Skip to content

Commit 71e6108

Browse files
puercopuerco
authored
Implement reusable VCS backends and attestation readers (#228)
* Add sourcetool models package Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]> * Add GitHub backend Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]> * Add repo package and PullRequest manager Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]> * Generate branch from branch options Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]> * Add auth contructor, use Actor model Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]> * Remove git objects from options Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]> * Remove git objects from options Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]> * sourcetool: Use new data types and backend model Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]> * First update of sourcetool tests Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]> * Update CLI to use new sourcetool Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]> * go mod tidy Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]> * Expose policy.ComputeEligibleSince Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]> * Create policy PR with PR manager Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]> * Add notes attestation reader Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]> * Add GetRepo to options Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]> * Add SLSA ControlStatus and states Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]> * Use ControlStatus in sourcetool and GitHub Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]> * Rename Status to ControlStatus Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]> * Support recommended actions in control status Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]> * Report policy status in controls Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]> * Update status subcommand to read policy status Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]> * Update integration tests and fakes Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]> * Handle authentication Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]> * Fix linter nits Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]> * Actually append policy status to controls Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]> * Fix nits and typos from review Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]> * Add Sign option to commit opts Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]> --------- Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>
1 parent 246c020 commit 71e6108

30 files changed

+3974
-1317
lines changed

‎go.work

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
1-
go 1.24.4
1+
go 1.24.5
22

33
use sourcetool

‎go.work.sum

Lines changed: 245 additions & 1 deletion
Large diffs are not rendered by default.

‎sourcetool/go.mod

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,23 @@
11
module github.com/slsa-framework/slsa-source-poc/sourcetool
22

3-
go 1.24.4
3+
go 1.24.5
44

55
require (
66
github.com/carabiner-dev/bnd v0.2.2
7-
github.com/carabiner-dev/github v0.2.2
87
github.com/carabiner-dev/vcslocator v0.3.1
98
github.com/fatih/color v1.18.0
9+
github.com/go-git/go-billy/v6 v6.0.0-20250627091229-31e2a16eef30
1010
github.com/go-git/go-git/v5 v5.16.2
11+
github.com/go-git/go-git/v6 v6.0.0-20250711134917-1f24ae85fe16
1112
github.com/google/go-github/v69 v69.2.0
13+
github.com/google/uuid v1.6.0
1214
github.com/in-toto/attestation v1.1.2
1315
github.com/maxbrunsfeld/counterfeiter/v6 v6.11.3
1416
github.com/migueleliasweb/go-github-mock v1.4.0
1517
github.com/sigstore/sigstore-go v1.1.0
16-
github.com/sirupsen/logrus v1.9.3
1718
github.com/spf13/cobra v1.9.1
1819
github.com/stretchr/testify v1.10.0
1920
google.golang.org/protobuf v1.36.6
20-
sigs.k8s.io/release-sdk v0.12.3
2121
sigs.k8s.io/release-utils v0.11.1
2222
)
2323

@@ -38,7 +38,7 @@ require (
3838
github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.53.0 // indirect
3939
github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.53.0 // indirect
4040
github.com/Microsoft/go-winio v0.6.2 // indirect
41-
github.com/ProtonMail/go-crypto v1.1.6 // indirect
41+
github.com/ProtonMail/go-crypto v1.3.0 // indirect
4242
github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
4343
github.com/avast/retry-go/v4 v4.6.1 // indirect
4444
github.com/blang/semver v3.5.1+incompatible // indirect
@@ -62,6 +62,7 @@ require (
6262
github.com/globocom/go-buffer v1.2.2 // indirect
6363
github.com/go-chi/chi v4.1.2+incompatible // indirect
6464
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
65+
github.com/go-git/gcfg/v2 v2.0.2 // indirect
6566
github.com/go-git/go-billy/v5 v5.6.2 // indirect
6667
github.com/go-jose/go-jose/v4 v4.0.5 // indirect
6768
github.com/go-logr/logr v1.4.3 // indirect
@@ -81,18 +82,17 @@ require (
8182
github.com/google/certificate-transparency-go v1.3.2 // indirect
8283
github.com/google/go-cmp v0.7.0 // indirect
8384
github.com/google/go-containerregistry v0.20.6 // indirect
84-
github.com/google/go-github/v72 v72.0.0 // indirect
8585
github.com/google/go-github/v73 v73.0.0 // indirect
8686
github.com/google/go-querystring v1.1.0 // indirect
8787
github.com/google/s2a-go v0.1.9 // indirect
88-
github.com/google/uuid v1.6.0 // indirect
8988
github.com/googleapis/enterprise-certificate-proxy v0.3.6 // indirect
9089
github.com/googleapis/gax-go/v2 v2.14.2 // indirect
9190
github.com/gorilla/mux v1.8.1 // indirect
9291
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.0 // indirect
9392
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
9493
github.com/hashicorp/go-retryablehttp v0.7.7 // indirect
9594
github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
95+
github.com/hashicorp/hcl v1.0.1-vault-7 // indirect
9696
github.com/in-toto/in-toto-golang v0.9.0 // indirect
9797
github.com/inconshreveable/mousetrap v1.1.0 // indirect
9898
github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
@@ -109,21 +109,22 @@ require (
109109
github.com/opencontainers/go-digest v1.0.0 // indirect
110110
github.com/opentracing/opentracing-go v1.2.0 // indirect
111111
github.com/pelletier/go-toml/v2 v2.2.3 // indirect
112-
github.com/pjbgf/sha1cd v0.3.2 // indirect
112+
github.com/pjbgf/sha1cd v0.4.0 // indirect
113113
github.com/pkg/errors v0.9.1 // indirect
114114
github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
115115
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
116116
github.com/sagikazarmark/locafero v0.7.0 // indirect
117117
github.com/sassoftware/relic v7.2.1+incompatible // indirect
118118
github.com/secure-systems-lab/go-securesystemslib v0.9.0 // indirect
119119
github.com/segmentio/ksuid v1.0.4 // indirect
120-
github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 // indirect
120+
github.com/sergi/go-diff v1.4.0 // indirect
121121
github.com/shibumi/go-pathspec v1.3.0 // indirect
122122
github.com/sigstore/protobuf-specs v0.5.0 // indirect
123123
github.com/sigstore/rekor v1.3.10 // indirect
124124
github.com/sigstore/rekor-tiles v0.1.7-0.20250624231741-98cd4a77300f // indirect
125125
github.com/sigstore/sigstore v1.9.5 // indirect
126126
github.com/sigstore/timestamp-authority v1.2.8 // indirect
127+
github.com/sirupsen/logrus v1.9.3 // indirect
127128
github.com/skeema/knownhosts v1.3.1 // indirect
128129
github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 // indirect
129130
github.com/sourcegraph/conc v0.3.0 // indirect
@@ -155,7 +156,7 @@ require (
155156
go.uber.org/multierr v1.11.0 // indirect
156157
go.uber.org/zap v1.27.0 // indirect
157158
golang.org/x/crypto v0.40.0 // indirect
158-
golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0 // indirect
159+
golang.org/x/exp v0.0.0-20250531010427-b6e5de432a8b // indirect
159160
golang.org/x/mod v0.26.0 // indirect
160161
golang.org/x/net v0.42.0 // indirect
161162
golang.org/x/oauth2 v0.30.0 // indirect
@@ -173,5 +174,4 @@ require (
173174
gopkg.in/warnings.v0 v0.1.2 // indirect
174175
gopkg.in/yaml.v3 v3.0.1 // indirect
175176
k8s.io/klog/v2 v2.130.1 // indirect
176-
k8s.io/utils v0.0.0-20241210054802-24370beab758 // indirect
177177
)

‎sourcetool/go.sum

Lines changed: 16 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -627,7 +627,6 @@ gioui.org v0.0.0-20210308172011-57750fc8a0a6/go.mod h1:RSH6KIUZ0p2xy5zHDxgAM4zum
627627
git.sr.ht/~sbinet/gg v0.3.1/go.mod h1:KGYtlADtqsqANL9ueOFkWymvzUvLMQllU5Ixo+8v3pc=
628628
github.com/AdamKorcz/go-fuzz-headers-1 v0.0.0-20230919221257-8b5d3ce2d11d h1:zjqpY4C7H15HjRPEenkS4SAn3Jy2eRRjkjZbGR30TOg=
629629
github.com/AdamKorcz/go-fuzz-headers-1 v0.0.0-20230919221257-8b5d3ce2d11d/go.mod h1:XNqJ7hv2kY++g8XEHREpi+JqZo3+0l+CH2egBVN4yqM=
630-
github.com/Azure/azure-sdk-for-go v68.0.0+incompatible h1:fcYLmCpyNYRnvJbPerq7U0hS+6+I79yEDJBqVNcqUzU=
631630
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.0 h1:Gt0j3wceWMwPmiazCa8MzMA0MfhmPIz0Qp0FJ6qcM0U=
632631
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.0/go.mod h1:Ot/6aikWnKWi4l9QB7qVSwa8iMphQNqkWALMoNT3rzM=
633632
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.10.1 h1:B+blDbyVIG3WaikNxPnhPiJ1MThR03b3vKGtER95TP4=
@@ -657,8 +656,8 @@ github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v
657656
github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
658657
github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
659658
github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
660-
github.com/ProtonMail/go-crypto v1.1.6 h1:ZcV+Ropw6Qn0AX9brlQLAUXfqLBc7Bl+f/DmNxpLfdw=
661-
github.com/ProtonMail/go-crypto v1.1.6/go.mod h1:rA3QumHc/FZ8pAHreoekgiAbzpNsfQAosU5td4SnOrE=
659+
github.com/ProtonMail/go-crypto v1.3.0 h1:ILq8+Sf5If5DCpHQp4PbZdS1J7HDFRXz/+xKBiRGFrw=
660+
github.com/ProtonMail/go-crypto v1.3.0/go.mod h1:9whxjD8Rbs29b4XWbB8irEcE8KHMqaR2e7GWU1R+/PE=
662661
github.com/ajstarks/deck v0.0.0-20200831202436-30c9fc6549a9/go.mod h1:JynElWSGnm/4RlzPXRlREEwqTHAN3T56Bv2ITsFT3gY=
663662
github.com/ajstarks/deck/generate v0.0.0-20210309230005-c3f852c02e19/go.mod h1:T13YZdzov6OU0A1+RfKZiZN9ca6VeKdBdyDV+BY97Tk=
664663
github.com/ajstarks/svgo v0.0.0-20180226025133-644b8db467af/go.mod h1:K08gAheRH3/J6wwsYMMT4xOr94bZjxIelGM0+d/wbFw=
@@ -718,8 +717,6 @@ github.com/boombuler/barcode v1.0.0/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl
718717
github.com/boombuler/barcode v1.0.1/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
719718
github.com/carabiner-dev/bnd v0.2.2 h1:xLHIANo3IrhwwgacndXPOO1tjlufWgnhvbZ+zLGFROg=
720719
github.com/carabiner-dev/bnd v0.2.2/go.mod h1:l93PFWzbbwb6NC0Hw323xlhXThW4MFXueLhoXP7/7Yg=
721-
github.com/carabiner-dev/github v0.2.2 h1:Ykrlcct71fRQm4j37LhAz9FyzG4n1nlm2e+V62MIoJM=
722-
github.com/carabiner-dev/github v0.2.2/go.mod h1:J7VqMAUewwRQH6r6HMDmVNf39f/z7H5iyTzOfC8am9A=
723720
github.com/carabiner-dev/vcslocator v0.3.1 h1:TIC7NfrBjMUkul9F+vvrDVIxxRqhsywjWy4L7WzdaMA=
724721
github.com/carabiner-dev/vcslocator v0.3.1/go.mod h1:jvYlXLVyqQqkBuSH/CiE1pbHifoPaAhWtUjLquHaBb0=
725722
github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
@@ -833,12 +830,20 @@ github.com/go-fonts/liberation v0.2.0/go.mod h1:K6qoJYypsmfVjWg8KOVDQhLc8UDgIK2H
833830
github.com/go-fonts/stix v0.1.0/go.mod h1:w/c1f0ldAUlJmLBvlbkvVXLAD+tAMqobIIQpmnUIzUY=
834831
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
835832
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic=
833+
github.com/go-git/gcfg/v2 v2.0.2 h1:MY5SIIfTGGEMhdA7d7JePuVVxtKL7Hp+ApGDJAJ7dpo=
834+
github.com/go-git/gcfg/v2 v2.0.2/go.mod h1:/lv2NsxvhepuMrldsFilrgct6pxzpGdSRC13ydTLSLs=
