From 12dd2e82d22d463107cacc64402eb3e0dce389de Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Adolfo=20Garc=C3=ADa=20Veytia=20=28Puerco=29?= Date: Thu, 10 Sep 2026 23:34:27 -0600 Subject: [PATCH 1/3] Support jsonl in bnd push MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This commit modifies bnd push to support a jsonl file as input Signed-off-by: Adolfo García Veytia (Puerco) --- internal/cmd/push.go | 81 +++++++++++++++++++++++- internal/cmd/push_test.go | 66 +++++++++++++++++++ internal/cmd/testdata/attestations.jsonl | 2 + internal/cmd/testdata/single.bundle.json | 1 + 4 files changed, 147 insertions(+), 3 deletions(-) create mode 100644 internal/cmd/push_test.go create mode 100644 internal/cmd/testdata/attestations.jsonl create mode 100644 internal/cmd/testdata/single.bundle.json diff --git a/internal/cmd/push.go b/internal/cmd/push.go index 7afefd2..479b7bb 100644 --- a/internal/cmd/push.go +++ b/internal/cmd/push.go @@ -6,8 +6,11 @@ package cmd import ( "errors" "fmt" + "os" + "path/filepath" "strings" + "github.com/carabiner-dev/attestation" "github.com/carabiner-dev/collector" "github.com/carabiner-dev/collector/envelope" "github.com/carabiner-dev/collector/repository/github" @@ -86,7 +89,11 @@ The push subcommand lets you send bundled attestations to remote storage locations. Initial support is provided for the GitHub attestation store but more drivers are on the way. -`, appname), +Bundles can be given as individual files, as directories (every file at +their top level is pushed) or as .jsonl files holding one bundle per line, +such as those written by %s pack. + +`, appname, appname), Use: "github [flags] [org/repo [bundle.json...]]", SilenceUsage: false, SilenceErrors: true, @@ -99,7 +106,11 @@ Same but with shortcut positional arguments: %s push github myorg/repo bundle.json -`, appname, appname), +Push every attestation in a packed jsonl file: + +%s push github myorg/repo attestations.jsonl + +`, appname, appname, appname), PersistentPreRunE: initLogging, PreRunE: func(_ *cobra.Command, args []string) error { if len(args) > 0 && opts.RepoName != "" && opts.RepoOrg != "" { @@ -144,7 +155,7 @@ Same but with shortcut positional arguments: } // Parse all envelopes - envs, err := envelope.Parsers.ParseFiles(opts.Bundles) + envs, err := parseBundles(opts.Bundles) if