chore: update dependencies (#551)

reneleonhardt · web-flow · commit eec737d14102 · 2025-10-16T07:22:43.000-07:00
* chore: update dependencies

Signed-off-by: Rene Leonhardt &lt;65483435+reneleonhardt@users.noreply.github.com&gt;

* review: use previous (release) branches

Signed-off-by: Rene Leonhardt &lt;65483435+reneleonhardt@users.noreply.github.com&gt;

* review: restore duplicated matrix entries

Signed-off-by: Rene Leonhardt &lt;65483435+reneleonhardt@users.noreply.github.com&gt;

* review: configure APP_VERSION for docker build

Signed-off-by: Rene Leonhardt &lt;65483435+reneleonhardt@users.noreply.github.com&gt;

---------

Signed-off-by: Rene Leonhardt &lt;65483435+reneleonhardt@users.noreply.github.com&gt;
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -13,16 +13,24 @@
 # limitations under the License.
 
 version: 2
-# See https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file.
+# See https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference
 updates:
   - package-ecosystem: "pip"
-    directory: "/"
+    directories:
+      - "/"
+#      - "slsa_for_models/install"  # requirement lockfiles have to be maintained manually
     schedule:
       interval: "weekly"
     groups:
       all:
         patterns:
         - "*"
+  - package-ecosystem: "docker"
+    directories:
+      - "/"
+      - "slsa_for_models/kubeflow/images/*"
+    schedule:
+      interval: "weekly"
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
@@ -31,3 +39,8 @@ updates:
       all:
         patterns:
         - "*"
+    allow:
+      - dependency-name: "pypa/hatch"
+        versions: [ "install" ] # stay on "install" branch
+      - dependency-name: "github/codeql-action"
+        versions: [ ">=4.0.0" ] # stay on "v4" tag (and "v5" in the future)
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -54,7 +54,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@f9a7c6738f28efb36e31d49c53a201a9c5d6a476 # v2.14.2
+      uses: github/codeql-action/init@f443b600d91635bebf5b0d9ebc620189c0d6fba5 # v4.30.8
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -68,7 +68,7 @@ jobs:
     # Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@f9a7c6738f28efb36e31d49c53a201a9c5d6a476 # v2.14.2
+      uses: github/codeql-action/autobuild@f443b600d91635bebf5b0d9ebc620189c0d6fba5 # v4.30.8
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -81,6 +81,6 @@ jobs:
     #     ./location_of_script_within_repo/buildscript.sh
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@f9a7c6738f28efb36e31d49c53a201a9c5d6a476 # v2.14.2
+      uses: github/codeql-action/analyze@f443b600d91635bebf5b0d9ebc620189c0d6fba5 # v4.30.8
       with:
         category: "/language:${{matrix.language}}"
diff --git a/.github/workflows/cross_os.yml b/.github/workflows/cross_os.yml
@@ -73,7 +73,7 @@ jobs:
           name: model.zip
           path: model_root/
       - name: Set up Hatch
-        uses: pypa/hatch@257e27e51a6a5616ed08a39a408a21c35c9931bc
+        uses: pypa/hatch@257e27e51a6a5616ed08a39a408a21c35c9931bc # install
       - name: store beacon token into oidc-token.txt
         uses: sigstore-conformance/extremely-dangerous-public-oidc-beacon@b517a742e5a3db9e3cbf8e2e1c792b36982f78db # main
       - name: Sign the model
@@ -109,7 +109,7 @@ jobs:
         with:
           name: ${{ matrix.signed-with-os }}-model.sig
       - name: Set up Hatch
-        uses: pypa/hatch@257e27e51a6a5616ed08a39a408a21c35c9931bc
+        uses: pypa/hatch@257e27e51a6a5616ed08a39a408a21c35c9931bc # install
       - name: Verify the model
         run: |
           hatch run python -m model_signing verify sigstore model_root/ --use_staging --signature model.sig \
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
@@ -34,7 +34,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Set up Hatch
-        uses: pypa/hatch@257e27e51a6a5616ed08a39a408a21c35c9931bc
+        uses: pypa/hatch@257e27e51a6a5616ed08a39a408a21c35c9931bc # install
       - name: build docs
         run: hatch run docs:build
       - name: upload docs artifact
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
@@ -44,7 +44,7 @@ jobs:
       with:
         persist-credentials: false
     - name: Set up Hatch
-      uses: pypa/hatch@257e27e51a6a5616ed08a39a408a21c35c9931bc
+      uses: pypa/hatch@257e27e51a6a5616ed08a39a408a21c35c9931bc # install
     - name: Run integration tests
       run: |
         set -euxo pipefail
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
@@ -78,7 +78,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Set up Hatch
-        uses: pypa/hatch@257e27e51a6a5616ed08a39a408a21c35c9931bc
+        uses: pypa/hatch@257e27e51a6a5616ed08a39a408a21c35c9931bc # install
       - name: Register pytype problem matcher
         run: echo "::add-matcher::$GITHUB_WORKSPACE/.github/pytype-problem-matcher.json"
       - name: Run type check
@@ -95,7 +95,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Set up Hatch
-        uses: pypa/hatch@257e27e51a6a5616ed08a39a408a21c35c9931bc
+        uses: pypa/hatch@257e27e51a6a5616ed08a39a408a21c35c9931bc # install
       - name: Run python linting
         run: hatch fmt --check
         env:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -33,7 +33,7 @@ jobs:
       with:
         persist-credentials: false
     - name: Set up Hatch
-      uses: pypa/hatch@257e27e51a6a5616ed08a39a408a21c35c9931bc
+      uses: pypa/hatch@257e27e51a6a5616ed08a39a408a21c35c9931bc # install
     - name: Build artifacts
       run: hatch build
     - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
@@ -83,6 +83,12 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Convert tag to version
+        run: |
+          tag="${{ github.event.release.tag_name }}"
+          version=${tag#v}  # Remove leading 'v' prefix
+          echo "APP_VERSION=${version}" >> $GITHUB_ENV
+
       - name: Build minimal image
         id: build_minimal_image
         uses: redhat-actions/buildah-build@7a95fa7ee0f02d552a32753e7414641a04307056 # v2.13
@@ -95,6 +101,7 @@ jobs:
           oci: false
           build-args: |
             BUILD_TYPE=minimal
+            APP_VERSION=${{ env.APP_VERSION }}
 
       - id: docker_meta_minimal
         uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
@@ -129,6 +136,7 @@ jobs:
           oci: false
           build-args: |
             BUILD_TYPE=full
+            APP_VERSION=${{ env.APP_VERSION }}
 
       - id: docker_meta_full
         uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
@@ -82,6 +82,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@17573ee1cc1b9d061760f3a006fc4aac4f944fd5 # v2.2.4
+        uses: github/codeql-action/upload-sarif@f443b600d91635bebf5b0d9ebc620189c0d6fba5 # v4.30.8
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/unit_tests.yml b/.github/workflows/unit_tests.yml
@@ -40,7 +40,7 @@ jobs:
       with:
         persist-credentials: false
     - name: Set up Hatch
-      uses: pypa/hatch@257e27e51a6a5616ed08a39a408a21c35c9931bc
+      uses: pypa/hatch@257e27e51a6a5616ed08a39a408a21c35c9931bc # install
     - name: Run unit tests (with coverage report at the end)
       run: |
         set -euxo pipefail
diff --git a/Containerfile b/Containerfile
@@ -15,7 +15,9 @@
 # Default
 ARG BUILD_TYPE=minimal
 
-FROM python:3.13-slim AS base_builder
+FROM python:3.13-slim AS base
+
+FROM base AS base_builder
 
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
@@ -32,11 +34,11 @@ WORKDIR /app
 COPY . /app
 RUN pip install .[pkcs11,otel]
 
