GO-2024-3252: gitsign may use incorrect Rekor entries during verification in github.com/sigstore/gitsign

attest

package

v0.3.0 Latest Latest Go to latest Published: Aug 25, 2022 License: Apache-2.0 Imports: 23 Imported by: 0

Details

View Source

const (
	CommitRef = "refs/attestations/commits"
	TreeRef   = "refs/attestations/trees"
)

This section is empty.

func WriteFile(ctx context.Context, repo *git.Repository, refName string, sha plumbing.Hash, path, attType string) (plumbing.Hash, error)

WriteFile writes the given file + a DSSE signed attestation to the corresponding attestation ref. The SHA of the created commit is returned.

type Encoder interface {
	Encode(o plumbing.EncodedObject) error
}