chore: verify SLSA token at creation

Signed-off-by: Ian Lewis <[email protected]>

Author: ianlewis

actions/delegator/setup-generic/dist/index.js

@@ -172,8 +172,7 @@ function run() {
             const bundle = yield (0, sigstore_1.sign)(Buffer.from(unsignedB64Token));
             // Verify just to double check.
             // NOTE: this is an offline verification.
-            // TODO(#1668): re-enable verification.
-            // await sigstore.verify(bundle, Buffer.from(unsignedB64Token));
+            yield (0, sigstore_1.verify)(bundle, Buffer.from(unsignedB64Token));
             const bundleStr = JSON.stringify(bundle);
             const bundleB64 = Buffer.from(bundleStr).toString("base64");
             core.info(`bundleStr: ${bundleStr}`);

actions/delegator/setup-generic/dist/index.js.map

@@ -14,7 +14,7 @@ limitations under the License.
 import * as github from "@actions/github";
 import * as core from "@actions/core";
 import * as process from "process";
-import { sign } from "sigstore";
+import { sign, verify } from "sigstore";
 import * as tscommon from "tscommon";
 
 async function run(): Promise<void> {
@@ -132,8 +132,7 @@ async function run(): Promise<void> {
 
     // Verify just to double check.
     // NOTE: this is an offline verification.
-    // TODO(#1668): re-enable verification.
-    // await sigstore.verify(bundle, Buffer.from(unsignedB64Token));
+    await verify(bundle, Buffer.from(unsignedB64Token));
     const bundleStr = JSON.stringify(bundle);
 
     const bundleB64 = Buffer.from(bundleStr).toString("base64");