-
Notifications
You must be signed in to change notification settings - Fork 5.7k
New issue
Have a question about this project?Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of serviceand privacy statement.We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
gh attestation verify
test for custom OIDC issuers
#9595
Conversation
Hi! Thanks for the pull request. Please ensure that this change is linked to an issue by mentioning an issue number in the description of the pull request. If this pull request would close the issue, please put the word 'Fixes' before the issue number somewhere in the pull request body. If this is a tiny change like fi xing a typo, feel free to ignore this message. |
59f2a8b
to
b15c5e9
Compare
The file being attested appears to be binary, would you mind changing that to a text file? Having binary files in a repo (even for tests) can be seen suspicious. Especially with the recent |
@kommendorkaptenmy first attempt at this had a text file as the subject but I couldn't get the tests to pass when running under Windows -- I suspect the line endings were being changed somewhere in the process. Using a binary file solved the issue, but I'll give it another try. |
How about creating a file with only one line and no newlines? I guess the content doesn't really matter here so a silly file like that should work I think. |
b293168
to
201b85c
Compare
Signed-off-by: Brian DeHamer <bdehamer@github >
201b85c
to
f128ae8
Compare
This PR contains the following updates: | Package | Update | Change | |---|---|---| | [cli/cli](https://redirect.github /cli/cli) | minor | `v2.56.0` -> `v2.57.0` | --- ### Release Notes <details> <summary>cli/cli (cli/cli)</summary> ### [`v2.57.0`](https://redirect.github /cli/cli/releases/tag/v2.57.0): GitHub CLI 2.57.0 [Compare Source](https://redirect.github /cli/cli/compare/v2.56.0...v2.57.0) #### What's Changed - Move non-integration tests to different test file by [@​codysoyland](https://redirect.github /codysoyland) in [https://github /cli/cli/pull/9577](https://redirect.github /cli/cli/pull/9577) - Added tenancy aware attestation commands by [@​kommendorkapten](https://redirect.github /kommendorkapten) in [https://github /cli/cli/pull/9542](https://redirect.github /cli/cli/pull/9542) - Added `--active` flag to the `gh auth status` command by [@​velumuruganr](https://redirect.github /velumuruganr) in [https://github /cli/cli/pull/9520](https://redirect.github /cli/cli/pull/9520) - build(deps): bump github /sigstore/sigstore-go from 0.6.1 to 0.6.2 by [@​dependabot](https://redirect.github /dependabot) in [https://github /cli/cli/pull/9601](https://redirect.github /cli/cli/pull/9601) - `gh attestation verify` test for custom OIDC issuers by [@​bdehamer](https://redirect.github /bdehamer) in [https://github /cli/cli/pull/9595](https://redirect.github /cli/cli/pull/9595) - Suggest installing Rosetta when extension installation fails due to missing `darwin-arm64` binary, but a `darwin-amd64` binary is available by [@​timrogers](https://redirect.github /timrogers) in [https://github /cli/cli/pull/9599](https://redirect.github /cli/cli/pull/9599) - Update `gh attestation verify` bundle parsing and validation errors by [@​malancas](https://redirect.github /malancas) in [https://github /cli/cli/pull/9564](https://redirect.github /cli/cli/pull/9564) - Suppress `attestation verify` output when no TTY present by [@​bdehamer](https://redirect.github /bdehamer) in [https://github /cli/cli/pull/9612](https://redirect.github /cli/cli/pull/9612) - Use api subdomains for tenant hosts by [@​williammartin](https://redirect.github /williammartin) in [https://github /cli/cli/pull/9618](https://redirect.github /cli/cli/pull/9618) #### New Contributors - [@​kommendorkapten](https://redirect.github /kommendorkapten) made their first contribution in [https://github /cli/cli/pull/9542](https://redirect.github /cli/cli/pull/9542) - [@​velumuruganr](https://redirect.github /velumuruganr) made their first contribution in [https://github /cli/cli/pull/9520](https://redirect.github /cli/cli/pull/9520) - [@​bdehamer](https://redirect.github /bdehamer) made their first contribution in [https://github /cli/cli/pull/9595](https://redirect.github /cli/cli/pull/9595) - [@​timrogers](https://redirect.github /timrogers) made their first contribution in [https://github /cli/cli/pull/9599](https://redirect.github /cli/cli/pull/9599) **Full Changelog**:cli/cli@v2.56.0...v2.57.0 </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/izumin5210/dotfiles). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOC44MC4wIiwidXBkYXRlZEluVmVyIjoiMzguODAuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==--> --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github > Co-authored-by: izumin5210-update-aqua-checksum[bot] <169593670+izumin5210-update-aqua-checksum[bot]@users.noreply.github >
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Cool
Ok |
