEpzWW01UmRWa3lPWFJOUkhOSFEybHpSMEZSVVVKbk56aDNRVkZuUlV4UmQzSmhTRkl3WTBoTk5reDVPVEJpTW5Sc1ltazFhRmt6VW5BS1lqSTFla3h0WkhCa1IyZ3hXVzVXZWxwWVNtcGlNalV3V2xjMU1FeHRUblppVkVGMVFtZHZja0puUlVWQldVOHZUVUZGVFVKRFFVMUliV2d3WkVoQ2VncFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVhRmt5TVd4TU0yUndXa2RrYkdSRVFsSkNaMjl5UW1kRlJVRlpUeTlOUVVWV1FrVk5UVkZYYURCa1NFSjZDazlwT0haYU1td3dZVWhXYVV4dFRuWmlVemxvV1RJeGJFd3paSEJhUjJSc1pFTTVhRmt6VW5CaU1qVjZURE5LTVdKdVRYWk5WRWw2VGtSVk1rNTZaelVLVFVNNWFHUklVbXhpV0VJd1kzazRlVTFCYjBkRFEzRkhVMDAwT1VKQlRVTkJNR3RCVFVWWlEwbFJSSGRXZW1rdmJuRTNMMUEyYkhOWk1qTlVMMjl0S3dwdlVHVTJka2xJU25sYWRXTlVVbnBoTVVwNFdqUlJTV2hCVUVsalUxWk9hRzVMVFc0NWRUQk9ZMDlXWkZwVVkxcElhVTVUYlhGMVRHWmxUVVJxS3poMkNtcENRMllLTFMwdExTMUZUa1FnUTBWU1ZFbEdTVU5CVkVVdExTMHRMUW89In1dfSwia2luZCI6ImRzc2UifQ==", + "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJzcGVjIjp7ImVudmVsb3BlSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImNhZmQ5MGVkZDY2YjU3ZWNiNjYxOGIzMDFmYzNhN2RiZThjNmFiNDMyZGQ1YTVhNjVmMGQ1NmZjMTQ5ODdiYTAifSwicGF5bG9hZEhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiI5ZWU5MDk3ZjU3NzFjZWY1MTMwOGMyNmU0Nzk2YTdlNzY1YzcxMDgxNGY0YTExMzk3MGRlZTdlOGE4ZjVmZDc3In0sInNpZ25hdHVyZXMiOlt7InNpZ25hdHVyZSI6Ik1FVUNJQkV4SWpxbnZNNXViaUVFWTRFempyUHF6T2U2NVVFTWRXSmdOMkdIc2t5VkFpRUEzQkpVOGJaQmQ1c0hrbm5POFJHOWFzVG03QlRjNlV1bWRjY01STElJOEhZPSIsInZlcmlmaWVyIjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTjZha05EUVc1VFowRjNTVUpCWjBsSlIwdHBPVkU1ZGk4NE1rVjNRMmRaU1V0dldrbDZhakJGUVhkSmQwNTZSVlpOUWsxSFFURlZSVU5vVFUwS1l6SnNibU16VW5aamJWVjFXa2RXTWsxU05IZElRVmxFVmxGUlJFVjRWbnBoVjJSNlpFYzVlVnBUTVhCaWJsSnNZMjB4YkZwSGJHaGtSMVYzU0doalRncE5hbGw0VFZSRmVrMVVVWHBPUkZVeFYyaGpUazFxV1hoTlZFVjZUVlJSTUU1VVZURlhha0ZCVFVacmQwVjNXVWhMYjFwSmVtb3dRMEZSV1VsTGIxcEpDbnBxTUVSQlVXTkVVV2RCUlhWd1ZYaG9UMHBYYkV0eGJsQXhWR05rV0U1d04wdDBOMmRUTlVacFZ6TTNlWEF6U2pkMGNFUkVObWxoZG04NU1WVk1UV1FLVEdoRlpIUndUWEoyYldSd1Z6aGFTMUZzUWpoRUsyVnFNbkJ4T1VOMlNIVnBTMDlEUVZvNGQyZG5SMkpOUVRSSFFURlZaRVIzUlVJdmQxRkZRWGRKU0FwblJFRlVRbWRPVmtoVFZVVkVSRUZMUW1kbmNrSm5SVVpDVVdORVFYcEJaa0puVGxaSVUwMUZSMFJCVjJkQ1VXbHVOVVEyZGs5RlVXOWxMMFZoUjFGc0NuZElUR2gzUlVSb1ZWUkNXVUpuVGxaSVVrVkNRV1k0UlZScVFrMW9hM0J2WkVoU2QyTjZiM1pNTW1Sd1pFZG9NVmxwTldwaU1qQjJXVmRPZEZwVE9UTUtZVmRTYmxwWVVYWk1iV1J3WkVkb01WbHBPVE5pTTBweVdtMTRkbVF6VFhaWmJsWndZa2RSZFdWWE1YTlJTRXBzV201TmRtRkhWbWhhU0UxMllsZEdjQXBpYWtFMVFtZHZja0puUlVWQldVOHZUVUZGUWtKRGRHOWtTRkozWTNwdmRrd3pVblpoTWxaMVRHMUdhbVJIYkhaaWJrMTFXakpzTUdGSVZtbGtXRTVzQ21OdFRuWmlibEpzWW01UmRWa3lPWFJOUkhOSFEybHpSMEZSVVVKbk56aDNRVkZuUlV4UmQzSmhTRkl3WTBoTk5reDVPVEJpTW5Sc1ltazFhRmt6VW5BS1lqSTFla3h0WkhCa1IyZ3hXVzVXZWxwWVNtcGlNalV3V2xjMU1FeHRUblppVkVGMVFtZHZja0puUlVWQldVOHZUVUZGVFVKRFFVMUliV2d3WkVoQ2VncFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVhRmt5TVd4TU0yUndXa2RrYkdSRVFsSkNaMjl5UW1kRlJVRlpUeTlOUVVWV1FrVk5UVkZYYURCa1NFSjZDazlwT0haYU1td3dZVWhXYVV4dFRuWmlVemxvV1RJeGJFd3paSEJhUjJSc1pFTTVhRmt6VW5CaU1qVjZURE5LTVdKdVRYWk5WRWw2VGtSVk1rNTZaelVLVFVNNWFHUklVbXhpV0VJd1kzazRlVTFCYjBkRFEzRkhVMDAwT1VKQlRVTkJNR2RCVFVWVlEwbFJSREJoVmk5TFYyOU1lbVZVTVdwRE0xQllRV3RTVEFwVlZsWkpRak5NY1VNemFHTlNSMlEzYkdZd1QyaG5TV2RPU1hwUlpuUlBTa0ZSYlZWSU0zRkVOa3BpT0V4TFZsSkNjakpZVFVSRVkwMDFjM1JKTmpad0NqWkpNRDBLTFMwdExTMUZUa1FnUTBWU1ZFbEdTVU5CVkVVdExTMHRMUW89In1dfSwia2luZCI6ImRzc2UifQ==", "inclusionPromise": { - "signedEntryTimestamp": "MEYCIQCYP4ceznT7A5C1bmAc0lKFcCySf7eYVwnHvAi3QJmsIgIhAKP07+U/YqbcQ3gC94QCQyEn/fPiJ/rmmmIh7NtT3WHT" + "signedEntryTimestamp": "MEUCIA8kC8vorOzydit2/rup/6wGoHIevA4Zg3X7Ll5YS3FSAiEAxF+3UgvRQbKTt/AUqJHKWaZYivMbV2ra0EPl9hBcuAw=" }, "inclusionProof": { "checkpoint": { - "envelope": "rekor.localhost - 123\n42\nlDznuTP6q/MPgASuws8nhPUqUmwLh/4cTzhQ72lLbX4=\n\n— rekor.localhost VbgJJjBFAiBQ7v3q+bVahbjf2jY9TubduhlV8qOHTZqIZ7Ne3m8heAIhAKWtfPns6+rNcpD2aCvAwHKgH3EH5bfacy4jP/FC/Jq3\n" + "envelope": "rekor.localhost - 123\n42\n44SFEt1NelwZoCv2tA6CgPPRnwz0vIogdxLnssWlkSE=\n\n— rekor.localhost 45EjTzBGAiEA29o2bZWIR7BA2A4mbR/wFiTSSUiFNZX2SIGVe3mwbgICIQDI/EYiat/ZiQH8YOWvBmUWkf+9Rn27SesMO6eWk1Hs4w==\n" }, - "rootHash": "lDznuTP6q/MPgASuws8nhPUqUmwLh/4cTzhQ72lLbX4=", + "rootHash": "44SFEt1NelwZoCv2tA6CgPPRnwz0vIogdxLnssWlkSE=", "treeSize": "1" }, - "integratedTime": "1794471595", + "integratedTime": "1794580675", "kindVersion": { "kind": "dsse", "version": "0.0.1" }, "logId": { - "keyId": "VbgJJh1uXk4PvCPZ3fIjaxUep33R8Z6T6wAJfVjz+BA=" + "keyId": "45EjT1abdD2MKrnHGSnayLaGvLNDQ4SRtMzNbF54fBc=" } } ] diff --git a/internal/intoto/testdata/slsa-v0.2-provenance.sigstore.json b/internal/intoto/testdata/slsa-v0.2-provenance.sigstore.json index 9851d06ce..01a113cfc 100644 --- a/internal/intoto/testdata/slsa-v0.2-provenance.sigstore.json +++ b/internal/intoto/testdata/slsa-v0.2-provenance.sigstore.json @@ -4,42 +4,42 @@ "payloadType": "application/vnd.in-toto+json", "signatures": [ { - "sig": "MEYCIQDNM3rL0D7ljeqg9L5AlvMfHSbnMngMHDKKXrg97Z+J7wIhAJ3+M3KDjpSRsBAezEXbN/w87aIfWmsXlyH+eOK+dQdm" + "sig": "MEYCIQDHhD5cWn/qAx52zYTLIhpQEOKoJfBeceNAUg63p+yMowIhAOr1r8zrfMsVlgWhmVSL45dxqJjrubjKf10QkK3gw24K" } ] }, "mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json", "verificationMaterial": { "certificate": { - "rawBytes": "MIICzjCCAnSgAwIBAgIILsfTF1aX27IwCgYIKoZIzj0EAwIwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYxMTEyMDgxNjU1WhcNMjYxMTEyMDgyNzU1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE8x3VM7yTG0NYLpXXBd9BQ5+tNTbL5U9lnyKV2zrCAJXcnuqKt2Vr97lRibLM7EdRF7EwYjDgC1G6V/ujX1qXhqOCAZ8wggGbMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAfBgNVHSMEGDAWgBSZpSIKVYxSQzu1jBpx0BTIUS5kPjBYBgNVHREBAf8ETjBMhkpodHRwczovL2dpdGh1Yi5jb20vYWNtZS93aWRnZXQvLmdpdGh1Yi93b3JrZmxvd3MvYnVpbGQueW1sQHJlZnMvaGVhZHMvbWFpbjA5BgorBgEEAYO/MAEBBCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAuBgorBgEEAYO/MAEMBCAMHmh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldDBRBgorBgEEAYO/MAEVBEMMQWh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldC9hY3Rpb25zL3J1bnMvMTIzNDU2Nzg5MC9hdHRlbXB0cy8xMAoGCCqGSM49BAMCA0gAMEUCIAqFAR1FDgW7s+GGHi/guZPCga2mKOoEbx3gR4tZrNGDAiEAwutMV7e4X2t4ku88XJCjwQul5HW0Ieoi77XeGFdho8Q=" + "rawBytes": "MIICzjCCAnSgAwIBAgIIDbNmQWOn69AwCgYIKoZIzj0EAwIwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYxMTEzMTQzNDU1WhcNMjYxMTEzMTQ0NTU1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE4w1Rq/EPeqK9xeneoW19+fv7rNO9ZoN6ji+0H223IHHkjrilG0cXdeAufq9SR1g56J8eGM7w861WvLsXjmIluqOCAZ8wggGbMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAfBgNVHSMEGDAWgBQin5D6vOEQoe/EaGQlwHLhwEDhUTBYBgNVHREBAf8ETjBMhkpodHRwczovL2dpdGh1Yi5jb20vYWNtZS93aWRnZXQvLmdpdGh1Yi93b3JrZmxvd3MvYnVpbGQueW1sQHJlZnMvaGVhZHMvbWFpbjA5BgorBgEEAYO/MAEBBCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAuBgorBgEEAYO/MAEMBCAMHmh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldDBRBgorBgEEAYO/MAEVBEMMQWh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldC9hY3Rpb25zL3J1bnMvMTIzNDU2Nzg5MC9hdHRlbXB0cy8xMAoGCCqGSM49BAMCA0gAMEUCIEMKP72woGldQ8RT9VZ3sfJI8v2ED8tPMScaF199+v2oAiEAvMbg3ucHZSxhjvlZgsO2A+qsxSpoMnOhZMQNCu689cs=" }, "timestampVerificationData": { "rfc3161Timestamps": [ { - "signedTimestamp": "MIICUTADAgEAMIICSAYJKoZIhvcNAQcCoIICOTCCAjUCAQMxDTALBglghkgBZQMEAgEwgYEGCyqGSIb3DQEJEAEEoHIEcDBuAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQg+zJC8AjlvOtg0S1zfWpLfCcTBza08pGCLFm8fyaJ8hACFA0yudk6HbWdkiKRtnBLkhrO2ChIGA8yMDI2MTExMjA4MTc1NVqgBKQCMACgADGCAZkwggGVAgEBMEAwOzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MSIwIAYDVQQDExlzaWdzdG9yZS10c2EtaW50ZXJtZWRpYXRlAgEBMAsGCWCGSAFlAwQCAaCB6jAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQAQQwHAYJKoZIhvcNAQkFMQ8XDTI2MTExMjA4MTc1NVowLwYJKoZIhvcNAQkEMSIEIKtZroDIJ7TkVjFHP+3WAhHz5IAAQhLVh6zCCULDi1YwMH0GCyqGSIb3DQEJEAIvMW4wbDBqMGgEIHGxNwJVZfB5irJH4y/SoTJA0ULqHcwUDQGasEQdUf20MEQwP6Q9MDsxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEiMCAGA1UEAxMZc2lnc3RvcmUtdHNhLWludGVybWVkaWF0ZQIBATAKBggqhkjOPQQDAgRIMEYCIQDF46ioAWbY1F6pWZqzHlbmxYaJpqJrWH8c0PQ5BpQAEwIhAKhYnBEY6t+nDrG2LHRnPDpFRTy4P1Rvfuba3FZt3eEy" + "signedTimestamp": "MIICUDADAgEAMIICRwYJKoZIhvcNAQcCoIICODCCAjQCAQMxDTALBglghkgBZQMEAgEwgYEGCyqGSIb3DQEJEAEEoHIEcDBuAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQgAnXKYTEf+bORlbf6SCLPjmD7zGHcd8AEmaW3TKBnY2sCFF2mQ3jkwEJbBPVCFrmz8GZ5KL/YGA8yMDI2MTExMzE0MzU1NVqgBKQCMACgADGCAZgwggGUAgEBMEAwOzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MSIwIAYDVQQDExlzaWdzdG9yZS10c2EtaW50ZXJtZWRpYXRlAgEBMAsGCWCGSAFlAwQCAaCB6jAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQAQQwHAYJKoZIhvcNAQkFMQ8XDTI2MTExMzE0MzU1NVowLwYJKoZIhvcNAQkEMSIEILLkr934BHEZyZzkQDSxNx33yxB73iV/2TPl4hicKjuPMH0GCyqGSIb3DQEJEAIvMW4wbDBqMGgEIHqzFO5j1R1hR/aZHc3rrpWfooCBV/JjusrovH+OhAVlMEQwP6Q9MDsxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEiMCAGA1UEAxMZc2lnc3RvcmUtdHNhLWludGVybWVkaWF0ZQIBATAKBggqhkjOPQQDAgRHMEUCIQCsmq1Uhg6cElgzOVSa9HxEBPxvC6iDfxN5iMbjE2FoKwIgM/DK21TzRXxx1Kapi8pf9q+zZPBbLzStbJGUGOE5FLo=" } ] }, "tlogEntries": [ { - "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJzcGVjIjp7ImVudmVsb3BlSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjUyOTY3NDRjYmQ1Yjc2YWVmN2JiNTY4MTQ1N2M4NWYxZmQxMGNiMTNmYTM0ZjQwZWMyMmNjZTYwY2Q0NzBkMTYifSwicGF5bG9hZEhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJmZjBkYmU2NDA0MmI2ZmU5ZTJjNzYyNTFkMjc3ZWNlYWMwOGNmN2U0YmJjNTgwNGQyYWQxNTg0NjBkZTJjMWFhIn0sInNpZ25hdHVyZXMiOlt7InNpZ25hdHVyZSI6Ik1FWUNJUUROTTNyTDBEN2xqZXFnOUw1QWx2TWZIU2JuTW5nTUhES0tYcmc5N1orSjd3SWhBSjMrTTNLRGpwU1JzQkFlekVYYk4vdzg3YUlmV21zWGx5SCtlT0srZFFkbSIsInZlcmlmaWVyIjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTjZha05EUVc1VFowRjNTVUpCWjBsSlRITm1WRVl4WVZneU4wbDNRMmRaU1V0dldrbDZhakJGUVhkSmQwNTZSVlpOUWsxSFFURlZSVU5vVFUwS1l6SnNibU16VW5aamJWVjFXa2RXTWsxU05IZElRVmxFVmxGUlJFVjRWbnBoVjJSNlpFYzVlVnBUTVhCaWJsSnNZMjB4YkZwSGJHaGtSMVYzU0doalRncE5hbGw0VFZSRmVVMUVaM2hPYWxVeFYyaGpUazFxV1hoTlZFVjVUVVJuZVU1NlZURlhha0ZCVFVacmQwVjNXVWhMYjFwSmVtb3dRMEZSV1VsTGIxcEpDbnBxTUVSQlVXTkVVV2RCUlRoNE0xWk5OM2xVUnpCT1dVeHdXRmhDWkRsQ1VUVXJkRTVVWWt3MVZUbHNibmxMVmpKNmNrTkJTbGhqYm5WeFMzUXlWbklLT1Rkc1VtbGlURTAzUldSU1JqZEZkMWxxUkdkRE1VYzJWaTkxYWxneGNWaG9jVTlEUVZvNGQyZG5SMkpOUVRSSFFURlZaRVIzUlVJdmQxRkZRWGRKU0FwblJFRlVRbWRPVmtoVFZVVkVSRUZMUW1kbmNrSm5SVVpDVVdORVFYcEJaa0puVGxaSVUwMUZSMFJCVjJkQ1UxcHdVMGxMVmxsNFUxRjZkVEZxUW5CNENqQkNWRWxWVXpWclVHcENXVUpuVGxaSVVrVkNRV1k0UlZScVFrMW9hM0J2WkVoU2QyTjZiM1pNTW1Sd1pFZG9NVmxwTldwaU1qQjJXVmRPZEZwVE9UTUtZVmRTYmxwWVVYWk1iV1J3WkVkb01WbHBPVE5pTTBweVdtMTRkbVF6VFhaWmJsWndZa2RSZFdWWE1YTlJTRXBzV201TmRtRkhWbWhhU0UxMllsZEdjQXBpYWtFMVFtZHZja0puUlVWQldVOHZUVUZGUWtKRGRHOWtTRkozWTNwdmRrd3pVblpoTWxaMVRHMUdhbVJIYkhaaWJrMTFXakpzTUdGSVZtbGtXRTVzQ21OdFRuWmlibEpzWW01UmRWa3lPWFJOUkhOSFEybHpSMEZSVVVKbk56aDNRVkZuUlV4UmQzSmhTRkl3WTBoTk5reDVPVEJpTW5Sc1ltazFhRmt6VW5BS1lqSTFla3h0WkhCa1IyZ3hXVzVXZWxwWVNtcGlNalV3V2xjMU1FeHRUblppVkVGMVFtZHZja0puUlVWQldVOHZUVUZGVFVKRFFVMUliV2d3WkVoQ2VncFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVhRmt5TVd4TU0yUndXa2RrYkdSRVFsSkNaMjl5UW1kRlJVRlpUeTlOUVVWV1FrVk5UVkZYYURCa1NFSjZDazlwT0haYU1td3dZVWhXYVV4dFRuWmlVemxvV1RJeGJFd3paSEJhUjJSc1pFTTVhRmt6VW5CaU1qVjZURE5LTVdKdVRYWk5WRWw2VGtSVk1rNTZaelVLVFVNNWFHUklVbXhpV0VJd1kzazRlRTFCYjBkRFEzRkhVMDAwT1VKQlRVTkJNR2RCVFVWVlEwbEJjVVpCVWpGR1JHZFhOM01yUjBkSWFTOW5kVnBRUXdwbllUSnRTMDl2UldKNE0yZFNOSFJhY2s1SFJFRnBSVUYzZFhSTlZqZGxORmd5ZERScmRUZzRXRXBEYW5kUmRXdzFTRmN3U1dWdmFUYzNXR1ZIUm1Sb0NtODRVVDBLTFMwdExTMUZUa1FnUTBWU1ZFbEdTVU5CVkVVdExTMHRMUW89In1dfSwia2luZCI6ImRzc2UifQ==", + "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJzcGVjIjp7ImVudmVsb3BlSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjA1YzhmZDYxMjIwMTZlNDA1ZTBiMmU2NGVjMzJkYWRhMTFjYTcwMGEyMzBlZTZmNWJkNGU0MjhlN2M5NzAyMzIifSwicGF5bG9hZEhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJmZjBkYmU2NDA0MmI2ZmU5ZTJjNzYyNTFkMjc3ZWNlYWMwOGNmN2U0YmJjNTgwNGQyYWQxNTg0NjBkZTJjMWFhIn0sInNpZ25hdHVyZXMiOlt7InNpZ25hdHVyZSI6Ik1FWUNJUURIaEQ1Y1duL3FBeDUyellUTElocFFFT0tvSmZCZWNlTkFVZzYzcCt5TW93SWhBT3Ixcjh6cmZNc1ZsZ1dobVZTTDQ1ZHhxSmpydWJqS2YxMFFrSzNndzI0SyIsInZlcmlmaWVyIjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTjZha05EUVc1VFowRjNTVUpCWjBsSlJHSk9iVkZYVDI0Mk9VRjNRMmRaU1V0dldrbDZhakJGUVhkSmQwNTZSVlpOUWsxSFFURlZSVU5vVFUwS1l6SnNibU16VW5aamJWVjFXa2RXTWsxU05IZElRVmxFVmxGUlJFVjRWbnBoVjJSNlpFYzVlVnBUTVhCaWJsSnNZMjB4YkZwSGJHaGtSMVYzU0doalRncE5hbGw0VFZSRmVrMVVVWHBPUkZVeFYyaGpUazFxV1hoTlZFVjZUVlJSTUU1VVZURlhha0ZCVFVacmQwVjNXVWhMYjFwSmVtb3dRMEZSV1VsTGIxcEpDbnBxTUVSQlVXTkVVV2RCUlRSM01WSnhMMFZRWlhGTE9YaGxibVZ2VnpFNUsyWjJOM0pPVHpsYWIwNDJhbWtyTUVneU1qTkpTRWhyYW5KcGJFY3dZMWdLWkdWQmRXWnhPVk5TTVdjMU5rbzRaVWROTjNjNE5qRlhka3h6V0dwdFNXeDFjVTlEUVZvNGQyZG5SMkpOUVRSSFFURlZaRVIzUlVJdmQxRkZRWGRKU0FwblJFRlVRbWRPVmtoVFZVVkVSRUZMUW1kbmNrSm5SVVpDVVdORVFYcEJaa0puVGxaSVUwMUZSMFJCVjJkQ1VXbHVOVVEyZGs5RlVXOWxMMFZoUjFGc0NuZElUR2gzUlVSb1ZWUkNXVUpuVGxaSVVrVkNRV1k0UlZScVFrMW9hM0J2WkVoU2QyTjZiM1pNTW1Sd1pFZG9NVmxwTldwaU1qQjJXVmRPZEZwVE9UTUtZVmRTYmxwWVVYWk1iV1J3WkVkb01WbHBPVE5pTTBweVdtMTRkbVF6VFhaWmJsWndZa2RSZFdWWE1YTlJTRXBzV201TmRtRkhWbWhhU0UxMllsZEdjQXBpYWtFMVFtZHZja0puUlVWQldVOHZUVUZGUWtKRGRHOWtTRkozWTNwdmRrd3pVblpoTWxaMVRHMUdhbVJIYkhaaWJrMTFXakpzTUdGSVZtbGtXRTVzQ21OdFRuWmlibEpzWW01UmRWa3lPWFJOUkhOSFEybHpSMEZSVVVKbk56aDNRVkZuUlV4UmQzSmhTRkl3WTBoTk5reDVPVEJpTW5Sc1ltazFhRmt6VW5BS1lqSTFla3h0WkhCa1IyZ3hXVzVXZWxwWVNtcGlNalV3V2xjMU1FeHRUblppVkVGMVFtZHZja0puUlVWQldVOHZUVUZGVFVKRFFVMUliV2d3WkVoQ2VncFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVhRmt5TVd4TU0yUndXa2RrYkdSRVFsSkNaMjl5UW1kRlJVRlpUeTlOUVVWV1FrVk5UVkZYYURCa1NFSjZDazlwT0haYU1td3dZVWhXYVV4dFRuWmlVemxvV1RJeGJFd3paSEJhUjJSc1pFTTVhRmt6VW5CaU1qVjZURE5LTVdKdVRYWk5WRWw2VGtSVk1rNTZaelVLVFVNNWFHUklVbXhpV0VJd1kzazRlRTFCYjBkRFEzRkhVMDAwT1VKQlRVTkJNR2RCVFVWVlEwbEZUVXRRTnpKM2IwZHNaRkU0VWxRNVZsb3pjMlpLU1FvNGRqSkZSRGgwVUUxVFkyRkdNVGs1SzNZeWIwRnBSVUYyVFdKbk0zVmpTRnBUZUdocWRteGFaM05QTWtFcmNYTjRVM0J2VFc1UGFGcE5VVTVEZFRZNENqbGpjejBLTFMwdExTMUZUa1FnUTBWU1ZFbEdTVU5CVkVVdExTMHRMUW89In1dfSwia2luZCI6ImRzc2UifQ==", "inclusionPromise": { - "signedEntryTimestamp": "MEYCIQCic+qbJiK6wsjwCZPtQ3RJCAbNtika1FIoAuzluJluJwIhALJyLDCeP3HkIZmt3YqKnLeQMfGakpLzSRPHOa0eL2ZO" + "signedEntryTimestamp": "MEYCIQD68NKeIW4QKZdWacFqondp3kKTIVfB7Fxlsv0SSUBIjgIhAIzSMhS7MtOAPne+qCQ4ruQ8SfRvMv6wMv92la5TiiW6" }, "inclusionProof": { "checkpoint": { - "envelope": "rekor.localhost - 123\n42\naOnYbuzltt/qzHg1EBpxRlWpiTE3tj8CfMx6i33eWgo=\n\n— rekor.localhost VbgJJjBFAiAUt58vUizzfGh9hDvAF0WLd+VQ5kK0pe5zYJpbuBnSQwIhAI+HoRXWcT/OC5ItWALpYr7sH+DHrCXtxh5IQWj5xcNl\n" + "envelope": "rekor.localhost - 123\n42\nTUdA95mGlPXVgV8lHl5+p9V4rJ6/IYwPba/0jg10SVM=\n\n— rekor.localhost 45EjTzBEAiBXZAF+2F3R7fRQGeAftHFndxJsNAkir/jcYyAmiMeUMQIgWosfxGI/4SuCeVVpI2O5zOcieThq2xmAPM+ULM4ATGw=\n" }, - "rootHash": "aOnYbuzltt/qzHg1EBpxRlWpiTE3tj8CfMx6i33eWgo=", + "rootHash": "TUdA95mGlPXVgV8lHl5+p9V4rJ6/IYwPba/0jg10SVM=", "treeSize": "1" }, - "integratedTime": "1794471535", + "integratedTime": "1794580615", "kindVersion": { "kind": "dsse", "version": "0.0.1" }, "logId": { - "keyId": "VbgJJh1uXk4PvCPZ3fIjaxUep33R8Z6T6wAJfVjz+BA=" + "keyId": "45EjT1abdD2MKrnHGSnayLaGvLNDQ4SRtMzNbF54fBc=" } } ] diff --git a/internal/intoto/testdata/spdx-sbom.sigstore.json b/internal/intoto/testdata/spdx-sbom.sigstore.json index 93f4a4282..f6f9e6040 100644 --- a/internal/intoto/testdata/spdx-sbom.sigstore.json +++ b/internal/intoto/testdata/spdx-sbom.sigstore.json @@ -4,42 +4,42 @@ "payloadType": "application/vnd.in-toto+json", "signatures": [ { - "sig": "MEUCIQCW2vISyYSR1THUSMvzI+14LJcht8Z/AU9FaqEnuvmhNwIga18VPYxzwoN1pykajJB7y/HCE2BIDxZMXa1tlxiOWmg=" + "sig": "MEUCIFEQoQ5s8YzqfdJjax6oTJMC6Lw5c0qoFLgZbW8ADgIQAiEA1bN5BzI9EzAqEA5kdBrJhaXaJ6uemwkbBhivhOKHPp0=" } ] }, "mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json", "verificationMaterial": { "certificate": { - "rawBytes": "MIICzjCCAnSgAwIBAgIIGvND+/19F8QwCgYIKoZIzj0EAwIwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYxMTEyMDgxNjU1WhcNMjYxMTEyMDgyNzU1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAENJSgZRO+Sr9PFrM5vkzmu2U4hJ/KYoKvbRs98jhnAaEfC0iAKr5BMZkR2kzTWeUealL+oiJ6God8hYuAf7aahqOCAZ8wggGbMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAfBgNVHSMEGDAWgBSZpSIKVYxSQzu1jBpx0BTIUS5kPjBYBgNVHREBAf8ETjBMhkpodHRwczovL2dpdGh1Yi5jb20vYWNtZS93aWRnZXQvLmdpdGh1Yi93b3JrZmxvd3MvYnVpbGQueW1sQHJlZnMvaGVhZHMvbWFpbjA5BgorBgEEAYO/MAEBBCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAuBgorBgEEAYO/MAEMBCAMHmh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldDBRBgorBgEEAYO/MAEVBEMMQWh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldC9hY3Rpb25zL3J1bnMvMTIzNDU2Nzg5MC9hdHRlbXB0cy8xMAoGCCqGSM49BAMCA0gAMEUCIQDVNAB2q3kN2Dg4oJYKX8sMoq5o3O4BLt8kEgEfttxlHwIgXvGufdoFI0sX8LQiC67IH4Yskl/GdZN6RCWETC4AWs4=" + "rawBytes": "MIICzzCCAnSgAwIBAgIIJWchm//R/xkwCgYIKoZIzj0EAwIwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYxMTEzMTQzNDU1WhcNMjYxMTEzMTQ0NTU1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE+9YLCNlpHijz8CepO8JDuqBd4yd11/wMBgXsJY5R8Q0INCjtfBGhBs2uZHVFx0pEZJ2VTfoGVujXV5SY5r16LqOCAZ8wggGbMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAfBgNVHSMEGDAWgBQin5D6vOEQoe/EaGQlwHLhwEDhUTBYBgNVHREBAf8ETjBMhkpodHRwczovL2dpdGh1Yi5jb20vYWNtZS93aWRnZXQvLmdpdGh1Yi93b3JrZmxvd3MvYnVpbGQueW1sQHJlZnMvaGVhZHMvbWFpbjA5BgorBgEEAYO/MAEBBCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAuBgorBgEEAYO/MAEMBCAMHmh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldDBRBgorBgEEAYO/MAEVBEMMQWh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldC9hY3Rpb25zL3J1bnMvMTIzNDU2Nzg5MC9hdHRlbXB0cy8xMAoGCCqGSM49BAMCA0kAMEYCIQDSerO/RQUuUdlQEbkxCjpVtUae+Af5NmO5Q7hcjfJ65wIhAKngyiNXf4p7V97iW1CIVPE8+6QeW6z5dH0xgzFnFKQR" }, "timestampVerificationData": { "rfc3161Timestamps": [ { - "signedTimestamp": "MIICTzADAgEAMIICRgYJKoZIhvcNAQcCoIICNzCCAjMCAQMxDTALBglghkgBZQMEAgEwgYEGCyqGSIb3DQEJEAEEoHIEcDBuAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQgG83kmFEYD4/cOs1fPbLucpxPIdYQQBLlNiWRKpexcMMCFGbS3pFHaKOH6Mjr73EVUdmW/ulsGA8yMDI2MTExMjA4MTc1NVqgBKQCMACgADGCAZcwggGTAgEBMEAwOzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MSIwIAYDVQQDExlzaWdzdG9yZS10c2EtaW50ZXJtZWRpYXRlAgEBMAsGCWCGSAFlAwQCAaCB6jAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQAQQwHAYJKoZIhvcNAQkFMQ8XDTI2MTExMjA4MTc1NVowLwYJKoZIhvcNAQkEMSIEICJZrBHug8UwEeWhyRvjakipuj46kd/mh6ekPnfp3GBuMH0GCyqGSIb3DQEJEAIvMW4wbDBqMGgEIHGxNwJVZfB5irJH4y/SoTJA0ULqHcwUDQGasEQdUf20MEQwP6Q9MDsxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEiMCAGA1UEAxMZc2lnc3RvcmUtdHNhLWludGVybWVkaWF0ZQIBATAKBggqhkjOPQQDAgRGMEQCIDiVTGEYKhrs66qEu7cntNxn+b7nG0Aku84NP8dHyMOOAiBaAcBB/UsMkbxFQlIMXyf7MGV3NLFSm30DjMvDLLhjow==" + "signedTimestamp": "MIICUTADAgEAMIICSAYJKoZIhvcNAQcCoIICOTCCAjUCAQMxDTALBglghkgBZQMEAgEwgYIGCyqGSIb3DQEJEAEEoHMEcTBvAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQgJmk2XiyldfrbHAYo/SlmgxfKlF54GdYf5oap/Y7wdvECFQDhD9dU53PiiR1RR+7egqmaKKpYlRgPMjAyNjExMTMxNDM1NTVaoASkAjAAoAAxggGYMIIBlAIBATBAMDsxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEiMCAGA1UEAxMZc2lnc3RvcmUtdHNhLWludGVybWVkaWF0ZQIBATALBglghkgBZQMEAgGggeowGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEEMBwGCSqGSIb3DQEJBTEPFw0yNjExMTMxNDM1NTVaMC8GCSqGSIb3DQEJBDEiBCCcjiWHkWQNwXxHBe1+WGrGrAQDEV39sXeeH6zOgQhPtjB9BgsqhkiG9w0BCRACLzFuMGwwajBoBCB6sxTuY9UdYUf2mR3N666Vn6KAgVfyY7rK6Lx/joQFZTBEMD+kPTA7MRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxIjAgBgNVBAMTGXNpZ3N0b3JlLXRzYS1pbnRlcm1lZGlhdGUCAQEwCgYIKoZIzj0EAwIERzBFAiA8n5dJM+WUA7NmfHfQ6lR/R5REfZUmSJgPcVUMSRANMQIhALhHweDLPMaHESWdWe6HWSxw7X4Le3+8CTwgzVshPx8W" } ] }, "tlogEntries": [ { - "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJzcGVjIjp7ImVudmVsb3BlSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImQ3YmUyNTE3OTUxZTc0ZjQwZjI5OTc3OTZiNGU1NzUzODk5NmNmZWZjNGE2MWMwYzRlMTkxZjg3OTJjNmYyNGIifSwicGF5bG9hZEhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiIxMTEwZDQ2MGFjMmIyMzRjMTRmZThlYWM1NTRhOGQ5NDcyYTYxZWE5YjQ3YTY0N2M3MWUxMThlY2ZjYjE2YjYxIn0sInNpZ25hdHVyZXMiOlt7InNpZ25hdHVyZSI6Ik1FVUNJUUNXMnZJU3lZU1IxVEhVU012ekkrMTRMSmNodDhaL0FVOUZhcUVudXZtaE53SWdhMThWUFl4endvTjFweWthakpCN3kvSENFMkJJRHhaTVhhMXRseGlPV21nPSIsInZlcmlmaWVyIjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTjZha05EUVc1VFowRjNTVUpCWjBsSlIzWk9SQ3N2TVRsR09GRjNRMmRaU1V0dldrbDZhakJGUVhkSmQwNTZSVlpOUWsxSFFURlZSVU5vVFUwS1l6SnNibU16VW5aamJWVjFXa2RXTWsxU05IZElRVmxFVmxGUlJFVjRWbnBoVjJSNlpFYzVlVnBUTVhCaWJsSnNZMjB4YkZwSGJHaGtSMVYzU0doalRncE5hbGw0VFZSRmVVMUVaM2hPYWxVeFYyaGpUazFxV1hoTlZFVjVUVVJuZVU1NlZURlhha0ZCVFVacmQwVjNXVWhMYjFwSmVtb3dRMEZSV1VsTGIxcEpDbnBxTUVSQlVXTkVVV2RCUlU1S1UyZGFVazhyVTNJNVVFWnlUVFYyYTNwdGRUSlZOR2hLTDB0WmIwdDJZbEp6T1RocWFHNUJZVVZtUXpCcFFVdHlOVUlLVFZwclVqSnJlbFJYWlZWbFlXeE1LMjlwU2paSGIyUTRhRmwxUVdZM1lXRm9jVTlEUVZvNGQyZG5SMkpOUVRSSFFURlZaRVIzUlVJdmQxRkZRWGRKU0FwblJFRlVRbWRPVmtoVFZVVkVSRUZMUW1kbmNrSm5SVVpDVVdORVFYcEJaa0puVGxaSVUwMUZSMFJCVjJkQ1UxcHdVMGxMVmxsNFUxRjZkVEZxUW5CNENqQkNWRWxWVXpWclVHcENXVUpuVGxaSVVrVkNRV1k0UlZScVFrMW9hM0J2WkVoU2QyTjZiM1pNTW1Sd1pFZG9NVmxwTldwaU1qQjJXVmRPZEZwVE9UTUtZVmRTYmxwWVVYWk1iV1J3WkVkb01WbHBPVE5pTTBweVdtMTRkbVF6VFhaWmJsWndZa2RSZFdWWE1YTlJTRXBzV201TmRtRkhWbWhhU0UxMllsZEdjQXBpYWtFMVFtZHZja0puUlVWQldVOHZUVUZGUWtKRGRHOWtTRkozWTNwdmRrd3pVblpoTWxaMVRHMUdhbVJIYkhaaWJrMTFXakpzTUdGSVZtbGtXRTVzQ21OdFRuWmlibEpzWW01UmRWa3lPWFJOUkhOSFEybHpSMEZSVVVKbk56aDNRVkZuUlV4UmQzSmhTRkl3WTBoTk5reDVPVEJpTW5Sc1ltazFhRmt6VW5BS1lqSTFla3h0WkhCa1IyZ3hXVzVXZWxwWVNtcGlNalV3V2xjMU1FeHRUblppVkVGMVFtZHZja0puUlVWQldVOHZUVUZGVFVKRFFVMUliV2d3WkVoQ2VncFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVhRmt5TVd4TU0yUndXa2RrYkdSRVFsSkNaMjl5UW1kRlJVRlpUeTlOUVVWV1FrVk5UVkZYYURCa1NFSjZDazlwT0haYU1td3dZVWhXYVV4dFRuWmlVemxvV1RJeGJFd3paSEJhUjJSc1pFTTVhRmt6VW5CaU1qVjZURE5LTVdKdVRYWk5WRWw2VGtSVk1rNTZaelVLVFVNNWFHUklVbXhpV0VJd1kzazRlRTFCYjBkRFEzRkhVMDAwT1VKQlRVTkJNR2RCVFVWVlEwbFJSRlpPUVVJeWNUTnJUakpFWnpSdlNsbExXRGh6VFFwdmNUVnZNMDgwUWt4ME9HdEZaMFZtZEhSNGJFaDNTV2RZZGtkMVptUnZSa2t3YzFnNFRGRnBRelkzU1VnMFdYTnJiQzlIWkZwT05sSkRWMFZVUXpSQkNsZHpORDBLTFMwdExTMUZUa1FnUTBWU1ZFbEdTVU5CVkVVdExTMHRMUW89In1dfSwia2luZCI6ImRzc2UifQ==", + "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJzcGVjIjp7ImVudmVsb3BlSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjhjNWQ0YTBkNTI5MWE3ZjNmZGIyNDcyNWJmMDZiYjliYmNhNWU0OTg1NDYyODA2M2YxMjVmNzUyZGQxNTQ4YjQifSwicGF5bG9hZEhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiIxMTEwZDQ2MGFjMmIyMzRjMTRmZThlYWM1NTRhOGQ5NDcyYTYxZWE5YjQ3YTY0N2M3MWUxMThlY2ZjYjE2YjYxIn0sInNpZ25hdHVyZXMiOlt7InNpZ25hdHVyZSI6Ik1FVUNJRkVRb1E1czhZenFmZEpqYXg2b1RKTUM2THc1YzBxb0ZMZ1piVzhBRGdJUUFpRUExYk41QnpJOUV6QXFFQTVrZEJySmhhWGFKNnVlbXdrYkJoaXZoT0tIUHAwPSIsInZlcmlmaWVyIjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTjZla05EUVc1VFowRjNTVUpCWjBsSlNsZGphRzB2TDFJdmVHdDNRMmRaU1V0dldrbDZhakJGUVhkSmQwNTZSVlpOUWsxSFFURlZSVU5vVFUwS1l6SnNibU16VW5aamJWVjFXa2RXTWsxU05IZElRVmxFVmxGUlJFVjRWbnBoVjJSNlpFYzVlVnBUTVhCaWJsSnNZMjB4YkZwSGJHaGtSMVYzU0doalRncE5hbGw0VFZSRmVrMVVVWHBPUkZVeFYyaGpUazFxV1hoTlZFVjZUVlJSTUU1VVZURlhha0ZCVFVacmQwVjNXVWhMYjFwSmVtb3dRMEZSV1VsTGIxcEpDbnBxTUVSQlVXTkVVV2RCUlNzNVdVeERUbXh3U0dscWVqaERaWEJQT0VwRWRYRkNaRFI1WkRFeEwzZE5RbWRZYzBwWk5WSTRVVEJKVGtOcWRHWkNSMmdLUW5NeWRWcElWa1o0TUhCRldrb3lWbFJtYjBkV2RXcFlWalZUV1RWeU1UWk1jVTlEUVZvNGQyZG5SMkpOUVRSSFFURlZaRVIzUlVJdmQxRkZRWGRKU0FwblJFRlVRbWRPVmtoVFZVVkVSRUZMUW1kbmNrSm5SVVpDVVdORVFYcEJaa0puVGxaSVUwMUZSMFJCVjJkQ1VXbHVOVVEyZGs5RlVXOWxMMFZoUjFGc0NuZElUR2gzUlVSb1ZWUkNXVUpuVGxaSVVrVkNRV1k0UlZScVFrMW9hM0J2WkVoU2QyTjZiM1pNTW1Sd1pFZG9NVmxwTldwaU1qQjJXVmRPZEZwVE9UTUtZVmRTYmxwWVVYWk1iV1J3WkVkb01WbHBPVE5pTTBweVdtMTRkbVF6VFhaWmJsWndZa2RSZFdWWE1YTlJTRXBzV201TmRtRkhWbWhhU0UxMllsZEdjQXBpYWtFMVFtZHZja0puUlVWQldVOHZUVUZGUWtKRGRHOWtTRkozWTNwdmRrd3pVblpoTWxaMVRHMUdhbVJIYkhaaWJrMTFXakpzTUdGSVZtbGtXRTVzQ21OdFRuWmlibEpzWW01UmRWa3lPWFJOUkhOSFEybHpSMEZSVVVKbk56aDNRVkZuUlV4UmQzSmhTRkl3WTBoTk5reDVPVEJpTW5Sc1ltazFhRmt6VW5BS1lqSTFla3h0WkhCa1IyZ3hXVzVXZWxwWVNtcGlNalV3V2xjMU1FeHRUblppVkVGMVFtZHZja0puUlVWQldVOHZUVUZGVFVKRFFVMUliV2d3WkVoQ2VncFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVhRmt5TVd4TU0yUndXa2RrYkdSRVFsSkNaMjl5UW1kRlJVRlpUeTlOUVVWV1FrVk5UVkZYYURCa1NFSjZDazlwT0haYU1td3dZVWhXYVV4dFRuWmlVemxvV1RJeGJFd3paSEJhUjJSc1pFTTVhRmt6VW5CaU1qVjZURE5LTVdKdVRYWk5WRWw2VGtSVk1rNTZaelVLVFVNNWFHUklVbXhpV0VJd1kzazRlRTFCYjBkRFEzRkhVMDAwT1VKQlRVTkJNR3RCVFVWWlEwbFJSRk5sY2s4dlVsRlZkVlZrYkZGRlltdDRRMnB3VmdwMFZXRmxLMEZtTlU1dFR6VlJOMmhqYW1aS05qVjNTV2hCUzI1bmVXbE9XR1kwY0RkV09UZHBWekZEU1ZaUVJUZ3JObEZsVnpaNk5XUklNSGhuZWtadUNrWkxVVklLTFMwdExTMUZUa1FnUTBWU1ZFbEdTVU5CVkVVdExTMHRMUW89In1dfSwia2luZCI6ImRzc2UifQ==", "inclusionPromise": { - "signedEntryTimestamp": "MEUCID1eSUbX9QmVnC3nwusBMCEIw+y40TRbDiHNbj9dKDL7AiEAopJuKQU5+ZeHFt25p61HwLXP27Kp6mTnSloCfeOWw5Y=" + "signedEntryTimestamp": "MEUCIQCJR12fcjCn9EDd+4JNaI8vpC5Wd0VkXM9gifVTvKiOWgIgVOMfd3rDq3qDLyiJzfuGE526umV/XTkabqyS1yYsw/8=" }, "inclusionProof": { "checkpoint": { - "envelope": "rekor.localhost - 123\n42\nrBQ0o+c98HkIo+T1KYtStsthQ+8mVV6Ic94MS+fGTjw=\n\n— rekor.localhost VbgJJjBEAiBOlTbRWucfJogBVhhGP7Jwa6ugwFVC4lFBhDWt4Br1pAIgVH/aXPzE61S5EE/T6Scoo76uWfxvX53tB8vwRIhDVSc=\n" + "envelope": "rekor.localhost - 123\n42\nE0lOSsNmFVZc0YiHN1PIxAv8b2JRO54UWmJOpcXZTAo=\n\n— rekor.localhost 45EjTzBEAiA+LVfUijS8GNGM/sV8jfvyL2VX3zqaR9Rukcn4pj9h0wIgVoxz37A0aJvNY+ZsDei3cJgnsvk01R1yZMeBEHa0S58=\n" }, - "rootHash": "rBQ0o+c98HkIo+T1KYtStsthQ+8mVV6Ic94MS+fGTjw=", + "rootHash": "E0lOSsNmFVZc0YiHN1PIxAv8b2JRO54UWmJOpcXZTAo=", "treeSize": "1" }, - "integratedTime": "1794471535", + "integratedTime": "1794580615", "kindVersion": { "kind": "dsse", "version": "0.0.1" }, "logId": { - "keyId": "VbgJJh1uXk4PvCPZ3fIjaxUep33R8Z6T6wAJfVjz+BA=" + "keyId": "45EjT1abdD2MKrnHGSnayLaGvLNDQ4SRtMzNbF54fBc=" } } ] diff --git a/internal/intoto/testdata/tampered-provenance.sigstore.json b/internal/intoto/testdata/tampered-provenance.sigstore.json index 97251d811..6bb0883f6 100644 --- a/internal/intoto/testdata/tampered-provenance.sigstore.json +++ b/internal/intoto/testdata/tampered-provenance.sigstore.json @@ -4,42 +4,42 @@ "payloadType": "application/vnd.in-toto+json", "signatures": [ { - "sig": "MEQCIDzgF+CqxrCzzEG7GBaXMmQ7nw/0IGb/DcQZUN/zGbV5AiAPUMVwxbLBh8fju9VyAHTQvT+CH5y5ftgUserY6/CUlQ==" + "sig": "MEUCIQDxgI2XK6VEALwVNUyDtG9jllxaMwUqTF3FaaP8ysemwgIgetkIPexGW4zWkRnYdZKfVX2A3IMTDMhGDTOPKMvywf8=" } ] }, "mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json", "verificationMaterial": { "certificate": { - "rawBytes": "MIICzjCCAnSgAwIBAgIIOcZnQ+9RvxEwCgYIKoZIzj0EAwIwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYxMTEyMDgxNjU1WhcNMjYxMTEyMDgyNzU1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAETNFp9TYlxC19tDPgdh9hFbnLl39OLBO3/GSZBcKM+jSc0Xb8dgV+Dxg9R4t26XGv+gfrD6m82O+LuELHFp8vqaOCAZ8wggGbMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAfBgNVHSMEGDAWgBSZpSIKVYxSQzu1jBpx0BTIUS5kPjBYBgNVHREBAf8ETjBMhkpodHRwczovL2dpdGh1Yi5jb20vYWNtZS93aWRnZXQvLmdpdGh1Yi93b3JrZmxvd3MvYnVpbGQueW1sQHJlZnMvaGVhZHMvbWFpbjA5BgorBgEEAYO/MAEBBCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAuBgorBgEEAYO/MAEMBCAMHmh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldDBRBgorBgEEAYO/MAEVBEMMQWh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldC9hY3Rpb25zL3J1bnMvMTIzNDU2Nzg5MC9hdHRlbXB0cy8xMAoGCCqGSM49BAMCA0gAMEUCIQCZ5wfFRNyCRuGu/r0HWVcfB/yo37/x58qgeg2BL2yt6wIgYJ2rNqNFiNdRUf9kmu8DD5IjcK3sVJNqodjZ+y1QBm0=" + "rawBytes": "MIICzjCCAnSgAwIBAgIINrgJEUUtAXMwCgYIKoZIzj0EAwIwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYxMTEzMTQzNDU1WhcNMjYxMTEzMTQ0NTU1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEopPPk5Ey2CifqO7ChXNS1A/L6XUTNJSk55Wxdteh9oYuA6cAYIqqz18HsVACKW96aACvFyAjDnTGajoMuouzYaOCAZ8wggGbMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAfBgNVHSMEGDAWgBQin5D6vOEQoe/EaGQlwHLhwEDhUTBYBgNVHREBAf8ETjBMhkpodHRwczovL2dpdGh1Yi5jb20vYWNtZS93aWRnZXQvLmdpdGh1Yi93b3JrZmxvd3MvYnVpbGQueW1sQHJlZnMvaGVhZHMvbWFpbjA5BgorBgEEAYO/MAEBBCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAuBgorBgEEAYO/MAEMBCAMHmh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldDBRBgorBgEEAYO/MAEVBEMMQWh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldC9hY3Rpb25zL3J1bnMvMTIzNDU2Nzg5MC9hdHRlbXB0cy8xMAoGCCqGSM49BAMCA0gAMEUCIQDgr4oxlERPe2RowxUQf6HzrN+Vbfe23Jzh3rZTGS1S6wIgQT2i4clXugcZm5JwDiN8zlTVYVtaS0SSBJuPUP0ACFA=" }, "timestampVerificationData": { "rfc3161Timestamps": [ { - "signedTimestamp": "MIICUDADAgEAMIICRwYJKoZIhvcNAQcCoIICODCCAjQCAQMxDTALBglghkgBZQMEAgEwgYEGCyqGSIb3DQEJEAEEoHIEcDBuAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQgTOiGkTza/CexPWp5ULumiPHUVQDh8tCzel5VzbMJQS0CFC0UA3QzDnCHVnhRNNrstD37XNSkGA8yMDI2MTExMjA4MTc1NVqgBKQCMACgADGCAZgwggGUAgEBMEAwOzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MSIwIAYDVQQDExlzaWdzdG9yZS10c2EtaW50ZXJtZWRpYXRlAgEBMAsGCWCGSAFlAwQCAaCB6jAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQAQQwHAYJKoZIhvcNAQkFMQ8XDTI2MTExMjA4MTc1NVowLwYJKoZIhvcNAQkEMSIEIB7xmFl/Iygi0zznKKZ7E3q2mNlfpNmdGhM4Nt6qmKxHMH0GCyqGSIb3DQEJEAIvMW4wbDBqMGgEIHGxNwJVZfB5irJH4y/SoTJA0ULqHcwUDQGasEQdUf20MEQwP6Q9MDsxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEiMCAGA1UEAxMZc2lnc3RvcmUtdHNhLWludGVybWVkaWF0ZQIBATAKBggqhkjOPQQDAgRHMEUCIQCXwKPU4cvRov2rrpCbBGlXRCk57X3zvVznTbwuvRawbwIgME/otjSfSvk4dG4cgxJGEawhr/fcgU2hgmr0QCIqKOk=" + "signedTimestamp": "MIICUDADAgEAMIICRwYJKoZIhvcNAQcCoIICODCCAjQCAQMxDTALBglghkgBZQMEAgEwgYEGCyqGSIb3DQEJEAEEoHIEcDBuAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQgKS0uS/cpgSvzZ1G7eVsCrETYwkyX0n3uz2U2/0V5PmwCFD3OEnyQN336TF4bzvyBnM5dhjidGA8yMDI2MTExMzE0MzU1NVqgBKQCMACgADGCAZgwggGUAgEBMEAwOzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MSIwIAYDVQQDExlzaWdzdG9yZS10c2EtaW50ZXJtZWRpYXRlAgEBMAsGCWCGSAFlAwQCAaCB6jAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQAQQwHAYJKoZIhvcNAQkFMQ8XDTI2MTExMzE0MzU1NVowLwYJKoZIhvcNAQkEMSIEILARV+fllkIWXjYAfi1HVKcFGkKCodAcFcKkY79uw7LlMH0GCyqGSIb3DQEJEAIvMW4wbDBqMGgEIHqzFO5j1R1hR/aZHc3rrpWfooCBV/JjusrovH+OhAVlMEQwP6Q9MDsxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEiMCAGA1UEAxMZc2lnc3RvcmUtdHNhLWludGVybWVkaWF0ZQIBATAKBggqhkjOPQQDAgRHMEUCIHH9l0tu+jPbmZHnvVD5SZd4JHCySVsgGfePV1eLaHajAiEAvOC5h3SuLhzSc2IZAbS2cKUfX0E/hE9CefqXUz0fF7g=" } ] }, "tlogEntries": [ { - "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJzcGVjIjp7ImVudmVsb3BlSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjY1NDY4YjYwODVmMzJhZTU1ZDEwMWVkNzc0MWU5YTVmYWQ0ODhhODZlZDc0OTA4ZjUyMWE3NDJjZjg5NjQwMzIifSwicGF5bG9hZEhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJmOTZjNDY3Y2I2Y2MzYmU1ZGRlMGE0YzZkYTFhZDQ5NTA3NGEzYjRiZTcyMDc2NDQyYzBmNGI4NzFjMTNhMWVlIn0sInNpZ25hdHVyZXMiOlt7InNpZ25hdHVyZSI6Ik1FUUNJRHpnRitDcXhyQ3p6RUc3R0JhWE1tUTdudy8wSUdiL0RjUVpVTi96R2JWNUFpQVBVTVZ3eGJMQmg4Zmp1OVZ5QUhUUXZUK0NINXk1ZnRnVXNlclk2L0NVbFE9PSIsInZlcmlmaWVyIjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTjZha05EUVc1VFowRjNTVUpCWjBsSlQyTmFibEVyT1ZKMmVFVjNRMmRaU1V0dldrbDZhakJGUVhkSmQwNTZSVlpOUWsxSFFURlZSVU5vVFUwS1l6SnNibU16VW5aamJWVjFXa2RXTWsxU05IZElRVmxFVmxGUlJFVjRWbnBoVjJSNlpFYzVlVnBUTVhCaWJsSnNZMjB4YkZwSGJHaGtSMVYzU0doalRncE5hbGw0VFZSRmVVMUVaM2hPYWxVeFYyaGpUazFxV1hoTlZFVjVUVVJuZVU1NlZURlhha0ZCVFVacmQwVjNXVWhMYjFwSmVtb3dRMEZSV1VsTGIxcEpDbnBxTUVSQlVXTkVVV2RCUlZST1JuQTVWRmxzZUVNeE9YUkVVR2RrYURsb1JtSnVUR3d6T1U5TVFrOHpMMGRUV2tKalMwMHJhbE5qTUZoaU9HUm5WaXNLUkhobk9WSTBkREkyV0VkMksyZG1ja1EyYlRneVR5dE1kVVZNU0Vad09IWnhZVTlEUVZvNGQyZG5SMkpOUVRSSFFURlZaRVIzUlVJdmQxRkZRWGRKU0FwblJFRlVRbWRPVmtoVFZVVkVSRUZMUW1kbmNrSm5SVVpDVVdORVFYcEJaa0puVGxaSVUwMUZSMFJCVjJkQ1UxcHdVMGxMVmxsNFUxRjZkVEZxUW5CNENqQkNWRWxWVXpWclVHcENXVUpuVGxaSVVrVkNRV1k0UlZScVFrMW9hM0J2WkVoU2QyTjZiM1pNTW1Sd1pFZG9NVmxwTldwaU1qQjJXVmRPZEZwVE9UTUtZVmRTYmxwWVVYWk1iV1J3WkVkb01WbHBPVE5pTTBweVdtMTRkbVF6VFhaWmJsWndZa2RSZFdWWE1YTlJTRXBzV201TmRtRkhWbWhhU0UxMllsZEdjQXBpYWtFMVFtZHZja0puUlVWQldVOHZUVUZGUWtKRGRHOWtTRkozWTNwdmRrd3pVblpoTWxaMVRHMUdhbVJIYkhaaWJrMTFXakpzTUdGSVZtbGtXRTVzQ21OdFRuWmlibEpzWW01UmRWa3lPWFJOUkhOSFEybHpSMEZSVVVKbk56aDNRVkZuUlV4UmQzSmhTRkl3WTBoTk5reDVPVEJpTW5Sc1ltazFhRmt6VW5BS1lqSTFla3h0WkhCa1IyZ3hXVzVXZWxwWVNtcGlNalV3V2xjMU1FeHRUblppVkVGMVFtZHZja0puUlVWQldVOHZUVUZGVFVKRFFVMUliV2d3WkVoQ2VncFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVhRmt5TVd4TU0yUndXa2RrYkdSRVFsSkNaMjl5UW1kRlJVRlpUeTlOUVVWV1FrVk5UVkZYYURCa1NFSjZDazlwT0haYU1td3dZVWhXYVV4dFRuWmlVemxvV1RJeGJFd3paSEJhUjJSc1pFTTVhRmt6VW5CaU1qVjZURE5LTVdKdVRYWk5WRWw2VGtSVk1rNTZaelVLVFVNNWFHUklVbXhpV0VJd1kzazRlRTFCYjBkRFEzRkhVMDAwT1VKQlRVTkJNR2RCVFVWVlEwbFJRMW8xZDJaR1VrNTVRMUoxUjNVdmNqQklWMVpqWmdwQ0wzbHZNemN2ZURVNGNXZGxaekpDVERKNWREWjNTV2RaU2pKeVRuRk9SbWxPWkZKVlpqbHJiWFU0UkVRMVNXcGpTek56VmtwT2NXOWthbG9yZVRGUkNrSnRNRDBLTFMwdExTMUZUa1FnUTBWU1ZFbEdTVU5CVkVVdExTMHRMUW89In1dfSwia2luZCI6ImRzc2UifQ==", + "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJzcGVjIjp7ImVudmVsb3BlSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjE3MTI1ZDAwODIwOWJkM2Y4OTNmYWJhMDlhNmU3NjJiNTI5OTM0MDVjZDA2MTZjMTU5Y2Q5MmNkZTc3YTBjNWUifSwicGF5bG9hZEhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJmOTZjNDY3Y2I2Y2MzYmU1ZGRlMGE0YzZkYTFhZDQ5NTA3NGEzYjRiZTcyMDc2NDQyYzBmNGI4NzFjMTNhMWVlIn0sInNpZ25hdHVyZXMiOlt7InNpZ25hdHVyZSI6Ik1FVUNJUUR4Z0kyWEs2VkVBTHdWTlV5RHRHOWpsbHhhTXdVcVRGM0ZhYVA4eXNlbXdnSWdldGtJUGV4R1c0eldrUm5ZZFpLZlZYMkEzSU1URE1oR0RUT1BLTXZ5d2Y4PSIsInZlcmlmaWVyIjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTjZha05EUVc1VFowRjNTVUpCWjBsSlRuSm5Ta1ZWVlhSQldFMTNRMmRaU1V0dldrbDZhakJGUVhkSmQwNTZSVlpOUWsxSFFURlZSVU5vVFUwS1l6SnNibU16VW5aamJWVjFXa2RXTWsxU05IZElRVmxFVmxGUlJFVjRWbnBoVjJSNlpFYzVlVnBUTVhCaWJsSnNZMjB4YkZwSGJHaGtSMVYzU0doalRncE5hbGw0VFZSRmVrMVVVWHBPUkZVeFYyaGpUazFxV1hoTlZFVjZUVlJSTUU1VVZURlhha0ZCVFVacmQwVjNXVWhMYjFwSmVtb3dRMEZSV1VsTGIxcEpDbnBxTUVSQlVXTkVVV2RCUlc5d1VGQnJOVVY1TWtOcFpuRlBOME5vV0U1VE1VRXZURFpZVlZST1NsTnJOVFZYZUdSMFpXZzViMWwxUVRaalFWbEpjWEVLZWpFNFNITldRVU5MVnprMllVRkRka1o1UVdwRWJsUkhZV3B2VFhWdmRYcFpZVTlEUVZvNGQyZG5SMkpOUVRSSFFURlZaRVIzUlVJdmQxRkZRWGRKU0FwblJFRlVRbWRPVmtoVFZVVkVSRUZMUW1kbmNrSm5SVVpDVVdORVFYcEJaa0puVGxaSVUwMUZSMFJCVjJkQ1VXbHVOVVEyZGs5RlVXOWxMMFZoUjFGc0NuZElUR2gzUlVSb1ZWUkNXVUpuVGxaSVVrVkNRV1k0UlZScVFrMW9hM0J2WkVoU2QyTjZiM1pNTW1Sd1pFZG9NVmxwTldwaU1qQjJXVmRPZEZwVE9UTUtZVmRTYmxwWVVYWk1iV1J3WkVkb01WbHBPVE5pTTBweVdtMTRkbVF6VFhaWmJsWndZa2RSZFdWWE1YTlJTRXBzV201TmRtRkhWbWhhU0UxMllsZEdjQXBpYWtFMVFtZHZja0puUlVWQldVOHZUVUZGUWtKRGRHOWtTRkozWTNwdmRrd3pVblpoTWxaMVRHMUdhbVJIYkhaaWJrMTFXakpzTUdGSVZtbGtXRTVzQ21OdFRuWmlibEpzWW01UmRWa3lPWFJOUkhOSFEybHpSMEZSVVVKbk56aDNRVkZuUlV4UmQzSmhTRkl3WTBoTk5reDVPVEJpTW5Sc1ltazFhRmt6VW5BS1lqSTFla3h0WkhCa1IyZ3hXVzVXZWxwWVNtcGlNalV3V2xjMU1FeHRUblppVkVGMVFtZHZja0puUlVWQldVOHZUVUZGVFVKRFFVMUliV2d3WkVoQ2VncFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVhRmt5TVd4TU0yUndXa2RrYkdSRVFsSkNaMjl5UW1kRlJVRlpUeTlOUVVWV1FrVk5UVkZYYURCa1NFSjZDazlwT0haYU1td3dZVWhXYVV4dFRuWmlVemxvV1RJeGJFd3paSEJhUjJSc1pFTTVhRmt6VW5CaU1qVjZURE5LTVdKdVRYWk5WRWw2VGtSVk1rNTZaelVLVFVNNWFHUklVbXhpV0VJd1kzazRlRTFCYjBkRFEzRkhVMDAwT1VKQlRVTkJNR2RCVFVWVlEwbFJSR2R5Tkc5NGJFVlNVR1V5VW05M2VGVlJaalpJZWdweVRpdFdZbVpsTWpOS2VtZ3pjbHBVUjFNeFV6WjNTV2RSVkRKcE5HTnNXSFZuWTFwdE5VcDNSR2xPT0hwc1ZGWlpWblJoVXpCVFUwSktkVkJWVURCQkNrTkdRVDBLTFMwdExTMUZUa1FnUTBWU1ZFbEdTVU5CVkVVdExTMHRMUW89In1dfSwia2luZCI6ImRzc2UifQ==", "inclusionPromise": { - "signedEntryTimestamp": "MEQCIGGImOSicPnprSTXupjGA5uOZTnxPJPP4RVteC/hLInVAiB0GVv2IWFGnvbd+80lYjZmKSJgkWRE3E1ukqIko8AiaQ==" + "signedEntryTimestamp": "MEQCICZh9eBiM9+wpFfBSICjC4+pCiE46VnmkzQFaf26VPiIAiBrWcJFTKrth7+3goA3QkH/IrNAjeqTL8/aVszEQmnFJg==" }, "inclusionProof": { "checkpoint": { - "envelope": "rekor.localhost - 123\n42\nfZV71m5j1vWXjdSMGCsEnI8fBsIbPK8rlQCTMATiOJo=\n\n— rekor.localhost VbgJJjBFAiADsHoFRhDvcFI+OcslQroF4SbNcC+Txji7KJkhxXyB5QIhANAhWQ6AEjcEXq1XVy8nIrSD2AXQ3qX00GefKzMuD1u1\n" + "envelope": "rekor.localhost - 123\n42\nN1h9saMA3X1YvO7pLsORCGOnG5yf8NK/otaH2o34gDE=\n\n— rekor.localhost 45EjTzBGAiEA3gHemqzoKvzF1FAz6XcANGHktodg1AyL9cBu3XKR1+wCIQD93aaYzLWookcbcb0xMp3E/uvHj6/NafO879CsXcYocQ==\n" }, - "rootHash": "fZV71m5j1vWXjdSMGCsEnI8fBsIbPK8rlQCTMATiOJo=", + "rootHash": "N1h9saMA3X1YvO7pLsORCGOnG5yf8NK/otaH2o34gDE=", "treeSize": "1" }, - "integratedTime": "1794471535", + "integratedTime": "1794580615", "kindVersion": { "kind": "dsse", "version": "0.0.1" }, "logId": { - "keyId": "VbgJJh1uXk4PvCPZ3fIjaxUep33R8Z6T6wAJfVjz+BA=" + "keyId": "45EjT1abdD2MKrnHGSnayLaGvLNDQ4SRtMzNbF54fBc=" } } ] diff --git a/internal/intoto/testdata/trusted_root.json b/internal/intoto/testdata/trusted_root.json index 269c14a6b..a04c9cec6 100644 --- a/internal/intoto/testdata/trusted_root.json +++ b/internal/intoto/testdata/trusted_root.json @@ -4,10 +4,10 @@ "certChain": { "certificates": [ { - "rawBytes": "MIIByDCCAW6gAwIBAgIBATAKBggqhkjOPQQDAjAqMRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxETAPBgNVBAMTCHNpZ3N0b3JlMB4XDTI2MTExMjA4MTU1NVoXDTI2MTExMjEwMTc1NVowNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQVZLoayenGRimhDju9Fs+rnSX1BF42YIKwo8A3WcUGJoT0Thg3R0bqpduFDZ43SNsbraUdpsR+Je7CrtyR7gy6o3gwdjAOBgNVHQ8BAf8EBAMCAQYwEwYDVR0lBAwwCgYIKwYBBQUHAwMwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUmaUiClWMUkM7tYwacdAUyFEuZD4wHwYDVR0jBBgwFoAUs8pN2ycHkUXoAWKWoMwDBjPl3acwCgYIKoZIzj0EAwIDSAAwRQIhALmvQquL/dw+gQG9sKuaLRvj5q5mDhowkFI0FDXCxzvIAiBh4jCkrH2s1cGhRZ2P0HLvNMM5op+QagPg4NHah+Sr9Q==" + "rawBytes": "MIIByDCCAW6gAwIBAgIBATAKBggqhkjOPQQDAjAqMRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxETAPBgNVBAMTCHNpZ3N0b3JlMB4XDTI2MTExMzE0MzM1NVoXDTI2MTExMzE2MzU1NVowNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARcqiNS2Yh42+ABMFf8l6MzWkVQ4ts0YVNLXwTyDrw0Rp4pWEuw27w/AxkmeTzbpDhdian61OP54IPmIzfmM4XEo3gwdjAOBgNVHQ8BAf8EBAMCAQYwEwYDVR0lBAwwCgYIKwYBBQUHAwMwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUIp+Q+rzhEKHvxGhkJcBy4cBA4VEwHwYDVR0jBBgwFoAULtDXnQexvhqr8vD7+oknFzGpNlQwCgYIKoZIzj0EAwIDSAAwRQIhAOsWoVCkyzDbuwPRgwMYRQM41/3/Xa8+tXbFc8RM/HUUAiACIIPywjp7uvCHpxbhz9oWZuJ8uzJrUiNypXeDIRz/zg==" }, { - "rawBytes": "MIIBhDCCASugAwIBAgIBATAKBggqhkjOPQQDAjAqMRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxETAPBgNVBAMTCHNpZ3N0b3JlMB4XDTI2MTExMjAzMTc1NVoXDTI2MTExMjEzMTc1NVowKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABI6TSj/7AyAWLgBC8Yv6AFMnAS3yBmiGO19PIRvz8kqL7RroM6GPvuzT/4qnuIQpnlRd9qZaHZroMhDG1U+/+xOjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBSzyk3bJweRRegBYpagzAMGM+XdpzAKBggqhkjOPQQDAgNHADBEAh82cqsJnOSWqw1G6e4d6tjsWPK9tOCLL6FMa4sZ7BMxAiEA8Axy+ZLVWfqkW/0yv21nXgLO6j01awhVlgwUH5Q0I6Y=" + "rawBytes": "MIIBhDCCASugAwIBAgIBATAKBggqhkjOPQQDAjAqMRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxETAPBgNVBAMTCHNpZ3N0b3JlMB4XDTI2MTExMzA5MzU1NVoXDTI2MTExMzE5MzU1NVowKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABKN5jh8HKcgsHS+DlDO3ix8lpHMV2yc5FITLsEJrztqShVINUu2bq3CZuUt1hFgl/8685+flewc9ZbABycgNBmSjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBQu0NedB7G+Gqvy8Pv6iScXMak2VDAKBggqhkjOPQQDAgNHADBEAiBn/FUYAQJLp+Os+OeCoaFJ6fYUDEso4UZxp3IkR5neMgIgUs1uHr0ho6eU6IaKqA5MYFnRxoj/VrBOAbRZIS3XxOE=" } ] }, @@ -17,7 +17,7 @@ }, "uri": "https://fulcio.example.test", "validFor": { - "start": "2026-11-12T07:17:55.143763Z" + "start": "2026-11-13T13:35:55.200778Z" } } ], @@ -26,14 +26,14 @@ "baseUrl": "test", "hashAlgorithm": "SHA2_256", "logId": { - "keyId": "NFs1oh2Hcc5PAfdv/S7WUuZvOS0bl+mabIYSHsCocf0=" + "keyId": "8hKvZBeeyu3FMDiyJgjKhQQ9MdA+LeEBKMpohrRZCnY=" }, "publicKey": { "keyDetails": "PKIX_ECDSA_P256_SHA_256", - "rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEHkBf06kjj/LS13QN8CFKqMhenlUiVYxxsVcbBHX1N+smD8zYRLua1K2mFXcEgrex2invsalV8K4Sw50hXk03+A==", + "rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEh/siOPIU9WQ56lxLY5OHrS1Xlq8M8MgRhz2H8ulEAlYNG/dwfFqrYn0oy4xMP0hKwLHyH+70v4Ne5PL3wqCXgA==", "validFor": { - "end": "2026-11-12T09:17:55.143766Z", - "start": "2026-11-12T07:17:55.143766Z" + "end": "2026-11-13T15:35:55.200782Z", + "start": "2026-11-13T13:35:55.200782Z" } } } @@ -44,13 +44,13 @@ "certChain": { "certificates": [ { - "rawBytes": "MIIBdjCCARugAwIBAgIBATAKBggqhkjOPQQDAjA7MRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxIjAgBgNVBAMTGXNpZ3N0b3JlLXRzYS1pbnRlcm1lZGlhdGUwHhcNMjYxMTEyMDgxMjU1WhcNMjYxMTEyMDgyMjU1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE6Y8vbE8LLigkTpMUE1has9ca9H9mNgLI3PSP24mwBiWZHd9t6qx5KWPm4xoLXV0fZgR6rfKKz57RsBQN11mrHKNLMEkwDgYDVR0PAQH/BAQDAgeAMB8GA1UdIwQYMBaAFEYIxp8nzZ5yInYOsSzBQrcsukZfMBYGA1UdJQEB/wQMMAoGCCsGAQUFBwMIMAoGCCqGSM49BAMCA0kAMEYCIQC4sM4VtMY1KLWwlkJWoaj0Mxbw/LHKXOe00dLS3UjvUwIhALDhJfN2u+3mOVsFii+21eTlFrjoX+GQDRP4Yi/3pg0c" + "rawBytes": "MIIBdDCCARugAwIBAgIBATAKBggqhkjOPQQDAjA7MRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxIjAgBgNVBAMTGXNpZ3N0b3JlLXRzYS1pbnRlcm1lZGlhdGUwHhcNMjYxMTEzMTQzMDU1WhcNMjYxMTEzMTQ0MDU1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEREVxA2jZMxcpefYZ/OFxCT/RGgYry1muHmVhpyVoAf1076cYr9cdAt3yuuiJ/zFNnq2qkJVQYb/K7IPlhbHOAKNLMEkwDgYDVR0PAQH/BAQDAgeAMB8GA1UdIwQYMBaAFJTKSXfXLGlfzLKDRWbhc3bTOvZoMBYGA1UdJQEB/wQMMAoGCCsGAQUFBwMIMAoGCCqGSM49BAMCA0cAMEQCIAPsyvaEElH8vl8T7970crETRNVSWCwhBEu9WMNGK/KvAiBpyDeC41BRliWWdINMa460tjpiWieooIxlBDG6H7kOaw==" }, { - "rawBytes": "MIIBzDCCAXKgAwIBAgIBATAKBggqhkjOPQQDAjAqMRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxETAPBgNVBAMTCHNpZ3N0b3JlMB4XDTI2MTExMjA4MTU1NVoXDTI2MTExMjEwMTc1NVowOzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MSIwIAYDVQQDExlzaWdzdG9yZS10c2EtaW50ZXJtZWRpYXRlMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE2hQTRa8L3HNvJ8GUWzAOnL+0kqXZOK3NpDMZahd/TFd7Tl6HD7qAsb1OlMogbJyjWpMrD0PSnHU+jZHO6xcyraN4MHYwDgYDVR0PAQH/BAQDAgEGMBMGA1UdJQQMMAoGCCsGAQUFBwMIMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFEYIxp8nzZ5yInYOsSzBQrcsukZfMB8GA1UdIwQYMBaAFHeO9V9gtReufoGb2jhx1K4bTzRkMAoGCCqGSM49BAMCA0gAMEUCIQDO+yapkGyZNmETYIw4LExGNsQAY4W/CmGGORCRbAv2XAIgEfp93vfZscmIgEA5dlijSnfMoLSjOJdgiWZ3wrG/tbM=" + "rawBytes": "MIIBzDCCAXKgAwIBAgIBATAKBggqhkjOPQQDAjAqMRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxETAPBgNVBAMTCHNpZ3N0b3JlMB4XDTI2MTExMzE0MzM1NVoXDTI2MTExMzE2MzU1NVowOzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MSIwIAYDVQQDExlzaWdzdG9yZS10c2EtaW50ZXJtZWRpYXRlMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE3naG4v1aEfw5NV8h8XTS0WLXTApTLSQj4WAHRUjbDDwBcI2JS43DIm00zMVQ4E89YTtJYUamnN1ZzuVbfN4rNqN4MHYwDgYDVR0PAQH/BAQDAgEGMBMGA1UdJQQMMAoGCCsGAQUFBwMIMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFJTKSXfXLGlfzLKDRWbhc3bTOvZoMB8GA1UdIwQYMBaAFA4Q8yXk05RTGWVl6QA9OI8lazYQMAoGCCqGSM49BAMCA0gAMEUCIEpl7brmrQc4Scf8UmuiAaaFL6I9l6JjLEmiXw1Tfs82AiEA4sU3/plMwJgcjEAuYwMYXnVn4mNBVM6kJ5MYhNoKRHY=" }, { - "rawBytes": "MIIBhTCCASugAwIBAgIBATAKBggqhkjOPQQDAjAqMRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxETAPBgNVBAMTCHNpZ3N0b3JlMB4XDTI2MTExMjAzMTc1NVoXDTI2MTExMjEzMTc1NVowKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABDinUDrrDSFLMudVzKUPWApWwtrz8ulLHftvB19ZJQyHuqPspnX2yrKL+Jv+5g1VdnDBcoRyl2bryRAnalyLte6jQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBR3jvVfYLUXrn6Bm9o4cdSuG080ZDAKBggqhkjOPQQDAgNIADBFAiEA56WorWgnKpOF7S0c7FSOf8QImYIsx6CyR6OgcPkgtYYCIB7bEMcHvBY/BJyztWDEB8Y+V1KC/mrwFyqAr+l/n+ZX" + "rawBytes": "MIIBhDCCASugAwIBAgIBATAKBggqhkjOPQQDAjAqMRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxETAPBgNVBAMTCHNpZ3N0b3JlMB4XDTI2MTExMzA5MzU1NVoXDTI2MTExMzE5MzU1NVowKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABJKtqpSgbY48bzJSZFfoGq35yO9ZLcr7cwBzrhVcgOpGQlcmKSkUdQuUS0WOZz15kisMjXA76tBOUeE92Choqy2jQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBQOEPMl5NOUUxllZekAPTiPJWs2EDAKBggqhkjOPQQDAgNHADBEAiBZgfHvHAUorPIqN91+5IJL2mtSVp4dXqdCfpn1z9jW0wIgQxR/RwWg4RwZqj9K4x9SUCl+VD0OEsRiI8lUfL6mlTY=" } ] }, @@ -60,8 +60,8 @@ }, "uri": "https://virtual.tsa.sigstore.dev", "validFor": { - "end": "2026-11-12T09:17:55.143466Z", - "start": "2026-11-12T03:17:55.143466Z" + "end": "2026-11-13T15:35:55.200251Z", + "start": "2026-11-13T09:35:55.200251Z" } } ], @@ -70,14 +70,14 @@ "baseUrl": "https://rekor.localhost", "hashAlgorithm": "SHA2_256", "logId": { - "keyId": "VbgJJh1uXk4PvCPZ3fIjaxUep33R8Z6T6wAJfVjz+BA=" + "keyId": "45EjT1abdD2MKrnHGSnayLaGvLNDQ4SRtMzNbF54fBc=" }, "publicKey": { "keyDetails": "PKIX_ECDSA_P256_SHA_256", - "rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEDkP+IYpRwa3dqASIrExc25tqxuE0OeAje2YDLyCLgWrdYVmArhPp3LwlnFqIkJQUJlw/3qo+sCeP8pnqhR8/CQ==", + "rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEuDERripznGZf5E2n+jo0/EhV9msH1Yz8zmcK+jdjphJptNVvwqYfxhbbFjqtmosbBSjXDPcu/fXC49EQ+pe5AA==", "validFor": { - "end": "2026-11-12T09:17:55.143769Z", - "start": "2026-11-12T07:17:55.143769Z" + "end": "2026-11-13T15:35:55.200791Z", + "start": "2026-11-13T13:35:55.200791Z" } } } diff --git a/internal/intoto/testdata/vuln-only.intoto.jsonl b/internal/intoto/testdata/vuln-only.intoto.jsonl index 6ecbfda13..6c598f9ee 100644 --- a/internal/intoto/testdata/vuln-only.intoto.jsonl +++ b/internal/intoto/testdata/vuln-only.intoto.jsonl @@ -1,2 +1,2 @@ -{"mediaType":"application/vnd.dev.sigstore.bundle.v0.3+json","verificationMaterial":{"certificate":{"rawBytes":"MIICzzCCAnSgAwIBAgIIC0k8amNM1fEwCgYIKoZIzj0EAwIwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYxMTEyMDgxNjU1WhcNMjYxMTEyMDgyNzU1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEDqlNCYzf8/LB1uqbvpherViXGWQ/csgGLwZIH1FrbSkG26JpFH8elkgl/fZt7OEaxVAiyhup8qHVdbmPkewHZaOCAZ8wggGbMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAfBgNVHSMEGDAWgBSZpSIKVYxSQzu1jBpx0BTIUS5kPjBYBgNVHREBAf8ETjBMhkpodHRwczovL2dpdGh1Yi5jb20vYWNtZS93aWRnZXQvLmdpdGh1Yi93b3JrZmxvd3MvYnVpbGQueW1sQHJlZnMvaGVhZHMvbWFpbjA5BgorBgEEAYO/MAEBBCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAuBgorBgEEAYO/MAEMBCAMHmh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldDBRBgorBgEEAYO/MAEVBEMMQWh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldC9hY3Rpb25zL3J1bnMvMTIzNDU2Nzg5MC9hdHRlbXB0cy8xMAoGCCqGSM49BAMCA0kAMEYCIQDTevPME2O8Fyn3i0glo33QGtL75wFuFG/bRMI+4sSi1AIhANmY8YJDdaPST8iqgCzLaMoICVNQW5EtzESc/OunqOl3"},"tlogEntries":[{"logId":{"keyId":"VbgJJh1uXk4PvCPZ3fIjaxUep33R8Z6T6wAJfVjz+BA="},"kindVersion":{"kind":"dsse","version":"0.0.1"},"integratedTime":"1794471535","inclusionPromise":{"signedEntryTimestamp":"MEUCIQC7itvX7jNPfNrZD3ht/JCd6ViSZDn6SgGe1Kmaz8YxtAIgf4bTIBj6XitfA7uFwsueWgbPnnBRRCK5ftxiahdia/s="},"inclusionProof":{"rootHash":"o1FHXmrAXrRO6z0ISDWvG4kOqofu+tcVQgHltp89VjA=","treeSize":"1","checkpoint":{"envelope":"rekor.localhost - 123\n42\no1FHXmrAXrRO6z0ISDWvG4kOqofu+tcVQgHltp89VjA=\n\n— rekor.localhost VbgJJjBFAiEAn4dq4l5TTFsFD9nmIp+x70DDurghkSGY+WCcBiDiywICIAGppCgM7QHS6hDXNiUZz/DCP0daZ1QhIL0k8WrLGhYo\n"}},"canonicalizedBody":"eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJzcGVjIjp7ImVudmVsb3BlSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjY5ZjNkYWM4MWRkZjk1ZjU1ZmQ2NzQxYTM2NmQ1YjRlYjJjYmJhMTk2NTc1ZDgyMzQ4MGE0YWMxZThlN2UzNjAifSwicGF5bG9hZEhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJiM2Q0NTk3OWYwMTRjNTAwNDdmOTMyZWM4NWYxYzFlZGQ1YjY4YWRiMmRiYTMwMzUxMDYzNTFjMzZjNWRhNmZmIn0sInNpZ25hdHVyZXMiOlt7InNpZ25hdHVyZSI6Ik1FUUNJRTAwaUwxK2QyMWhrOFVlNUZnOUs4cXVYYndyUXp1Qno0SVZSczc4NFRwZUFpQkRSLzZ0YzJKYndQK3VqbzMzcFpHU0NUUTdNOTR1UUcvK1k3aXdiVDF4bGc9PSIsInZlcmlmaWVyIjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTjZla05EUVc1VFowRjNTVUpCWjBsSlF6QnJPR0Z0VGsweFprVjNRMmRaU1V0dldrbDZhakJGUVhkSmQwNTZSVlpOUWsxSFFURlZSVU5vVFUwS1l6SnNibU16VW5aamJWVjFXa2RXTWsxU05IZElRVmxFVmxGUlJFVjRWbnBoVjJSNlpFYzVlVnBUTVhCaWJsSnNZMjB4YkZwSGJHaGtSMVYzU0doalRncE5hbGw0VFZSRmVVMUVaM2hPYWxVeFYyaGpUazFxV1hoTlZFVjVUVVJuZVU1NlZURlhha0ZCVFVacmQwVjNXVWhMYjFwSmVtb3dRMEZSV1VsTGIxcEpDbnBxTUVSQlVXTkVVV2RCUlVSeGJFNURXWHBtT0M5TVFqRjFjV0oyY0dobGNsWnBXRWRYVVM5amMyZEhUSGRhU1VneFJuSmlVMnRITWpaS2NFWklPR1VLYkd0bmJDOW1XblEzVDBWaGVGWkJhWGxvZFhBNGNVaFdaR0p0VUd0bGQwaGFZVTlEUVZvNGQyZG5SMkpOUVRSSFFURlZaRVIzUlVJdmQxRkZRWGRKU0FwblJFRlVRbWRPVmtoVFZVVkVSRUZMUW1kbmNrSm5SVVpDVVdORVFYcEJaa0puVGxaSVUwMUZSMFJCVjJkQ1UxcHdVMGxMVmxsNFUxRjZkVEZxUW5CNENqQkNWRWxWVXpWclVHcENXVUpuVGxaSVVrVkNRV1k0UlZScVFrMW9hM0J2WkVoU2QyTjZiM1pNTW1Sd1pFZG9NVmxwTldwaU1qQjJXVmRPZEZwVE9UTUtZVmRTYmxwWVVYWk1iV1J3WkVkb01WbHBPVE5pTTBweVdtMTRkbVF6VFhaWmJsWndZa2RSZFdWWE1YTlJTRXBzV201TmRtRkhWbWhhU0UxMllsZEdjQXBpYWtFMVFtZHZja0puUlVWQldVOHZUVUZGUWtKRGRHOWtTRkozWTNwdmRrd3pVblpoTWxaMVRHMUdhbVJIYkhaaWJrMTFXakpzTUdGSVZtbGtXRTVzQ21OdFRuWmlibEpzWW01UmRWa3lPWFJOUkhOSFEybHpSMEZSVVVKbk56aDNRVkZuUlV4UmQzSmhTRkl3WTBoTk5reDVPVEJpTW5Sc1ltazFhRmt6VW5BS1lqSTFla3h0WkhCa1IyZ3hXVzVXZWxwWVNtcGlNalV3V2xjMU1FeHRUblppVkVGMVFtZHZja0puUlVWQldVOHZUVUZGVFVKRFFVMUliV2d3WkVoQ2VncFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVhRmt5TVd4TU0yUndXa2RrYkdSRVFsSkNaMjl5UW1kRlJVRlpUeTlOUVVWV1FrVk5UVkZYYURCa1NFSjZDazlwT0haYU1td3dZVWhXYVV4dFRuWmlVemxvV1RJeGJFd3paSEJhUjJSc1pFTTVhRmt6VW5CaU1qVjZURE5LTVdKdVRYWk5WRWw2VGtSVk1rNTZaelVLVFVNNWFHUklVbXhpV0VJd1kzazRlRTFCYjBkRFEzRkhVMDAwT1VKQlRVTkJNR3RCVFVWWlEwbFJSRlJsZGxCTlJUSlBPRVo1YmpOcE1HZHNiek16VVFwSGRFdzNOWGRHZFVaSEwySlNUVWtyTkhOVGFURkJTV2hCVG0xWk9GbEtSR1JoVUZOVU9HbHhaME42VEdGTmIwbERWazVSVnpWRmRIcEZVMk12VDNWdUNuRlBiRE1LTFMwdExTMUZUa1FnUTBWU1ZFbEdTVU5CVkVVdExTMHRMUW89In1dfSwia2luZCI6ImRzc2UifQ=="}],"timestampVerificationData":{"rfc3161Timestamps":[{"signedTimestamp":"MIICUTADAgEAMIICSAYJKoZIhvcNAQcCoIICOTCCAjUCAQMxDTALBglghkgBZQMEAgEwgYIGCyqGSIb3DQEJEAEEoHMEcTBvAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQgcWl2Y4REzerXQzm7V4i2/DoOrTa+2vJG3qUW3zqNVl8CFQCeu0WDUj1u3CecZg1WOOafmwlArhgPMjAyNjExMTIwODE3NTVaoASkAjAAoAAxggGYMIIBlAIBATBAMDsxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEiMCAGA1UEAxMZc2lnc3RvcmUtdHNhLWludGVybWVkaWF0ZQIBATALBglghkgBZQMEAgGggeowGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEEMBwGCSqGSIb3DQEJBTEPFw0yNjExMTIwODE3NTVaMC8GCSqGSIb3DQEJBDEiBCD/7woeQrSN5YTRYQO3NTYB0sVgHVrWzBN11qkKWdadsDB9BgsqhkiG9w0BCRACLzFuMGwwajBoBCBxsTcCVWXweYqyR+Mv0qEyQNFC6h3MFA0BmrBEHVH9tDBEMD+kPTA7MRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxIjAgBgNVBAMTGXNpZ3N0b3JlLXRzYS1pbnRlcm1lZGlhdGUCAQEwCgYIKoZIzj0EAwIERzBFAiEAoF+ROrCKB7vcjt8TGmzpxXFvSUuKSs0o/OiRWDYNpGgCIAED5ye14Cewi1HluiTIQgP4YTwj01CXRZJ0tAQxShYe"}]}},"dsseEnvelope":{"payload":"eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoiYXJ0aWZhY3QuYmluIiwiZGlnZXN0Ijp7InNoYTI1NiI6ImU4ODk1MTI5MWJjYTA4MDdhNDFmM2MwMTQ0MDA5YmZmZjVjNmM3N2RjMTMxMGQ1MmU4YzZkNjJmZWVlOTYwYTgifX1dLCJwcmVkaWNhdGVUeXBlIjoiaHR0cHM6Ly9jb3NpZ24uc2lnc3RvcmUuZGV2L2F0dGVzdGF0aW9uL3Z1bG4vdjEiLCJwcmVkaWNhdGUiOnsiaW52b2NhdGlvbiI6eyJ1cmkiOiJodHRwczovL2dpdGh1Yi5jb20vYWNtZS93aWRnZXQvYWN0aW9ucy9ydW5zLzEyMzQ1Njc4OTAifSwic2Nhbm5lciI6eyJ1cmkiOiJwa2c6Z2l0aHViL2FxdWFzZWN1cml0eS90cml2eUAwLjUwLjAiLCJ2ZXJzaW9uIjoiMC41MC4wIiwicmVzdWx0Ijp7fX0sIm1ldGFkYXRhIjp7InNjYW5TdGFydGVkT24iOiIyMDI2LTExLTAxVDA5OjAwOjAwWiIsInNjYW5GaW5pc2hlZE9uIjoiMjAyNi0xMS0wMVQwOTowMTowMFoifX19","payloadType":"application/vnd.in-toto+json","signatures":[{"sig":"MEQCIE00iL1+d21hk8Ue5Fg9K8quXbwrQzuBz4IVRs784TpeAiBDR/6tc2JbwP+ujo33pZGSCTQ7M94uQG/+Y7iwbT1xlg=="}]}} +{"mediaType":"application/vnd.dev.sigstore.bundle.v0.3+json","verificationMaterial":{"certificate":{"rawBytes":"MIICzTCCAnSgAwIBAgIIPf+TbOTbL20wCgYIKoZIzj0EAwIwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYxMTEzMTQzNDU1WhcNMjYxMTEzMTQ0NTU1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEKix5TbLF01TnL5B+P8/uNGmpDTaLT3ygC3AapCpy/DBGtE3lVJvJvJT6OmDEGlnIsVpcdl4DT3wQuWymH+0Gc6OCAZ8wggGbMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAfBgNVHSMEGDAWgBQin5D6vOEQoe/EaGQlwHLhwEDhUTBYBgNVHREBAf8ETjBMhkpodHRwczovL2dpdGh1Yi5jb20vYWNtZS93aWRnZXQvLmdpdGh1Yi93b3JrZmxvd3MvYnVpbGQueW1sQHJlZnMvaGVhZHMvbWFpbjA5BgorBgEEAYO/MAEBBCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAuBgorBgEEAYO/MAEMBCAMHmh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldDBRBgorBgEEAYO/MAEVBEMMQWh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldC9hY3Rpb25zL3J1bnMvMTIzNDU2Nzg5MC9hdHRlbXB0cy8xMAoGCCqGSM49BAMCA0cAMEQCIFAglt6T2yfrX6Ee8c7Mv4g1s1+39gUTd+H1JYil7W9DAiBCRzxvt3URnQ1F+vCn7QushoUfUOg1WM9uxOTV12jqmA=="},"tlogEntries":[{"logId":{"keyId":"45EjT1abdD2MKrnHGSnayLaGvLNDQ4SRtMzNbF54fBc="},"kindVersion":{"kind":"dsse","version":"0.0.1"},"integratedTime":"1794580615","inclusionPromise":{"signedEntryTimestamp":"MEQCIEmv9d55wn9ucKGLwqi7YsomHMJ/2JjttY+GEAoG+CFbAiBcgIEIkLK5u+xrEQRIuRdArj0yliFda2gEiliPlWk20w=="},"inclusionProof":{"rootHash":"wl6xJUpR2rMMJ3s04v88Cxwxzcwzc0o3jmjyAeseAw0=","treeSize":"1","checkpoint":{"envelope":"rekor.localhost - 123\n42\nwl6xJUpR2rMMJ3s04v88Cxwxzcwzc0o3jmjyAeseAw0=\n\n— rekor.localhost 45EjTzBEAiBJc0dMRsGzvoITKiGNb8pJJDKjZC4rMd+py3a80F3n+gIgFBoO4EPav20HHqrZuBtdOFyzKn3s4+9vynwNuTsSunQ=\n"}},"canonicalizedBody":"eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJzcGVjIjp7ImVudmVsb3BlSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImNjYmQ5ZDUzMTBiNzg2MmM0NjNiMDVhYTUwOTM4OGZlZDRkOGVhNTQyYTI5ZTVhM2U1MGQ3MzA0YzNiY2U0YmUifSwicGF5bG9hZEhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJiM2Q0NTk3OWYwMTRjNTAwNDdmOTMyZWM4NWYxYzFlZGQ1YjY4YWRiMmRiYTMwMzUxMDYzNTFjMzZjNWRhNmZmIn0sInNpZ25hdHVyZXMiOlt7InNpZ25hdHVyZSI6Ik1FWUNJUUMxNWZNcmZDS1NPL1NNZU9JTk5KNU83Ri9jdTl3UHg3YmlraTV3aXU2YjdnSWhBSzlDSmRqR3RDREZxUVI3SlBRVjYyaWQ0OUlsTG5sNno2bUYwWm1hRzNNTyIsInZlcmlmaWVyIjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTjZWRU5EUVc1VFowRjNTVUpCWjBsSlVHWXJWR0pQVkdKTU1qQjNRMmRaU1V0dldrbDZhakJGUVhkSmQwNTZSVlpOUWsxSFFURlZSVU5vVFUwS1l6SnNibU16VW5aamJWVjFXa2RXTWsxU05IZElRVmxFVmxGUlJFVjRWbnBoVjJSNlpFYzVlVnBUTVhCaWJsSnNZMjB4YkZwSGJHaGtSMVYzU0doalRncE5hbGw0VFZSRmVrMVVVWHBPUkZVeFYyaGpUazFxV1hoTlZFVjZUVlJSTUU1VVZURlhha0ZCVFVacmQwVjNXVWhMYjFwSmVtb3dRMEZSV1VsTGIxcEpDbnBxTUVSQlVXTkVVV2RCUlV0cGVEVlVZa3hHTURGVWJrdzFRaXRRT0M5MVRrZHRjRVJVWVV4VU0zbG5Rek5CWVhCRGNIa3ZSRUpIZEVVemJGWktka29LZGtwVU5rOXRSRVZIYkc1SmMxWndZMlJzTkVSVU0zZFJkVmQ1YlVnck1FZGpOazlEUVZvNGQyZG5SMkpOUVRSSFFURlZaRVIzUlVJdmQxRkZRWGRKU0FwblJFRlVRbWRPVmtoVFZVVkVSRUZMUW1kbmNrSm5SVVpDVVdORVFYcEJaa0puVGxaSVUwMUZSMFJCVjJkQ1VXbHVOVVEyZGs5RlVXOWxMMFZoUjFGc0NuZElUR2gzUlVSb1ZWUkNXVUpuVGxaSVVrVkNRV1k0UlZScVFrMW9hM0J2WkVoU2QyTjZiM1pNTW1Sd1pFZG9NVmxwTldwaU1qQjJXVmRPZEZwVE9UTUtZVmRTYmxwWVVYWk1iV1J3WkVkb01WbHBPVE5pTTBweVdtMTRkbVF6VFhaWmJsWndZa2RSZFdWWE1YTlJTRXBzV201TmRtRkhWbWhhU0UxMllsZEdjQXBpYWtFMVFtZHZja0puUlVWQldVOHZUVUZGUWtKRGRHOWtTRkozWTNwdmRrd3pVblpoTWxaMVRHMUdhbVJIYkhaaWJrMTFXakpzTUdGSVZtbGtXRTVzQ21OdFRuWmlibEpzWW01UmRWa3lPWFJOUkhOSFEybHpSMEZSVVVKbk56aDNRVkZuUlV4UmQzSmhTRkl3WTBoTk5reDVPVEJpTW5Sc1ltazFhRmt6VW5BS1lqSTFla3h0WkhCa1IyZ3hXVzVXZWxwWVNtcGlNalV3V2xjMU1FeHRUblppVkVGMVFtZHZja0puUlVWQldVOHZUVUZGVFVKRFFVMUliV2d3WkVoQ2VncFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVhRmt5TVd4TU0yUndXa2RrYkdSRVFsSkNaMjl5UW1kRlJVRlpUeTlOUVVWV1FrVk5UVkZYYURCa1NFSjZDazlwT0haYU1td3dZVWhXYVV4dFRuWmlVemxvV1RJeGJFd3paSEJhUjJSc1pFTTVhRmt6VW5CaU1qVjZURE5LTVdKdVRYWk5WRWw2VGtSVk1rNTZaelVLVFVNNWFHUklVbXhpV0VJd1kzazRlRTFCYjBkRFEzRkhVMDAwT1VKQlRVTkJNR05CVFVWUlEwbEdRV2RzZERaVU1ubG1jbGcyUldVNFl6ZE5kalJuTVFwek1Tc3pPV2RWVkdRclNERktXV2xzTjFjNVJFRnBRa05TZW5oMmRETlZVbTVSTVVZcmRrTnVOMUYxYzJodlZXWlZUMmN4VjAwNWRYaFBWRll4TW1weENtMUJQVDBLTFMwdExTMUZUa1FnUTBWU1ZFbEdTVU5CVkVVdExTMHRMUW89In1dfSwia2luZCI6ImRzc2UifQ=="}],"timestampVerificationData":{"rfc3161Timestamps":[{"signedTimestamp":"MIICUDADAgEAMIICRwYJKoZIhvcNAQcCoIICODCCAjQCAQMxDTALBglghkgBZQMEAgEwgYIGCyqGSIb3DQEJEAEEoHMEcTBvAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQgBXb2BTczKXo95wNAo5MUowbbvV+5PJGvEmlsbzXaDEoCFQD7rPgrB+fg0cEqFNzEaEFflE+9ChgPMjAyNjExMTMxNDM1NTVaoASkAjAAoAAxggGXMIIBkwIBATBAMDsxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEiMCAGA1UEAxMZc2lnc3RvcmUtdHNhLWludGVybWVkaWF0ZQIBATALBglghkgBZQMEAgGggeowGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEEMBwGCSqGSIb3DQEJBTEPFw0yNjExMTMxNDM1NTVaMC8GCSqGSIb3DQEJBDEiBCAciUpmoOhvrGjMPxp+Xo+3JWt+Af5SqomqV4uHk6phhzB9BgsqhkiG9w0BCRACLzFuMGwwajBoBCB6sxTuY9UdYUf2mR3N666Vn6KAgVfyY7rK6Lx/joQFZTBEMD+kPTA7MRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxIjAgBgNVBAMTGXNpZ3N0b3JlLXRzYS1pbnRlcm1lZGlhdGUCAQEwCgYIKoZIzj0EAwIERjBEAiBxuf6cqAxGDs9LctMHdWtcSDLzTH8kd8jTqbBerAw8cwIgIBbUku8JxTUmeTFGBqsql8gKrOuLNDN1LxtK+Ai8rgg="}]}},"dsseEnvelope":{"payload":"eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoiYXJ0aWZhY3QuYmluIiwiZGlnZXN0Ijp7InNoYTI1NiI6ImU4ODk1MTI5MWJjYTA4MDdhNDFmM2MwMTQ0MDA5YmZmZjVjNmM3N2RjMTMxMGQ1MmU4YzZkNjJmZWVlOTYwYTgifX1dLCJwcmVkaWNhdGVUeXBlIjoiaHR0cHM6Ly9jb3NpZ24uc2lnc3RvcmUuZGV2L2F0dGVzdGF0aW9uL3Z1bG4vdjEiLCJwcmVkaWNhdGUiOnsiaW52b2NhdGlvbiI6eyJ1cmkiOiJodHRwczovL2dpdGh1Yi5jb20vYWNtZS93aWRnZXQvYWN0aW9ucy9ydW5zLzEyMzQ1Njc4OTAifSwic2Nhbm5lciI6eyJ1cmkiOiJwa2c6Z2l0aHViL2FxdWFzZWN1cml0eS90cml2eUAwLjUwLjAiLCJ2ZXJzaW9uIjoiMC41MC4wIiwicmVzdWx0Ijp7fX0sIm1ldGFkYXRhIjp7InNjYW5TdGFydGVkT24iOiIyMDI2LTExLTAxVDA5OjAwOjAwWiIsInNjYW5GaW5pc2hlZE9uIjoiMjAyNi0xMS0wMVQwOTowMTowMFoifX19","payloadType":"application/vnd.in-toto+json","signatures":[{"sig":"MEYCIQC15fMrfCKSO/SMeOINNJ5O7F/cu9wPx7biki5wiu6b7gIhAK9CJdjGtCDFqQR7JPQV62id49IlLnl6z6mF0ZmaG3MO"}]}} {"_type":"https://in-toto.io/Statement/v1","subject":[{"name":"artifact.bin","digest":{"sha256":"e88951291bca0807a41f3c0144009bfff5c6c77dc1310d52e8c6d62feee960a8"}}],"predicateType":"https://cosign.sigstore.dev/attestation/vuln/v1","predicate":{"invocation":{"uri":"https://github.com/acme/widget/actions/runs/1234567890"},"scanner":{"uri":"pkg:github/aquasecurity/trivy@0.50.0","version":"0.50.0","result":{}},"metadata":{"scanStartedOn":"2026-11-01T09:00:00Z","scanFinishedOn":"2026-11-01T09:01:00Z"}}} diff --git a/internal/intoto/testdata/wrong-signer-and-unsigned.intoto.jsonl b/internal/intoto/testdata/wrong-signer-and-unsigned.intoto.jsonl index 60fc6cb8b..a9eb7a3b4 100644 --- a/internal/intoto/testdata/wrong-signer-and-unsigned.intoto.jsonl +++ b/internal/intoto/testdata/wrong-signer-and-unsigned.intoto.jsonl @@ -1,2 +1,2 @@ -{"mediaType":"application/vnd.dev.sigstore.bundle.v0.3+json","verificationMaterial":{"certificate":{"rawBytes":"MIIC0TCCAnegAwIBAgIII/iQOrA0QgIwCgYIKoZIzj0EAwIwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYxMTEyMDgxNjU1WhcNMjYxMTEyMDgyNzU1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEywROPu1f3XpKb5n5wHKx7+zc69Oe5wa4j8B3SGVRgWuUYI/10t/EfSeIBKpRevAFQgTorfTxLl/MWyUb69CiSKOCAaIwggGeMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAfBgNVHSMEGDAWgBSZpSIKVYxSQzu1jBpx0BTIUS5kPjBbBgNVHREBAf8EUTBPhk1odHRwczovL2dpdGh1Yi5jb20vbWFsbG9yeS93aWRnZXQvLmdpdGh1Yi93b3JrZmxvd3MvYnVpbGQueW1sQHJlZnMvaGVhZHMvbWFpbjA5BgorBgEEAYO/MAEBBCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAuBgorBgEEAYO/MAEMBCAMHmh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldDBRBgorBgEEAYO/MAEVBEMMQWh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldC9hY3Rpb25zL3J1bnMvMTIzNDU2Nzg5MC9hdHRlbXB0cy8xMAoGCCqGSM49BAMCA0gAMEUCIF1soOT3xiHGpl/S++JYwh+/968JpjaG8F2qycAN/sUcAiEAz2GCT2Xg64B5fHxdH5FYOR0qECXnOMLVUW2J3yyrwAY="},"tlogEntries":[{"logId":{"keyId":"VbgJJh1uXk4PvCPZ3fIjaxUep33R8Z6T6wAJfVjz+BA="},"kindVersion":{"kind":"dsse","version":"0.0.1"},"integratedTime":"1794471535","inclusionPromise":{"signedEntryTimestamp":"MEUCIBVcAtLb03kC/4DRZaUXzGhLPPEt0kEryMuwWORqcMajAiEA1VZ9JWulTslIyfKajJPQUj/pZY4XziwSjuph0ccQXbM="},"inclusionProof":{"rootHash":"3vqyxne1rllpAIQ3+fj62E2qwmDv8SDjW+nHabNWbio=","treeSize":"1","checkpoint":{"envelope":"rekor.localhost - 123\n42\n3vqyxne1rllpAIQ3+fj62E2qwmDv8SDjW+nHabNWbio=\n\n— rekor.localhost VbgJJjBGAiEA0wqTdb2ErXV9jVIUAyBC2CKI5uoUuJRYiBXMPyHTtcACIQDUdUj/yclHE9KBL+QVFdMqhFlF433LpJpSp/dUnDvG8g==\n"}},"canonicalizedBody":"eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJzcGVjIjp7ImVudmVsb3BlSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImVmMmJlMjNjNmYzYTAzMTRjYjgwMWEyNzQ2OWE2MDNiOWRkMDZjZWNkZjVmMzRkMDRhMzdmZTRhZGY1OGJhNmIifSwicGF5bG9hZEhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJmOTZjNDY3Y2I2Y2MzYmU1ZGRlMGE0YzZkYTFhZDQ5NTA3NGEzYjRiZTcyMDc2NDQyYzBmNGI4NzFjMTNhMWVlIn0sInNpZ25hdHVyZXMiOlt7InNpZ25hdHVyZSI6Ik1FVUNJQVdTYjRqQ0xFM1JnKzh1dEIyOS9yUVI2dk5PNnFqejVCM1g5QjkrOWY0SEFpRUE3QjFZaVlodTk5YmVFL2N5ZUd3Yk1GY3JHaEt6dHMxNXJweEt2b3BFbDl3PSIsInZlcmlmaWVyIjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTXdWRU5EUVc1bFowRjNTVUpCWjBsSlNTOXBVVTl5UVRCUlowbDNRMmRaU1V0dldrbDZhakJGUVhkSmQwNTZSVlpOUWsxSFFURlZSVU5vVFUwS1l6SnNibU16VW5aamJWVjFXa2RXTWsxU05IZElRVmxFVmxGUlJFVjRWbnBoVjJSNlpFYzVlVnBUTVhCaWJsSnNZMjB4YkZwSGJHaGtSMVYzU0doalRncE5hbGw0VFZSRmVVMUVaM2hPYWxVeFYyaGpUazFxV1hoTlZFVjVUVVJuZVU1NlZURlhha0ZCVFVacmQwVjNXVWhMYjFwSmVtb3dRMEZSV1VsTGIxcEpDbnBxTUVSQlVXTkVVV2RCUlhsM1VrOVFkVEZtTTFod1MySTFialYzU0V0NE55dDZZelk1VDJVMWQyRTBhamhDTTFOSFZsSm5WM1ZWV1Vrdk1UQjBMMFVLWmxObFNVSkxjRkpsZGtGR1VXZFViM0ptVkhoTWJDOU5WM2xWWWpZNVEybFRTMDlEUVdGSmQyZG5SMlZOUVRSSFFURlZaRVIzUlVJdmQxRkZRWGRKU0FwblJFRlVRbWRPVmtoVFZVVkVSRUZMUW1kbmNrSm5SVVpDVVdORVFYcEJaa0puVGxaSVUwMUZSMFJCVjJkQ1UxcHdVMGxMVmxsNFUxRjZkVEZxUW5CNENqQkNWRWxWVXpWclVHcENZa0puVGxaSVVrVkNRV1k0UlZWVVFsQm9hekZ2WkVoU2QyTjZiM1pNTW1Sd1pFZG9NVmxwTldwaU1qQjJZbGRHYzJKSE9Ya0taVk01TTJGWFVtNWFXRkYyVEcxa2NHUkhhREZaYVRrellqTktjbHB0ZUhaa00wMTJXVzVXY0dKSFVYVmxWekZ6VVVoS2JGcHVUWFpoUjFab1draE5kZ3BpVjBad1ltcEJOVUpuYjNKQ1owVkZRVmxQTDAxQlJVSkNRM1J2WkVoU2QyTjZiM1pNTTFKMllUSldkVXh0Um1wa1IyeDJZbTVOZFZveWJEQmhTRlpwQ21SWVRteGpiVTUyWW01U2JHSnVVWFZaTWpsMFRVUnpSME5wYzBkQlVWRkNaemM0ZDBGUlowVk1VWGR5WVVoU01HTklUVFpNZVRrd1lqSjBiR0pwTldnS1dUTlNjR0l5TlhwTWJXUndaRWRvTVZsdVZucGFXRXBxWWpJMU1GcFhOVEJNYlU1MllsUkJkVUpuYjNKQ1owVkZRVmxQTDAxQlJVMUNRMEZOU0cxb01BcGtTRUo2VDJrNGRsb3liREJoU0ZacFRHMU9kbUpUT1doWk1qRnNURE5rY0ZwSFpHeGtSRUpTUW1kdmNrSm5SVVZCV1U4dlRVRkZWa0pGVFUxUlYyZ3dDbVJJUW5wUGFUaDJXakpzTUdGSVZtbE1iVTUyWWxNNWFGa3lNV3hNTTJSd1drZGtiR1JET1doWk0xSndZakkxZWt3elNqRmliazEyVFZSSmVrNUVWVElLVG5wbk5VMURPV2hrU0ZKc1lsaENNR041T0hoTlFXOUhRME54UjFOTk5EbENRVTFEUVRCblFVMUZWVU5KUmpGemIwOVVNM2hwU0Vkd2JDOVRLeXRLV1FwM2FDc3ZPVFk0U25CcVlVYzRSakp4ZVdOQlRpOXpWV05CYVVWQmVqSkhRMVF5V0djMk5FSTFaa2g0WkVnMVJsbFBVakJ4UlVOWWJrOU5URlpWVnpKS0NqTjVlWEozUVZrOUNpMHRMUzB0UlU1RUlFTkZVbFJKUmtsRFFWUkZMUzB0TFMwSyJ9XX0sImtpbmQiOiJkc3NlIn0="}],"timestampVerificationData":{"rfc3161Timestamps":[{"signedTimestamp":"MIICUTADAgEAMIICSAYJKoZIhvcNAQcCoIICOTCCAjUCAQMxDTALBglghkgBZQMEAgEwgYEGCyqGSIb3DQEJEAEEoHIEcDBuAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQgEeeBbL42kk8sY89zFUdRiZIhLU7y05m9EBW59B3v+28CFADIGvn31QKM5NjHiKVgKGGWoLVAGA8yMDI2MTExMjA4MTc1NVqgBKQCMACgADGCAZkwggGVAgEBMEAwOzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MSIwIAYDVQQDExlzaWdzdG9yZS10c2EtaW50ZXJtZWRpYXRlAgEBMAsGCWCGSAFlAwQCAaCB6jAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQAQQwHAYJKoZIhvcNAQkFMQ8XDTI2MTExMjA4MTc1NVowLwYJKoZIhvcNAQkEMSIEIL0B0bN/jDhEVZMmRIKSjY9P9RTC3Vh7nyD2bRtBQYmVMH0GCyqGSIb3DQEJEAIvMW4wbDBqMGgEIHGxNwJVZfB5irJH4y/SoTJA0ULqHcwUDQGasEQdUf20MEQwP6Q9MDsxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEiMCAGA1UEAxMZc2lnc3RvcmUtdHNhLWludGVybWVkaWF0ZQIBATAKBggqhkjOPQQDAgRIMEYCIQDyL5fwP+comAdS0QhbL9b7WvEgIwkmx610/D6BtUpt5QIhANJ5CtvzfRMgFY1BODs910M/CF0mB5QYwEjcV4IjLLqU"}]}},"dsseEnvelope":{"payload":"eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoiYXJ0aWZhY3QuYmluIiwiZGlnZXN0Ijp7InNoYTI1NiI6ImU4ODk1MTI5MWJjYTA4MDdhNDFmM2MwMTQ0MDA5YmZmZjVjNmM3N2RjMTMxMGQ1MmU4YzZkNjJmZWVlOTYwYTgifX1dLCJwcmVkaWNhdGVUeXBlIjoiaHR0cHM6Ly9zbHNhLmRldi9wcm92ZW5hbmNlL3YxIiwicHJlZGljYXRlIjp7ImJ1aWxkRGVmaW5pdGlvbiI6eyJidWlsZFR5cGUiOiJodHRwczovL2FjdGlvbnMuZ2l0aHViLmlvL2J1aWxkdHlwZXMvd29ya2Zsb3cvdjEiLCJleHRlcm5hbFBhcmFtZXRlcnMiOnsid29ya2Zsb3ciOnsicmVmIjoicmVmcy9oZWFkcy9tYWluIiwicmVwb3NpdG9yeSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldCIsInBhdGgiOiIuZ2l0aHViL3dvcmtmbG93cy9idWlsZC55bWwifX0sImludGVybmFsUGFyYW1ldGVycyI6eyJnaXRodWIiOnsiZXZlbnRfbmFtZSI6InB1c2giLCJyZXBvc2l0b3J5X2lkIjoiMTIzNDU2Nzg5IiwicmVwb3NpdG9yeV9vd25lcl9pZCI6Ijk4NzY1NDMyMSIsInJ1bm5lcl9lbnZpcm9ubWVudCI6ImdpdGh1Yi1ob3N0ZWQifX0sInJlc29sdmVkRGVwZW5kZW5jaWVzIjpbeyJ1cmkiOiJnaXQraHR0cHM6Ly9naXRodWIuY29tL2FjbWUvd2lkZ2V0QHJlZnMvaGVhZHMvbWFpbiIsImRpZ2VzdCI6eyJnaXRDb21taXQiOiI0ZjlkMmE3YzFlNmI4YTNkNWYwZTJjOWI3YTFkNGU2ZjhjM2I1YTcwIn19XX0sInJ1bkRldGFpbHMiOnsiYnVpbGRlciI6eyJpZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9hY3Rpb25zL3J1bm5lci9naXRodWItaG9zdGVkIn0sIm1ldGFkYXRhIjp7Imludm9jYXRpb25JZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldC9hY3Rpb25zL3J1bnMvMTIzNDU2Nzg5MC9hdHRlbXB0cy8xIn19fX0=","payloadType":"application/vnd.in-toto+json","signatures":[{"sig":"MEUCIAWSb4jCLE3Rg+8utB29/rQR6vNO6qjz5B3X9B9+9f4HAiEA7B1YiYhu99beE/cyeGwbMFcrGhKzts15rpxKvopEl9w="}]}} +{"mediaType":"application/vnd.dev.sigstore.bundle.v0.3+json","verificationMaterial":{"certificate":{"rawBytes":"MIIC0TCCAnegAwIBAgIINPJ+/beX+d4wCgYIKoZIzj0EAwIwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYxMTEzMTQzNDU1WhcNMjYxMTEzMTQ0NTU1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEu/d1ELKjQ+WCjV1FyrcAIqtl80679pfBeuIfM+X+t7WwKubqzbWuckbQaTJFKXwzrhR+K4W3fmNFfN0RqNHj9aOCAaIwggGeMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAfBgNVHSMEGDAWgBQin5D6vOEQoe/EaGQlwHLhwEDhUTBbBgNVHREBAf8EUTBPhk1odHRwczovL2dpdGh1Yi5jb20vbWFsbG9yeS93aWRnZXQvLmdpdGh1Yi93b3JrZmxvd3MvYnVpbGQueW1sQHJlZnMvaGVhZHMvbWFpbjA5BgorBgEEAYO/MAEBBCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAuBgorBgEEAYO/MAEMBCAMHmh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldDBRBgorBgEEAYO/MAEVBEMMQWh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldC9hY3Rpb25zL3J1bnMvMTIzNDU2Nzg5MC9hdHRlbXB0cy8xMAoGCCqGSM49BAMCA0gAMEUCIQCj3AcEhLHaiBoKu807P0X/QYoxoiYHYObC0J6vYnDqOAIgGXIiEDZxbvSfa2Q2OZDBcHv0ZuQXwUIa3QWQv7ykhWw="},"tlogEntries":[{"logId":{"keyId":"45EjT1abdD2MKrnHGSnayLaGvLNDQ4SRtMzNbF54fBc="},"kindVersion":{"kind":"dsse","version":"0.0.1"},"integratedTime":"1794580615","inclusionPromise":{"signedEntryTimestamp":"MEQCIAqn0aVsBdHAP7omeyu7PrXXBf+amaUGq5gQYmkVUc26AiADkavlKreV53MSmLRVknZhrhY1e5TjxZp7mF9mM29J8w=="},"inclusionProof":{"rootHash":"a5pS3MWBiyKWTBvB5duQ6/jxnmsxF+udLDZKr7cZK2g=","treeSize":"1","checkpoint":{"envelope":"rekor.localhost - 123\n42\na5pS3MWBiyKWTBvB5duQ6/jxnmsxF+udLDZKr7cZK2g=\n\n— rekor.localhost 45EjTzBEAiAyty+4TFFLdhGQ79ITEXCfyB5yU3Oo9540w8XRzq5zDQIgGTCz6H9Hm7Th1yC40d7JmpsElNIIagVtKw3RGaivMHw=\n"}},"canonicalizedBody":"eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJzcGVjIjp7ImVudmVsb3BlSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImI5ZDFmZmJmYWU5N2I0M2UxNjAwYmNkNGIzOWY3ZjZkODEzYzg3ZTJiMDU0YTlmOGMwMTY2ODUzZGNmNmQ0ZmEifSwicGF5bG9hZEhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJmOTZjNDY3Y2I2Y2MzYmU1ZGRlMGE0YzZkYTFhZDQ5NTA3NGEzYjRiZTcyMDc2NDQyYzBmNGI4NzFjMTNhMWVlIn0sInNpZ25hdHVyZXMiOlt7InNpZ25hdHVyZSI6Ik1FWUNJUUNEY2t4dlVLY3p5U09iR3p5d3V2dktSYXMrZTVQRVR5TndWc2dYdGV5RTZnSWhBTU9hNmE2N2VhQVpMZDg4NGlrRzQwRUFGNE4veEV5WU1oVlFrc3ozZlJZYiIsInZlcmlmaWVyIjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTXdWRU5EUVc1bFowRjNTVUpCWjBsSlRsQktLeTlpWlZnclpEUjNRMmRaU1V0dldrbDZhakJGUVhkSmQwNTZSVlpOUWsxSFFURlZSVU5vVFUwS1l6SnNibU16VW5aamJWVjFXa2RXTWsxU05IZElRVmxFVmxGUlJFVjRWbnBoVjJSNlpFYzVlVnBUTVhCaWJsSnNZMjB4YkZwSGJHaGtSMVYzU0doalRncE5hbGw0VFZSRmVrMVVVWHBPUkZVeFYyaGpUazFxV1hoTlZFVjZUVlJSTUU1VVZURlhha0ZCVFVacmQwVjNXVWhMYjFwSmVtb3dRMEZSV1VsTGIxcEpDbnBxTUVSQlVXTkVVV2RCUlhVdlpERkZURXRxVVN0WFEycFdNVVo1Y21OQlNYRjBiRGd3TmpjNWNHWkNaWFZKWmswcldDdDBOMWQzUzNWaWNYcGlWM1VLWTJ0aVVXRlVTa1pMV0hkNmNtaFNLMHMwVnpObWJVNUdaazR3VW5GT1NHbzVZVTlEUVdGSmQyZG5SMlZOUVRSSFFURlZaRVIzUlVJdmQxRkZRWGRKU0FwblJFRlVRbWRPVmtoVFZVVkVSRUZMUW1kbmNrSm5SVVpDVVdORVFYcEJaa0puVGxaSVUwMUZSMFJCVjJkQ1VXbHVOVVEyZGs5RlVXOWxMMFZoUjFGc0NuZElUR2gzUlVSb1ZWUkNZa0puVGxaSVVrVkNRV1k0UlZWVVFsQm9hekZ2WkVoU2QyTjZiM1pNTW1Sd1pFZG9NVmxwTldwaU1qQjJZbGRHYzJKSE9Ya0taVk01TTJGWFVtNWFXRkYyVEcxa2NHUkhhREZaYVRrellqTktjbHB0ZUhaa00wMTJXVzVXY0dKSFVYVmxWekZ6VVVoS2JGcHVUWFpoUjFab1draE5kZ3BpVjBad1ltcEJOVUpuYjNKQ1owVkZRVmxQTDAxQlJVSkNRM1J2WkVoU2QyTjZiM1pNTTFKMllUSldkVXh0Um1wa1IyeDJZbTVOZFZveWJEQmhTRlpwQ21SWVRteGpiVTUyWW01U2JHSnVVWFZaTWpsMFRVUnpSME5wYzBkQlVWRkNaemM0ZDBGUlowVk1VWGR5WVVoU01HTklUVFpNZVRrd1lqSjBiR0pwTldnS1dUTlNjR0l5TlhwTWJXUndaRWRvTVZsdVZucGFXRXBxWWpJMU1GcFhOVEJNYlU1MllsUkJkVUpuYjNKQ1owVkZRVmxQTDAxQlJVMUNRMEZOU0cxb01BcGtTRUo2VDJrNGRsb3liREJoU0ZacFRHMU9kbUpUT1doWk1qRnNURE5rY0ZwSFpHeGtSRUpTUW1kdmNrSm5SVVZCV1U4dlRVRkZWa0pGVFUxUlYyZ3dDbVJJUW5wUGFUaDJXakpzTUdGSVZtbE1iVTUyWWxNNWFGa3lNV3hNTTJSd1drZGtiR1JET1doWk0xSndZakkxZWt3elNqRmliazEyVFZSSmVrNUVWVElLVG5wbk5VMURPV2hrU0ZKc1lsaENNR041T0hoTlFXOUhRME54UjFOTk5EbENRVTFEUVRCblFVMUZWVU5KVVVOcU0wRmpSV2hNU0dGcFFtOUxkVGd3TndwUU1GZ3ZVVmx2ZUc5cFdVaFpUMkpETUVvMmRsbHVSSEZQUVVsblIxaEphVVZFV25oaWRsTm1ZVEpSTWs5YVJFSmpTSFl3V25WUldIZFZTV0V6VVZkUkNuWTNlV3RvVjNjOUNpMHRMUzB0UlU1RUlFTkZVbFJKUmtsRFFWUkZMUzB0TFMwSyJ9XX0sImtpbmQiOiJkc3NlIn0="}],"timestampVerificationData":{"rfc3161Timestamps":[{"signedTimestamp":"MIICUTADAgEAMIICSAYJKoZIhvcNAQcCoIICOTCCAjUCAQMxDTALBglghkgBZQMEAgEwgYIGCyqGSIb3DQEJEAEEoHMEcTBvAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQgyquYfstJWBMAUy3cVKh8bYD9NPNvZMSeIQHEo9rRVK4CFQCb2aIRzVMHjsK8uAFio6iO0AhcpBgPMjAyNjExMTMxNDM1NTVaoASkAjAAoAAxggGYMIIBlAIBATBAMDsxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEiMCAGA1UEAxMZc2lnc3RvcmUtdHNhLWludGVybWVkaWF0ZQIBATALBglghkgBZQMEAgGggeowGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEEMBwGCSqGSIb3DQEJBTEPFw0yNjExMTMxNDM1NTVaMC8GCSqGSIb3DQEJBDEiBCA3ckzmFjuZOrUXOe2hadWCo0M/1JsMimmKDYiI670SpTB9BgsqhkiG9w0BCRACLzFuMGwwajBoBCB6sxTuY9UdYUf2mR3N666Vn6KAgVfyY7rK6Lx/joQFZTBEMD+kPTA7MRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxIjAgBgNVBAMTGXNpZ3N0b3JlLXRzYS1pbnRlcm1lZGlhdGUCAQEwCgYIKoZIzj0EAwIERzBFAiAHLef0cM/dG8WZpQ9DXGskLzq/+gp+91vJFsl2dmnCCQIhANI+hYn3mhgaOHiHy0E4z/K6KJCEw5rSQLYWNKtrxKac"}]}},"dsseEnvelope":{"payload":"eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoiYXJ0aWZhY3QuYmluIiwiZGlnZXN0Ijp7InNoYTI1NiI6ImU4ODk1MTI5MWJjYTA4MDdhNDFmM2MwMTQ0MDA5YmZmZjVjNmM3N2RjMTMxMGQ1MmU4YzZkNjJmZWVlOTYwYTgifX1dLCJwcmVkaWNhdGVUeXBlIjoiaHR0cHM6Ly9zbHNhLmRldi9wcm92ZW5hbmNlL3YxIiwicHJlZGljYXRlIjp7ImJ1aWxkRGVmaW5pdGlvbiI6eyJidWlsZFR5cGUiOiJodHRwczovL2FjdGlvbnMuZ2l0aHViLmlvL2J1aWxkdHlwZXMvd29ya2Zsb3cvdjEiLCJleHRlcm5hbFBhcmFtZXRlcnMiOnsid29ya2Zsb3ciOnsicmVmIjoicmVmcy9oZWFkcy9tYWluIiwicmVwb3NpdG9yeSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldCIsInBhdGgiOiIuZ2l0aHViL3dvcmtmbG93cy9idWlsZC55bWwifX0sImludGVybmFsUGFyYW1ldGVycyI6eyJnaXRodWIiOnsiZXZlbnRfbmFtZSI6InB1c2giLCJyZXBvc2l0b3J5X2lkIjoiMTIzNDU2Nzg5IiwicmVwb3NpdG9yeV9vd25lcl9pZCI6Ijk4NzY1NDMyMSIsInJ1bm5lcl9lbnZpcm9ubWVudCI6ImdpdGh1Yi1ob3N0ZWQifX0sInJlc29sdmVkRGVwZW5kZW5jaWVzIjpbeyJ1cmkiOiJnaXQraHR0cHM6Ly9naXRodWIuY29tL2FjbWUvd2lkZ2V0QHJlZnMvaGVhZHMvbWFpbiIsImRpZ2VzdCI6eyJnaXRDb21taXQiOiI0ZjlkMmE3YzFlNmI4YTNkNWYwZTJjOWI3YTFkNGU2ZjhjM2I1YTcwIn19XX0sInJ1bkRldGFpbHMiOnsiYnVpbGRlciI6eyJpZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9hY3Rpb25zL3J1bm5lci9naXRodWItaG9zdGVkIn0sIm1ldGFkYXRhIjp7Imludm9jYXRpb25JZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldC9hY3Rpb25zL3J1bnMvMTIzNDU2Nzg5MC9hdHRlbXB0cy8xIn19fX0=","payloadType":"application/vnd.in-toto+json","signatures":[{"sig":"MEYCIQCDckxvUKczySObGzywuvvKRas+e5PETyNwVsgXteyE6gIhAMOa6a67eaAZLd884ikG40EAF4N/xEyYMhVQksz3fRYb"}]}} {"_type":"https://in-toto.io/Statement/v1","subject":[{"name":"artifact.bin","digest":{"sha256":"e88951291bca0807a41f3c0144009bfff5c6c77dc1310d52e8c6d62feee960a8"}}],"predicateType":"https://slsa.dev/provenance/v1","predicate":{"buildDefinition":{"buildType":"https://actions.github.io/buildtypes/workflow/v1","externalParameters":{"workflow":{"ref":"refs/heads/main","repository":"https://github.com/acme/widget","path":".github/workflows/build.yml"}},"internalParameters":{"github":{"event_name":"push","repository_id":"123456789","repository_owner_id":"987654321","runner_environment":"github-hosted"}},"resolvedDependencies":[{"uri":"git+https://github.com/acme/widget@refs/heads/main","digest":{"gitCommit":"4f9d2a7c1e6b8a3d5f0e2c9b7a1d4e6f8c3b5a70"}}]},"runDetails":{"builder":{"id":"https://github.com/actions/runner/github-hosted"},"metadata":{"invocationId":"https://github.com/acme/widget/actions/runs/1234567890/attempts/1"}}}} diff --git a/internal/intoto/testdata/wrong-signer-provenance.sigstore.json b/internal/intoto/testdata/wrong-signer-provenance.sigstore.json index 101d25b1b..3bc997191 100644 --- a/internal/intoto/testdata/wrong-signer-provenance.sigstore.json +++ b/internal/intoto/testdata/wrong-signer-provenance.sigstore.json @@ -4,42 +4,42 @@ "payloadType": "application/vnd.in-toto+json", "signatures": [ { - "sig": "MEQCIC8kItjzxtAHW7/vZM3hcjwP4dd7lJLPCj/YQmtcMvmwAiA429OpWFCgP3eQcZwKIonBbbBxtRPXjSyPI4e1B2L12w==" + "sig": "MEUCIHK6pIVHUzFGrL0ghQXhsbErygkGFKWur9vYk9WvcaKWAiEAvBptjP9yOjPAbdxbpPfmqMfCpJxKnK1c5cJFY4VSiRA=" } ] }, "mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json", "verificationMaterial": { "certificate": { - "rawBytes": "MIIC0TCCAnegAwIBAgIIFvTDUKixd5gwCgYIKoZIzj0EAwIwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYxMTEyMDgxNjU1WhcNMjYxMTEyMDgyNzU1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEJ8SyAD+uCtOPgUwoyXIFV42IpRW73ljcwEiuhZk1QkUupiqnaI1t9XWEuL6jZ9OrtDg0fdcH1tvWA9SjsvHvs6OCAaIwggGeMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAfBgNVHSMEGDAWgBSZpSIKVYxSQzu1jBpx0BTIUS5kPjBbBgNVHREBAf8EUTBPhk1odHRwczovL2dpdGh1Yi5jb20vbWFsbG9yeS93aWRnZXQvLmdpdGh1Yi93b3JrZmxvd3MvYnVpbGQueW1sQHJlZnMvaGVhZHMvbWFpbjA5BgorBgEEAYO/MAEBBCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAuBgorBgEEAYO/MAEMBCAMHmh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldDBRBgorBgEEAYO/MAEVBEMMQWh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldC9hY3Rpb25zL3J1bnMvMTIzNDU2Nzg5MC9hdHRlbXB0cy8xMAoGCCqGSM49BAMCA0gAMEUCIE7RPtXH3B6wgoPVaQaRATnEHvlM2NDpWEN0jNh97B+5AiEAnvIjy3A/ePbJ5reQ5MexeD45cmZQ6V5aSm1zWagJfAE=" + "rawBytes": "MIIC0TCCAnegAwIBAgIICGsLBLcKaeowCgYIKoZIzj0EAwIwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYxMTEzMTQzNDU1WhcNMjYxMTEzMTQ0NTU1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEAj4uDTnDpJ6N/QKnJGs+mAlm4eEyRvxU5Q23oeTd1jRBL/ACK4CB6FNJngjR7SNXUQLlGJDlefjeSa7icOpbRKOCAaIwggGeMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAfBgNVHSMEGDAWgBQin5D6vOEQoe/EaGQlwHLhwEDhUTBbBgNVHREBAf8EUTBPhk1odHRwczovL2dpdGh1Yi5jb20vbWFsbG9yeS93aWRnZXQvLmdpdGh1Yi93b3JrZmxvd3MvYnVpbGQueW1sQHJlZnMvaGVhZHMvbWFpbjA5BgorBgEEAYO/MAEBBCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAuBgorBgEEAYO/MAEMBCAMHmh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldDBRBgorBgEEAYO/MAEVBEMMQWh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldC9hY3Rpb25zL3J1bnMvMTIzNDU2Nzg5MC9hdHRlbXB0cy8xMAoGCCqGSM49BAMCA0gAMEUCIQCM03z4nyV6rEWaTSPBNyGH7s65xUx1KN4Jq9FR6Yb0bQIgPT0y6in0vpCVhXXd/1JjPExJxlu15SC/fp6aMlRq3vs=" }, "timestampVerificationData": { "rfc3161Timestamps": [ { - "signedTimestamp": "MIICUDADAgEAMIICRwYJKoZIhvcNAQcCoIICODCCAjQCAQMxDTALBglghkgBZQMEAgEwgYIGCyqGSIb3DQEJEAEEoHMEcTBvAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQgoqT8mfxNuc9Ms0F6k4xOoAP/OmJZTkJk+uvhiJNcoxwCFQCzfVOoiecY7ynvH0vqFWFC9lZYdBgPMjAyNjExMTIwODE3NTVaoASkAjAAoAAxggGXMIIBkwIBATBAMDsxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEiMCAGA1UEAxMZc2lnc3RvcmUtdHNhLWludGVybWVkaWF0ZQIBATALBglghkgBZQMEAgGggeowGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEEMBwGCSqGSIb3DQEJBTEPFw0yNjExMTIwODE3NTVaMC8GCSqGSIb3DQEJBDEiBCBdxlOp3BU41AJhg/2SgLAfYz3atPHTCmgPkZhNalbjDDB9BgsqhkiG9w0BCRACLzFuMGwwajBoBCBxsTcCVWXweYqyR+Mv0qEyQNFC6h3MFA0BmrBEHVH9tDBEMD+kPTA7MRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxIjAgBgNVBAMTGXNpZ3N0b3JlLXRzYS1pbnRlcm1lZGlhdGUCAQEwCgYIKoZIzj0EAwIERjBEAiALeZW/euLcifRqS4tryzEKZ4Q+qll0WsVR6800lk0m7gIgOqu5Y3VSqStasM/iLTrnCfyKBWbrCkZ2OJX/q49rAds=" + "signedTimestamp": "MIICUDADAgEAMIICRwYJKoZIhvcNAQcCoIICODCCAjQCAQMxDTALBglghkgBZQMEAgEwgYIGCyqGSIb3DQEJEAEEoHMEcTBvAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQgpQ2LXe8jP07aj/tyqdTFLyO1+BKUPzoPXpApVZPB/IYCFQD5N9p5F8iVUeaC71n72l5ST6QONRgPMjAyNjExMTMxNDM1NTVaoASkAjAAoAAxggGXMIIBkwIBATBAMDsxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEiMCAGA1UEAxMZc2lnc3RvcmUtdHNhLWludGVybWVkaWF0ZQIBATALBglghkgBZQMEAgGggeowGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEEMBwGCSqGSIb3DQEJBTEPFw0yNjExMTMxNDM1NTVaMC8GCSqGSIb3DQEJBDEiBCBDpc7np2gYC7sIfURJqM+ZRDLDe6UKirIcLiDklwnVrjB9BgsqhkiG9w0BCRACLzFuMGwwajBoBCB6sxTuY9UdYUf2mR3N666Vn6KAgVfyY7rK6Lx/joQFZTBEMD+kPTA7MRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxIjAgBgNVBAMTGXNpZ3N0b3JlLXRzYS1pbnRlcm1lZGlhdGUCAQEwCgYIKoZIzj0EAwIERjBEAiBLM65THx0kGf/OvN4RCnlDmfOOvo0VUiCOPdW0Ee6q5wIgFpYEbMrkP7BRbb38j/t9HApsQNBbUcVLbG3uhZsTh0Y=" } ] }, "tlogEntries": [ { - "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJzcGVjIjp7ImVudmVsb3BlSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImZhMjk1Mjk0MDNjNWY0MmE5ZjQwYThjMzM3NzdlNTIyMTM1ODY5NDJlNTVkNDg3MWRkNDhiNmU5OTg2ODg5MTEifSwicGF5bG9hZEhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJmOTZjNDY3Y2I2Y2MzYmU1ZGRlMGE0YzZkYTFhZDQ5NTA3NGEzYjRiZTcyMDc2NDQyYzBmNGI4NzFjMTNhMWVlIn0sInNpZ25hdHVyZXMiOlt7InNpZ25hdHVyZSI6Ik1FUUNJQzhrSXRqenh0QUhXNy92Wk0zaGNqd1A0ZGQ3bEpMUENqL1lRbXRjTXZtd0FpQTQyOU9wV0ZDZ1AzZVFjWndLSW9uQmJiQnh0UlBYalN5UEk0ZTFCMkwxMnc9PSIsInZlcmlmaWVyIjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTXdWRU5EUVc1bFowRjNTVUpCWjBsSlJuWlVSRlZMYVhoa05XZDNRMmRaU1V0dldrbDZhakJGUVhkSmQwNTZSVlpOUWsxSFFURlZSVU5vVFUwS1l6SnNibU16VW5aamJWVjFXa2RXTWsxU05IZElRVmxFVmxGUlJFVjRWbnBoVjJSNlpFYzVlVnBUTVhCaWJsSnNZMjB4YkZwSGJHaGtSMVYzU0doalRncE5hbGw0VFZSRmVVMUVaM2hPYWxVeFYyaGpUazFxV1hoTlZFVjVUVVJuZVU1NlZURlhha0ZCVFVacmQwVjNXVWhMYjFwSmVtb3dRMEZSV1VsTGIxcEpDbnBxTUVSQlVXTkVVV2RCUlVvNFUzbEJSQ3QxUTNSUFVHZFZkMjk1V0VsR1ZqUXlTWEJTVnpjemJHcGpkMFZwZFdoYWF6RlJhMVYxY0dseGJtRkpNWFFLT1ZoWFJYVk1ObXBhT1U5eWRFUm5NR1prWTBneGRIWlhRVGxUYW5OMlNIWnpOazlEUVdGSmQyZG5SMlZOUVRSSFFURlZaRVIzUlVJdmQxRkZRWGRKU0FwblJFRlVRbWRPVmtoVFZVVkVSRUZMUW1kbmNrSm5SVVpDVVdORVFYcEJaa0puVGxaSVUwMUZSMFJCVjJkQ1UxcHdVMGxMVmxsNFUxRjZkVEZxUW5CNENqQkNWRWxWVXpWclVHcENZa0puVGxaSVVrVkNRV1k0UlZWVVFsQm9hekZ2WkVoU2QyTjZiM1pNTW1Sd1pFZG9NVmxwTldwaU1qQjJZbGRHYzJKSE9Ya0taVk01TTJGWFVtNWFXRkYyVEcxa2NHUkhhREZaYVRrellqTktjbHB0ZUhaa00wMTJXVzVXY0dKSFVYVmxWekZ6VVVoS2JGcHVUWFpoUjFab1draE5kZ3BpVjBad1ltcEJOVUpuYjNKQ1owVkZRVmxQTDAxQlJVSkNRM1J2WkVoU2QyTjZiM1pNTTFKMllUSldkVXh0Um1wa1IyeDJZbTVOZFZveWJEQmhTRlpwQ21SWVRteGpiVTUyWW01U2JHSnVVWFZaTWpsMFRVUnpSME5wYzBkQlVWRkNaemM0ZDBGUlowVk1VWGR5WVVoU01HTklUVFpNZVRrd1lqSjBiR0pwTldnS1dUTlNjR0l5TlhwTWJXUndaRWRvTVZsdVZucGFXRXBxWWpJMU1GcFhOVEJNYlU1MllsUkJkVUpuYjNKQ1owVkZRVmxQTDAxQlJVMUNRMEZOU0cxb01BcGtTRUo2VDJrNGRsb3liREJoU0ZacFRHMU9kbUpUT1doWk1qRnNURE5rY0ZwSFpHeGtSRUpTUW1kdmNrSm5SVVZCV1U4dlRVRkZWa0pGVFUxUlYyZ3dDbVJJUW5wUGFUaDJXakpzTUdGSVZtbE1iVTUyWWxNNWFGa3lNV3hNTTJSd1drZGtiR1JET1doWk0xSndZakkxZWt3elNqRmliazEyVFZSSmVrNUVWVElLVG5wbk5VMURPV2hrU0ZKc1lsaENNR041T0hoTlFXOUhRME54UjFOTk5EbENRVTFEUVRCblFVMUZWVU5KUlRkU1VIUllTRE5DTm5kbmIxQldZVkZoVWdwQlZHNUZTSFpzVFRKT1JIQlhSVTR3YWs1b09UZENLelZCYVVWQmJuWkphbmt6UVM5bFVHSktOWEpsVVRWTlpYaGxSRFExWTIxYVVUWldOV0ZUYlRGNkNsZGhaMHBtUVVVOUNpMHRMUzB0UlU1RUlFTkZVbFJKUmtsRFFWUkZMUzB0TFMwSyJ9XX0sImtpbmQiOiJkc3NlIn0=", + "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJzcGVjIjp7ImVudmVsb3BlSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjE2Nzc3MGRlZTU0YmFmNTM3ZWE1M2Q5ODkxZWYzYzc4YTA2NzFhOTE5ZWE3NWJjZjc0ZGRkYzNjYjkxZTg0Y2IifSwicGF5bG9hZEhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiJmOTZjNDY3Y2I2Y2MzYmU1ZGRlMGE0YzZkYTFhZDQ5NTA3NGEzYjRiZTcyMDc2NDQyYzBmNGI4NzFjMTNhMWVlIn0sInNpZ25hdHVyZXMiOlt7InNpZ25hdHVyZSI6Ik1FVUNJSEs2cElWSFV6RkdyTDBnaFFYaHNiRXJ5Z2tHRktXdXI5dllrOVd2Y2FLV0FpRUF2QnB0alA5eU9qUEFiZHhicFBmbXFNZkNwSnhLbksxYzVjSkZZNFZTaVJBPSIsInZlcmlmaWVyIjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTXdWRU5EUVc1bFowRjNTVUpCWjBsSlEwZHpURUpNWTB0aFpXOTNRMmRaU1V0dldrbDZhakJGUVhkSmQwNTZSVlpOUWsxSFFURlZSVU5vVFUwS1l6SnNibU16VW5aamJWVjFXa2RXTWsxU05IZElRVmxFVmxGUlJFVjRWbnBoVjJSNlpFYzVlVnBUTVhCaWJsSnNZMjB4YkZwSGJHaGtSMVYzU0doalRncE5hbGw0VFZSRmVrMVVVWHBPUkZVeFYyaGpUazFxV1hoTlZFVjZUVlJSTUU1VVZURlhha0ZCVFVacmQwVjNXVWhMYjFwSmVtb3dRMEZSV1VsTGIxcEpDbnBxTUVSQlVXTkVVV2RCUlVGcU5IVkVWRzVFY0VvMlRpOVJTMjVLUjNNcmJVRnNiVFJsUlhsU2RuaFZOVkV5TTI5bFZHUXhhbEpDVEM5QlEwczBRMElLTmtaT1NtNW5hbEkzVTA1WVZWRk1iRWRLUkd4bFptcGxVMkUzYVdOUGNHSlNTMDlEUVdGSmQyZG5SMlZOUVRSSFFURlZaRVIzUlVJdmQxRkZRWGRKU0FwblJFRlVRbWRPVmtoVFZVVkVSRUZMUW1kbmNrSm5SVVpDVVdORVFYcEJaa0puVGxaSVUwMUZSMFJCVjJkQ1VXbHVOVVEyZGs5RlVXOWxMMFZoUjFGc0NuZElUR2gzUlVSb1ZWUkNZa0puVGxaSVVrVkNRV1k0UlZWVVFsQm9hekZ2WkVoU2QyTjZiM1pNTW1Sd1pFZG9NVmxwTldwaU1qQjJZbGRHYzJKSE9Ya0taVk01TTJGWFVtNWFXRkYyVEcxa2NHUkhhREZaYVRrellqTktjbHB0ZUhaa00wMTJXVzVXY0dKSFVYVmxWekZ6VVVoS2JGcHVUWFpoUjFab1draE5kZ3BpVjBad1ltcEJOVUpuYjNKQ1owVkZRVmxQTDAxQlJVSkNRM1J2WkVoU2QyTjZiM1pNTTFKMllUSldkVXh0Um1wa1IyeDJZbTVOZFZveWJEQmhTRlpwQ21SWVRteGpiVTUyWW01U2JHSnVVWFZaTWpsMFRVUnpSME5wYzBkQlVWRkNaemM0ZDBGUlowVk1VWGR5WVVoU01HTklUVFpNZVRrd1lqSjBiR0pwTldnS1dUTlNjR0l5TlhwTWJXUndaRWRvTVZsdVZucGFXRXBxWWpJMU1GcFhOVEJNYlU1MllsUkJkVUpuYjNKQ1owVkZRVmxQTDAxQlJVMUNRMEZOU0cxb01BcGtTRUo2VDJrNGRsb3liREJoU0ZacFRHMU9kbUpUT1doWk1qRnNURE5rY0ZwSFpHeGtSRUpTUW1kdmNrSm5SVVZCV1U4dlRVRkZWa0pGVFUxUlYyZ3dDbVJJUW5wUGFUaDJXakpzTUdGSVZtbE1iVTUyWWxNNWFGa3lNV3hNTTJSd1drZGtiR1JET1doWk0xSndZakkxZWt3elNqRmliazEyVFZSSmVrNUVWVElLVG5wbk5VMURPV2hrU0ZKc1lsaENNR041T0hoTlFXOUhRME54UjFOTk5EbENRVTFEUVRCblFVMUZWVU5KVVVOTk1ETjZORzU1VmpaeVJWZGhWRk5RUWdwT2VVZElOM00yTlhoVmVERkxUalJLY1RsR1VqWlpZakJpVVVsblVGUXdlVFpwYmpCMmNFTldhRmhZWkM4eFNtcFFSWGhLZUd4MU1UVlRReTltY0RaaENrMXNVbkV6ZG5NOUNpMHRMUzB0UlU1RUlFTkZVbFJKUmtsRFFWUkZMUzB0TFMwSyJ9XX0sImtpbmQiOiJkc3NlIn0=", "inclusionPromise": { - "signedEntryTimestamp": "MEYCIQDjTrdFfqFAQoMPME5MAr8oxSyL5Ohp47NEWgzVG3zq/QIhAN9CusLShGjhDY01Y+aCSD8RFiJfqDKBX+6ZbL1B4OiU" + "signedEntryTimestamp": "MEUCIQDoUdFyjvGdf3l/coXdvXhu6JauMMbnSbz5p72EI9CmsQIgA60XJzDjLWgYta88ItSKshanMh/MLEbJDK51ylP/drA=" }, "inclusionProof": { "checkpoint": { - "envelope": "rekor.localhost - 123\n42\nguEIyPpJ4TYqIqL5Yleon8aLByOBMqoRwHAbNjU04I0=\n\n— rekor.localhost VbgJJjBEAiAl8T/s70QK6yvw+tfYyrZUiQGBZwVuRsHiz9Juf5mmIAIgdqq2JNoSDgABPCQXy4NfSTCPh1PvCuUVKSQnLFQc3XM=\n" + "envelope": "rekor.localhost - 123\n42\nYDIFM21vM5YwHDzApei6lkUwgZTosIum24G5GHGUflg=\n\n— rekor.localhost 45EjTzBGAiEA62c1Do71hRPPQubjzkEgEJ7TtcBCwXXQs4K58PyGolgCIQDZsn1Ablc26CIfE5GKRtR3NQBJDrVZuN1tSBkdxrGXeg==\n" }, - "rootHash": "guEIyPpJ4TYqIqL5Yleon8aLByOBMqoRwHAbNjU04I0=", + "rootHash": "YDIFM21vM5YwHDzApei6lkUwgZTosIum24G5GHGUflg=", "treeSize": "1" }, - "integratedTime": "1794471535", + "integratedTime": "1794580615", "kindVersion": { "kind": "dsse", "version": "0.0.1" }, "logId": { - "keyId": "VbgJJh1uXk4PvCPZ3fIjaxUep33R8Z6T6wAJfVjz+BA=" + "keyId": "45EjT1abdD2MKrnHGSnayLaGvLNDQ4SRtMzNbF54fBc=" } } ] diff --git a/internal/intoto/testdata/wrong-subject-provenance.sigstore.json b/internal/intoto/testdata/wrong-subject-provenance.sigstore.json index b2ccc80a3..afda5326a 100644 --- a/internal/intoto/testdata/wrong-subject-provenance.sigstore.json +++ b/internal/intoto/testdata/wrong-subject-provenance.sigstore.json @@ -4,42 +4,42 @@ "payloadType": "application/vnd.in-toto+json", "signatures": [ { - "sig": "MEQCIAc4a64wIhrJUftRRsiBSHBj/ssNF7bVyA6FPqJqRc3QAiBBdxItWb4WMwQnFXUjZyvn7guQSZaYRTo9UKKaOmwADQ==" + "sig": "MEQCIHN57Lb5MZZroj3NpT7yUQGsP8MaaP1mxnqqoIeyvareAiBs5rOMV81a4GJrXfeUlZSFUU8RsBKrr3HvYnUq2uXanw==" } ] }, "mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json", "verificationMaterial": { "certificate": { - "rawBytes": "MIICzTCCAnSgAwIBAgIIC4ljjtwoou8wCgYIKoZIzj0EAwIwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYxMTEyMDgxNjU1WhcNMjYxMTEyMDgyNzU1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEwZswKqBIxaHhnqDQluBI3DjNTkISqwVZbQddGwNUb+Xj+wAMIHce03tj/hXVHp5OYC/gBhcMBtU5XoHmEDTD2qOCAZ8wggGbMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAfBgNVHSMEGDAWgBSZpSIKVYxSQzu1jBpx0BTIUS5kPjBYBgNVHREBAf8ETjBMhkpodHRwczovL2dpdGh1Yi5jb20vYWNtZS93aWRnZXQvLmdpdGh1Yi93b3JrZmxvd3MvYnVpbGQueW1sQHJlZnMvaGVhZHMvbWFpbjA5BgorBgEEAYO/MAEBBCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAuBgorBgEEAYO/MAEMBCAMHmh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldDBRBgorBgEEAYO/MAEVBEMMQWh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldC9hY3Rpb25zL3J1bnMvMTIzNDU2Nzg5MC9hdHRlbXB0cy8xMAoGCCqGSM49BAMCA0cAMEQCIF/p3St5Hv55N0xAprut/+mgFRi9716+7cgm+1mDIYUMAiAyNJd+RTvmVfz2YHZk0Kj0+LXeXjOxyBemNNhz/MZErw==" + "rawBytes": "MIICzTCCAnSgAwIBAgIIMp8eseY9BZowCgYIKoZIzj0EAwIwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjYxMTEzMTQzNDU1WhcNMjYxMTEzMTQ0NTU1WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAER/q8lZcNHVUSBXH65LhiLInqFy45U+5W1E8ZfmF/jkA5WPiMi0HK5Y5Q6kGjYvO92Z/4OY+9FHgsdKSc9QX3zKOCAZ8wggGbMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAfBgNVHSMEGDAWgBQin5D6vOEQoe/EaGQlwHLhwEDhUTBYBgNVHREBAf8ETjBMhkpodHRwczovL2dpdGh1Yi5jb20vYWNtZS93aWRnZXQvLmdpdGh1Yi93b3JrZmxvd3MvYnVpbGQueW1sQHJlZnMvaGVhZHMvbWFpbjA5BgorBgEEAYO/MAEBBCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTAuBgorBgEEAYO/MAEMBCAMHmh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldDBRBgorBgEEAYO/MAEVBEMMQWh0dHBzOi8vZ2l0aHViLmNvbS9hY21lL3dpZGdldC9hY3Rpb25zL3J1bnMvMTIzNDU2Nzg5MC9hdHRlbXB0cy8xMAoGCCqGSM49BAMCA0cAMEQCICQuBBUQgkuHzE5yHmEbd7wlWn/4oacJbHY97LTAngeuAiAX6/JcvyOHkA2qIURh8UQKDXQ3BY6+7QQotaOQOiINYA==" }, "timestampVerificationData": { "rfc3161Timestamps": [ { - "signedTimestamp": "MIICTzADAgEAMIICRgYJKoZIhvcNAQcCoIICNzCCAjMCAQMxDTALBglghkgBZQMEAgEwgYEGCyqGSIb3DQEJEAEEoHIEcDBuAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQgVCoXNrsal13QucxnOeo6AG/5Xd9KwLyHcJ7lNMABVCgCFA6AyiIYbdNtZc/RqPqpLBJSYxU8GA8yMDI2MTExMjA4MTc1NVqgBKQCMACgADGCAZcwggGTAgEBMEAwOzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MSIwIAYDVQQDExlzaWdzdG9yZS10c2EtaW50ZXJtZWRpYXRlAgEBMAsGCWCGSAFlAwQCAaCB6jAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQAQQwHAYJKoZIhvcNAQkFMQ8XDTI2MTExMjA4MTc1NVowLwYJKoZIhvcNAQkEMSIEIGF+Pzhwz5XFIWtWKcyybtwfPb1wdrb8s2YKzVnJCeVrMH0GCyqGSIb3DQEJEAIvMW4wbDBqMGgEIHGxNwJVZfB5irJH4y/SoTJA0ULqHcwUDQGasEQdUf20MEQwP6Q9MDsxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEiMCAGA1UEAxMZc2lnc3RvcmUtdHNhLWludGVybWVkaWF0ZQIBATAKBggqhkjOPQQDAgRGMEQCIGp6pZqXVcf0Qj7QIpt0SE3gjB/7yvNG46S20EsDN5iXAiAkhGHY7/8LzQLuiWEINoBmBidu/syn7h1yGOCu/bkx2Q==" + "signedTimestamp": "MIICUTADAgEAMIICSAYJKoZIhvcNAQcCoIICOTCCAjUCAQMxDTALBglghkgBZQMEAgEwgYIGCyqGSIb3DQEJEAEEoHMEcTBvAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQgtBJLxOHPjdKD2hlSe2mmL5N+9gE99jgIR4dlHTHBdVUCFQDv9zVtJ6kL85uW78zzpEHebyjHtRgPMjAyNjExMTMxNDM1NTVaoASkAjAAoAAxggGYMIIBlAIBATBAMDsxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEiMCAGA1UEAxMZc2lnc3RvcmUtdHNhLWludGVybWVkaWF0ZQIBATALBglghkgBZQMEAgGggeowGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEEMBwGCSqGSIb3DQEJBTEPFw0yNjExMTMxNDM1NTVaMC8GCSqGSIb3DQEJBDEiBCCm0Rvejb5yYSzrcAqaKGOhazNcpLeBRx5LmIjmcFV+9zB9BgsqhkiG9w0BCRACLzFuMGwwajBoBCB6sxTuY9UdYUf2mR3N666Vn6KAgVfyY7rK6Lx/joQFZTBEMD+kPTA7MRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxIjAgBgNVBAMTGXNpZ3N0b3JlLXRzYS1pbnRlcm1lZGlhdGUCAQEwCgYIKoZIzj0EAwIERzBFAiEAuNBhLf682N6VakS7kezFgQmaV491yBA5XV7nf97c8uICIBzvywGD32JSByLO3oj2Xq20qv/f+j8Gru/34t0LIW3z" } ] }, "tlogEntries": [ { - "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJzcGVjIjp7ImVudmVsb3BlSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjkzOWMyMWQ2NTNhYTk3OTk3ODMxMGY2ZTIzNDVkNWNjNjFkZTMyZjdkZjJlMWJhMjNlZDI4ZDkxY2U1YmVlNWQifSwicGF5bG9hZEhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiI0MjFhMDJjN2ZkNjE4YTFiZDZkMjliNzQ4MjQ2MGQwYjc1NGU0ZmNmOWE2NDI4N2Q0Zjg0NTBkNjA2Y2VkYjMxIn0sInNpZ25hdHVyZXMiOlt7InNpZ25hdHVyZSI6Ik1FUUNJQWM0YTY0d0lockpVZnRSUnNpQlNIQmovc3NORjdiVnlBNkZQcUpxUmMzUUFpQkJkeEl0V2I0V013UW5GWFVqWnl2bjdndVFTWmFZUlRvOVVLS2FPbXdBRFE9PSIsInZlcmlmaWVyIjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTjZWRU5EUVc1VFowRjNTVUpCWjBsSlF6UnNhbXAwZDI5dmRUaDNRMmRaU1V0dldrbDZhakJGUVhkSmQwNTZSVlpOUWsxSFFURlZSVU5vVFUwS1l6SnNibU16VW5aamJWVjFXa2RXTWsxU05IZElRVmxFVmxGUlJFVjRWbnBoVjJSNlpFYzVlVnBUTVhCaWJsSnNZMjB4YkZwSGJHaGtSMVYzU0doalRncE5hbGw0VFZSRmVVMUVaM2hPYWxVeFYyaGpUazFxV1hoTlZFVjVUVVJuZVU1NlZURlhha0ZCVFVacmQwVjNXVWhMYjFwSmVtb3dRMEZSV1VsTGIxcEpDbnBxTUVSQlVXTkVVV2RCUlhkYWMzZExjVUpKZUdGSWFHNXhSRkZzZFVKSk0wUnFUbFJyU1ZOeGQxWmFZbEZrWkVkM1RsVmlLMWhxSzNkQlRVbElZMlVLTUROMGFpOW9XRlpJY0RWUFdVTXZaMEpvWTAxQ2RGVTFXRzlJYlVWRVZFUXljVTlEUVZvNGQyZG5SMkpOUVRSSFFURlZaRVIzUlVJdmQxRkZRWGRKU0FwblJFRlVRbWRPVmtoVFZVVkVSRUZMUW1kbmNrSm5SVVpDVVdORVFYcEJaa0puVGxaSVUwMUZSMFJCVjJkQ1UxcHdVMGxMVmxsNFUxRjZkVEZxUW5CNENqQkNWRWxWVXpWclVHcENXVUpuVGxaSVVrVkNRV1k0UlZScVFrMW9hM0J2WkVoU2QyTjZiM1pNTW1Sd1pFZG9NVmxwTldwaU1qQjJXVmRPZEZwVE9UTUtZVmRTYmxwWVVYWk1iV1J3WkVkb01WbHBPVE5pTTBweVdtMTRkbVF6VFhaWmJsWndZa2RSZFdWWE1YTlJTRXBzV201TmRtRkhWbWhhU0UxMllsZEdjQXBpYWtFMVFtZHZja0puUlVWQldVOHZUVUZGUWtKRGRHOWtTRkozWTNwdmRrd3pVblpoTWxaMVRHMUdhbVJIYkhaaWJrMTFXakpzTUdGSVZtbGtXRTVzQ21OdFRuWmlibEpzWW01UmRWa3lPWFJOUkhOSFEybHpSMEZSVVVKbk56aDNRVkZuUlV4UmQzSmhTRkl3WTBoTk5reDVPVEJpTW5Sc1ltazFhRmt6VW5BS1lqSTFla3h0WkhCa1IyZ3hXVzVXZWxwWVNtcGlNalV3V2xjMU1FeHRUblppVkVGMVFtZHZja0puUlVWQldVOHZUVUZGVFVKRFFVMUliV2d3WkVoQ2VncFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVhRmt5TVd4TU0yUndXa2RrYkdSRVFsSkNaMjl5UW1kRlJVRlpUeTlOUVVWV1FrVk5UVkZYYURCa1NFSjZDazlwT0haYU1td3dZVWhXYVV4dFRuWmlVemxvV1RJeGJFd3paSEJhUjJSc1pFTTVhRmt6VW5CaU1qVjZURE5LTVdKdVRYWk5WRWw2VGtSVk1rNTZaelVLVFVNNWFHUklVbXhpV0VJd1kzazRlRTFCYjBkRFEzRkhVMDAwT1VKQlRVTkJNR05CVFVWUlEwbEdMM0F6VTNRMVNIWTFOVTR3ZUVGd2NuVjBMeXR0WndwR1VtazVOekUyS3pkaloyMHJNVzFFU1ZsVlRVRnBRWGxPU21RclVsUjJiVlptZWpKWlNGcHJNRXRxTUN0TVdHVllhazk0ZVVKbGJVNU9hSG92VFZwRkNuSjNQVDBLTFMwdExTMUZUa1FnUTBWU1ZFbEdTVU5CVkVVdExTMHRMUW89In1dfSwia2luZCI6ImRzc2UifQ==", + "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJzcGVjIjp7ImVudmVsb3BlSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjdjYzAwN2ZlYmIxMDliMDgwYjU3ODNmODVkZGEwYTAwNDIyYzM3NWRkOTA5YzEyZWQ2NmQzZTg0YjZmNWNmZjQifSwicGF5bG9hZEhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiI0MjFhMDJjN2ZkNjE4YTFiZDZkMjliNzQ4MjQ2MGQwYjc1NGU0ZmNmOWE2NDI4N2Q0Zjg0NTBkNjA2Y2VkYjMxIn0sInNpZ25hdHVyZXMiOlt7InNpZ25hdHVyZSI6Ik1FUUNJSE41N0xiNU1aWnJvajNOcFQ3eVVRR3NQOE1hYVAxbXhucXFvSWV5dmFyZUFpQnM1ck9NVjgxYTRHSnJYZmVVbFpTRlVVOFJzQktycjNIdlluVXEydVhhbnc9PSIsInZlcmlmaWVyIjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVTjZWRU5EUVc1VFowRjNTVUpCWjBsSlRYQTRaWE5sV1RsQ1dtOTNRMmRaU1V0dldrbDZhakJGUVhkSmQwNTZSVlpOUWsxSFFURlZSVU5vVFUwS1l6SnNibU16VW5aamJWVjFXa2RXTWsxU05IZElRVmxFVmxGUlJFVjRWbnBoVjJSNlpFYzVlVnBUTVhCaWJsSnNZMjB4YkZwSGJHaGtSMVYzU0doalRncE5hbGw0VFZSRmVrMVVVWHBPUkZVeFYyaGpUazFxV1hoTlZFVjZUVlJSTUU1VVZURlhha0ZCVFVacmQwVjNXVWhMYjFwSmVtb3dRMEZSV1VsTGIxcEpDbnBxTUVSQlVXTkVVV2RCUlZJdmNUaHNXbU5PU0ZaVlUwSllTRFkxVEdocFRFbHVjVVo1TkRWVkt6VlhNVVU0V21adFJpOXFhMEUxVjFCcFRXa3dTRXNLTlZrMVVUWnJSMnBaZGs4NU1sb3ZORTlaS3psR1NHZHpaRXRUWXpsUldETjZTMDlEUVZvNGQyZG5SMkpOUVRSSFFURlZaRVIzUlVJdmQxRkZRWGRKU0FwblJFRlVRbWRPVmtoVFZVVkVSRUZMUW1kbmNrSm5SVVpDVVdORVFYcEJaa0puVGxaSVUwMUZSMFJCVjJkQ1VXbHVOVVEyZGs5RlVXOWxMMFZoUjFGc0NuZElUR2gzUlVSb1ZWUkNXVUpuVGxaSVVrVkNRV1k0UlZScVFrMW9hM0J2WkVoU2QyTjZiM1pNTW1Sd1pFZG9NVmxwTldwaU1qQjJXVmRPZEZwVE9UTUtZVmRTYmxwWVVYWk1iV1J3WkVkb01WbHBPVE5pTTBweVdtMTRkbVF6VFhaWmJsWndZa2RSZFdWWE1YTlJTRXBzV201TmRtRkhWbWhhU0UxMllsZEdjQXBpYWtFMVFtZHZja0puUlVWQldVOHZUVUZGUWtKRGRHOWtTRkozWTNwdmRrd3pVblpoTWxaMVRHMUdhbVJIYkhaaWJrMTFXakpzTUdGSVZtbGtXRTVzQ21OdFRuWmlibEpzWW01UmRWa3lPWFJOUkhOSFEybHpSMEZSVVVKbk56aDNRVkZuUlV4UmQzSmhTRkl3WTBoTk5reDVPVEJpTW5Sc1ltazFhRmt6VW5BS1lqSTFla3h0WkhCa1IyZ3hXVzVXZWxwWVNtcGlNalV3V2xjMU1FeHRUblppVkVGMVFtZHZja0puUlVWQldVOHZUVUZGVFVKRFFVMUliV2d3WkVoQ2VncFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVhRmt5TVd4TU0yUndXa2RrYkdSRVFsSkNaMjl5UW1kRlJVRlpUeTlOUVVWV1FrVk5UVkZYYURCa1NFSjZDazlwT0haYU1td3dZVWhXYVV4dFRuWmlVemxvV1RJeGJFd3paSEJhUjJSc1pFTTVhRmt6VW5CaU1qVjZURE5LTVdKdVRYWk5WRWw2VGtSVk1rNTZaelVLVFVNNWFHUklVbXhpV0VJd1kzazRlRTFCYjBkRFEzRkhVMDAwT1VKQlRVTkJNR05CVFVWUlEwbERVWFZDUWxWUloydDFTSHBGTlhsSWJVVmlaRGQzYkFwWGJpODBiMkZqU21KSVdUazNURlJCYm1kbGRVRnBRVmcyTDBwamRubFBTR3RCTW5GSlZWSm9PRlZSUzBSWVVUTkNXVFlyTjFGUmIzUmhUMUZQYVVsT0NsbEJQVDBLTFMwdExTMUZUa1FnUTBWU1ZFbEdTVU5CVkVVdExTMHRMUW89In1dfSwia2luZCI6ImRzc2UifQ==", "inclusionPromise": { - "signedEntryTimestamp": "MEYCIQD7S9MjjeNGP8k+Au1oSd8DngwA459dDFydShh+5nzs0AIhAOHOjv8Va/a0cJlGBB0WbcTg3z7XWzRwtkqioYyzAKmn" + "signedEntryTimestamp": "MEYCIQDfaUvk9wP0tK+NORUv+AygLFjEBEgM35GjuCGC2AokiwIhAMLrjeZGMRSEIJnqjzfNgN5k/yCAL5o6f1mZRPwUE3bD" }, "inclusionProof": { "checkpoint": { - "envelope": "rekor.localhost - 123\n42\ne8L/DkKHcIo6dQRBcBXf0GYu0RyFLVz+t7A10OzSOLQ=\n\n— rekor.localhost VbgJJjBGAiEAgOa30MIA/fpAW+P3B6Nnc9UBJmAO00JkjfEL1G5yydsCIQD0rZVfLW/9WablMuCJofjeg5XV1AYodINoAG64N25+kQ==\n" + "envelope": "rekor.localhost - 123\n42\nPo7Lc+urbs3js9FW+5jxQHnfoXyISzQYxXvOCSapSbY=\n\n— rekor.localhost 45EjTzBEAiBtpRgNhs17rLeT0cbhMU5cw8kDlg7Pggbr6rVDzKmVmAIgLptcmGe6rFDyzYro3O71L3OFJeTJtKcFNUXm+5mkGYk=\n" }, - "rootHash": "e8L/DkKHcIo6dQRBcBXf0GYu0RyFLVz+t7A10OzSOLQ=", + "rootHash": "Po7Lc+urbs3js9FW+5jxQHnfoXyISzQYxXvOCSapSbY=", "treeSize": "1" }, - "integratedTime": "1794471535", + "integratedTime": "1794580615", "kindVersion": { "kind": "dsse", "version": "0.0.1" }, "logId": { - "keyId": "VbgJJh1uXk4PvCPZ3fIjaxUep33R8Z6T6wAJfVjz+BA=" + "keyId": "45EjT1abdD2MKrnHGSnayLaGvLNDQ4SRtMzNbF54fBc=" } } ] diff --git a/internal/intoto/verify.go b/internal/intoto/verify.go index 7c73fa495..4e7520547 100644 --- a/internal/intoto/verify.go +++ b/internal/intoto/verify.go @@ -36,6 +36,12 @@ type Policy struct { // AllowUnsigned accepts attestations with no signature, recorded as // unverified. AllowUnsigned bool + // RunInvocationURI narrows the signer to one CI run: the certificate must + // have been issued to the run at this run-invocation URI, in any of its + // attempts. No flag sets it. It goes with an identity that names a + // workflow whatever branch or pull request it runs on, which is only safe + // to trust for what the caller's own run attested. + RunInvocationURI string } // Validate checks the policy's parts make sense together. It needs nothing @@ -109,6 +115,11 @@ var ErrFailedVerification = errors.New("failed verification") // nothing about whether the signature is good. var ErrCannotVerify = errors.New("could not be verified") +// ErrOtherRun marks an attestation whose signature is good and whose signer +// the policy pins, but which was made by a run other than the one the policy +// is tied to. +var ErrOtherRun = errors.New("was made by another run") + // Verifier checks attestations against a policy. type Verifier struct { policy Policy @@ -125,7 +136,8 @@ func NewVerifier(policy Policy, trust *TrustRoots) *Verifier { // the policy pins. An empty digest checks the signature alone, for an // attestation recorded on a trail rather than an artifact. A signature that // does not verify is an ErrFailedVerification; one that cannot be checked is -// an ErrCannotVerify. +// an ErrCannotVerify; a good one from a run the policy is not tied to is an +// ErrOtherRun. func (v *Verifier) Verify(a *Attestation, digest string) (*Evidence, error) { if digest != "" { if err := a.RequireSubject(digest); err != nil { @@ -160,6 +172,13 @@ func (v *Verifier) Verify(a *Attestation, digest string) (*Evidence, error) { evidence.SignerIssuer = summary.Issuer evidence.RunInvocationURI = summary.RunInvocationURI } + if run := v.policy.RunInvocationURI; run != "" && !sameRun(evidence.RunInvocationURI, run) { + madeBy := evidence.RunInvocationURI + if madeBy == "" { + madeBy = "its certificate names no run" + } + return nil, fmt.Errorf("%s %w: %s, signed as %s", a.Describe(), ErrOtherRun, madeBy, evidence.SignerIdentity) + } for _, ts := range result.VerifiedTimestamps { switch ts.Type { case "Tlog": diff --git a/internal/intoto/verify_test.go b/internal/intoto/verify_test.go index e44fc9ba8..00a6328e8 100644 --- a/internal/intoto/verify_test.go +++ b/internal/intoto/verify_test.go @@ -122,6 +122,68 @@ func TestVerifySignedBundle(t *testing.T) { }) } +// ownRunSigner trusts the repository's workflows, as its identity matches them +// on any branch or pull request, but only for what the run at fixtureRunURI +// attested. +var ownRunSigner = Policy{ + CertificateIdentityRegexp: `^https://github\.com/acme/widget/\.github/workflows/`, + CertificateOIDCIssuer: fixtureIssuer, + RunInvocationURI: fixtureRunURI, +} + +func TestVerifyUnderAPolicyTiedToARun(t *testing.T) { + t.Run("accepts an attestation the run made", func(t *testing.T) { + evidence, err := verifyFixture(t, ownRunSigner, "github-provenance.sigstore.json") + require.NoError(t, err) + require.True(t, evidence.Verified) + }) + + t.Run("accepts an attestation another attempt of the run made", func(t *testing.T) { + evidence, err := verifyFixture(t, ownRunSigner, "rerun-provenance.sigstore.json") + require.NoError(t, err) + require.Equal(t, fixtureRerunURI, evidence.RunInvocationURI) + }) + + t.Run("accepts an attestation the run made when the repository's name differs only in its letters' case, as GitHub's names do", func(t *testing.T) { + policy := ownRunSigner + policy.RunInvocationURI = "https://github.com/Acme/Widget/actions/runs/1234567890/attempts/1" + _, err := verifyFixture(t, policy, "github-provenance.sigstore.json") + require.NoError(t, err) + }) + + for name, tc := range map[string]struct{ fixture, runURI, identity string }{ + "a branch": {"branch-provenance.sigstore.json", fixtureBranchRunURI, fixtureBranchIdentity}, + "a pull request": {"pull-request-provenance.sigstore.json", fixturePullRequestRunURI, fixturePullRequestIdentity}, + } { + t.Run("refuses an attestation another run made from "+name+", naming the run and the signer", func(t *testing.T) { + _, err := verifyFixture(t, ownRunSigner, tc.fixture) + require.ErrorIs(t, err, ErrOtherRun) + require.NotErrorIs(t, err, ErrFailedVerification) + require.EqualError(t, err, "the attestation was made by another run: "+tc.runURI+", signed as "+tc.identity) + }) + } + + t.Run("refuses an attestation another run made though the same workflow on the same branch signed it", func(t *testing.T) { + policy := ownRunSigner + policy.RunInvocationURI = "https://github.com/acme/widget/actions/runs/42/attempts/1" + _, err := verifyFixture(t, policy, "github-provenance.sigstore.json") + require.ErrorIs(t, err, ErrOtherRun) + }) + + t.Run("still refuses another signer's attestation as a failed verification", func(t *testing.T) { + _, err := verifyFixture(t, ownRunSigner, "wrong-signer-provenance.sigstore.json") + require.ErrorIs(t, err, ErrFailedVerification) + require.NotErrorIs(t, err, ErrOtherRun) + }) + + t.Run("accepts an attestation from any run when the policy names none", func(t *testing.T) { + policy := ownRunSigner + policy.RunInvocationURI = "" + _, err := verifyFixture(t, policy, "branch-provenance.sigstore.json") + require.NoError(t, err) + }) +} + func TestVerifyKeySignedEnvelope(t *testing.T) { t.Run("verifies a DSSE envelope with the key that signed it", func(t *testing.T) { evidence, err := verifyFixture(t, Policy{KeyPath: filepath.Join("testdata", "key.pub")}, "key-signed-provenance.dsse.json") @@ -329,6 +391,13 @@ func TestFind(t *testing.T) { require.ErrorContains(t, err, "attestation 2 failed verification: ") }) + t.Run("refuses the file when another run made a candidate and the policy is tied to a run, though this run made one too", func(t *testing.T) { + source := BundleFile{Path: jsonlFile(t, "github-provenance.sigstore.json", "branch-provenance.sigstore.json")} + _, err := Find(source, KindProvenance, artifactDigest, NewVerifier(ownRunSigner, fixtureTrust(t))) + require.ErrorIs(t, err, ErrOtherRun) + require.ErrorContains(t, err, "attestation 2 was made by another run: ") + }) + t.Run("names every candidate that failed verification", func(t *testing.T) { path := jsonlFile(t, "wrong-signer-provenance.sigstore.json", "tampered-provenance.sigstore.json") @@ -442,6 +511,37 @@ func TestFindBySourceSelection(t *testing.T) { require.Equal(t, fixtureRunURI, found.Evidence.RunInvocationURI) }) + t.Run("chooses the run's own attestation under a policy tied to the run, without reporting what other runs made", func(t *testing.T) { + found, err := find(t, ownRunSigner, fixtureRunURI, "branch-provenance.sigstore.json", "github-provenance.sigstore.json", "pull-request-provenance.sigstore.json") + require.NoError(t, err) + require.Equal(t, 2, found.Position) + require.Equal(t, fixtureIdentity, found.Evidence.SignerIdentity) + require.Empty(t, found.Rejected) + }) + + t.Run("still reports another signer's attestation beside the run's own", func(t *testing.T) { + found, err := find(t, ownRunSigner, fixtureRunURI, "wrong-signer-provenance.sigstore.json", "branch-provenance.sigstore.json", "github-provenance.sigstore.json") + require.NoError(t, err) + require.Equal(t, 3, found.Position) + require.Len(t, found.Rejected, 1) + require.ErrorContains(t, found.Rejected[0], "attestation 1 failed verification: ") + }) + + t.Run("records nothing under a policy tied to the run when only other runs attested, though theirs are newer and validly signed", func(t *testing.T) { + _, err := find(t, ownRunSigner, fixtureRunURI, "branch-provenance.sigstore.json", "pull-request-provenance.sigstore.json") + require.ErrorIs(t, err, ErrOtherRun) + require.ErrorContains(t, err, ": 2 attestations could not be accepted: attestation 1 was made by another run: "+fixtureBranchRunURI+", signed as "+fixtureBranchIdentity+ + "; attestation 2 was made by another run: "+fixturePullRequestRunURI+", signed as "+fixturePullRequestIdentity) + }) + + t.Run("names another run's attestation beside one that failed verification when none is accepted", func(t *testing.T) { + _, err := find(t, ownRunSigner, fixtureRunURI, "branch-provenance.sigstore.json", "wrong-signer-provenance.sigstore.json") + require.ErrorIs(t, err, ErrOtherRun) + require.ErrorIs(t, err, ErrFailedVerification) + require.ErrorContains(t, err, ": 2 attestations could not be accepted: attestation 1 was made by another run: ") + require.ErrorContains(t, err, "; attestation 2 failed verification: ") + }) + t.Run("chooses the newest when none is from the run it is part of", func(t *testing.T) { found, err := find(t, pinnedSigner, "https://github.com/acme/widget/actions/runs/42/attempts/1", "github-provenance.sigstore.json", "rerun-provenance.sigstore.json") require.NoError(t, err)