Skip to content

Releases: slsa-framework/slsa-github-generator

v1.5.0-rc.0

15 Feb 08:11
@ianlewis ianlewis
v1.5.0-rc.0
ad5c0dd
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.5.0-rc.0 Pre-release
Pre-release

See the CHANGELOG for details.

Assets 8

v1.4.0

02 Dec 00:12
@ianlewis ianlewis
v1.4.0
68bad40
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.4.0

What's Changed

🥳 This release is the first Generally Available version of the Container Generator workflow. The Container Generator workflow is now considered stable and can be included in your production GitHub Actions workflows 🥳

🎉 This is also the first release (technically the second) with support for the generally available version of sigstore!! 🎉
We hope to have fewer issues with sigstore infrastructure moving forward.

Generic Generator

Bug fixes

  1. Allow users of the Generic Generator to generate provenance for artifacts created in a project subdirectory (#1225)

Go Builder

Bug fixes

  1. Allow environment variables to contain '=' characters in the Go builder (#1231)

New Contributors

Full Changelog

v1.2.2...v1.4.0

Contributors

ianlewis, DanAlbert, and 5 other contributors
Assets 8

v1.4.0-rc.2

30 Nov 20:36
@ianlewis ianlewis
v1.4.0-rc.2
c40a5cf
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.4.0-rc.2 Pre-release
Pre-release

⚠️ This is a pre-release. It is not meant for general consumption. The following is the proposed release notes for the official release. ⚠️

What's Changed

This release is the first Generally Available version of the generic container workflow. The generic container workflow is now considered stable and can be included in your production GitHub Actions workflows 🥳

This is also the first release with support for the generally available version of sigstore! 🎉

This release also includes a couple of bug fixes:

  1. Allow users of the generic generator workflow to generate provenance using for artifacts created in a project subdirectory (#1225)
  2. Allow environment variables to contain '=' characters in the Go workflow (#1231)

New Contributors

Full Changelog

v1.2.2...v1.4.0-rc.2

Contributors

ianlewis, DanAlbert, and 5 other contributors
Assets 8

v1.4.0-rc.1

29 Nov 13:07
@ianlewis ianlewis
v1.4.0-rc.1
02134cf
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.4.0-rc.1 Pre-release
Pre-release

⚠️ This is a pre-release. It is not meant for general consumption. The following is the proposed release notes for the official release. ⚠️

What's Changed

This release is the first Generally Available version of the generic container workflow. The generic container workflow is now considered stable and can be included in your production GitHub Actions workflows 🥳

This is also the first release with support for the generally available version of sigstore! 🎉

This release also includes a couple of bug fixes:

  1. Allow users of the generic generator workflow to generate provenance using for artifacts created in a project subdirectory (#1225)
  2. Allow environment variables to contain '=' characters in the Go workflow (#1231)

New Contributors

Full Changelog

v1.2.2...v1.4.0-rc.1

Contributors

ianlewis, DanAlbert, and 5 other contributors
Assets 8

v1.4.0-rc.0

28 Nov 12:13
@ianlewis ianlewis
v1.4.0-rc.0
f2a679c
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.4.0-rc.0 Pre-release
Pre-release

⚠️ This is a pre-release. It is not meant for general consumption. The following is the proposed release notes for the official release. ⚠️

What's Changed

This release is the first Generally Available version of the generic container workflow. The generic container workflow is now considered stable and can be included in your production GitHub Actions workflows 🥳

This is also the first release with support for the generally available version of sigstore! 🎉

This release also includes a couple of bug fixes:

  1. Allow users of the generic generator workflow to generate provenance using for artifacts created in a project subdirectory (#1225)
  2. Allow environment variables to contain '=' characters in the Go workflow (#1231)

New Contributors

Full Changelog

v1.2.2...v1.4.0-rc.0

Contributors

ianlewis, DanAlbert, and 5 other contributors
Assets 2

v1.3.0

28 Nov 03:22
@ianlewis ianlewis
v1.3.0
10cb4de
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.3.0 Pre-release
Pre-release

🚨 ⚠️ This is a release and tag that was created as a pre-release for testing purposes and is not supported. DO NOT UPGRADE. If you have already upgraded please downgrade to v1.2.2 ⚠️ 🚨

See: #1250

Assets 2

v1.2.2

07 Nov 08:46
@ianlewis ianlewis
v1.2.2
c3a3e40
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.2.2

What's Changed

This release fixes issues with signing provenance due to a change in Sigstore TUF root certificates (#1163). This release also includes better handling of transient errors from the Rekor transparency logs.

New Contributors

Full Changelog

v1.2.1...v1.2.2

Contributors

ianlewis, asraa, and 6 other contributors
Assets 8

v1.2.1

17 Oct 02:17
@ianlewis ianlewis
v1.2.1
dc705ba
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.2.1

🚨⚠️ DO NOT USE THIS RELEASE. This version will no longer work and is not supported due to errors described in #1163. Please upgrade to v1.2.2 or later. ⚠️🚨

What's Changed

This release fixes an error that occurs on the "Generate Builder" step for various workflows.

FAILED: SLSA verification failed: could not find a matching valid signature entry

See #942

Generic generator

buildType

This release changes the buildType used in provenance created by the generic generator.

The previous value was:

"buildType": "https://github.com/slsa-framework/slsa-github-generator@v1",

The new value is:

"buildType": "https://github.com/slsa-framework/slsa-github-generator/generic@v1",

See #627

Provenance file names

Previously the default file name for provenance was attestation.intoto.jsonl. This has been updated to be in line with intoto attestation file naming conventions. The file name now defaults to <artifact filename>.intoto.jsonl if there is a single artifact, or multiple.intoto.jsonl if there are multiple artifacts.

See #654

Explicit opt-in for private repos

Private repository support was enhanced to required the private-repository input field as the repository name will be made public in the public Rekor transparency log.

Please add the following to your workflows if you opt into allowing repository names to be recorded in the public Rekor transparency log.

with:
  private-repository: true

See #823

Go builder

Support private repos

Support for private repositories was fixed. If using a private repository you must specify the private-repository input field as the repository name will be made public in the public Rekor transparency log.

Please add the following to your workflows if you opt into allowing repository names to be recorded in the public Rekor transparency log.

with:
  private-repository: true

See #823

New Contributors

Full Changelog

v1.2.0...v1.2.1

Read more

Contributors

ianlewis, naveensrinivasan, and 8 other contributors
Assets 6

v1.2.0

19 Jul 18:06
@laurentsimon laurentsimon
v1.2.0
bdd89e6
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.2.0

🚨⚠️ DO NOT USE THIS RELEASE. This version will no longer work and is not supported due to errors described in #942. Please upgrade to v1.2.2 or later. ⚠️🚨

What's Changed

Generic generator

The highlight of this release is a new re-usable workflow called the "Generic generator". It lets users build artifacts on their own and generate a provenance that satisfies SLSA provenance 3 requirement. It's perfect to get started with SLSA with minimal changes to an existing build workflow. To use it, check the README.md!

Go builder

No changes.

New Contributors

Full Changelog: v1.1.1...v1.2.0

Contributors

naveensrinivasan, loosebazooka, and 3 other contributors
Assets 6

v1.1.1

20 Jun 22:04
@laurentsimon laurentsimon
v1.1.1
d995948
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.
Compare
Choose a tag to compare
v1.1.1

What's Changed

  • Improve documentation
  • Fix filename issue when resolving it with variables
  • Add support for environment variables in artifact filename

New Contributors

Full Changelog: v1.0.0...v1.1.1

Contributors

MarkLodato, mihaimaruseac, and 2 other contributors
Assets 6