Skip to content

Commit 0f3b0b9

Browse files
ramonpetgrave64ramonpetgrave64
committed
remove unused rekor addr, use trusted root for partial inline
verification Signed-off-by: Ramon Petgrave <[email protected]> Signed-off-by: Ramon Petgrave <[email protected]>
1 parent 2f0a04d commit 0f3b0b9

File tree

5 files changed

+52
-37
lines changed

5 files changed

+52
-37
lines changed

‎go.mod‎

Lines changed: 14 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
module github.com/slsa-framework/slsa-github-generator
22

3-
go 1.22.0
3+
go 1.22.5
4+
5+
toolchain go1.23.0
46

57
require (
68
github.com/coreos/go-oidc/v3 v3.11.0
@@ -13,10 +15,10 @@ require (
1315
github.com/secure-systems-lab/go-securesystemslib v0.8.0
1416
github.com/sigstore/cosign/v2 v2.2.4
1517
github.com/sigstore/rekor v1.3.6
16-
github.com/sigstore/sigstore v1.8.7
17-
github.com/sigstore/sigstore-go v0.5.1
18+
github.com/sigstore/sigstore v1.8.8
19+
github.com/sigstore/sigstore-go v0.6.0
1820
github.com/spf13/cobra v1.8.1
19-
golang.org/x/oauth2 v0.21.0
21+
golang.org/x/oauth2 v0.22.0
2022
gopkg.in/square/go-jose.v2 v2.6.0
2123
gopkg.in/yaml.v3 v3.0.1
2224
)
@@ -108,7 +110,7 @@ require (
108110
github.com/golang/snappy v0.0.4 // indirect
109111
github.com/google/certificate-transparency-go v1.2.1 // indirect
110112
github.com/google/gnostic-models v0.6.9-0.20230804172637-c7be7c783f49 // indirect
111-
github.com/google/go-containerregistry v0.20.0 // indirect
113+
github.com/google/go-containerregistry v0.20.1 // indirect
112114
github.com/google/go-github/v55 v55.0.0 // indirect
113115
github.com/google/go-querystring v1.1.0 // indirect
114116
github.com/google/gofuzz v1.2.0 // indirect
@@ -119,6 +121,7 @@ require (
119121
github.com/hashicorp/go-retryablehttp v0.7.7 // indirect
120122
github.com/hashicorp/hcl v1.0.1-vault-5 // indirect
121123
github.com/imdario/mergo v0.3.16 // indirect
124+
github.com/in-toto/attestation v1.1.0 // indirect
122125
github.com/inconshreveable/mousetrap v1.1.0 // indirect
123126
github.com/jedisct1/go-minisign v0.0.0-20230811132847-661be99b8267 // indirect
124127
github.com/jmespath/go-jmespath v0.4.0 // indirect
@@ -180,14 +183,14 @@ require (
180183
go.step.sm/crypto v0.44.2 // indirect
181184
go.uber.org/multierr v1.11.0 // indirect
182185
go.uber.org/zap v1.27.0 // indirect
183-
golang.org/x/crypto v0.25.0 // indirect
186+
golang.org/x/crypto v0.26.0 // indirect
184187
golang.org/x/exp v0.0.0-20240112132812-db7319d0e0e3 // indirect
185-
golang.org/x/mod v0.19.0 // indirect
188+
golang.org/x/mod v0.20.0 // indirect
186189
golang.org/x/net v0.27.0 // indirect
187-
golang.org/x/sync v0.7.0 // indirect
188-
golang.org/x/sys v0.22.0 // indirect
189-
golang.org/x/term v0.22.0 // indirect
190-
golang.org/x/text v0.16.0 // indirect
190+
golang.org/x/sync v0.8.0 // indirect
191+
golang.org/x/sys v0.23.0 // indirect
192+
golang.org/x/term v0.23.0 // indirect
193+
golang.org/x/text v0.17.0 // indirect
191194
golang.org/x/time v0.5.0 // indirect
192195
golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d // indirect
193196
google.golang.org/api v0.172.0 // indirect

