Skip to content

deps: bump version of slsa generator#1468

Merged
jonjohnsonjr merged 1 commit intogoogle:mainfrom
asraa:bump-version
Oct 19, 2022
Merged

deps: bump version of slsa generator#1468
jonjohnsonjr merged 1 commit intogoogle:mainfrom
asraa:bump-version

Conversation

@asraa
Copy link
Copy Markdown
Contributor

@asraa asraa commented Oct 19, 2022

Signed-off-by: Asra Ali asraa@google.com

We just updated the generators because of a breaking change in verification flows due to a rekor sharding rollout

Signed-off-by: Asra Ali <asraa@google.com>
@jonjohnsonjr jonjohnsonjr merged commit 02f47e1 into google:main Oct 19, 2022
@imjasonh
Copy link
Copy Markdown
Contributor

Thanks Asra! 🎉

@imjasonh
Copy link
Copy Markdown
Contributor

This happened again on the release of v0.12.1: https://github.com/google/go-containerregistry/actions/runs/3439316070/jobs/5736576729

}: unable to fetch Rekor public keys from TUF repository, trying Redis search index to find entries by subject digest
FAILED: SLSA verification failed: could not find a matching valid signature entry: got unexpected errors updating local metadata and targets: error updating to TUF remote mirror: tuf: invalid key
remote status:{
	"mirror": "https://sigstore-tuf-root.storage.googleapis.com/",
	"metadata": {
		"root.json": {
			"version": 5,
			"len": 6388,
			"expiration": "18 Apr 23 18:13 UTC",
			"error": ""
		},
		"snapshot.json": {
			"version": 54,
			"len": 1977,
			"expiration": "21 Nov 22 15:59 UTC",
			"error": ""
		},
		"targets.json": {
			"version": 5,
			"len": 4188,
			"expiration": "18 Apr 23 18:13 UTC",
			"error": ""
		},
		"timestamp.json": {
			"version": 54,
			"len": 719,
			"expiration": "14 Nov 22 15:59 UTC",
			"error": ""
		}
	}
}: unable to fetch Rekor public keys from TUF repository: verifying tlog entry 24296fb24b8ad77aa554c72040fd95aa256c746048e580348fe27258d8a2aad641dc3d0842bb23f3

@asraa
Copy link
Copy Markdown
Contributor Author

asraa commented Nov 14, 2022

This happened again on the release of v0.12.1: https://github.com/google/go-containerregistry/actions/runs/3439316070/jobs/5736576729

Hi! I think this ends up resolved by #1489
I'm sorry :| After Sigstore GA older libraries were incompatible and needed updating. It should be stable going forward.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants