Skip to content

Releases: philips-labs/slsa-provenance-action

v0.9.0

11 Dec 10:46
@github-actions github-actions
v0.9.0
This tag was signed with the committer’s verified signature. The key has expired.
marcofranssen Marco Franssen
GPG key ID: 196A5F57979D5CD2
Expired
Learn about vigilant mode.
6b2fd19
This commit was signed with the committer’s verified signature. The key has expired.
marcofranssen Marco Franssen
GPG key ID: 196A5F57979D5CD2
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.9.0 Latest
Latest

Changelog

Read more

Contributors

JeroenKnoops, jkremser, and 3 other contributors
Assets 29

v0.8.0

24 Jun 10:28
@github-actions github-actions
v0.8.0
This tag was signed with the committer’s verified signature. The key has expired.
marcofranssen Marco Franssen
GPG key ID: 196A5F57979D5CD2
Expired
Learn about vigilant mode.
752766b
This commit was signed with the committer’s verified signature. The key has expired.
marcofranssen Marco Franssen
GPG key ID: 196A5F57979D5CD2
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.8.0

Changelog

Full Changelog: v0.7.2...v0.8.0

Contributors

marcofranssen and dependabot
Assets 31
Loading

v0.7.2

18 Feb 10:39
@github-actions github-actions
v0.7.2
This tag was signed with the committer’s verified signature. The key has expired.
marcofranssen Marco Franssen
GPG key ID: 196A5F57979D5CD2
Expired
Learn about vigilant mode.
dddb40e
This commit was signed with the committer’s verified signature. The key has expired.
marcofranssen Marco Franssen
GPG key ID: 196A5F57979D5CD2
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.7.2
Marketplace
Marketplace

Changelog

Full Changelog: v0.7.1...v0.7.2

Contributors

marcofranssen
Assets 31
Loading

v0.7.1

18 Feb 09:34
@github-actions github-actions
v0.7.1
This tag was signed with the committer’s verified signature. The key has expired.
marcofranssen Marco Franssen
GPG key ID: 196A5F57979D5CD2
Expired
Learn about vigilant mode.
3645ec0
This commit was signed with the committer’s verified signature. The key has expired.
marcofranssen Marco Franssen
GPG key ID: 196A5F57979D5CD2
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.7.1
Marketplace
Marketplace

Changelog

Full Changelog: v0.7.0...v0.7.1

Contributors

marcofranssen and Brend-Smits
Assets 29
Loading

v0.7.0

14 Feb 12:14
@github-actions github-actions
v0.7.0
This tag was signed with the committer’s verified signature. The key has expired.
marcofranssen Marco Franssen
GPG key ID: 196A5F57979D5CD2
Expired
Learn about vigilant mode.
91684f3
This commit was signed with the committer’s verified signature. The key has expired.
marcofranssen Marco Franssen
GPG key ID: 196A5F57979D5CD2
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.7.0
Marketplace
Marketplace

This release drops the use of Docker to run this action. Instead we are now using the binaries natively. This allows to reuse you docker login session. Either via the docker/login-action or a docker login within your workflow. It is recommended to use the sigstore/cosign- installer so the release signature will also be verified upon installation of the binary.

Changelog

  • d50e6fc ⬆️ Bump actions/setup-go from 2.1.5 to 2.2.0
  • 9be60c7 ⬆️ Bump sigstore/cosign-installer from 1.4.1 to 2.0.0
  • 6ae8f65 Bump cosign from v1.4.1 to v1.5.1
  • 1917ee5 Bump v0.6.0 to v0.7.0-rc for release
  • 91684f3 Bump v0.7.0-rc to v0.7.0 for release
  • 419b873 Fix draft release installer
  • 5df3fa8 Fix draft releases
  • 58b193c Fix gh-release make task on MacOS
  • 3c3ee60 Fix link to slsa-framework/github-actions-demo
  • f9e3db5 Fix list releases test
  • 03e87f5 Improve logging of slsa-provenance install
  • ef55f6d Install slsa-provenance instead of using docker image
  • cdc0cb7 Log cosign unavailable as warning
  • 0d93f72 Make k8s keychain vs default keychain configurable
  • 4d3ee36 Reduce duplication in downloading assets
  • dfdaf36 Support Windows and ARM64 in installer
  • 67318bf Utilize new setup-go action 'check-latest'

Full Changelog: v0.6.0...v0.7.0

Assets 18
Loading

v0.7.0-rc

10 Feb 15:48
@github-actions github-actions
v0.7.0-rc
This tag was signed with the committer’s verified signature. The key has expired.
marcofranssen Marco Franssen
GPG key ID: 196A5F57979D5CD2
Expired
Learn about vigilant mode.
47260ae
This commit was signed with the committer’s verified signature. The key has expired.
marcofranssen Marco Franssen
GPG key ID: 196A5F57979D5CD2
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.7.0-rc Pre-release
Marketplace
Pre-release
Marketplace

⚠️ This release installs the binary on the runner as opposed to using the Docker image.

