mirror of
https://github.com/taiki-e/install-action
synced 2026-11-02 21:14:01 +00:00
Update syft manifest
This commit is contained in:
Taiki Endo
@@ -10,6 +10,8 @@ Note: In this file, do not use the hard wrap in the middle of a sentence for com
|
||||
|
||||
## [Unreleased]
|
||||
|
||||
- Update `syft@latest` to 1.54.0.
|
||||
|
||||
## [2.87.22] - 2026-09-29
|
||||
|
||||
- Update `typos@latest` to 1.50.3.
|
||||
|
||||
Generated
+39
-2
@@ -35,10 +35,47 @@
|
||||
}
|
||||
},
|
||||
"latest": {
|
||||
"version": "1.52.0"
|
||||
"version": "1.54.0"
|
||||
},
|
||||
"1": {
|
||||
"version": "1.52.0"
|
||||
"version": "1.54.0"
|
||||
},
|
||||
"1.54": {
|
||||
"version": "1.54.0"
|
||||
},
|
||||
"1.54.0": {
|
||||
"x86_64_linux_musl": {
|
||||
"etag": "0x8DF1FFE2E0C47EB",
|
||||
"hash": "54a87372498168b2d033e876fd41fa4e8035b872699e525a57046e1f2f09c860"
|
||||
},
|
||||
"x86_64_macos": {
|
||||
"etag": "0x8DF1FFE2E1D4BBD",
|
||||
"hash": "22b71725e388a4c0de385249c4bc1044f78a870f2894f34b43ba957e792145d7"
|
||||
},
|
||||
"x86_64_windows": {
|
||||
"etag": "0x8DF1FFE2DCD3BEF",
|
||||
"hash": "77f4b472779058e819eec9a054753a5071a996aaa40db31a290f8b256748593f"
|
||||
},
|
||||
"aarch64_linux_musl": {
|
||||
"etag": "0x8DF1FFE2E0BAC63",
|
||||
"hash": "ee6d4566373a05b344bc6b5f1706f14419bf9338ba39ff686e247deefe9b8818"
|
||||
},
|
||||
"aarch64_macos": {
|
||||
"etag": "0x8DF1FFE2E04D644",
|
||||
"hash": "7e0bdad94c569fc6d5785c9a657bbae3d4c4e140ccb5eace3d0b5b6bc2b6dbcf"
|
||||
},
|
||||
"aarch64_windows": {
|
||||
"etag": "0x8DF1FFE2E1F1E77",
|
||||
"hash": "0fdfa61470a69b99ace491df1fd7ef9803439c15d4d3d19a0bcb139d8b9fba4e"
|
||||
},
|
||||
"powerpc64le_linux_musl": {
|
||||
"etag": "0x8DF1FFE2E0C6ECA",
|
||||
"hash": "5c96d7dfa60dc03864ec55ed3fdccf68d1beaf51f281fff91e790769d68a075d"
|
||||
},
|
||||
"s390x_linux_musl": {
|
||||
"etag": "0x8DF1FFE2E35FC37",
|
||||
"hash": "270fe7f001d637680f9a9b44d0d73295d68548fd98014ffe0311bc42f5f6afcf"
|
||||
}
|
||||
},
|
||||
"1.52": {
|
||||
"version": "1.52.0"
|
||||
|
||||
+61
-40
@@ -396,47 +396,68 @@ fn main() {
|
||||
}
|
||||
"syft" => {
|
||||
// Refs: https://oss.anchore.com/docs/installation/verification/
|
||||
let [checksum, certificate, signature] =
|
||||
["checksums.txt", "checksums.txt.pem", "checksums.txt.sig"].map(
|
||||
|f| {
|
||||
let asset = release
|
||||
.assets
|
||||
.iter()
|
||||
.find(|asset| asset.name.ends_with(f))
|
||||
.unwrap();
|
||||
let download_cache =
|
||||
download_cache_dir.join(format!("{version}-{f}"));
|
||||
let url = &asset.browser_download_url;
|
||||
eprint!(
|
||||
"downloading {url} for signature verification ... "
|
||||
);
|
||||
if download_cache.is_file() {
|
||||
eprintln!("already downloaded");
|
||||
} else {
|
||||
download_to_buf(url, &mut buf);
|
||||
eprintln!("download complete");
|
||||
fs::write(&download_cache, &buf).unwrap();
|
||||
buf.clear();
|
||||
}
|
||||
download_cache
|
||||
},
|
||||
);
|
||||
let mut checksum = None;
|
||||
let mut bundle = None;
|
||||
let mut certificate = None;
|
||||
let mut signature = None;
|
||||
for (f, out) in [
|
||||
("checksums.txt", &mut checksum),
|
||||
/* >= 1.54.0 */ ("checksums.txt.sigstore.json", &mut bundle),
|
||||
/* < 1.54.0 */ ("checksums.txt.pem", &mut certificate),
|
||||
/* < 1.54.0 */ ("checksums.txt.sig", &mut signature),
|
||||
] {
|
||||
let Some(asset) =
|
||||
release.assets.iter().find(|asset| asset.name.ends_with(f))
|
||||
else {
|
||||
continue;
|
||||
};
|
||||
let download_cache =
|
||||
download_cache_dir.join(format!("{version}-{f}"));
|
||||
let url = &asset.browser_download_url;
|
||||
eprint!("downloading {url} for signature verification ... ");
|
||||
if download_cache.is_file() {
|
||||
eprintln!("already downloaded");
|
||||
} else {
|
||||
download_to_buf(url, &mut buf);
|
||||
eprintln!("download complete");
|
||||
fs::write(&download_cache, &buf).unwrap();
|
||||
buf.clear();
|
||||
}
|
||||
*out = Some(download_cache);
|
||||
}
|
||||
let checksum = checksum.unwrap();
|
||||
eprint!("verifying checksum file for {package}@{version} ... ");
|
||||
cmd!(
|
||||
"cosign",
|
||||
"verify-blob",
|
||||
&checksum,
|
||||
"--certificate",
|
||||
certificate,
|
||||
"--signature",
|
||||
signature,
|
||||
"--certificate-identity-regexp",
|
||||
format!("https://github\\.com/{repo}/\\.github/workflows/.+"),
|
||||
"--certificate-oidc-issuer",
|
||||
"https://token.actions.githubusercontent.com"
|
||||
)
|
||||
.run()
|
||||
.unwrap();
|
||||
if let Some(bundle) = bundle {
|
||||
cmd!(
|
||||
"cosign",
|
||||
"verify-blob",
|
||||
&checksum,
|
||||
"--bundle",
|
||||
bundle,
|
||||
"--certificate-identity-regexp",
|
||||
format!("https://github\\.com/{repo}/\\.github/workflows/.+"),
|
||||
"--certificate-oidc-issuer",
|
||||
"https://token.actions.githubusercontent.com"
|
||||
)
|
||||
.run()
|
||||
.unwrap();
|
||||
} else {
|
||||
cmd!(
|
||||
"cosign",
|
||||
"verify-blob",
|
||||
&checksum,
|
||||
"--certificate",
|
||||
certificate.unwrap(),
|
||||
"--signature",
|
||||
signature.unwrap(),
|
||||
"--certificate-identity-regexp",
|
||||
format!("https://github\\.com/{repo}/\\.github/workflows/.+"),
|
||||
"--certificate-oidc-issuer",
|
||||
"https://token.actions.githubusercontent.com"
|
||||
)
|
||||
.run()
|
||||
.unwrap();
|
||||
}
|
||||
verified_checksum = Some(
|
||||
fs::read_to_string(checksum)
|
||||
.unwrap()
|
||||
|
||||
Reference in New Issue
Block a user