836835
github.com/go-git/go-billy/v5 v5.6.2 h1:6Q86EsPXMa7c3YZ3aLAQsMA0VlWmy43r6FHqa/UNbRM=
837836
github.com/go-git/go-billy/v5 v5.6.2/go.mod h1:rcFC2rAsp/erv7CMz9GczHcuD0D32fWzH+MJAU+jaUU=
837+
github.com/go-git/go-billy/v6 v6.0.0-20250627091229-31e2a16eef30 h1:4KqVJTL5eanN8Sgg3BV6f2/QzfZEFbCd+rTak1fGRRA=
838+
github.com/go-git/go-billy/v6 v6.0.0-20250627091229-31e2a16eef30/go.mod h1:snwvGrbywVFy2d6KJdQ132zapq4aLyzLMgpo79XdEfM=
838839
github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
839840
github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
841+
github.com/go-git/go-git-fixtures/v5 v5.1.0 h1:b8cWxDLTk0s09Ihm9x1HvNGUzxUVlRwIH7EAM0gGDKg=
842+
github.com/go-git/go-git-fixtures/v5 v5.1.0/go.mod h1:CdmU0oQeDuy4Xh8V0i9Ym+vsTkgDDPKEiofBFEVT+aE=
840843
github.com/go-git/go-git/v5 v5.16.2 h1:fT6ZIOjE5iEnkzKyxTHK1W4HGAsPhqEqiSAssSO77hM=
841844
github.com/go-git/go-git/v5 v5.16.2/go.mod h1:4Ge4alE/5gPs30F2H1esi2gPd69R0C39lolkucHBOp8=
845+
github.com/go-git/go-git/v6 v6.0.0-20250711134917-1f24ae85fe16 h1:LGHFWd3pmIuMugWNIQfBd1CY6k6Gy+XuJ/VnNQZCXWg=
846+
github.com/go-git/go-git/v6 v6.0.0-20250711134917-1f24ae85fe16/go.mod h1:gI6xSrrkXH4EKP38iovrsY2EYf2XDU3DrIZRshlNDm0=
842847
github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
843848
github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
844849
github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
@@ -954,8 +959,6 @@ github.com/google/go-containerregistry v0.20.6 h1:cvWX87UxxLgaH76b4hIvya6Dzz9qHB
954959
github.com/google/go-containerregistry v0.20.6/go.mod h1:T0x8MuoAoKX/873bkeSfLD2FAkwCDf9/HZgsFJ02E2Y=
955960
github.com/google/go-github/v69 v69.2.0 h1:wR+Wi/fN2zdUx9YxSmYE0ktiX9IAR/BeePzeaUUbEHE=
956961
github.com/google/go-github/v69 v69.2.0/go.mod h1:xne4jymxLR6Uj9b7J7PyTpkMYstEMMwGZa0Aehh1azM=
957-
github.com/google/go-github/v72 v72.0.0 h1:FcIO37BLoVPBO9igQQ6tStsv2asG4IPcYFi655PPvBM=
958-
github.com/google/go-github/v72 v72.0.0/go.mod h1:WWtw8GMRiL62mvIquf1kO3onRHeWWKmK01qdCY8c5fg=
959962
github.com/google/go-github/v73 v73.0.0 h1:aR+Utnh+Y4mMkS+2qLQwcQ/cF9mOTpdwnzlaw//rG24=
960963
github.com/google/go-github/v73 v73.0.0/go.mod h1:fa6w8+/V+edSU0muqdhCVY7Beh1M8F1IlQPZIANKIYw=
961964
github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8=
@@ -1156,8 +1159,8 @@ github.com/phpdave11/gofpdf v1.4.2/go.mod h1:zpO6xFn9yxo3YLyMvW8HcKWVdbNqgIfOOp2
11561159
github.com/phpdave11/gofpdi v1.0.12/go.mod h1:vBmVV0Do6hSBHC8uKUQ71JGW+ZGQq74llk/7bXwjDoI=
11571160
github.com/phpdave11/gofpdi v1.0.13/go.mod h1:vBmVV0Do6hSBHC8uKUQ71JGW+ZGQq74llk/7bXwjDoI=
11581161
github.com/pierrec/lz4/v4 v4.1.15/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
1159-
github.com/pjbgf/sha1cd v0.3.2 h1:a9wb0bp1oC2TGwStyn0Umc/IGKQnEgF0vVaZ8QF8eo4=
1160-
github.com/pjbgf/sha1cd v0.3.2/go.mod h1:zQWigSxVmsHEZow5qaLtPYxpcKMMQpa09ixqBxuCS6A=
1162+
github.com/pjbgf/sha1cd v0.4.0 h1:NXzbL1RvjTUi6kgYZCX3fPwwl27Q1LJndxtUDVfJGRY=
1163+
github.com/pjbgf/sha1cd v0.4.0/go.mod h1:zQWigSxVmsHEZow5qaLtPYxpcKMMQpa09ixqBxuCS6A=
11611164
github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
11621165
github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU=
11631166
github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
@@ -1207,8 +1210,8 @@ github.com/secure-systems-lab/go-securesystemslib v0.9.0 h1:rf1HIbL64nUpEIZnjLZ3
12071210
github.com/secure-systems-lab/go-securesystemslib v0.9.0/go.mod h1:DVHKMcZ+V4/woA/peqr+L0joiRXbPpQ042GgJckkFgw=
