github.com/slsa-framework/slsa-github-generator

Releases

1. v1.6.0-rc.226 Apr 2023pre-release

   Nothing published for this version

2. v1.6.0-rc.1.0.20230501224621-ad13ea4eff871 May 2023pre-release

   Nothing published for this version

3. v1.6.0-rc.124 Apr 2023pre-release

   Nothing published for this version

4. v1.6.0-rc.0.0.20230425040949-8f12c7b08b0f25 Apr 2023pre-release

   Nothing published for this version

5. v1.6.0-rc.0.0.20230405220418-3bdba8deef905 Apr 2023pre-release

   Nothing published for this version

6. v1.6.0-rc.05 Apr 2023pre-release

   Nothing published for this version

7. v1.5.1-0.20230405232421-8688b4acd9985 Apr 2023pre-release

   Nothing published for this version

8. v1.5.024 Feb 2023
   Release notes

   https://github.com/slsa-framework/slsa-github-generator/compare/v1.5.0...v1.6.0

   v1.5.0

   <!-- Information on the next release will be added here. -->

   Open source →
   Additional notes

   <!-- Information on the next release will be added here. -->

   Summary of changes

   Go builder

   New Features

   • A new upload-tag-name input was added to allow users to specify the tag name for the release when upload-assets is set to true.
   • The environment variables included in provenance output were changed to include only those variables that are specified by the user in the slsa-goreleaser.yml configuration file in order to improve reproducibility. See #822 for more information and background.

   Generic generator

   New Features

   • A new boolean continue-on-error input was added which, when set to true, prevents the workflow from failing when a step fails. If set to true, the result of the reusable workflow will be return in the outcome output.
   • A new upload-tag-name input was added to allow users to specify the tag name for the release when upload-assets is set to true.

   Container generator

   New Features

   • A new boolean continue-on-error input was added which, when set to true, prevents the workflow from failing when a step fails. If set to true, the result of the reusable workflow will be return in the outcome output.
   • A new repository-username secret input was added to allow users to pass their repository username that is stored in a Github Actions encrypted secret. This secret input should only be used for high-entropy registry username values such as AWS Access Key.
   • Support was added for authenticating with Google Artifact Registry and Google Container Registry using Workload Identity Federation. Users can use this new feature by using the gcp-workload-identity-provider and gcp-service-account inputs

   Changelog since v1.4.0

   https://github.com/slsa-framework/slsa-github-generator/compare/v1.4.0...v1.5.0

   Open source →
9. v1.5.0-rc.0.0.20230112033309-d3868d6f621512 Jan 2023pre-release

   Nothing published for this version

10. v1.5.0-rc.0.0.20230112021742-df1a62578f7012 Jan 2023pre-release

    Nothing published for this version

11. v1.5.0-rc.0.0.20230110171639-531b2194eb7110 Jan 2023pre-release

    Nothing published for this version

12. v1.5.0-rc.0.0.20230110154912-2a948505350b10 Jan 2023pre-release

    Nothing published for this version

13. v1.5.0-rc.010 Jan 2023pre-release

    Nothing published for this version

14. v1.4.1-0.20230224060652-ad5c0dd4e70e24 Feb 2023pre-release

    Nothing published for this version

15. v1.4.1-0.20230208135118-7837b666522a8 Feb 2023pre-release

    Nothing published for this version

16. v1.4.1-0.20230106205159-9a579f0fc7846 Jan 2023pre-release

    Nothing published for this version

17. v1.4.1-0.20230106045437-1ed3657976aa6 Jan 2023pre-release

    Nothing published for this version

18. v1.4.1-0.20221228213521-20958a255fc528 Dec 2022pre-release

    Nothing published for this version

19. v1.4.030 Nov 2022
    Release notes

    https://github.com/slsa-framework/slsa-github-generator/compare/v1.4.0...v1.5.0

    v1.4.0

    Open source →
    Additional notes

    What's Changed

    This release is the first Generally Available version of the Container Generator workflow. The Container Generator workflow is now considered stable and can be included in your production GitHub Actions workflows

    This is also the first release (technically the second) with support for the generally available version of sigstore!! We hope to have fewer issues with sigstore infrastructure moving forward.

    Generic Generator

    Bug fixes

    1. Allow users of the Generic Generator to generate provenance for artifacts created in a project subdirectory (#1225)

    Go Builder

    Bug fixes

    1. Allow environment variables to contain '=' characters in the Go builder (#1231)

    New Contributors

    • @cfergeau made their first contribution in https://github.com/slsa-framework/slsa-github-generator/pull/1232
    • @DanAlbert made their first contribution in https://github.com/slsa-framework/slsa-github-generator/pull/1239
    • @gal-legit made their first contribution in https://github.com/slsa-framework/slsa-github-generator/pull/1252

    Full Changelog

    https://github.com/slsa-framework/slsa-github-generator/compare/v1.2.2...v1.4.0

    Open source →
20. v1.4.0-rc.230 Nov 2022pre-release
    Release notes

    *This is a pre-release. It is not meant for general consumption. The following is the proposed release notes for the official release.

    What's Changed

    This release is the first Generally Available version of the generic container workflow. The generic container workflow is now considered stable and can be included in your production GitHub Actions workflows

    This is also the first release with support for the generally available version of sigstore!

    This release also includes a couple of bug fixes:

    1. Allow users of the generic generator workflow to generate provenance using for artifacts created in a project subdirectory (#1225)
    2. Allow environment variables to contain '=' characters in the Go workflow (#1231)

    New Contributors

    • @cfergeau made their first contribution in https://github.com/slsa-framework/slsa-github-generator/pull/1232
    • @DanAlbert made their first contribution in https://github.com/slsa-framework/slsa-github-generator/pull/1239
    • @gal-legit made their first contribution in https://github.com/slsa-framework/slsa-github-generator/pull/1252

    Full Changelog

    https://github.com/slsa-framework/slsa-github-generator/compare/v1.2.2...v1.4.0-rc.2

    Open source →
21. v1.4.0-rc.1.0.20221130211528-c40a5cf504a530 Nov 2022pre-release

    Nothing published for this version

22. v1.4.0-rc.129 Nov 2022pre-release
    Release notes

    *This is a pre-release. It is not meant for general consumption. The following is the proposed release notes for the official release.

    What's Changed

    This release is the first Generally Available version of the generic container workflow. The generic container workflow is now considered stable and can be included in your production GitHub Actions workflows

    This is also the first release with support for the generally available version of sigstore!

    This release also includes a couple of bug fixes:

    1. Allow users of the generic generator workflow to generate provenance using for artifacts created in a project subdirectory (#1225)
    2. Allow environment variables to contain '=' characters in the Go workflow (#1231)

    New Contributors

    • @cfergeau made their first contribution in https://github.com/slsa-framework/slsa-github-generator/pull/1232
    • @DanAlbert made their first contribution in https://github.com/slsa-framework/slsa-github-generator/pull/1239
    • @gal-legit made their first contribution in https://github.com/slsa-framework/slsa-github-generator/pull/1252

    Full Changelog

    https://github.com/slsa-framework/slsa-github-generator/compare/v1.2.2...v1.4.0-rc.1

    Open source →
23. v1.4.0-rc.0.0.20221130033136-02134cf3d22330 Nov 2022pre-release

    Nothing published for this version

24. v1.4.0-rc.028 Nov 2022pre-release
    Release notes

    This is a pre-release. It is not meant for general consumption. The following is the proposed release notes for the official release.

    What's Changed

    This release is the first Generally Available version of the generic container workflow. The generic container workflow is now considered stable and can be included in your production GitHub Actions workflows

    This is also the first release with support for the generally available version of sigstore!

