dnrops
/
mise
mirror of https://github.com/jdx/mise
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

feat(aqua): use source tag in SLSA verification (#4836) 

For a bit tighter checking. aqua does it too.

Closes https://github.com/jdx/mise/discussions/4791

*
fdfe33db55/pkg/slsa/exec.go (L69-L79)
*
fdfe33db55/pkg/installpackage/verify_slsa.go (L41-L44)

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
This commit is contained in:
Ville Skyttä 2025-04-12 18:06:10 +03:00 committed by GitHub
parent 6e0cf195ef
commit 370214def7
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/aqua/aqua_registry.rs
View File

@ -136,6 +136,7 @@ pub struct AquaSlsaProvenance {
pub url: Option<String>, pub url: Option<String>,
pub asset: Option<String>, pub asset: Option<String>,
pub source_uri: Option<String>, pub source_uri: Option<String>,
pub source_tag: Option<String>,
} }
#[derive(Debug, Deserialize, Clone)] #[derive(Debug, Deserialize, Clone)]
@ -710,6 +711,9 @@ impl AquaSlsaProvenance {
if let Some(source_uri) = other.source_uri { if let Some(source_uri) = other.source_uri {
self.source_uri = Some(source_uri); self.source_uri = Some(source_uri);
} }
if let Some(source_tag) = other.source_tag {
self.source_tag = Some(source_tag);
}
} }
} }

4
src/backend/aqua.rs
View File

@ -416,6 +416,10 @@ impl AquaBackend {
.arg(source_uri) .arg(source_uri)
.arg("--provenance-path") .arg("--provenance-path")
.arg(provenance_path); .arg(provenance_path);
let source_tag = slsa.source_tag.clone().unwrap_or_else(|| v.to_string());
if source_tag != "-" {
cmd = cmd.arg("--source-tag").arg(source_tag);
}
cmd = cmd.with_pr(&ctx.pr); cmd = cmd.with_pr(&ctx.pr);
cmd.execute()?; cmd.execute()?;
} else { } else {