‎go.sum‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -332,6 +332,8 @@ github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
332332
github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
333333
github.com/google/go-containerregistry v0.20.0 h1:wRqHpOeVh3DnenOrPy9xDOLdnLatiGuuNRVelR2gSbg=
334334
github.com/google/go-containerregistry v0.20.0/go.mod h1:YCMFNQeeXeLF+dnhhWkqDItx/JSkH01j1Kis4PsjzFI=
335+
github.com/google/go-containerregistry v0.20.1 h1:eTgx9QNYugV4DN5mz4U8hiAGTi1ybXn0TPi4Smd8du0=
336+
github.com/google/go-containerregistry v0.20.1/go.mod h1:YCMFNQeeXeLF+dnhhWkqDItx/JSkH01j1Kis4PsjzFI=
335337
github.com/google/go-github/v55 v55.0.0 h1:4pp/1tNMB9X/LuAhs5i0KQAE40NmiR/y6prLNb9x9cg=
336338
github.com/google/go-github/v55 v55.0.0/go.mod h1:JLahOTA1DnXzhxEymmFF5PP2tSS9JVNj68mSZNDwskA=
337339
github.com/google/go-github/v57 v57.0.0 h1:L+Y3UPTY8ALM8x+TV0lg+IEBI+upibemtBD8Q9u7zHs=
@@ -393,6 +395,8 @@ github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpO
393395
github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
394396
github.com/imdario/mergo v0.3.16 h1:wwQJbIsHYGMUyLSPrEq1CT16AhnhNJQ51+4fdHUnCl4=
395397
github.com/imdario/mergo v0.3.16/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY=
398+
github.com/in-toto/attestation v1.1.0 h1:oRWzfmZPDSctChD0VaQV7MJrywKOzyNrtpENQFq//2Q=
399+
github.com/in-toto/attestation v1.1.0/go.mod h1:DB59ytd3z7cIHgXxwpSX2SABrU6WJUKg/grpdgHVgVs=
396400
github.com/in-toto/in-toto-golang v0.9.0 h1:tHny7ac4KgtsfrG6ybU8gVOZux2H8jN05AXJ9EBM1XU=
397401
github.com/in-toto/in-toto-golang v0.9.0/go.mod h1:xsBVrVsHNsB61++S6Dy2vWosKhuA3lUTQd+eF9HdeMo=
398402
github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
@@ -546,8 +550,12 @@ github.com/sigstore/rekor v1.3.6 h1:QvpMMJVWAp69a3CHzdrLelqEqpTM3ByQRt5B5Kspbi8=
546550
github.com/sigstore/rekor v1.3.6/go.mod h1:JDTSNNMdQ/PxdsS49DJkJ+pRJCO/83nbR5p3aZQteXc=
547551
github.com/sigstore/sigstore v1.8.7 h1:L7/zKauHTg0d0Hukx7qlR4nifh6T6O6UIt9JBwAmTIg=
548552
github.com/sigstore/sigstore v1.8.7/go.mod h1:MPiQ/NIV034Fc3Kk2IX9/XmBQdK60wfmpvgK9Z1UjRA=
553+
github.com/sigstore/sigstore v1.8.8 h1:B6ZQPBKK7Z7tO3bjLNnlCMG+H66tO4E/+qAphX8T/hg=
554+
github.com/sigstore/sigstore v1.8.8/go.mod h1:GW0GgJSCTBJY3fUOuGDHeFWcD++c4G8Y9K015pwcpDI=
549555
github.com/sigstore/sigstore-go v0.5.1 h1:5IhKvtjlQBeLnjKkzMELNG4tIBf+xXQkDzhLV77+/8Y=
550556
github.com/sigstore/sigstore-go v0.5.1/go.mod h1:TuOfV7THHqiDaUHuJ5+QN23RP/YoKmsbwJpY+aaYPN0=
557+
github.com/sigstore/sigstore-go v0.6.0 h1:X72BkR8kXFcdhF/V5GA2fpFvCz+VyZ6fI0YgTBn5feI=
558+
github.com/sigstore/sigstore-go v0.6.0/go.mod h1:+RyopI/FJDE6z5WVs2sQ2nkc+zsxxByDmbp8a4HoxbA=
551559
github.com/sigstore/sigstore/pkg/signature/kms/aws v1.8.3 h1:LTfPadUAo+PDRUbbdqbeSl2OuoFQwUFTnJ4stu+nwWw=
552560
github.com/sigstore/sigstore/pkg/signature/kms/aws v1.8.3/go.mod h1:QV/Lxlxm0POyhfyBtIbTWxNeF18clMlkkyL9mu45y18=
553561
github.com/sigstore/sigstore/pkg/signature/kms/azure v1.8.3 h1:xgbPRCr2npmmsuVVteJqi/ERw9+I13Wou7kq0Yk4D8g=
@@ -684,6 +692,8 @@ golang.org/x/crypto v0.18.0/go.mod h1:R0j02AL6hcrfOiy9T4ZYp/rcWeMxM3L6QYxlOuEG1m
684692
golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
685693
golang.org/x/crypto v0.25.0 h1:ypSNr+bnYL2YhwoMt2zPxHFmbAN1KZs/njMG3hxUp30=
686694
golang.org/x/crypto v0.25.0/go.mod h1:T+wALwcMOSE0kXgUAnPAHqTLW+XHgcELELW8VaDgm/M=
695+
golang.org/x/crypto v0.26.0 h1:RrRspgV4mU+YwB4FYnuBoKsUapNIL5cohGAmSH3azsw=
696+
golang.org/x/crypto v0.26.0/go.mod h1:GY7jblb9wI+FOo5y8/S2oY4zWP07AkOJ4+jxCqdqn54=
687697
golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
688698
golang.org/x/exp v0.0.0-20240112132812-db7319d0e0e3 h1:hNQpMuAJe5CtcUqCXaWga3FHu+kQvCqcsoVaQgSV60o=
689699
golang.org/x/exp v0.0.0-20240112132812-db7319d0e0e3/go.mod h1:idGWGoKP1toJGkd5/ig9ZLuPcZBC3ewk7SzmH0uou08=
@@ -696,6 +706,8 @@ golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91