-FROM python:3.13-slim AS minimal_image
+FROM base AS minimal_image
 COPY --from=minimal_install /usr/local/bin /usr/local/bin
 COPY --from=minimal_install /usr/local/lib/python3.13/site-packages /usr/local/lib/python3.13/site-packages
 
-FROM python:3.13-slim AS full_image
+FROM base AS full_image
 COPY --from=full_install /usr/local/bin /usr/local/bin
 COPY --from=full_install /usr/local/lib/python3.13/site-packages /usr/local/lib/python3.13/site-packages
 
@@ -45,7 +47,7 @@ FROM ${BUILD_TYPE}_image AS final_image
 ENTRYPOINT ["model_signing"]
 CMD ["--help"]
 
-ARG APP_VERSION="1.0.1"
+ARG APP_VERSION="1.1.1"
 
 LABEL org.opencontainers.image.title="Model Transparency Library" \
       org.opencontainers.image.description="Supply chain security for ML" \
diff --git a/slsa_for_models/install/requirements_Darwin.txt b/slsa_for_models/install/requirements_Darwin.txt
@@ -1,9 +1,5 @@
-#
-# This file is autogenerated by pip-compile with Python 3.11
-# by the following command:
-#
-#    pip-compile --generate-hashes --output-file=slsa_for_models/install/requirements_Darwin.txt --strip-extras slsa_for_models/install/requirements.in
-#
+# This file was autogenerated by uv via the following command:
+#    uv pip compile --generate-hashes --strip-extras --no-emit-package setuptools --output-file=slsa_for_models/install/requirements_Darwin.txt slsa_for_models/install/requirements.in
 absl-py==2.1.0 \
     --hash=sha256:526a04eadab8b4ee719ce68f204172ead1027549089702d99b9059f129ff1308 \
     --hash=sha256:7820790efbb316739cde8b4e19357243fc3608a152024288513dd968d7d959ff
@@ -732,9 +728,9 @@ six==1.16.0 \
     #   promise
     #   tensorboard
     #   tensorflow
-sympy==1.13.1 \
-    --hash=sha256:9cebf7e04ff162015ce31c9c6c9144daa34a93bd082f54fd8f12deca4f47515f \
-    --hash=sha256:db36cdc64bf61b9b24578b6f7bab1ecdd2452cf008f34faa33776680c26d66f8
+sympy==1.14.0 \
+    --hash=sha256:d3d3fe8df1e5a0b42f0e7bdf50541697dbe7d23746e894990c030e2b05e72517 \
+    --hash=sha256:e091cc3e99d2141a0ba2847328f5479b05d94a6635cb96148ccb3f34671bd8f5
     # via torch
 tensorboard==2.17.0 \
     --hash=sha256:859a499a9b1fb68a058858964486627100b71fcb21646861c61d31846a6478fb
@@ -825,32 +821,31 @@ torch==2.8.0 \
     # via
     #   -r slsa_for_models/install/requirements.in
     #   torchvision
-torchvision==0.19.0 \
-    --hash=sha256:02f1dd5cfc897957535b41b0258ec452d30de044e20c2de2c75869f7708e7656 \
-    --hash=sha256:079a696e0b2cb52e4be30afa8e9b3d7d280f02a2b5ffedd7e821fa1efd1a5a8d \
-    --hash=sha256:106842b1e475b14d9a04ee0d6f5477d43100e3bb78e9d31e37422384d0d84179 \
-    --hash=sha256:13aee7a46e049c8c1e7d35a0394b0587a7e62ff3d1a822cd2bbbacb675ac4a09 \
-    --hash=sha256:2acc436d043d4f81b3bc6929cbfa4ef1cdae4d8a0b04ec72ec30a497e9a38179 \
-    --hash=sha256:4d54b5e19b7ebebca7d0b08497b4c6335264cad04c94c05fa35988d9e9eed0c4 \
-    --hash=sha256:4e6aa4fa3f0bc3599fa071c149e651a3e6bdd67c9161794478f9f91471c406a2 \
-    --hash=sha256:5f9a598dcf82bdfc8e4436ce74763b3877dabec3b33f94613b94ede13e3e4dee \
-    --hash=sha256:6b1bce2e4c003d890a18f14ff289528707d918e38539ff890ef02aa31dae1b56 \
-    --hash=sha256:6ed066aae5c50465d7c4761357aefe5dbd2eb7075a33ab8c14b352fc2353ad4c \
-    --hash=sha256:854e967a16a9409e941b5bbe5aa357b23f7158bccb9de35ae20fd4945f05ecd1 \
-    --hash=sha256:a6ba7756f75c80212e51d3576f85ea204589e0c16efdb9b835dd677bc8929a67 \
-    --hash=sha256:aaa338ff3a55a8c0f94e0e64eff6fe2af1fc933a95fd43812760e72ea66e986b \