12081211
github.com/segmentio/ksuid v1.0.4 h1:sBo2BdShXjmcugAMwjugoGUdUV0pcxY5mW4xKRn3v4c=
12091212
github.com/segmentio/ksuid v1.0.4/go.mod h1:/XUiZBD3kVx5SmUOl55voK5yeAbBNNIed+2O73XgrPE=
1210-
github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 h1:n661drycOFuPLCN3Uc8sB6B/s6Z4t2xvBgU1htSHuq8=
1211-
github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
1213+
github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw=
1214+
github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
12121215
github.com/shibumi/go-pathspec v1.3.0 h1:QUyMZhFo0Md5B8zV8x2tesohbb5kfbpTi9rBnKh5dkI=
12131216
github.com/shibumi/go-pathspec v1.3.0/go.mod h1:Xutfslp817l2I1cZvgcfeMQJG5QnU2lh5tVaaMCl3jE=
12141217
github.com/sigstore/protobuf-specs v0.5.0 h1:F8YTI65xOHw70NrvPwJ5PhAzsvTnuJMGLkA4FIkofAY=
@@ -1387,8 +1390,8 @@ golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u0
13871390
golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
13881391
golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
13891392
golang.org/x/exp v0.0.0-20220827204233-334a2380cb91/go.mod h1:cyybsKvd6eL0RnXn6p/Grxp8F5bW7iYuBgsNCOHpMYE=
1390-
golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0 h1:R84qjqJb5nVJMxqWYb3np9L5ZsaDtB+a39EqjV0JSUM=
1391-
golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0/go.mod h1:S9Xr4PYopiDyqSyp5NjCrhFrqg6A5zA2E/iPHPhqnS8=
1393+
golang.org/x/exp v0.0.0-20250531010427-b6e5de432a8b h1:QoALfVG9rhQ/M7vYDScfPdWjGL9dlsVVM5VGh7aKoAA=
1394+
golang.org/x/exp v0.0.0-20250531010427-b6e5de432a8b/go.mod h1:U6Lno4MTRCDY+Ba7aCcauB9T60gsv5s4ralQzP72ZoQ=
13921395
golang.org/x/image v0.0.0-20180708004352-c73c2afc3b81/go.mod h1:ux5Hcp/YLpHSI86hEcLt0YII63i6oz57MZXIpbrjZUs=
13931396
golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
13941397
golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
@@ -2042,8 +2045,6 @@ honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9
20422045
honnef.co/go/tools v0.1.3/go.mod h1:NgwopIslSNH47DimFoV78dnkksY2EFtX0ajyb3K/las=
20432046
k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
20442047
k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
2045-
k8s.io/utils v0.0.0-20241210054802-24370beab758 h1:sdbE21q2nlQtFh65saZY+rRM6x6aJJI8IUa1AmH/qa0=
2046-
k8s.io/utils v0.0.0-20241210054802-24370beab758/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
20472048
lukechampine.com/uint128 v1.1.1/go.mod h1:c4eWIwlEGaxC/+H1VguhU4PHXNWDCDMUlWdIWl2j1gk=
20482049
lukechampine.com/uint128 v1.2.0/go.mod h1:c4eWIwlEGaxC/+H1VguhU4PHXNWDCDMUlWdIWl2j1gk=
20492050
modernc.org/cc/v3 v3.36.0/go.mod h1:NFUHyPn4ekoC/JHeZFfZurN6ixxawE1BnVonP/oahEI=
@@ -2082,8 +2083,6 @@ rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8
20822083
rsc.io/pdf v0.1.1/go.mod h1:n8OzWcQ6Sp37PL01nO98y4iUCRdTGarVfzxY20ICaU4=
20832084
rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
20842085
rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
2085-
sigs.k8s.io/release-sdk v0.12.3 h1:gwti7Twx/8xvoAnir0tQzbIhw71lCKFqCdwmeUogDh4=
2086-
sigs.k8s.io/release-sdk v0.12.3/go.mod h1:MsNuKVrCJI9YVi1cZOI2vBxEDeeDH8DAj4m7ZHdfU98=
20872086
sigs.k8s.io/release-utils v0.11.1 h1:hzvXGpHgHJfLOJB6TRuu14bzWc3XEglHmXHJqwClSZE=
20882087
sigs.k8s.io/release-utils v0.11.1/go.mod h1:ybR2V/uQAOGxYfzYtBenSYeXWkBGNP2qnEiX77ACtpc=
20892088
sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=