696706
golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
697707
golang.org/x/mod v0.19.0 h1:fEdghXQSo20giMthA7cd28ZC+jts4amQ3YMXiP5oMQ8=
698708
golang.org/x/mod v0.19.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
709+
golang.org/x/mod v0.20.0 h1:utOm6MM3R3dnawAiJgn0y+xvuYRsm1RKM/4giyfDgV0=
710+
golang.org/x/mod v0.20.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
699711
golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
700712
golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
701713
golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -726,6 +738,8 @@ golang.org/x/net v0.27.0/go.mod h1:dDi0PyhWNoiUOrAS8uXv/vnScO4wnHQO4mj9fn/RytE=
726738
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
727739
golang.org/x/oauth2 v0.21.0 h1:tsimM75w1tF/uws5rbeHzIWxEqElMehnc+iW793zsZs=
728740
golang.org/x/oauth2 v0.21.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
741+
golang.org/x/oauth2 v0.22.0 h1:BzDx2FehcG7jJwgWLELCdmLuxk2i+x9UDpSiss2u0ZA=
742+
golang.org/x/oauth2 v0.22.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
729743
golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
730744
golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
731745
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -736,6 +750,8 @@ golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJ
736750
golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
737751
golang.org/x/sync v0.7.0 h1:YsImfSBoP9QPYL0xyKJPq0gcaJdG3rInoqxTWbfQu9M=
738752
golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
753+
golang.org/x/sync v0.8.0 h1:3NFvSEYkUoMifnESzZl15y791HH1qU2xm6eCJU5ZPXQ=
754+
golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
739755
golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
740756
golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
741757
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -765,6 +781,8 @@ golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
765781
golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
766782
golang.org/x/sys v0.22.0 h1:RI27ohtqKCnwULzJLqkv897zojh5/DwS/ENaMzUOaWI=
767783
golang.org/x/sys v0.22.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
784+
golang.org/x/sys v0.23.0 h1:YfKFowiIMvtgl1UERQoTPPToxltDeZfbj4H7dVUCwmM=
785+
golang.org/x/sys v0.23.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
768786
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
769787
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
770788
golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
@@ -775,6 +793,8 @@ golang.org/x/term v0.16.0/go.mod h1:yn7UURbUtPyrVJPGPq404EukNFxcm/foM+bV/bfcDsY=
775793
golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
776794
golang.org/x/term v0.22.0 h1:BbsgPEJULsl2fV/AT3v15Mjva5yXKQDyKf+TbDz7QJk=
777795
golang.org/x/term v0.22.0/go.mod h1:F3qCibpT5AMpCRfhfT53vVJwhLtIVHhB9XDjfFvnMI4=
796+
golang.org/x/term v0.23.0 h1:F6D4vR+EHoL9/sWAWgAR1H2DcHr4PareCbAaCo1RpuU=
797+
golang.org/x/term v0.23.0/go.mod h1:DgV24QBUrK6jhZXl+20l6UWznPlwAHm1Q1mGHtydmSk=
778798
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
779799
golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
780800
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
@@ -787,6 +807,8 @@ golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
787807
golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
788808
golang.org/x/text v0.16.0 h1:a94ExnEXNtEwYLGJSIUxnWoxoRz/ZcCsV63ROupILh4=
789809
golang.org/x/text v0.16.0/go.mod h1:GhwF1Be+LQoKShO3cGOHzqOgRrGaYc9AvblQOmPVHnI=
810+
golang.org/x/text v0.17.0 h1:XtiM5bkSOt+ewxlOE/aE/AKEHibwj/6gvWMl9Rsh0Qc=
811+
golang.org/x/text v0.17.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
790812
golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
791813
golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
792814
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=