-    --hash=sha256:ac5525d5cc09e425b5cf5752ecf66eefbbbd8c8cd945198ce35eb01a694e6069 \
-    --hash=sha256:b5f70f5a8bd9c8b00a076bf466b39b5cd679ef62587c47cc048adb04d9c5f155 \
-    --hash=sha256:be0f27a28b8e9f2ae98a31af34a4bdd2a5bf154d92bd73a5797c8d2156fb3ab6 \
-    --hash=sha256:c09ef8ed184fa877f6251b620226e74f682b8f1d6b341456428d4955b8d9c670 \
-    --hash=sha256:d467d434005fd05a227a2ba7af4c591bb67e6d4a97bbd06eda8da83f43e9fd07 \
-    --hash=sha256:d9afb8a3c3ce99a161a64c2a3b91cb545632a72118053cbfb84e87a02a8dcd02 \
-    --hash=sha256:dbf3aa71a3899244fc884303ed3c4604a160824fefac77e82317a5463efc1d9b \
-    --hash=sha256:dd1279571d4b68d5a53d9b7a35aedf91c4cb1e0b08099f6a1effa7b25b8c95e7 \
-    --hash=sha256:ec1281c10402234d470bfd4d53663d81f4364f293b2f8fe24d4a7a1adc78c90c \
-    --hash=sha256:ec4162dc71d9db7f0b51d0f92491929c1419605ff436e1305e50de13504a1c30 \
-    --hash=sha256:ec874ef85dcb24c69e600f6e276af892c80cde3ffdaeb7275efda463242bc2a8 \
-    --hash=sha256:f77ac31f7337d0f6f4b58e65582c6c93b9d9eeec7dfd7478896b5cdc19a2d60d
+torchvision==0.23.0 \
+    --hash=sha256:01dc33ee24c79148aee7cdbcf34ae8a3c9da1674a591e781577b716d233b1fa6 \
+    --hash=sha256:07d069cb29691ff566e3b7f11f20d91044f079e1dbdc9d72e0655899a9b06938 \
+    --hash=sha256:09bfde260e7963a15b80c9e442faa9f021c7e7f877ac0a36ca6561b367185013 \
+    --hash=sha256:1c37e325e09a184b730c3ef51424f383ec5745378dc0eca244520aca29722600 \
+    --hash=sha256:2a3299d2b1d5a7aed2d3b6ffb69c672ca8830671967eb1cee1497bacd82fe47b \
+    --hash=sha256:2df618e1143805a7673aaf82cb5720dd9112d4e771983156aaf2ffff692eebf9 \
+    --hash=sha256:2f7fd6c15f3697e80627b77934f77705f3bc0e98278b989b2655de01f6903e1d \
+    --hash=sha256:31c583ba27426a3a04eca8c05450524105c1564db41be6632f7536ef405a6de2 \
+    --hash=sha256:35c27941831b653f5101edfe62c03d196c13f32139310519e8228f35eae0e96a \
+    --hash=sha256:3932bf67256f2d095ce90a9f826f6033694c818856f4bb26794cf2ce64253e53 \
+    --hash=sha256:49aa20e21f0c2bd458c71d7b449776cbd5f16693dd5807195a820612b8a229b7 \
+    --hash=sha256:4e7d31c43bc7cbecbb1a5652ac0106b436aa66e26437585fc2c4b2cf04d6014c \
+    --hash=sha256:6c74cbc1cbee26dd4f35f989cd80dccc40411f258dee476b29871dee4b483af0 \
+    --hash=sha256:6dd7c4d329a0e03157803031bc856220c6155ef08c26d4f5bbac938acecf0948 \
+    --hash=sha256:7266871daca00ad46d1c073e55d972179d12a58fa5c9adec9a3db9bbed71284a \
+    --hash=sha256:76bc4c0b63d5114aa81281390f8472a12a6a35ce9906e67ea6044e5af4cab60c \
+    --hash=sha256:83ee5bf827d61a8af14620c0a61d8608558638ac9c3bac8adb7b27138e2147d1 \
+    --hash=sha256:a2e45272abe7b8bf0d06c405e78521b5757be1bd0ed7e5cd78120f7fdd4cbf35 \
+    --hash=sha256:a76fafe113b2977be3a21bf78f115438c1f88631d7a87203acb3dd6ae55889e6 \
+    --hash=sha256:a9e9d7552d34547b80843eaf64ab0737b19b2e8bec2514286b8cfd30861ca8b5 \
+    --hash=sha256:b190db205f90206c230fc2f91cbdfd5733334babc0e0d19bddb90a40b8cf26c2 \
+    --hash=sha256:b9e2dabf0da9c8aa9ea241afb63a8f3e98489e706b22ac3f30416a1be377153b \
+    --hash=sha256:dc7ce5accbbb8c9df9a79f8cef6a6df042f28e2250a6ae0d2ca70b06473fa03b \
+    --hash=sha256:e0e2c04a91403e8dd3af9756c6a024a1d9c0ed9c0d592a8314ded8f4fe30d440
     # via -r slsa_for_models/install/requirements.in
 tqdm==4.66.5 \
     --hash=sha256:90279a3770753eafc9194a0364852159802111925aa30eb3f9d85b0e805ac7cd \
@@ -958,7 +953,5 @@ zipp==3.19.2 \
     --hash=sha256:f091755f667055f2d02b32c53771a7a6c8b47e1fdbc4b72a8b9072b3eef8015c
     # via etils
 