err != nil { return fmt.Errorf("parsing envelopes: %w", err) } @@ -158,3 +169,67 @@ Same but with shortcut positional arguments: opts.AddFlags(pushCmd) parentCmd.AddCommand(pushCmd) } + +// parseBundles parses the envelopes found in paths. Each path may be a +// bundle file, a .jsonl file with one bundle per line or a directory, whose +// top-level files are handled the same way. Subdirectories are not traversed. +func parseBundles(paths []string) ([]attestation.Envelope, error) { + var bundlePaths, jsonlPaths []string + sortPath := func(path string) { + if strings.EqualFold(filepath.Ext(path), ".jsonl") { + jsonlPaths = append(jsonlPaths, path) + } else { + bundlePaths = append(bundlePaths, path) + } + } + + for _, path := range paths { + info, err := os.Stat(path) + if err != nil { + return nil, fmt.Errorf("stat %s: %w", path, err) + } + if !info.IsDir() { + sortPath(path) + continue + } + entries, err := os.ReadDir(path) + if err != nil { + return nil, fmt.Errorf("reading %s: %w", path, err) + } + for _, e := range entries { + if e.IsDir() { + continue + } + sortPath(filepath.Join(path, e.Name())) + } + } + + envs := []attestation.Envelope{} + if len(bundlePaths) > 0 { + parsed, err := envelope.Parsers.ParseFiles(bundlePaths) + if err != nil { + return nil, err + } + envs = append(envs, parsed...) + } + + jsonlParser := envelope.NewJSONL() + for _, path := range jsonlPaths { + parsed, err := parseJSONLFile(jsonlParser, path) + if err != nil { + return nil, fmt.Errorf("parsing %s: %w", path, err) + } + envs = append(envs, parsed...) + } + return envs, nil +} + +// parseJSONLFile opens path and parses the bundles in it, one per line. +func parseJSONLFile(parser *envelope.JsonlParser, path string) ([]attestation.Envelope, error) { + f, err := os.Open(path) + if err != nil { + return nil, fmt.Errorf("opening file: %w", err) + } + defer f.Close() //nolint:errcheck + return parser.ParseStream(f) +} diff --git a/internal/cmd/push_test.go b/internal/cmd/push_test.go new file mode 100644 index 0000000..b8ddcc8 --- /dev/null +++ b/internal/cmd/push_test.go @@ -0,0 +1,66 @@ +// SPDX-FileCopyrightText: Copyright 2025 Carabiner Systems, Inc +// SPDX-License-Identifier: Apache-2.0 + +package cmd + +import ( + "os" + "path/filepath" + "testing" + + "github.com/stretchr/testify/require" +) + +func TestParseBundles(t *testing.T) { + t.Parallel() + + // A directory mixing a bundle and a jsonl file, plus a subdirectory + // that must not be traversed. + mixed := t.TempDir() + copyTestFile(t, "testdata/single.bundle.json", filepath.Join(mixed, "single.bundle.json")) + copyTestFile(t, "testdata/attestations.jsonl", filepath.Join(mixed, "attestations.jsonl")) + require.NoError(t, os.MkdirAll(filepath.Join(mixed, "nested"), 0o750)) + copyTestFile(t, "testdata/single.bundle.json", filepath.Join(mixed, "nested", "ignored.bundle.json")) + + // A jsonl file with a line that is not JSON. The jsonl iterator skips + // such lines, so the bundles around it are still parsed. + garbage := filepath.Join(t.TempDir(), "garbage.jsonl") + data, err := os.ReadFile("testdata/attestations.jsonl") + require.NoError(t, err) + require.NoError(t, os.WriteFile(garbage, append(data, []byte("not json\n")...), 0o600)) //nolint:gosec // test paths + + for _, tc := range []struct { + name string + paths []string + count int + mustErr bool + }{ + {"bundle", []string{"testdata/single.bundle.json"}, 1, false}, + {"jsonl", []string{"testdata/attestations.jsonl"}, 2, false}, + {"bundle-and-jsonl", []string{"testdata/single.bundle.json", "testdata/attestations.jsonl"}, 3, false}, + {"directory", []string{mixed}, 3, false}, + {"missing", []string{"testdata/does-not-exist.json"}, 0, true}, + {"jsonl-with-garbage-line", []string{garbage}, 2, false}, + } { + t.Run(tc.name, func(t *testing.T) { + t.Parallel() + envs, err := parseBundles(tc.paths) + if tc.mustErr { + require.Error(t, err) + return + } + require.NoError(t, err) + require.Len(t, envs, tc.count) + for _, env := range envs { + require.NotNil(t, env.GetStatement()) + } + }) + } +} + +func copyTestFile(t *testing.T, src, dst string) { + t.Helper() + data, err := os.ReadFile(src) + require.NoError(t, err) + require.NoError(t, os.WriteFile(dst, data, 0o600)) //nolint:gosec // test paths +} diff --git a/internal/cmd/testdata/attestations.jsonl b/internal/cmd/testdata/attestations.jsonl new file mode 100644 index 0000000..d9cdf56 --- /dev/null +++ b/internal/cmd/testdata/attestations.jsonl @@ -0,0 +1,2 @@ +{"mediaType":"application/vnd.dev.sigstore.bundle.v0.3+json","verificationMaterial":{"certificate":{"rawBytes":"MIIGpzCCBi2gAwIBAgIUSrH0nWmVlIImJPR0Rdb1cJPA92owCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjUwNTE5MTUxNTA3WhcNMjUwNTE5MTUyNTA3WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEjPP4QzHPhrXfPjnCQadid6ViiihQHSJcC+Zcwytcm3Q0dJA4OaQm0KLRaNYJxg8GvM5X47qh6fsZjqGYPRh+JKOCBUwwggVIMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUzyk0nVfOtPmUGJUTJnNSWGoWitYwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wYQYDVR0RAQH/BFcwVYZTaHR0cHM6Ly9naXRodWIuY29tL29wZW52ZXgvZ28tdmV4Ly5naXRodWIvd29ya2Zsb3dzL2NvbXBsaWFuY2UueWFtbEByZWZzL2hlYWRzL21haW4wOQYKKwYBBAGDvzABAQQraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTASBgorBgEEAYO/MAECBARwdXNoMDYGCisGAQQBg78wAQMEKGJlNTc4ZWIyMzQzMWEzYmQwNWYwZTAyMmNhZDc0YzBjNjViMDIyYTgwHQYKKwYBBAGDvzABBAQPT1NQUyBDb21wbGlhbmNlMBwGCisGAQQBg78wAQUEDm9wZW52ZXgvZ28tdmV4MB0GCisGAQQBg78wAQYED3JlZnMvaGVhZHMvbWFpbjA7BgorBgEEAYO/MAEIBC0MK2h0dHBzOi8vdG9rZW4uYWN0aW9ucy5naXRodWJ1c2VyY29udGVudC5jb20wYwYKKwYBBAGDvzABCQRVDFNodHRwczovL2dpdGh1Yi5jb20vb3BlbnZleC9nby12ZXgvLmdpdGh1Yi93b3JrZmxvd3MvY29tcGxpYW5jZS55YW1sQHJlZnMvaGVhZHMvbWFpbjA4BgorBgEEAYO/MAEKBCoMKGJlNTc4ZWIyMzQzMWEzYmQwNWYwZTAyMmNhZDc0YzBjNjViMDIyYTgwHQYKKwYBBAGDvzABCwQPDA1naXRodWItaG9zdGVkMDEGCisGAQQBg78wAQwEIwwhaHR0cHM6Ly9naXRodWIuY29tL29wZW52ZXgvZ28tdmV4MDgGCisGAQQBg78wAQ0EKgwoYmU1NzhlYjIzNDMxYTNiZDA1ZjBlMDIyY2FkNzRjMGM2NWIwMjJhODAfBgorBgEEAYO/MAEOBBEMD3JlZnMvaGVhZHMvbWFpbjAZBgorBgEEAYO/MAEPBAsMCTU4NzEwMDUyNjAqBgorBgEEAYO/MAEQBBwMGmh0dHBzOi8vZ2l0aHViLmNvbS9vcGVudmV4MBkGCisGAQQBg78wAREECwwJMTIxMzYxMTY0MGMGCisGAQQBg78wARIEVQxTaHR0cHM6Ly9naXRodWIuY29tL29wZW52ZXgvZ28tdmV4Ly5naXRodWIvd29ya2Zsb3dzL2NvbXBsaWFuY2UueWFtbEByZWZzL2hlYWRzL21haW4wOAYKKwYBBAGDvzABEwQqDChiZTU3OGViMjM0MzFhM2JkMDVmMGUwMjJjYWQ3NGMwYzY1YjAyMmE4MBQGCisGAQQBg78wARQEBgwEcHVzaDBVBgorBgEEAYO/MAEVBEcMRWh0dHBzOi8vZ2l0aHViLmNvbS9vcGVudmV4L2dvLXZleC9hY3Rpb25zL3J1bnMvMTUxMTY3MTMwNjMvYXR0ZW1wdHMvMTAWBgorBgEEAYO/MAEWBAgMBnB1YmxpYzCBiwYKKwYBBAHWeQIEAgR9BHsAeQB3AN09MGrGxxEyYxkeHJlnNwKiSl643jyt/4eKcoAvKe6OAAABlukc5skAAAQDAEgwRgIhAPy20I6tU6w6DsAZORUPCBcQM1rTDtCIxeFu3SdvXGpEAiEA5oHiR+m8O6ARiYoeGciWjBf5UBJR3OxWvf7ml/Q32cowCgYIKoZIzj0EAwMDaAAwZQIwW07eEgTny+2RC3DhiMEzZqCCenACADE66oI6kwBwtuRV6duS3n3s4HOCl+8jC5pKAjEAhBos2gudTyY0jQ8mty7o1Yro9ztNaMFXe0tYubnD51z/Tov0BoZmogZnBFy6l18m"},"tlogEntries":[{"logIndex":"215150747","logId":{"keyId":"wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0