This MR contains the following updates: | Package | Update | Change | |---|---|---| | [cli/cli](https://github /cli/cli) | minor | `v2.55.0` -> `v2.57.0` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab /el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>cli/cli (cli/cli)</summary> ### [`v2.57.0`](https://github /cli/cli/releases/tag/v2.57.0): GitHub CLI 2.57.0 [Compare Source](cli/cli@v2.56.0...v2.57.0) #### What's Changed - Move non-integration tests to different test file by [@​codysoyland](https://github /codysoyland) incli/cli#9577 - Added tenancy aware attestation commands by [@​kommendorkapten](https://github /kommendorkapten) incli/cli#9542 - Added `--active` flag to the `gh auth status` command by [@​velumuruganr](https://github /velumuruganr) incli/cli#9520 - build(deps): bump github /sigstore/sigstore-go from 0.6.1 to 0.6.2 by [@​dependabot](https://github /dependabot) incli/cli#9601 - `gh attestation verify` test for custom OIDC issuers by [@​bdehamer](https://github /bdehamer) incli/cli#9595 - Suggest installing Rosetta when extension installation fails due to missing `darwin-arm64` binary, but a `darwin-amd64` binary is available by [@​timrogers](https://github /timrogers) incli/cli#9599 - Update `gh attestation verify` bundle parsing and validation errors by [@​malancas](https://github /malancas) incli/cli#9564 - Suppress `attestation verify` output when no TTY present by [@​bdehamer](https://github /bdehamer) incli/cli#9612 - Use api subdomains for tenant hosts by [@​williammartin](https://github /williammartin) incli/cli#9618 #### New Contributors - [@​kommendorkapten](https://github /kommendorkapten) made their first contribution incli/cli#9542 - [@​velumuruganr](https://github /velumuruganr) made their first contribution incli/cli#9520 - [@​bdehamer](https://github /bdehamer) made their first contribution incli/cli#9595 - [@​timrogers](https://github /timrogers) made their first contribution incli/cli#9599 **Full Changelog**:cli/cli@v2.56.0...v2.57.0 ### [`v2.56.0`](https://github /cli/cli/releases/tag/v2.56.0): GitHub CLI 2.56.0 [Compare Source](cli/cli@v2.55.0...v2.56.0) #### Important note about renewed GPG key The Debian and RedHat releases have been signed with a new GPG key. If you are experiencing issues updating your `.deb` or `.rpm` packages, please read [cli/cli#9569](cli/cli#9569). #### What's Changed - Always print URL scheme to stdout by [@​heaths](https://github /heaths) incli/cli#9471 - Quote repo names consistently in `gh repo sync` stdout by [@​muzimuzhi](https://github /muzimuzhi) incli/cli#9491 - Fetch bundle from OCI registry for verify by [@​ejahnGithub](https://github /ejahnGithub) incli/cli#9421 - Remove `Internal` from `gh repo create` prompt when owner is not an org by [@​jtmcg](https://github /jtmcg) incli/cli#9465 - Drop surplus trailing space char in flag names in web by [@​muzimuzhi](https://github /muzimuzhi) incli/cli#9495 - fix the trimming of log filenames for `gh run view` by [@​benebsiny](https://github /benebsiny) incli/cli#9482 - "offline" verification using the bundle of attestations without any additional handling of the file by [@​aryanbhosale](https://github /aryanbhosale) incli/cli#9523 - build(deps): bump actions/attest-build-provenance from 1.4.1 to 1.4.2 by [@​dependabot](https://github /dependabot) incli/cli#9518 - Fix doc typo for `repo sync` by [@​muzimuzhi](https://github /muzimuzhi) incli/cli#9509 - Correct the help message for -F by [@​Goooler](https://github /Goooler) incli/cli#9525 - chore: fix some function names by [@​crystalstall](https://github /crystalstall) incli/cli#9555 - verify 2nd artifact without swapping order by [@​aryanbhosale](https://github /aryanbhosale) incli/cli#9532 - `gh attestation verify` handles empty JSONL files by [@​malancas](https://github /malancas) incli/cli#9541 - Enhance Linux installation docs to redirect users to GPG renewal issue, better troubleshooting support by [@​andyfeller](https://github /andyfeller) incli/cli#9573 - Upgrade sigstore-go to v0.6.1 by [@​codysoyland](https://github /codysoyland) incli/cli#9566 - Check for nil values to prevent nil dereference panic by [@​codysoyland](https://github /codysoyland) incli/cli#9578 - build(deps): bump actions/attest-build-provenance from 1.4.2 to 1.4.3 by [@​dependabot](https://github /dependabot) incli/cli#9575 #### New Contributors - [@​aryanbhosale](https://github /aryanbhosale) made their first contribution incli/cli#9523 - [@​Goooler](https://github /Goooler) made their first contribution incli/cli#9525 - [@​crystalstall](https://github /crystalstall) made their first contribution incli/cli#9555 **Full Changelog**:cli/cli@v2.55.0...v2.56.0 </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this MR, check this box --- This MR has been generated by [Renovate Bot](https://github /renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy40NDAuNyIsInVwZGF0ZWRJblZlciI6IjM3LjQ0MC43IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJSZW5vdmF0ZSBCb3QiXX0=-->
Adds a new integration test for the
gh attestation verify
command that attempts to verify a build provenance attestation bundle generated from an account where the OIDC token is using acustom issuer value.