Comments (1)
Using the go-builder is blocked:
- The SLSA Go builder is currently broken (slsa-framework/slsa-github-generator#1163 (comment))
- Anyway, it does not support multiple builds yet, so we might want to wait for the functionality to be available
We might be able to generate provenance anyway (along with our goreleaser) by using the post-build hook to output the digest and then use it in a follow-up job that invokes SLSA's generic provenance generator.
Note that we must output the digest directly from the goreleaser because:
- The provenance generation invocation must be from the same workflow as the build.
- Doing some sort of a post-upload trick isn't good enough, because we can't tell that the artifact wasn't modified before the provenance generation job acted on it.
from legitify.
Related Issues (20)
- Install CLI in MAC HOT 1
- Custom Policy HOT 3
- Allow for disabling specific policies from the command line
- Premium GitLab accounts with skipped tests HOT 9
- Ignore invalid or expired certificate
- Reduce GitLab API Calls HOT 6
- Report Script HOT 1
- Policy Skip Support for GitHub Action HOT 1
- Parameterize output report name in GH action HOT 2
- legitify analyze --repo doesn't support gitlab projects within subgroups HOT 5
- When the "ignore-policies" option is enabled, GitHub Action disregards the "extra" parameter HOT 4
- SARIF format results do no supply the actual violation results? HOT 2
- legitify doesn't support nested GitLab projects completely HOT 8
- "organization_has_too_many_admins" policy doesn't flag an organization with 8 owners HOT 5
- Add the needed permissions/scopes to the custom action documentation HOT 4
- Running the GitHub action with ` scorecard: verbose` fails with error `failed to enrich scorecard: expecting []ScorecardCheck` HOT 1
- Support using legitify action with GITHUB_TOKEN
- 1.0.5 release did not get completed HOT 2
- "Reaching out" Message comes with every usage of legitify convert HOT 1
- Unmet prerequisite: premium, but premium license is used HOT 6
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from legitify.