Changelog

  • 9be60c7 ⬆️ Bump sigstore/cosign-installer from 1.4.1 to 2.0.0
  • 6ae8f65 Bump cosign from v1.4.1 to v1.5.1
  • 47260ae Bump v0.6.0 to v0.7.0-rc for release
  • 58b193c Fix gh-release make task on MacOS
  • 3c3ee60 Fix link to slsa-framework/github-actions-demo
  • e79e0f9 Install slsa-provenance instead of using docker image
  • ee2282e Make k8s keychain vs default keychain configurable

Full Changelog: v0.6.0...v0.7.0-rc

Assets 18
Loading

v0.6.0

26 Jan 10:00
@github-actions github-actions
v0.6.0
This tag was signed with the committer’s verified signature. The key has expired.
marcofranssen Marco Franssen
GPG key ID: 196A5F57979D5CD2
Expired
Learn about vigilant mode.
3c40057
This commit was signed with the committer’s verified signature. The key has expired.
marcofranssen Marco Franssen
GPG key ID: 196A5F57979D5CD2
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.6.0
Marketplace
Marketplace

This release adds support for Private Docker registries that require authentication.

To authenticate simply run docker login. slsa-provenance will read the credentials from the credential store.

Changelog

  • 8d0286f Add ClientOptions for authentication to crane
  • 3c40057 Bump v0.5.1 to v0.6.0 for release
  • 6d36724 Fix version in docker build
  • a16ebc9 Pass json as environment variables
  • 1d1afcf Replace docker client with crane

Full Changelog: v0.5.1...v0.6.0

Assets 18
Loading

v0.5.1

14 Jan 15:07
@github-actions github-actions
v0.5.1
This tag was signed with the committer’s verified signature. The key has expired.
marcofranssen Marco Franssen
GPG key ID: 196A5F57979D5CD2
Expired
Learn about vigilant mode.
7510a8c
This commit was signed with the committer’s verified signature. The key has expired.
marcofranssen Marco Franssen
GPG key ID: 196A5F57979D5CD2
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.5.1

Changelog

  • ca6c1b2 ⬆️ Bump actions/setup-go from 2.1.4 to 2.1.5
  • b29f27b ⬆️ Bump github.com/docker/docker
  • 91e5591 Add footer to release notes
  • 885106c Add signing of binaries
  • fae521a Add signing of release artifacts and containers
  • f0be99d Attach slsaprovenance predicate only
  • 940f3c5 Bump goreleaser version in Makefile
  • 6a643ba Bump version for release to v0.5.1-draft
  • 7855bd2 Bump version to v0.5.1 for release
  • 7255811 Check release has a annotation/description
  • f454e93 Fix to also sign the images
  • 7736088 Remove as pub key is already committed
  • 8cfdefd Remove certificates as we not use PKCS11
  • abc16c4 Remove the PKCS11 certs from signing
  • 7510a8c Revert "Remove as pub key is already committed"
  • 598f792 Update release docs with drafts explanation
  • 43d7a70 Update test for release paging

Full Changelog: v0.5.0...v0.5.1

Assets 18
Loading

v0.5.0

24 Dec 15:40
@github-actions github-actions
v0.5.0
This tag was signed with the committer’s verified signature. The key has expired.
marcofranssen Marco Franssen
GPG key ID: 196A5F57979D5CD2
Expired
Learn about vigilant mode.
ba29e99
This commit was signed with the committer’s verified signature. The key has expired.
marcofranssen Marco Franssen
GPG key ID: 196A5F57979D5CD2
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.5.0
Marketplace
Marketplace

Changelog

  • b5cf8b5 ⬆️ Bump actions/cache from 2.1.6 to 2.1.7
  • 33a20a0 ⬆️ Bump github.com/spf13/cobra from 1.2.1 to 1.3.0
  • 4dc7f6f Add IMAGE_DIGEST output to release job
  • 5c3277b Add container provenance job
  • 79973f2 Add debugging for the action arguments
  • 7225285 Add logging of http request with GitHub
  • 6a59561 Add some missing defer calls to Close
  • d5263fa Add subcommand input to the Github Action
  • 6b4cbd9 Add test-race task to Makefile
  • b7c8807 Add tests for OCI subjecter
  • 636239e Add tests for container command + fix digest flag error
  • 9390333 Args as string output
  • 7e2ee54 Attest the container using cosign
  • f70badb Bump github.com/google/go-github/v41/github from v39.2 to v41.0
  • ba29e99 Bump version from v0.4.0 to v0.5.0 for release
  • dac1c12 Change default to provenance.json instead of build.provenance
  • 587690e Do not commit doc updates
  • 8778fdc Fix arguments
  • 5bd7c0a Fix provenance args for dockers in CI
  • 6d97912 Fix release provenance to use the new github-release subcommand
  • 1489f06 Get container variables for provenance in workflow
  • 0c0ed88 Implement first draft to generate provenance for containers
  • 0fc6b93 Migrate error wrapping to use go native logic
  • d40a806 Move repeated string to const in files_test
  • 0a8c490 Prevent whitelines in base64 encoding
  • 4233703 Publish as draft when tag has suffix -draft
  • a8bd75c Quote contexts in action.yml
  • dca7236 Refactor Generate Command to cobra cli lib
  • 29db98e Refactor Generate Command to cobra cli lib
  • 2e451be Refactor action to support multiple usecases
  • 0d8b360 Refactor additional materials to the environment
  • 75cb706 Refactor materials reading from file to lib
  • 95c63d2 Refactor version command to cobra lib
  • 3125396 Remove action-docs.yaml as it does not add value anymore
  • 8595578 Remove docker username secret
  • a93f24e Resolve bug resulting in failing to push tags to origin
  • 60802d7 Resolve issue with CONTAINER_DIGEST var in ci
  • cf2d451 Resolve linter warnings
  • b8149b4 Split files and release asset cli commands
  • 0c8cf3a Swap files and github-release command to cobra lib
  • c4d4dc4 Switch to composite action to dynamically build the image args
  • bf324a9 Temp fix testcase release pages
  • b92a609 Tidy go modules
  • a28c1a8 Try fix action.yml
  • 204d953 Update documentation
  • 065eab8 Use base64 encoding for github and runner context
  • cc02d63 Use variable for repos in Makefile
  • 6d30e4e Validate required params gh-release make task
  • 0645c6a fix-snapshot release naming

Docker images

  • docker pull philipssoftware/slsa-provenance:v0.5.0
  • docker pull philipssoftware/slsa-provenance:7b62f2c0c0604997f0fad2288e85016f64c7bf1e
  • docker pull ghcr.io/philips-labs/slsa-provenance:v0.5.0
  • docker pull ghcr.io/philips-labs/slsa-provenance:7b62f2c0c0604997f0fad2288e85016f64c7bf1e
Assets 10
Loading

v0.4.0

12 Nov 10:09
@github-actions github-actions
v0.4.0
This tag was signed with the committer’s verified signature.
Brend-Smits Brend Smits
GPG key ID: F43FAD96B20744CC
Learn about vigilant mode.
33ba3da
This commit was signed with the committer’s verified signature.
Brend-Smits Brend Smits
GPG key ID: F43FAD96B20744CC
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.4.0
Marketplace
Marketplace

Changelog

6442288 Add BuildConfig to predicate structure
5e82c30 Add URI and Digest to ConfigSource
9086b31 Add assertions for metadata
33cb940 Add documentation about release procedure
60854d2 Add make command to automate release procedure
4d1028a Add test to verify code is producing the correct JSON
2ca9be8 Apply suggestions from code review
33ba3da Bump v0.3.0 to v0.4.0 for release
10c44b6 Move recipe.type one level up as buildType
b79087a Refactor arguments to parameters
19073a9 Refactor invocation entrypoint to configSource
968662e Remove definedInMaterial from invocation
9551b97 Rename recipe to invocation
af780dc Update example_provenance.json to slsa 0.2 spec

Docker images

  • docker pull philipssoftware/slsa-provenance:v0.4.0
  • docker pull philipssoftware/slsa-provenance:33ba3da2213c83ce02df0f2f6ba925ec79037f9d
  • docker pull ghcr.io/philips-labs/slsa-provenance:v0.4.0
  • docker pull ghcr.io/philips-labs/slsa-provenance:33ba3da2213c83ce02df0f2f6ba925ec79037f9d
Assets 10
Loading