-# WARNING: The following packages were not pinned, but pip requires them to be
-# pinned when the requirements file includes hashes and the requirement is not
-# satisfied by a package already installed. Consider using the --allow-unsafe flag.
+# The following packages were excluded from the output:
 # setuptools
diff --git a/slsa_for_models/kubeflow/images/build_model/Dockerfile b/slsa_for_models/kubeflow/images/build_model/Dockerfile
@@ -1,4 +1,4 @@
-FROM docker.io/python:3.11
+FROM python:3.13-slim
 ARG DEBIAN_FRONTEND=noninteractive
 RUN apt-get update && apt-get install coreutils -y
 COPY . /src
diff --git a/slsa_for_models/kubeflow/images/upload_model/Dockerfile b/slsa_for_models/kubeflow/images/upload_model/Dockerfile
@@ -1,4 +1,4 @@
-FROM gcr.io/google.com/cloudsdktool/cloud-sdk:379.0.0-slim@sha256:d844877c7aaa06a0072979230c68417ddb0f27087277f29747c7169d6ed0d2b9
+FROM gcr.io/google.com/cloudsdktool/cloud-sdk:543.0.0-slim
 ARG DEBIAN_FRONTEND=noninteractive
 RUN apt-get update && apt-get install coreutils -y
 COPY . /src
