From a6e1e776eed43fdeb309ead63a23c3d3277aa99a Mon Sep 17 00:00:00 2001 From: Taiki Endo Date: Sun, 4 Oct 2026 01:01:09 +0900 Subject: [PATCH] Update syft manifest --- CHANGELOG.md | 2 + manifests/syft.json | 41 +++++++++++++++- tools/codegen/src/main.rs | 101 +++++++++++++++++++++++--------------- 3 files changed, 102 insertions(+), 42 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2ae3a6dd..83b8a81a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,6 +10,8 @@ Note: In this file, do not use the hard wrap in the middle of a sentence for com ## [Unreleased] +- Update `syft@latest` to 1.54.0. + ## [2.87.22] - 2026-09-29 - Update `typos@latest` to 1.50.3. diff --git a/manifests/syft.json b/manifests/syft.json index f20c1537..b70e3e89 100644 --- a/manifests/syft.json +++ b/manifests/syft.json @@ -35,10 +35,47 @@ } }, "latest": { - "version": "1.52.0" + "version": "1.54.0" }, "1": { - "version": "1.52.0" + "version": "1.54.0" + }, + "1.54": { + "version": "1.54.0" + }, + "1.54.0": { + "x86_64_linux_musl": { + "etag": "0x8DF1FFE2E0C47EB", + "hash": "54a87372498168b2d033e876fd41fa4e8035b872699e525a57046e1f2f09c860" + }, + "x86_64_macos": { + "etag": "0x8DF1FFE2E1D4BBD", + "hash": "22b71725e388a4c0de385249c4bc1044f78a870f2894f34b43ba957e792145d7" + }, + "x86_64_windows": { + "etag": "0x8DF1FFE2DCD3BEF", + "hash": "77f4b472779058e819eec9a054753a5071a996aaa40db31a290f8b256748593f" + }, + "aarch64_linux_musl": { + "etag": "0x8DF1FFE2E0BAC63", + "hash": "ee6d4566373a05b344bc6b5f1706f14419bf9338ba39ff686e247deefe9b8818" + }, + "aarch64_macos": { + "etag": "0x8DF1FFE2E04D644", + "hash": "7e0bdad94c569fc6d5785c9a657bbae3d4c4e140ccb5eace3d0b5b6bc2b6dbcf" + }, + "aarch64_windows": { + "etag": "0x8DF1FFE2E1F1E77", + "hash": "0fdfa61470a69b99ace491df1fd7ef9803439c15d4d3d19a0bcb139d8b9fba4e" + }, + "powerpc64le_linux_musl": { + "etag": "0x8DF1FFE2E0C6ECA", + "hash": "5c96d7dfa60dc03864ec55ed3fdccf68d1beaf51f281fff91e790769d68a075d" + }, + "s390x_linux_musl": { + "etag": "0x8DF1FFE2E35FC37", + "hash": "270fe7f001d637680f9a9b44d0d73295d68548fd98014ffe0311bc42f5f6afcf" + } }, "1.52": { "version": "1.52.0" diff --git a/tools/codegen/src/main.rs b/tools/codegen/src/main.rs index 1ff36fac..0ad35f52 100644 --- a/tools/codegen/src/main.rs +++ b/tools/codegen/src/main.rs @@ -396,47 +396,68 @@ fn main() { } "syft" => { // Refs: https://oss.anchore.com/docs/installation/verification/ - let [checksum, certificate, signature] = - ["checksums.txt", "checksums.txt.pem", "checksums.txt.sig"].map( - |f| { - let asset = release - .assets - .iter() - .find(|asset| asset.name.ends_with(f)) - .unwrap(); - let download_cache = - download_cache_dir.join(format!("{version}-{f}")); - let url = &asset.browser_download_url; - eprint!( - "downloading {url} for signature verification ... " - ); - if download_cache.is_file() { - eprintln!("already downloaded"); - } else { - download_to_buf(url, &mut buf); - eprintln!("download complete"); - fs::write(&download_cache, &buf).unwrap(); - buf.clear(); - } - download_cache - }, - ); + let mut checksum = None; + let mut bundle = None; + let mut certificate = None; + let mut signature = None; + for (f, out) in [ + ("checksums.txt", &mut checksum), + /* >= 1.54.0 */ ("checksums.txt.sigstore.json", &mut bundle), + /* < 1.54.0 */ ("checksums.txt.pem", &mut certificate), + /* < 1.54.0 */ ("checksums.txt.sig", &mut signature), + ] { + let Some(asset) = + release.assets.iter().find(|asset| asset.name.ends_with(f)) + else { + continue; + }; + let download_cache = + download_cache_dir.join(format!("{version}-{f}")); + let url = &asset.browser_download_url; + eprint!("downloading {url} for signature verification ... "); + if download_cache.is_file() { + eprintln!("already downloaded"); + } else { + download_to_buf(url, &mut buf); + eprintln!("download complete"); + fs::write(&download_cache, &buf).unwrap(); + buf.clear(); + } + *out = Some(download_cache); + } + let checksum = checksum.unwrap(); eprint!("verifying checksum file for {package}@{version} ... "); - cmd!( - "cosign", - "verify-blob", - &checksum, - "--certificate", - certificate, - "--signature", - signature, - "--certificate-identity-regexp", - format!("https://github\\.com/{repo}/\\.github/workflows/.+"), - "--certificate-oidc-issuer", - "https://token.actions.githubusercontent.com" - ) - .run() - .unwrap(); + if let Some(bundle) = bundle { + cmd!( + "cosign", + "verify-blob", + &checksum, + "--bundle", + bundle, + "--certificate-identity-regexp", + format!("https://github\\.com/{repo}/\\.github/workflows/.+"), + "--certificate-oidc-issuer", + "https://token.actions.githubusercontent.com" + ) + .run() + .unwrap(); + } else { + cmd!( + "cosign", + "verify-blob", + &checksum, + "--certificate", + certificate.unwrap(), + "--signature", + signature.unwrap(), + "--certificate-identity-regexp", + format!("https://github\\.com/{repo}/\\.github/workflows/.+"), + "--certificate-oidc-issuer", + "https://token.actions.githubusercontent.com" + ) + .run() + .unwrap(); + } verified_checksum = Some( fs::read_to_string(checksum) .unwrap()