slsa-github-generator
slsa-github-generator copied to clipboard
[feature] Reduce latency during inclusion proof validation
trafficstars
The log entry https://github.com/slsa-framework/slsa-github-generator/blob/main/signing/sigstore/rekor.go#L68 has the information for validating the inclusion proof, so we should be able to just do:
logEntry, err := cosign.TLogUploadInTotoAttestation(ctx, rekorClient, att.Bytes(), []byte(string(att.Cert())))
...
err := cosign.VerifyTLogEntry(ctx, rekorClient, &logEntry)
Something @bobcallaway pointed out.
@asraa assigning to you.
I believe this is because we wanted the entry UUID and the TLogUploadInTotoAttestation func does not provide that.
We can just calculate it from the entry body.