feat: SLSA features (in-flight checksumming + cache artifact signing)#257

Merged

leodido merged 21 commits into

mainfrom

leo/slsa-against-main

Oct 23, 2025

Commits on Oct 23, 2025

Add checksum storage to build context for in-flight checksumming

leodido
and
ona-agent
committed
Implement checksum helper functions for in-flight checksumming

leodido
and
ona-agent
committed
Hook checksum recording after cache artifact creation

leodido
and
ona-agent
committed
Add end-of-build verification to complete TOCTU attack protection

leodido
and
ona-agent
committed
Add --in-flight-checksums CLI flag for TOCTU attack prevention

leodido
and
ona-agent
committed
Add comprehensive tests for in-flight checksumming security

leodido
and
ona-agent
committed
feat: implement integrated SLSA signing architecture

leodido
and
ona-agent
committed
feat: add sign-cache plumbing command for CI/CD integration

leodido
and
ona-agent
committed
fix: replace placeholder Sigstore implementation with production API

leodido
and
ona-agent
committed
refactor: simplify sign-cache command interface

leodido
and
ona-agent
committed
refactor: remove unnecessary tempMu mutex from sign-cache

leodido
and
ona-agent
committed
refactor: extract magic number to maxAcceptableFailureRate constant

leodido
and
ona-agent
committed
refactor: use GITHUB_WORKFLOW_REF for builderID instead of hardcoded path

leodido
and
ona-agent
committed
fix: set build timestamps to nil in SLSA attestations

leodido
and
ona-agent
committed
refactor: add UploadFile method to RemoteCache interface

leodido
and
ona-agent
committed
feat: add environment variable support for in-flight checksumming

leodido
and
ona-agent
committed
test: add comprehensive environment variable test coverage

leodido
and
ona-agent
committed
test: fix environment variable test implementation

leodido
and
ona-agent
committed
chore: run go mod tidy

leodido
and
ona-agent
committed
fix: implement UploadFile method for cache wrapper types

leodido
and
ona-agent
committed
fix: resolve linting issues

leodido
and
ona-agent
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: SLSA features (in-flight checksumming + cache artifact signing)#257

feat: SLSA features (in-flight checksumming + cache artifact signing)#257
leodido merged 21 commits into
mainfrom
leo/slsa-against-main

Commits on Oct 23, 2025

Add checksum storage to build context for in-flight checksumming

Implement checksum helper functions for in-flight checksumming

Hook checksum recording after cache artifact creation

Add end-of-build verification to complete TOCTU attack protection

Add --in-flight-checksums CLI flag for TOCTU attack prevention

Add comprehensive tests for in-flight checksumming security

feat: implement integrated SLSA signing architecture

feat: add sign-cache plumbing command for CI/CD integration

fix: replace placeholder Sigstore implementation with production API

refactor: simplify sign-cache command interface

refactor: remove unnecessary tempMu mutex from sign-cache

refactor: extract magic number to maxAcceptableFailureRate constant

refactor: use GITHUB_WORKFLOW_REF for builderID instead of hardcoded path

fix: set build timestamps to nil in SLSA attestations

refactor: add UploadFile method to RemoteCache interface

feat: add environment variable support for in-flight checksumming

test: add comprehensive environment variable test coverage

test: fix environment variable test implementation

chore: run go mod tidy

fix: implement UploadFile method for cache wrapper types

fix: resolve linting issues