Plugin for Helm to integrate the sigstore ecosystem

Last update: Dec 21, 2022

Related tags

Overview

helm-sigstore

Plugin for Helm to integrate the sigstore ecosystem. Search, upload and verify signed Helm Charts in the Rekor Transparency Log.

Info

helm-sigstore is developed as part of the sigstore project.

We also use a slack channel! Click here for the invite link.

Installation

Use the following steps to build the helm-sigstore binary and install it as a Helm Plugin

Building

On a system with Go installed, execute the following to download the source and build the plugin

$ mkdir -p $GOPATH/src/github.com/sigstore
$ cd $GOPATH/src/github.com/sigstore
$ git clone https://github.com/sigstore/helm-sigstore.git
$ cd helm-sigstore

Build the plugin

$ make

The plugin binary will be available in the bin directory

Plugin Installation

Before installing helm-sigstore as a Helm plugin, ensure that Helm is installed and configured on your machine. Then install the plugin.

$ helm plugin install https://github.com/sigstore/helm-sigstore

Confirm the plugin is available in Helm

$ helm plugin list

NAME            VERSION         DESCRIPTION                                                                  
sigstore        0.1.0           This plugin integrates Helm into the Sigstore ecosystem.

With the installation complete and successful, the plugin can be invoked through the helm sigstore command

$ helm sigstore

Integrates sigstore with Helm

Usage:
  sigstore [command]
...

Quickstart

This brief example demonstrates how to upload a signed Helm chart to Rekor and validate the entry

Upload a Signed Helm Chart

$ helm sigstore upload <path_to_packaged_chart>

Created Helm entry at index 6821, available at: https://rekor.sigstore.dev/api/v1/log/entries/b30a142ef6c8b0480cd3e081fc99bc3d2a1a50ef60f68749c983a1479be6c4b9

NOTE: The provenance file must be located in the same directory as the packaged chart

Verify the Signed Chart from Rekor

Use the same signed Helm chart from the prior section to verify the entry in Rekor

helm sigstore verify <path_to_packaged_chart>
Chart Verified Successfully From Helm entry:

Rekor Server: https://rekor.sigstore.dev
Rekor Index: 6821
Rekor UUID: b30a142ef6c8b0480cd3e081fc99bc3d2a1a50ef60f68749c983a1479be6c4b9

See the Usage documentation for detailed explanations and additional options.

Security

Should you discover any security issues, please refer to sigstores security process

Comments

Bump github.com/sigstore/rekor from 0.11.0 to 0.12.2
Bumps github.com/sigstore/rekor from 0.11.0 to 0.12.2.

Release notes

Sourced from github.com/sigstore/rekor's releases.

v0.12.2

What's Changed

add changelog for 0.12.0 and 0.12.1 by @cpanato in sigstore/rekor#1064

add description on /api/v1/index/retrieve endpoint by @bobcallaway in sigstore/rekor#1073

Adding e2e test coverage by @cdris in sigstore/rekor#1071

export rekor build/version information by @cpanato in sigstore/rekor#1074

Use POST instead of GET for /api/log/entries/retrieve metrics. by @var-sdk in sigstore/rekor#1083

Search through all shards when searching by hash by @priyawadhwa in sigstore/rekor#1082

Full Changelog: https://github.com/sigstore/rekor/compare/v0.12.1...v0.12.2

v0.12.1

Highlights

** Rekor ** v0.12.1 comes with a breaking change to rekor-cli v0.12.1. Users of rekor-cli MUST upgrade to the latest version The addition of the intotov2 created a breaking change for the rekor-cli

What's Changed

fix: fix harness tests with intoto v0.0.2 by @asraa in sigstore/rekor#1052

feat: add file based signer and password by @asraa in sigstore/rekor#1049

Adds new rekor metrics for latency and QPS. by @var-sdk in sigstore/rekor#1059

New Contributors

@var-sdk made their first contribution in sigstore/rekor#1059

Full Changelog: https://github.com/sigstore/rekor/compare/v0.12.0...v0.12.1

Thanks for all contributors!

v0.12.0

What's Changed

update changelog for 0.11.0 by @cpanato in sigstore/rekor#989

bump sigstore/sigstore from 1.2.1 to 1.4.0 by @k4leung4 in sigstore/rekor#985

check supportedVersions list rather than directly reading from version map by @bobcallaway in sigstore/rekor#1003

enable blocking specific pluggable type versions from being inserted into the log by @bobcallaway in sigstore/rekor#1004

api.SearchLogQueryHandler thread safety by @cdris in sigstore/rekor#1006

'docker compose' to 'docker-compose' by @bobcallaway in sigstore/rekor#1009

Intoto v0.0.2 by @pxp928 in sigstore/rekor#973

Add bounds on number of elements in api/v1/log/entries/retrieve by @priyawadhwa in sigstore/rekor#1011

Change Checkpoint origin to be "Hostname - Tree ID" by @haydentherapper in sigstore/rekor#1013

feat: add verification functions by @asraa in sigstore/rekor#986

Validate tree ID on calls to /api/v1/log/entries/retrieve by @priyawadhwa in sigstore/rekor#1017

Include checkpoint (STH) in entry upload and retrieve responses by @haydentherapper in sigstore/rekor#1015

fix: use entry uuid uniformly in return responses by @asraa in sigstore/rekor#1012

remove /api/v1/version endpoint by @bobcallaway in sigstore/rekor#1022

upgrade to go1.19 by @cpanato in sigstore/rekor#1018

update to go-swagger v0.30.2 by @bobcallaway in sigstore/rekor#1028

Fix rekor-cli backwards incompatibility & run harness tests against HEAD by @priyawadhwa in sigstore/rekor#1030

... (truncated)

Changelog

Sourced from github.com/sigstore/rekor's changelog.

v0.12.2

Enhancements

add changelog for 0.12.0 and 0.12.1 (#1064)

add description on /api/v1/index/retrieve endpoint (#1073)

Adding e2e test coverage (#1071)

export rekor build/version information (#1074)

Bug Fixes

Search through all shards when searching by hash (#1082)

Use POST instead of GET for /api/log/entries/retrieve metrics (#1083)

Contributors

Bob Callaway

Carlos Tadeu Panato Junior

Ceridwen Driskill

Simon Kent

Priya Wadhwa

v0.12.1

** Rekor v0.12.1 comes with a breaking change to rekor-cli v0.12.1. Users of rekor-cli MUST upgrade to the latest version ** The addition of the intotov2 created a breaking change for the rekor-cli

Enhancements

Adds new rekor metrics for latency and QPS. (sigstore/rekor#1059)

feat: add file based signer and password (sigstore/rekor#1049)

Bug Fixes

fix: fix harness tests with intoto v0.0.2 (sigstore/rekor#1052)

Contributors

Asra Ali (@asraa)

Simon Kent (@var-sdk)

v0.12.0

Enhancements

remove /api/v1/version endpoint (sigstore/rekor#1022)

Include checkpoint (STH) in entry upload and retrieve responses (sigstore/rekor#1015)

Validate tree ID on calls to /api/v1/log/entries/retrieve (sigstore/rekor#1017)

feat: add verification functions (sigstore/rekor#986)

Change Checkpoint origin to be "Hostname - Tree ID" (sigstore/rekor#1013)

Add bounds on number of elements in api/v1/log/entries/retrieve (sigstore/rekor#1011)

Intoto v0.0.2 (sigstore/rekor#973)

api.SearchLogQueryHandler thread safety (sigstore/rekor#1006)

... (truncated)

Commits

b2e7ec9 Update CHANGELOG.md for 0.12.2 release

838f40b Search through all shards when searching by hash (#1082)

ca2dce6 Use POST instead of GET for /api/log/entries/retrieve metrics (#1083)

204d9af Bump ossf/scorecard-action from 2.0.3 to 2.0.4 (#1081)

1df8e51 Bump actions/github-script from 6.2.0 to 6.3.0 (#1079)

6904cff Bump sigstore/cosign-installer from 2.6.0 to 2.7.0 (#1077)

5ebde78 Bump actions/dependency-review-action from 2.3.0 to 2.4.0 (#1076)

851ee7e Bump github.com/go-swagger/go-swagger in /hack/tools (#1078)

f3daebb export rekor build/version information (#1074)

f989b43 Adding e2e test coverage (#1071)

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies go
opened by dependabot[bot] 8
Security Policy violation Branch Protection

This issue was automatically created by Allstar.

Security Policy Violation Dismiss stale reviews not configured for branch main Block force push not configured for branch main

This issue will auto resolve when the policy is in compliance.

Issue created by Allstar. See https://github.com/ossf/allstar/ for more information. For questions specific to the repository, please contact the owner or maintainer.
allstar

opened by allstar-app[bot] 8
add arm64 to be downloaded when using helm plugin install
Summary

add arm64 to be downloaded when using helm plugin install

Ticket Link

Fixes #34

cc @strongjz

Release Note

add arm64 to be downloaded when using helm plugin install
opened by cpanato 2
add goreleaser and update release job
Summary

add goreleaser and update release job

Ticket Link

Fixes: https://github.com/sigstore/helm-sigstore/issues/26

Release Note

add goreleaser and update release job
opened by cpanato 2
Bump github.com/go-openapi/strfmt from 0.20.1 to 0.20.3
Bumps github.com/go-openapi/strfmt from 0.20.1 to 0.20.3.

Commits

cdff709 Merge pull request #86 from dimovnike/85-bson-precision-loss

e143a57 issue-85: DateTime.MarshalBSONValue() was losing milliseconds

583b813 Merge pull request #84 from dimovnike/83-objectid-hex

f9b2b7b issue-83: ObjectId.String() breaks swagger validation and CLI

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies
opened by dependabot[bot] 2
Bump github.com/go-openapi/runtime from 0.19.29 to 0.20.0
Bumps github.com/go-openapi/runtime from 0.19.29 to 0.20.0.

Commits

2f6d5dc update github actions

f7fb72b Update go.mod

2bc043c Merge pull request #216 from jkawamoto/215

b3931df Stop preparing the request if an error occurs

715c788 Merge pull request #214 from jkawamoto/213

6a7287f Avoid copying the whole file into RAM to detect its content type

e518b0a Merge pull request #212 from jsilland/julien/207-again

c83326f Adds support for query parameters in path patterns

d555223 Merge pull request #211 from germanhs/master

4444a78 Merge branch 'master' into master

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies
opened by dependabot[bot] 2
Bump actions/checkout from 3.1.0 to 3.2.0
Bumps actions/checkout from 3.1.0 to 3.2.0.

Release notes

Sourced from actions/checkout's releases.

v3.2.0

What's Changed

Add GitHub Action to perform release by @rentziass in actions/checkout#942

Fix status badge by @ScottBrenner in actions/checkout#967

Replace datadog/squid with ubuntu/squid Docker image by @cory-miller in actions/checkout#1002

Wrap pipeline commands for submoduleForeach in quotes by @jokreliable in actions/checkout#964

Update @actions/io to 1.1.2 by @cory-miller in actions/checkout#1029

Upgrading version to 3.2.0 by @vmjoseph in actions/checkout#1039

New Contributors

@ScottBrenner made their first contribution in actions/checkout#967

@cory-miller made their first contribution in actions/checkout#1002

@jokreliable made their first contribution in actions/checkout#964

@vmjoseph made their first contribution in actions/checkout#1039

Full Changelog: https://github.com/actions/checkout/compare/v3...v3.2.0

Commits

755da8c 3.2.0 (#1039)

26d48e8 Update @actions/io to 1.1.2 (#1029)

bf08527 wrap pipeline commands for submoduleForeach in quotes (#964)

5c3ccc2 Replace datadog/squid with ubuntu/squid Docker image (#1002)

1f9a0c2 README - fix status badge (#967)

8230315 Add workflow to update a main version (#942)

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies github_actions
opened by dependabot[bot] 1
Bump github.com/sigstore/rekor from 0.11.0 to 0.12.1
Bumps github.com/sigstore/rekor from 0.11.0 to 0.12.1.

Release notes

Sourced from github.com/sigstore/rekor's releases.

v0.12.1

What's Changed

fix: fix harness tests with intoto v0.0.2 by @asraa in sigstore/rekor#1052

feat: add file based signer and password by @asraa in sigstore/rekor#1049

Adds new rekor metrics for latency and QPS. by @var-sdk in sigstore/rekor#1059

New Contributors

@var-sdk made their first contribution in sigstore/rekor#1059

Full Changelog: https://github.com/sigstore/rekor/compare/v0.12.0...v0.12.1

Thanks for all contributors!

v0.12.0

What's Changed

update changelog for 0.11.0 by @cpanato in sigstore/rekor#989

bump sigstore/sigstore from 1.2.1 to 1.4.0 by @k4leung4 in sigstore/rekor#985

check supportedVersions list rather than directly reading from version map by @bobcallaway in sigstore/rekor#1003

enable blocking specific pluggable type versions from being inserted into the log by @bobcallaway in sigstore/rekor#1004

api.SearchLogQueryHandler thread safety by @cdris in sigstore/rekor#1006

'docker compose' to 'docker-compose' by @bobcallaway in sigstore/rekor#1009

Intoto v0.0.2 by @pxp928 in sigstore/rekor#973

Add bounds on number of elements in api/v1/log/entries/retrieve by @priyawadhwa in sigstore/rekor#1011

Change Checkpoint origin to be "Hostname - Tree ID" by @haydentherapper in sigstore/rekor#1013

feat: add verification functions by @asraa in sigstore/rekor#986

Validate tree ID on calls to /api/v1/log/entries/retrieve by @priyawadhwa in sigstore/rekor#1017

Include checkpoint (STH) in entry upload and retrieve responses by @haydentherapper in sigstore/rekor#1015

fix: use entry uuid uniformly in return responses by @asraa in sigstore/rekor#1012

remove /api/v1/version endpoint by @bobcallaway in sigstore/rekor#1022

upgrade to go1.19 by @cpanato in sigstore/rekor#1018

update to go-swagger v0.30.2 by @bobcallaway in sigstore/rekor#1028

Fix rekor-cli backwards incompatibility & run harness tests against HEAD by @priyawadhwa in sigstore/rekor#1030

Fix harness tests @ main by @priyawadhwa in sigstore/rekor#1038

Fetch all tags in harness tests by @priyawadhwa in sigstore/rekor#1039

fix retrieve endpoint response code and add testing by @asraa in sigstore/rekor#1043

update go builder to go1.19.1 by @cpanato in sigstore/rekor#1044

New Contributors

@cdris made their first contribution in sigstore/rekor#1006

@pxp928 made their first contribution in sigstore/rekor#973

Full Changelog: https://github.com/sigstore/rekor/compare/v0.11.0...v0.12.0

Commits

584bc16 Bump actions/dependency-review-action from 2.1.0 to 2.2.0 (#1063)

b2cd790 Bump codecov/codecov-action from 3.1.0 to 3.1.1 (#1061)

f27af35 Adds new rekor metrics for latency and QPS. (#1059)

8260a79 Bump github.com/go-playground/validator/v10 from 10.11.0 to 10.11.1 (#1058)

2d16546 Bump github/codeql-action from 2.1.23 to 2.1.24 (#1057)

4bb6f44 feat: add file based signer and password (#1049)

f1b8bae Bump github/codeql-action from 2.1.22 to 2.1.23 (#1053)

689924f Bump golang from 4c8f4b8 to 02f2932 (#1050)

e0853da fix: fix harness tests with intoto v0.0.2 (#1052)

e7dc6c5 Bump github.com/sigstore/sigstore from 1.4.0 to 1.4.1 (#1048)

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies go
opened by dependabot[bot] 1
Bump github.com/sigstore/rekor from 0.11.0 to 0.12.0
Bumps github.com/sigstore/rekor from 0.11.0 to 0.12.0.

Commits

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies go
opened by dependabot[bot] 1
Bump github.com/go-openapi/swag from 0.22.0 to 0.22.3
Bumps github.com/go-openapi/swag from 0.22.0 to 0.22.3.

Commits

0579829 fix detecting yaml timestamp

bf6952f also support timestamp values

3fa115d add support for alias node

622d9a7 add jsonmapslice yaml marshal

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies go
opened by dependabot[bot] 1
Bump github.com/go-openapi/swag from 0.22.0 to 0.22.1
Bumps github.com/go-openapi/swag from 0.22.0 to 0.22.1.

Commits

3fa115d add support for alias node

622d9a7 add jsonmapslice yaml marshal

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies go
opened by dependabot[bot] 1
Use SLSA 3 Go Builder

Closes #102

Summary

This PR replaces the old Go Releaser build to the SLSA 3 Go Builder which is based on Go Releaser.

To also cover all the other important release artifacts other than the binary, such as SBOM and Signing Build, I've created SBOM using SYFT (same as the Go Releaser used to generate the SBOM). I've also generate provenance to the SBOM.

To sign the binaries I've also used the sigstore cosign with keyless config.

Here is an example of the release https://github.com/joycebrum/helm-sigstore/releases/tag/v1.0.17 and the action that created it https://github.com/joycebrum/helm-sigstore/actions/runs/3795159339

Any doubts or concerns let me know.

Release Note

Updated build process to generate provenance in a trustful builder.

Documentation

Not necessary

opened by joycebrum 2
Generate SLSA 3 Provenance
Description

Hi, I am Joyce, working on behalf of Google and the Open Source Security Foundation (OpenSSF) to help open source projects to improve their supply chain security.

I would like to offer help to config helm-sigstore's builds to generate a SLSA Level 3 Provenance. The Supply chain Levels for Software Artifacts, or SLSA (salsa) aims to improve security in the build process, to do that it has defined 4 levels of build integrity.

I would suggest, since it seems you already user goreleaser to build and release on github, to use the SLSA Go Builder which do the same as the goreleaser but also generates and sign the artifacts, besides being a Level 3 build process.

Are you open to a PR with these changes?

It could also contain changes on the README with:

A SLSA Level 3 badge

A brief paragraph to end-user know how to verify the artifact integrity using the provenance.

enhancement
opened by joycebrum 2
deal with deprecation of x/crypto/openpgp

Description

Per https://github.com/golang/go/issues/44226 golang.org/x/crypto/openpgp is now frozen and deprecated. We should look to switch to a different implementation to ensure we stay up to date as best we can with this technology.

similar to https://github.com/sigstore/rekor/issues/286
enhancement help wanted dependencies

opened by cpanato 1