‎internal/builders/go/main.go‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -75,8 +75,8 @@ func runBuild(dry bool, configFile, evalEnvs string) error {
7575
return nil
7676
}
7777

78-
func runProvenanceGeneration(subject, digest, commands, envs, workingDir, rekor string) error {
79-
s := sigstore.NewBundleSigner(sigstore.DefaultFulcioAddr, rekor)
78+
func runProvenanceGeneration(subject, digest, commands, envs, workingDir string) error {
79+
s := sigstore.NewDefaultBundleSigner()
8080

8181
attBytes, err := pkg.GenerateProvenance(subject, digest,
8282
commands, envs, workingDir, s, nil)
@@ -118,7 +118,6 @@ func main() {
118118
provenanceCommand := provenanceCmd.String("command", "", "command used to compile the binary")
119119
provenanceEnv := provenanceCmd.String("env", "", "env variables used to compile the binary")
120120
provenanceWorkingDir := provenanceCmd.String("workingDir", "", "working directory used to issue compilation commands")
121-
provenanceRekor := provenanceCmd.String("rekor", sigstore.DefaultRekorAddr, "rekor server to use for provenance")
122121

123122
// Expect a sub-command.
124123
if len(os.Args) < 2 {
@@ -145,7 +144,7 @@ func main() {
145144
}
146145

147146
err := runProvenanceGeneration(*provenanceName, *provenanceDigest,
148-
*provenanceCommand, *provenanceEnv, *provenanceWorkingDir, *provenanceRekor)
147+
*provenanceCommand, *provenanceEnv, *provenanceWorkingDir)
149148
check(err)
150149

151150
default:

‎signing/sigstore/bundle.go‎

Lines changed: 11 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ import (
2121

2222
intoto "github.com/in-toto/in-toto-golang/in_toto"
2323
sigstoreBundle "github.com/sigstore/sigstore-go/pkg/bundle"
24+
sigstoreRoot "github.com/sigstore/sigstore-go/pkg/root"
2425
sigstoreSign "github.com/sigstore/sigstore-go/pkg/sign"
2526
"github.com/slsa-framework/slsa-github-generator/github"
2627
"github.com/slsa-framework/slsa-github-generator/signing"
@@ -49,15 +50,7 @@ func (s *sigstoreBundleAtt) Bytes() []byte {
4950

