Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

deps: bump version of slsa generator #1468

Merged
merged 1 commit into from Oct 19, 2022
Merged

Conversation

asraa
Copy link
Contributor

@asraa asraa commented Oct 19, 2022

Signed-off-by: Asra Ali asraa@google.com

We just updated the generators because of a breaking change in verification flows due to a rekor sharding rollout

Signed-off-by: Asra Ali <asraa@google.com>
@jonjohnsonjr jonjohnsonjr merged commit 02f47e1 into google:main Oct 19, 2022
@imjasonh
Copy link
Collaborator

Thanks Asra! 🎉

@imjasonh
Copy link
Collaborator

This happened again on the release of v0.12.1: https://github.com/google/go-containerregistry/actions/runs/3439316070/jobs/5736576729

}: unable to fetch Rekor public keys from TUF repository, trying Redis search index to find entries by subject digest
FAILED: SLSA verification failed: could not find a matching valid signature entry: got unexpected errors updating local metadata and targets: error updating to TUF remote mirror: tuf: invalid key
remote status:{
	"mirror": "https://sigstore-tuf-root.storage.googleapis.com/",
	"metadata": {
		"root.json": {
			"version": 5,
			"len": 6388,
			"expiration": "18 Apr 23 18:13 UTC",
			"error": ""
		},
		"snapshot.json": {
			"version": 54,
			"len": 1977,
			"expiration": "21 Nov 22 15:59 UTC",
			"error": ""
		},
		"targets.json": {
			"version": 5,
			"len": 4188,
			"expiration": "18 Apr 23 18:13 UTC",
			"error": ""
		},
		"timestamp.json": {
			"version": 54,
			"len": 719,
			"expiration": "14 Nov 22 15:59 UTC",
			"error": ""
		}
	}
}: unable to fetch Rekor public keys from TUF repository: verifying tlog entry 24296fb24b8ad77aa554c72040fd95aa256c746048e580348fe27258d8a2aad641dc3d0842bb23f3

@asraa
Copy link
Contributor Author

asraa commented Nov 14, 2022

This happened again on the release of v0.12.1: https://github.com/google/go-containerregistry/actions/runs/3439316070/jobs/5736576729

Hi! I think this ends up resolved by #1489
I'm sorry :| After Sigstore GA older libraries were incompatible and needed updating. It should be stable going forward.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants