feat: add GitHub attestation discovery #1020

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Merged

benmss merged 16 commits into main from 915-discover-github-attestations

Jun 4, 2025

Member

benmss commented Mar 19, 2025 •

edited

Loading

This PR adds support for GitHub attestation discovery. To access GitHub attestations, the SHA256 hash of the repositories artefacts must be generated and submitted via the API. Artefacts may be found in local caches, or downloaded from remote repositories.

Support for Maven artefacts
Support for PyPI artefacts

Closes #915

benmss self-assigned this

oracle-contributor-agreement bot added the OCA Verified label

benmss force-pushed the 915-discover-github-attestations branch from dc4736e to 69099a8 Compare

March 19, 2025 10:14

benmss changed the base branch from staging to main

April 8, 2025 06:38

benmss force-pushed the 915-discover-github-attestations branch from ea49398 to dce704b Compare

April 28, 2025 02:50

benmss marked this pull request as ready for review

April 30, 2025 23:27

benmss requested review from behnazh-w and tromai as code owners

April 30, 2025 23:27

behnazh-w requested a review from nicallen

May 1, 2025 11:33

benmss force-pushed the 915-discover-github-attestations branch from dce704b to 4be1f9d Compare

May 19, 2025 05:31

tromai reviewed

View reviewed changes

src/macaron/slsa_analyzer/package_registry/maven_central_registry.py Outdated Show resolved Hide resolved

nicallen reviewed

View reviewed changes

src/macaron/slsa_analyzer/analyzer.py Outdated Show resolved Hide resolved

tromai reviewed

View reviewed changes

src/macaron/artifact/local_artifact.py Outdated Show resolved Hide resolved

tromai reviewed

View reviewed changes

src/macaron/artifact/local_artifact.py Outdated Show resolved Hide resolved

tromai reviewed

View reviewed changes

src/macaron/slsa_analyzer/analyzer.py Outdated Show resolved Hide resolved

tromai reviewed

View reviewed changes

src/macaron/slsa_analyzer/analyzer.py Show resolved Hide resolved

tromai reviewed

View reviewed changes

src/macaron/slsa_analyzer/analyzer.py Outdated Show resolved Hide resolved

tromai reviewed

View reviewed changes

src/macaron/slsa_analyzer/package_registry/maven_central_registry.py Outdated Show resolved Hide resolved

tromai reviewed

View reviewed changes

src/macaron/artifact/local_artifact.py Outdated Show resolved Hide resolved

tromai reviewed

View reviewed changes

src/macaron/slsa_analyzer/package_registry/maven_central_registry.py Outdated Show resolved Hide resolved

tromai reviewed

View reviewed changes

src/macaron/slsa_analyzer/package_registry/maven_central_registry.py Outdated Show resolved Hide resolved

tromai reviewed

View reviewed changes

src/macaron/slsa_analyzer/package_registry/pypi_registry.py Show resolved Hide resolved

tromai reviewed

View reviewed changes

src/macaron/slsa_analyzer/analyzer.py Show resolved Hide resolved

tromai reviewed

View reviewed changes

tests/integration/cases/github_pypi_attestation/test.yaml Show resolved Hide resolved

tromai reviewed

View reviewed changes

tests/integration/cases/github_maven_attestation_local/test.yaml Outdated Show resolved Hide resolved

tromai reviewed

View reviewed changes

tests/integration/cases/github_maven_attestation_local/test.yaml Show resolved Hide resolved

tromai reviewed

View reviewed changes

src/macaron/slsa_analyzer/package_registry/maven_central_registry.py Show resolved Hide resolved

tromai requested changes

View reviewed changes

Member

tromai left a comment

I have finished my first round of review. Thank you.

behnazh-w reviewed

View reviewed changes

src/macaron/artifact/local_artifact.py Outdated Show resolved Hide resolved

behnazh-w reviewed

View reviewed changes

src/macaron/artifact/local_artifact.py Show resolved Hide resolved

tromai reviewed

View reviewed changes

src/macaron/slsa_analyzer/analyzer.py Outdated Show resolved Hide resolved

benmss force-pushed the 915-discover-github-attestations branch 2 times, most recently from 029a0dc to 4d2ff9a Compare

June 3, 2025 05:42

tromai reviewed

View reviewed changes

src/macaron/repo_finder/repo_finder.py Outdated Show resolved Hide resolved

benmss added 16 commits

June 4, 2025 14:09


          feat: add GitHub attestation discovery

89df90d

Signed-off-by: Ben Selwyn-Smith <[email protected]>


          chore: add support for PyPI PURLs

d960f66

Signed-off-by: Ben Selwyn-Smith <[email protected]>


          chore: add support for sha256 hashes in maven

79ec896

Signed-off-by: Ben Selwyn-Smith <[email protected]>


          chore: add pypi sha256 support

ebfaf89

Signed-off-by: Ben Selwyn-Smith <[email protected]>


          chore: use maven hashes as reference only; add pypi integration test

Signed-off-by: Ben Selwyn-Smith <[email protected]>


          chore: minor fixes

0c402b4

Signed-off-by: Ben Selwyn-Smith <[email protected]>


          chore: use correct path to sha256 hash for versioned pypi asset

8222e30

Signed-off-by: Ben Selwyn-Smith <[email protected]>


          chore: address PR feedback

73b8587

Signed-off-by: Ben Selwyn-Smith <[email protected]>


          chore: minor fix

c27b97f

Signed-off-by: Ben Selwyn-Smith <[email protected]>


          chore: add GitHub attestation schema link; add local artifact hash un…

6b6ff7b

…it test

Signed-off-by: Ben Selwyn-Smith <[email protected]>


          chore: update test

aa640dd

Signed-off-by: Ben Selwyn-Smith <[email protected]>


          chore: add doc comment for modification of package registry info

cdee7fc

Signed-off-by: Ben Selwyn-Smith <[email protected]>


          chore: use correct import location for error class

e09ed8b

Signed-off-by: Ben Selwyn-Smith <[email protected]>


          chore: fix cyclic import issue; rearrange unsubscriptable issue bypas…

76ec567

…sers

Signed-off-by: Ben Selwyn-Smith <[email protected]>


          chore: minor fixes

2fcc15d

Signed-off-by: Ben Selwyn-Smith <[email protected]>


          chore: minor fixes

a937044

Signed-off-by: Ben Selwyn-Smith <[email protected]>

benmss force-pushed the 915-discover-github-attestations branch from f2ade69 to a937044 Compare

June 4, 2025 04:51

behnazh-w approved these changes

View reviewed changes

tromai approved these changes

View reviewed changes

benmss merged commit 219903d into main

10 checks passed

benmss deleted the 915-discover-github-attestations branch

June 4, 2025 06:26

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels