v0.1.9

Changelog

Features

• 5d7bc95: feat: block known sensitive environment variables (@mikhailswift)

Others

• b55fb8b: chore: add guards to scripts to check presence of required programs (@mikhailswift)

v0.1.8

Changelog

Features

• 98d8714: feat: add support for fulcio keyless signatures (@colek42)

Documentation

• 97ca6e2: docs: edit of all witness docs (@bilzinho)

Others

• b928ea1: Update rekor.go (@colek42)

v0.1.7

Changelog

Features

• d689897: feat: syft attestor (@mikhailswift)

Bug fixes

• 9500d99: fix: dev/Dockerfile.go-builder to reduce vulnerabilities (@snyk-bot)
• 0914fc2: fix: update docker image (@colek42)
• e194af8: fix: examples/solarwinds/Dockerfile to reduce vulnerabilities (@snyk-bot)

Others

• 6221b9d: CHORE: move signer locgic out of cmd (@)
• 4ab0f68: CHORE: add testing to cmd package (@)
• 539897c: feat!: recurse through rekor subjects (@)

v0.1.6

Changelog

Bug fixes

• 7fd0ecc: fix: verification of attestations from rekor (@mikhailswift)

v0.1.5

Changelog

Bug fixes

• cb797dd: fix: change attestor names to witness.dev domain (@)
• 75f7868: fix: use intermediates from rekor (@mikhailswift)

v0.1.4

Changelog

Bug fixes

• bbfe5a2: fix: use intermediates on dsse signature to verify certificate (@mikhailswift)

Others

• 422d9b8: chore: add additional debug logging during verify (@mikhailswift)

v0.1.3

Changelog

Others

• 7d3e1d4: bug: ensure sarif and scorecard packages are imported (@mikhailswift)

v0.1.2

Changelog

Features

• 9c95b23: feat: Add command to print version (@hooksie1)
• f5d2d2c: feat:add more robust policy constraints (@mikhailswift)
• bf5c3a7: feat:scorecard attestor (@colek42)
• 97adc5f: feat:sarif attestor (@colek42)

Bug fixes

• 83ad247: fix: typo in README (@hectorj2f)

Documentation

• 3651dc7: docs: update readme (@colek42)
• 674d9c5: docs: add documentation for the policy verification process (@mikhailswift)

Others

• 7c8b22e: chore(deps): bump github.com/open-policy-agent/opa from 0.35.0 to 0.37.0 (@dependabot[bot])
• 442c26a: refactor: move attestor imports to pkg (@mikhailswift)
• ace8194: test: update test-oci.sh script (@mikhailswift)

v0.1.1

Changelog

Features

• 5ab9ccc: feat: verify artifacts between collections (@mikhailswift)
• 8524008: feat: use rekor integrated time as a trusted time stamp (@mikhailswift)

Documentation

• 800abd4: docs(attestors): add basic docs for each attestor (@mikhailswift)
• 48c2dcd: docs: update README and add arch docs. (@colek42)
• af249e3: docs: update README and add arch docs. (@colek42)

Others

• 124eea9: bug: temporarily turn off go mod proxy (@mikhailswift)
• b0b7167: bug: fix incorrect policy evaluation (@mikhailswift)

v0.1.0

Changelog

Features

• 5ab9ccc: feat: verify artifacts between collections (@mikhailswift)
• 8524008: feat: use rekor integrated time as a trusted time stamp (@mikhailswift)

Documentation

• 800abd4: docs(attestors): add basic docs for each attestor (@mikhailswift)
• 48c2dcd: docs: update README and add arch docs. (@colek42)
• af249e3: docs: update README and add arch docs. (@colek42)

Others

• 0df87b1: bug: temporarily turn off go mod proxy (@mikhailswift)