b149223223
Great blog post! I added it to the documentation of the https://github.com/slsa-framework/slsa-github-generator :) This PR fixes the command to verify SLSA provenance in the blog post https://goreleaser.com/blog/slsa-generation-for-your-artifacts/. The verification for binary artifacts is correct. The verification for container images is incorrect: - The command verifies the identity of the builder only, but it should also verify the source repository - The command does not verify the release version, which _may_ allows an attacker to perform a downgrade attack. (not a super big deal, but still useful to close this gap if the image was built on a tag trigger) This follows the same steps on argoCD's documentation https://argo-cd.readthedocs.io/en/stable/operator-manual/signed-release-assets/#verification-of-container-image-with-slsa-attestations Thanks! --------- Signed-off-by: laurentsimon <laurentsimon@google.com>
GoReleaser
Deliver Go binaries as fast and easily as possible.
GoReleaser builds Go binaries for several platforms, creates a GitHub release and then pushes a Homebrew formula to a tap repository. All that wrapped in your favorite CI.
Get GoReleaser
Documentation
Documentation is hosted live at https://goreleaser.com
Community
You have questions, need support and or just want to talk about GoReleaser?
Here are ways to get in touch with the GoReleaser community:
You can find the links above and all others here.
Code of Conduct
This project adheres to the Contributor Covenant code of conduct. By participating, you are expected to uphold this code. We appreciate your contribution. Please refer to our contributing guidelines for further information.
Badges
GitHub Sponsors
High-tier sponsors of @caarlos0 on GitHub:
OpenCollective
Sponsors
Does your company use goreleaser? Help keep the project bug-free and feature rich by sponsoring the project.
Backers
Love our work and community? Become a backer.
Contributors
This project exists thanks to all the people who contribute. [Contribute].
Stargazers over time