‎sourcetool/internal/cmd/options.go

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ import (
1010
"github.com/spf13/cobra"
1111

1212
"github.com/slsa-framework/slsa-source-poc/sourcetool/pkg/ghcontrol"
13+
"github.com/slsa-framework/slsa-source-poc/sourcetool/pkg/sourcetool/models"
1314
)
1415

1516
type repoOptions struct {
@@ -49,6 +50,13 @@ func (ro *repoOptions) ParseSlug(lString string) error {
4950
return nil
5051
}
5152

53+
func (ro *repoOptions) GetRepository() *models.Repository {
54+
return &models.Repository{
55+
Hostname: "github.com",
56+
Path: fmt.Sprintf("%s/%s", ro.owner, ro.repository),
57+
}
58+
}
59+
5260
func (bo *branchOptions) Validate() error {
5361
errs := []error{}
5462
errs = append(errs, bo.repoOptions.Validate())
@@ -68,6 +76,16 @@ func (bo *branchOptions) AddFlags(cmd *cobra.Command) {
6876
)
6977
}
7078

79+
func (bo *branchOptions) GetBranch() *models.Branch {
80+
return &models.Branch{
81+
Name: bo.branch,
82+
Repository: &models.Repository{
83+
Hostname: "github.com",
84+
Path: fmt.Sprintf("%s/%s", bo.owner, bo.repository),
85+
},
86+
}
87+
}
88+
7189
type branchOptions struct {
7290
repoOptions
7391
branch string

‎sourcetool/internal/cmd/root.go

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,14 @@ Copyright © 2025 NAME HERE <EMAIL ADDRESS>
44
package cmd
55

66
import (
7+
"errors"
78
"fmt"
89
"os"
910

1011
"github.com/spf13/cobra"
1112

1213
"github.com/slsa-framework/slsa-source-poc/sourcetool/pkg/attest"
14+
"github.com/slsa-framework/slsa-source-poc/sourcetool/pkg/auth"
1315
)
1416

1517
var githubToken string
@@ -64,3 +66,24 @@ func Execute() {
6466
os.Exit(1)
6567
}
6668
}
69+
70+
func CheckAuth() (*auth.Authenticator, error) {
71+
authenticator := auth.New()
72+
user, err := authenticator.WhoAmI()
73+
if err != nil {
74+
return nil, fmt.Errorf("checking authentication status: %w", err)
75+
}
76+
77+
if user == nil {
78+
fmt.Println()
79+
fmt.Println("🚫 " + w("sourcetool is not logged in"))
80+
fmt.Println()
81+
fmt.Println("Please log into your GitHub account before using sourcetool. To")
82+
fmt.Println("log in, run the following command:")
83+
fmt.Println()
84+
fmt.Println(" sourcetool auth login")
85+
fmt.Println()
86+
return nil, errors.New("source tool is not logged in")
87+
}
88+
return authenticator, nil
89+
}

0 commit comments

Comments
 (0)