Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Cherry pick vulnerability PRs to release-1.5 #1486

Merged
merged 3 commits into from Feb 18, 2022
Merged

Cherry pick vulnerability PRs to release-1.5 #1486

merged 3 commits into from Feb 18, 2022

Commits on Feb 18, 2022

  1. Merge pull request from GHSA-ccxc-vr6p-4858 

    * Make sure signature in Rekor bundle matches signature being verified

Signed-off-by: Priya Wadhwa <priya@chainguard.dev>

* Only print "fulcio verified" when using Fulcio

Currently we tell users that we've verified against the Fulcio root
trust when verifying but this isn't always true. This work ensures we
only say this when we actually use the Fulcio root cert for
verification.

Signed-off-by: Nathan Smith <nathan@chainguard.dev>

* Add e2e test

Signed-off-by: Nathan Smith <nathan@chainguard.dev>

Co-authored-by: Priya Wadhwa <priya@chainguard.dev>
    @nsmith5 @priyawadhwa
    nsmith5 and priyawadhwa committed Feb 18, 2022
    Copy the full SHA
    04ad1a6 View commit details
    Browse the repository at this point in the history

  2. fix lint (sigstore#1484) 

    Signed-off-by: Priya Wadhwa <priya@chainguard.dev>
    @priyawadhwa
    priyawadhwa committed Feb 18, 2022
    Copy the full SHA
    796db02 View commit details
    Browse the repository at this point in the history

  3. Manual merge conflict resolution in e2e_test. 

    Signed-off-by: Dan Lorenc <lorenc.d@gmail.com>
    @dlorenc
    dlorenc committed Feb 18, 2022
    Copy the full SHA
    f84bcbe View commit details
    Browse the repository at this point in the history