    This release also includes a couple of bug fixes:

    1. Allow users of the generic generator workflow to generate provenance using for artifacts created in a project subdirectory (#1225)
    2. Allow environment variables to contain '=' characters in the Go workflow (#1231)

    New Contributors

    • @cfergeau made their first contribution in https://github.com/slsa-framework/slsa-github-generator/pull/1232
    • @DanAlbert made their first contribution in https://github.com/slsa-framework/slsa-github-generator/pull/1239
    • @gal-legit made their first contribution in https://github.com/slsa-framework/slsa-github-generator/pull/1252

    Full Changelog

    https://github.com/slsa-framework/slsa-github-generator/compare/v1.2.2...v1.4.0-rc.0

    Open source →
25. v1.3.1-0.20221128062549-f2a679cdeaae28 Nov 2022pre-release

    Nothing published for this version

26. v1.3.018 Nov 2022

    Nothing published for this version

27. v1.2.27 Nov 2022
    Release notes

    c3a3e40

    This commit was created on GitHub.com and signed with GitHub’s verified signature . The key has expired.

    GPG key ID: 4AEE18F83AFDEB23 Expired

    Verified Learn about vigilant mode .

    What's Changed

    This release fixes issues with signing provenance due to a change in Sigstore TUF root certificates ( #1163 ). This release also includes better handling of transient errors from the Rekor transparency logs.

    New Contributors

    • @suzuki-shunsuke made their first contribution in #1061

    • @datosh made their first contribution in #1074

    • @pnacht made their first contribution in #1187

    • @dongheelee92 made their first contribution in #1209

    Full Changelog

    Open source →
    Additional notes

    What's Changed

    This release fixes issues with signing provenance due to a change in Sigstore TUF root certificates (#1163). This release also includes better handling of transient errors from the Rekor transparency logs.

    New Contributors

    • @suzuki-shunsuke made their first contribution in https://github.com/slsa-framework/slsa-github-generator/pull/1061
    • @datosh made their first contribution in https://github.com/slsa-framework/slsa-github-generator/pull/1074
    • @pnacht made their first contribution in https://github.com/slsa-framework/slsa-github-generator/pull/1187
    • @dongheelee92 made their first contribution in https://github.com/slsa-framework/slsa-github-generator/pull/1209

    Full Changelog

    https://github.com/slsa-framework/slsa-github-generator/compare/v1.2.1...v1.2.2

    Open source →
28. v1.2.2-0.20221018132050-e6d55deb5bfc18 Oct 2022pre-release

    Nothing published for this version

29. v1.2.114 Oct 2022
    Release notes

    DO NOT USE THIS RELEASE. This version will no longer work and is not supported due to errors described in #1163. Please upgrade to v1.2.2 or later.

    What's Changed

    This release fixes an error that occurs on the "Generate Builder" step for various workflows.

    FAILED: SLSA verification failed: could not find a matching valid signature entry
    

    See #942

    Generic generator

    buildType

    This release changes the buildType used in provenance created by the generic generator.

    The previous value was:

    "buildType": "https://github.com/slsa-framework/slsa-github-generator@v1",
    

    The new value is:

    "buildType": "https://github.com/slsa-framework/slsa-github-generator/generic@v1",
    

    See #627

    Provenance file names

    Previously the default file name for provenance was attestation.intoto.jsonl. This has been updated to be in line with intoto attestation file naming conventions. The file name now defaults to <artifact filename>.intoto.jsonl if there is a single artifact, or multiple.intoto.jsonl if there are multiple artifacts.

    See #654

    Explicit opt-in for private repos

    Private repository support was enhanced to required the private-repository input field as the repository name will be made public in the public Rekor transparency log.

    Please add the following to your workflows if you opt into allowing repository names to be recorded in the public Rekor transparency log.

    with:
      private-repository: true
    

    See #823

    Go builder

    Support private repos

    Support for private repositories was fixed. If using a private repository you must specify the private-repository input field as the repository name will be made public in the public Rekor transparency log.

    Please add the following to your workflows if you opt into allowing repository names to be recorded in the public Rekor transparency log.

    with:
      private-repository: true
    

    See #823

    New Contributors

    • @sethmlarson made their first contribution in https://github.com/slsa-framework/slsa-github-generator/pull/758
    • @yunginnanet made their first contribution in https://github.com/slsa-framework/slsa-github-generator/pull/776
    • @diogoteles08 made their first contribution in https://github.com/slsa-framework/slsa-github-generator/pull/957

    Full Changelog

    https://github.com/slsa-framework/slsa-github-generator/compare/v1.2.0...v1.2.1

    Open source →
30. v1.2.1-0.20221005094154-87722f4064b65 Oct 2022pre-release

    Nothing published for this version

31. v1.2.1-0.20221004005119-9dc6318aedc34 Oct 2022pre-release

    Nothing published for this version

32. v1.2.1-0.20220930024014-fc650058207930 Sept 2022pre-release

    Nothing published for this version

33. v1.2.1-0.20220927032718-b075c0c61eb327 Sept 2022pre-release

    Nothing published for this version

34. v1.2.1-0.20220926153732-c5040382e11b26 Sept 2022pre-release

    Nothing published for this version

35. v1.2.1-0.20220926014222-fad5583edd3826 Sept 2022pre-release

    Nothing published for this version

36. v1.2.1-0.20220922185913-6f5328bff44722 Sept 2022pre-release

    Nothing published for this version

37. v1.2.1-0.20220921171740-22155a9f175521 Sept 2022pre-release

    Nothing published for this version

38. v1.2.1-0.20220921051006-de4491844e9b21 Sept 2022pre-release

    Nothing published for this version

39. v1.2.1-0.20220919174055-d9871fd12e9119 Sept 2022pre-release

    Nothing published for this version

40. v1.2.1-0.20220919173230-40de3b9ad75019 Sept 2022pre-release

    Nothing published for this version

41. v1.2.1-0.20220919132012-0b56d2ab4e7c19 Sept 2022pre-release

    Nothing published for this version

42. v1.2.1-0.20220915170156-3ad3ff03b52115 Sept 2022pre-release

    Nothing published for this version

43. v1.2.1-0.20220915144721-3f2a7554c85715 Sept 2022pre-release

    Nothing published for this version

44. v1.2.1-0.20220914143811-fbbc34ad955914 Sept 2022pre-release

    Nothing published for this version

45. v1.2.1-0.20220914042524-a3c7a56c874914 Sept 2022pre-release

    Nothing published for this version

46. v1.2.1-0.20220913023124-78c9fea54a2413 Sept 2022pre-release

    Nothing published for this version

47. v1.2.1-0.20220913004241-9544d4f4d6e413 Sept 2022pre-release

    Nothing published for this version

48. v1.2.1-0.20220913003347-77b9f17faffd13 Sept 2022pre-release

    Nothing published for this version

49. v1.2.1-0.20220909085028-5b0c704226f99 Sept 2022pre-release

    Nothing published for this version

50. v1.2.1-0.20220909025635-d7bb090d4c7d9 Sept 2022pre-release

    Nothing published for this version

51. v1.2.1-0.20220908145902-65d43c9cb5038 Sept 2022pre-release

    Nothing published for this version

52. v1.2.1-0.20220907014645-11f701ad156c7 Sept 2022pre-release

    Nothing published for this version

53. v1.2.1-0.20220907013234-e77551c09e147 Sept 2022pre-release

    Nothing published for this version

54. v1.2.1-0.20220906210452-0ca71a4e67556 Sept 2022pre-release

    Nothing published for this version

55. v1.2.1-0.20220906172048-96a2f25046e26 Sept 2022pre-release

    Nothing published for this version

56. v1.2.1-0.20220906055309-9cac929d18b16 Sept 2022pre-release

    Nothing published for this version

57. v1.2.1-0.20220906052920-f9878d18f3c86 Sept 2022pre-release

    Nothing published for this version

58. v1.2.1-0.20220901021635-3d27f18a67e11 Sept 2022pre-release

    Nothing published for this version

59. v1.2.1-0.20220831002526-b0db1514cfb431 Aug 2022pre-release

    Nothing published for this version

60. v1.2.1-0.20220830233032-f3a107fef19a30 Aug 2022pre-release

    Nothing published for this version