5051
// NewDefaultBundleSigner creates a new BundleSigner instance.
5152
func NewDefaultBundleSigner() *BundleSigner {
52-
return NewBundleSigner(DefaultFulcioAddr, DefaultRekorAddr)
53-
}
54-
55-
// NewBundleSigner creates a new BundleSigner instance.
56-
func NewBundleSigner(fulcioAddr, rekorAddr string) *BundleSigner {
57-
return &BundleSigner{
58-
fulcioAddr: fulcioAddr,
59-
rekorAddr: rekorAddr,
60-
}
53+
return &BundleSigner{}
6154
}
6255

6356
// Sign signs the given provenance statement and returns the signed Sigstore Bundle.
@@ -90,12 +83,7 @@ func (s *BundleSigner) Sign(ctx context.Context, statement *intoto.Statement) (s
9083
rawToken := TokenStruct.RawToken
9184

9285
// signing opts.
93-
bundleOpts, err := getBundleOpts(
94-
ctx,
95-
&s.fulcioAddr,
96-
&s.rekorAddr,
97-
&rawToken,
98-
)
86+
bundleOpts, err := getBundleOpts(ctx, &rawToken)
9987
if err != nil {
10088
return nil, err
10189
}
@@ -133,24 +121,28 @@ func (s *BundleSigner) Sign(ctx context.Context, statement *intoto.Statement) (s
133121
// getBundleOpts provides the opts for sigstoreSign.Bundle().
134122
func getBundleOpts(
135123
ctx context.Context,
136-
fulcioAddr *string,
137-
rekorAddr *string,
138124
identityToken *string,
139125
) (*sigstoreSign.BundleOptions, error) {
140126
bundleOpts := &sigstoreSign.BundleOptions{
141127
Context: ctx,
142128
}
143129

130+
trustedRoot, err := sigstoreRoot.FetchTrustedRoot()
131+
if err != nil {
132+
return nil, err
133+
}
134+
bundleOpts.TrustedRoot = trustedRoot
135+
144136
fulcioOpts := &sigstoreSign.FulcioOptions{
145-
BaseURL: *fulcioAddr,
137+
BaseURL: defaultFulcioAddr,
146138
}
147139
bundleOpts.CertificateProvider = sigstoreSign.NewFulcio(fulcioOpts)
148140
bundleOpts.CertificateProviderOptions = &sigstoreSign.CertificateProviderOptions{
149141
IDToken: *identityToken,
150142
}
151143

152144
rekorOpts := &sigstoreSign.RekorOptions{
153-
BaseURL: *rekorAddr,
145+
BaseURL: DefaultRekorAddr,
154146
}
155147
bundleOpts.TransparencyLogs = append(bundleOpts.TransparencyLogs, sigstoreSign.NewRekor(rekorOpts))
156148
return bundleOpts, nil

‎signing/sigstore/fulcio.go‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,7 @@ import (
3232
)
3333

3434
const (
35-
// DefaultFulcioAddr is the default Sigstore Fulcio URL.
36-
DefaultFulcioAddr = options.DefaultFulcioURL
35+
defaultFulcioAddr = options.DefaultFulcioURL
3736
defaultOIDCIssuer = options.DefaultOIDCIssuerURL
3837
defaultOIDCClientID = "sigstore"
3938
)
@@ -64,7 +63,7 @@ func (a *attestation) Cert() []byte {
6463
// NewDefaultFulcio creates a new Fulcio instance using the public Fulcio
6564
// server and public sigstore OIDC issuer.
6665
func NewDefaultFulcio() *Fulcio {
67-
return NewFulcio(DefaultFulcioAddr, defaultOIDCIssuer, defaultOIDCClientID)
66+
return NewFulcio(defaultFulcioAddr, defaultOIDCIssuer, defaultOIDCClientID)
6867
}
6968

7069
// NewFulcio creates a new Fulcio instance.

0 commit comments

Comments
 (0)