="},"kindVersion":{"kind":"dsse","version":"0.0.1"},"integratedTime":"1747667707","inclusionPromise":{"signedEntryTimestamp":"MEQCIAP2lDo8u9Fz1wCo+x9GcGuRZ8ZYqgSh6CeklFbljeXeAiA79imFXi1TuFyW4hnpByRxJYVrGbo4/vbF7pBSlXZgmg=="},"inclusionProof":{"logIndex":"93246485","rootHash":"BYMejhrpNF6602PfYM9OD3FsnNfeo8kr4HifMTUHQmQ=","treeSize":"93246487","hashes":["pa2Ur2BO13jb72OqVwgkfYJucdDnebyuyYJegc9LuFU=","0VfTi1dEkAOS4ve/iZUhRf5n9s7uaEW1HqpsRCuNCTU=","qEJONCXQdyzmvHdzLJIfjEZCTH2HgoN5vzWSoR8bZDE=","Ld3G2AavYEqOe2kC/n39eODP2GNP0kbSe1ACwUzq7J0=","yE/bG+8P1uXiHlkuy+KclStPT+MKJEEyX4kzoOuKZgQ=","042DYR2d1hwvoL0HQbthgDNoQ1HSPnc0KgG0Ng7OIRc=","6IuKpfamF5MnXbiV7ZkiPNLe5s0ITFqh7+dz0NyQ7OA=","oGyx4R/A6Ag6s0TRt4mm4oxGmfF7f+xkF+zKu/qXqiw=","y21aAimBjVROsW/BCWkp05AFH6eiZQ/3gF4VOzAXAAQ=","W9wJ9WSCVQtk9KyFvgvUeSTSdIlinFsIzc4CRRneqqE=","wEs+MEa1o73p8j5DbGsLUnaP98q0PK8ZBoqwDPyZLIw=","h5VTNNCORtYrwvf9h5wlAx+k3+9SY5/VIETuNnly6Xk=","++1LMuz3tIdW1/pfEfhPfXC4ot1AwDAXDcPyfibzGyc=","7v8qPHNDLerpduaMx06eb/MwgoQwczTn/cYGKX/9wZ4="],"checkpoint":{"envelope":"rekor.sigstore.dev - 1193050959916656506\n93246487\nBYMejhrpNF6602PfYM9OD3FsnNfeo8kr4HifMTUHQmQ=\n\n— rekor.sigstore.dev wNI9ajBFAiEA+iLv8SPgYIZLSiWUIBMki1NCjeDH3HWLh6rVaepKdhQCIFktXIvu0TY289VjjNjs1V7JZsfqEFhb9nAdv0ZhLiWW\n"}},"canonicalizedBody":"eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiZHNzZSIsInNwZWMiOnsiZW52ZWxvcGVIYXNoIjp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiNDlmNjY5MzhjYWJmNzFmYTRlMDhmZWRiMzY1OGY1MzYzYzMyN2VhYTNjOTFiYzI0MjFjYjY3ZDBhYTA3NTgyMyJ9LCJwYXlsb2FkSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImViYTQ4M2QwOWE5ZTFhYWMwMWRlMjUxZDI0OGYyZTQ2MzgwMjZiMDljOWQxNWJkMTBjYTFmZGUzY2ZiNDMzOGEifSwic2lnbmF0dXJlcyI6W3sic2lnbmF0dXJlIjoiTUVVQ0lRRFZGc1NISlNvbHB5MlViS05kRnkreUVNYUpoU1Jzb2prZHNabVdwRUNyQkFJZ0lMOFkrVUlTWW03MUR0NFZQd0c2eXdmaWRCQ1AzMCt1a0NBRjh6MlhhRTg9IiwidmVyaWZpZXIiOiJMUzB0TFMxQ1JVZEpUaUJEUlZKVVNVWkpRMEZVUlMwdExTMHRDazFKU1Vkd2VrTkRRbWt5WjBGM1NVSkJaMGxWVTNKSU1HNVhiVlpzU1VsdFNsQlNNRkprWWpGalNsQkJPVEp2ZDBObldVbExiMXBKZW1vd1JVRjNUWGNLVG5wRlZrMUNUVWRCTVZWRlEyaE5UV015Ykc1ak0xSjJZMjFWZFZwSFZqSk5ValIzU0VGWlJGWlJVVVJGZUZaNllWZGtlbVJIT1hsYVV6RndZbTVTYkFwamJURnNXa2RzYUdSSFZYZElhR05PVFdwVmQwNVVSVFZOVkZWNFRsUkJNMWRvWTA1TmFsVjNUbFJGTlUxVVZYbE9WRUV6VjJwQlFVMUdhM2RGZDFsSUNrdHZXa2w2YWpCRFFWRlpTVXR2V2tsNmFqQkVRVkZqUkZGblFVVnFVRkEwVVhwSVVHaHlXR1pRYW01RFVXRmthV1EyVm1scGFXaFJTRk5LWTBNcldtTUtkM2wwWTIwelVUQmtTa0UwVDJGUmJUQkxURkpoVGxsS2VHYzRSM1pOTlZnME4zRm9ObVp6V21weFIxbFFVbWdyU2t0UFEwSlZkM2RuWjFaSlRVRTBSd3BCTVZWa1JIZEZRaTkzVVVWQmQwbElaMFJCVkVKblRsWklVMVZGUkVSQlMwSm5aM0pDWjBWR1FsRmpSRUY2UVdSQ1owNVdTRkUwUlVablVWVjZlV3N3Q201V1prOTBVRzFWUjBwVlZFcHVUbE5YUjI5WGFYUlpkMGgzV1VSV1VqQnFRa0puZDBadlFWVXpPVkJ3ZWpGWmEwVmFZalZ4VG1wd1MwWlhhWGhwTkZrS1drUTRkMWxSV1VSV1VqQlNRVkZJTDBKR1kzZFdXVnBVWVVoU01HTklUVFpNZVRsdVlWaFNiMlJYU1hWWk1qbDBUREk1ZDFwWE5USmFXR2QyV2pJNGRBcGtiVlkwVEhrMWJtRllVbTlrVjBsMlpESTVlV0V5V25OaU0yUjZUREpPZG1KWVFuTmhWMFoxV1RKVmRXVlhSblJpUlVKNVdsZGFla3d5YUd4WlYxSjZDa3d5TVdoaFZ6UjNUMUZaUzB0M1dVSkNRVWRFZG5wQlFrRlJVWEpoU0ZJd1kwaE5Oa3g1T1RCaU1uUnNZbWsxYUZrelVuQmlNalY2VEcxa2NHUkhhREVLV1c1V2VscFlTbXBpTWpVd1dsYzFNRXh0VG5aaVZFRlRRbWR2Y2tKblJVVkJXVTh2VFVGRlEwSkJVbmRrV0U1dlRVUlpSME5wYzBkQlVWRkNaemM0ZHdwQlVVMUZTMGRLYkU1VVl6UmFWMGw1VFhwUmVrMVhSWHBaYlZGM1RsZFpkMXBVUVhsTmJVNW9Xa1JqTUZsNlFtcE9hbFpwVFVSSmVWbFVaM2RJVVZsTENrdDNXVUpDUVVkRWRucEJRa0pCVVZCVU1VNVJWWGxDUkdJeU1YZGlSMnhvWW0xT2JFMUNkMGREYVhOSFFWRlJRbWMzT0hkQlVWVkZSRzA1ZDFwWE5USUtXbGhuZGxveU9IUmtiVlkwVFVJd1IwTnBjMGRCVVZGQ1p6YzRkMEZSV1VWRU0wcHNXbTVOZG1GSFZtaGFTRTEyWWxkR2NHSnFRVGRDWjI5eVFtZEZSUXBCV1U4dlRVRkZTVUpETUUxTE1tZ3daRWhDZWs5cE9IWmtSemx5V2xjMGRWbFhUakJoVnpsMVkzazFibUZZVW05a1Ywb3hZekpXZVZreU9YVmtSMVoxQ21SRE5XcGlNakIzV1hkWlMwdDNXVUpDUVVkRWRucEJRa05SVWxaRVJrNXZaRWhTZDJONmIzWk1NbVJ3WkVkb01WbHBOV3BpTWpCMllqTkNiR0p1V213S1pVTTVibUo1TVRKYVdHZDJURzFrY0dSSGFERlphVGt6WWpOS2NscHRlSFprTTAxMldUSTVkR05IZUhCWlZ6VnFXbE0xTlZsWE1YTlJTRXBzV201TmRncGhSMVpvV2toTmRtSlhSbkJpYWtFMFFtZHZja0puUlVWQldVOHZUVUZGUzBKRGIwMUxSMHBzVGxSak5GcFhTWGxOZWxGNlRWZEZlbGx0VVhkT1YxbDNDbHBVUVhsTmJVNW9Xa1JqTUZsNlFtcE9hbFpwVFVSSmVWbFVaM2RJVVZsTFMzZFpRa0pCUjBSMmVrRkNRM2RSVUVSQk1XNWhXRkp2WkZkSmRHRkhPWG9LWkVkV2EwMUVSVWREYVhOSFFWRlJRbWMzT0hkQlVYZEZTWGQzYUdGSVVqQmpTRTAyVEhrNWJtRllVbTlrVjBsMVdUSTVkRXd5T1hkYVZ6VXlXbGhuZGdwYU1qaDBaRzFXTkUxRVowZERhWE5IUVZGUlFtYzNPSGRCVVRCRlMyZDNiMWx0VlRGT2VtaHNXV3BKZWs1RVRYaFpWRTVwV2tSQk1WcHFRbXhOUkVsNUNsa3lSbXRPZWxKcVRVZE5NazVYU1hkTmFrcG9UMFJCWmtKbmIzSkNaMFZGUVZsUEwwMUJSVTlDUWtWTlJETktiRnB1VFhaaFIxWm9Xa2hOZG1KWFJuQUtZbXBCV2tKbmIzSkNaMFZGUVZsUEwwMUJSVkJDUVhOTlExUlZORTU2UlhkTlJGVjVUbXBCY1VKbmIzSkNaMFZGUVZsUEwwMUJSVkZDUW5kTlIyMW9NQXBrU0VKNlQyazRkbG95YkRCaFNGWnBURzFPZG1KVE9YWmpSMVoxWkcxV05FMUNhMGREYVhOSFFWRlJRbWMzT0hkQlVrVkZRM2QzU2sxVVNYaE5lbGw0Q2sxVVdUQk5SMDFIUTJselIwRlJVVUpuTnpoM1FWSkpSVlpSZUZSaFNGSXdZMGhOTmt4NU9XNWhXRkp2WkZkSmRWa3lPWFJNTWpsM1dsYzFNbHBZWjNZS1dqSTRkR1J0VmpSTWVUVnVZVmhTYjJSWFNYWmtNamw1WVRKYWMySXpaSHBNTWs1MllsaENjMkZYUm5WWk1sVjFaVmRHZEdKRlFubGFWMXA2VERKb2JBcFpWMUo2VERJeGFHRlhOSGRQUVZsTFMzZFpRa0pCUjBSMmVrRkNSWGRSY1VSRGFHbGFWRlV6VDBkV2FVMXFUVEJOZWtab1RUSkthMDFFVm0xTlIxVjNDazFxU21wWlYxRXpUa2ROZDFsNldURlpha0Y1VFcxRk5FMUNVVWREYVhOSFFWRlJRbWMzT0hkQlVsRkZRbWQzUldOSVZucGhSRUpXUW1kdmNrSm5SVVVLUVZsUEwwMUJSVlpDUldOTlVsZG9NR1JJUW5wUGFUaDJXakpzTUdGSVZtbE1iVTUyWWxNNWRtTkhWblZrYlZZMFRESmtka3hZV214bFF6bG9XVE5TY0FwaU1qVjZURE5LTVdKdVRYWk5WRlY0VFZSWk0wMVVUWGRPYWsxMldWaFNNRnBYTVhka1NFMTJUVlJCVjBKbmIzSkNaMFZGUVZsUEwwMUJSVmRDUVdkTkNrSnVRakZaYlhod1dYcERRbWwzV1V0TGQxbENRa0ZJVjJWUlNVVkJaMUk1UWtoelFXVlJRak5CVGpBNVRVZHlSM2g0UlhsWmVHdGxTRXBzYms1M1Mya0tVMncyTkROcWVYUXZOR1ZMWTI5QmRrdGxOazlCUVVGQ2JIVnJZelZ6YTBGQlFWRkVRVVZuZDFKblNXaEJVSGt5TUVrMmRGVTJkelpFYzBGYVQxSlZVQXBEUW1OUlRURnlWRVIwUTBsNFpVWjFNMU5rZGxoSGNFVkJhVVZCTlc5SWFWSXJiVGhQTmtGU2FWbHZaVWRqYVZkcVFtWTFWVUpLVWpOUGVGZDJaamR0Q213dlVUTXlZMjkzUTJkWlNVdHZXa2w2YWpCRlFYZE5SR0ZCUVhkYVVVbDNWekEzWlVWblZHNTVLekpTUXpORWFHbE5SWHBhY1VORFpXNUJRMEZFUlRZS05tOUpObXQzUW5kMGRWSldObVIxVXpOdU0zTTBTRTlEYkNzNGFrTTFjRXRCYWtWQmFFSnZjekpuZFdSVWVWa3dhbEU0YlhSNU4yOHhXWEp2T1hwMFRncGhUVVpZWlRCMFdYVmlia1ExTVhvdlZHOTJNRUp2V20xdloxcHVRa1o1Tm13eE9HMEtMUzB0TFMxRlRrUWdRMFZTVkVsR1NVTkJWRVV0TFMwdExRbz0ifV19fQ=="}],"timestampVerificationData":{"rfc3161Timestamps":[{"signedTimestamp":"MIIC0DADAgEAMIICxwYJKoZIhvcNAQcCoIICuDCCArQCAQMxDTALBglghkgBZQMEAgIwgbwGCyqGSIb3DQEJEAEEoIGsBIGpMIGmAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQgsfdMUSP10OOyhDMUa2TuZqtuxEqhdViOrfFehO+j/IACFQDIaCDkQsoyOse6qSi9RMu2nFV7AxgPMjAyNTA1MTkxNTE1MDdaMAMCAQGgNqQ0MDIxFTATBgNVBAoTDEdpdEh1YiwgSW5jLjEZMBcGA1UEAxMQVFNBIFRpbWVzdGFtcGluZ6AAMYIB3TCCAdkCAQEwSjAyMRUwEwYDVQQKEwxHaXRIdWIsIEluYy4xGTAXBgNVBAMTEFRTQSBpbnRlcm1lZGlhdGUCFB+7MIjE5/rL4XA4fNDnmXHA04+wMAsGCWCGSAFlAwQCAqCCAQUwGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEEMBwGCSqGSIb3DQEJBTEPFw0yNTA1MTkxNTE1MDdaMD8GCSqGSIb3DQEJBDEyBDC2/CamygPxYeiiVM6RotGLEuliqW+dHYD0KfhlrFBvYq99h2j1PPCs0wRDuPFM9tEwgYcGCyqGSIb3DQEJEAIvMXgwdjB0MHIEIHuISsKSyiJtlhGjT+RyS+tYQ7iwCMsMCTGmz2NK3D7DME4wNqQ0MDIxFTATBgNVBAoTDEdpdEh1YiwgSW5jLjEZMBcGA1UEAxMQVFNBIGludGVybWVkaWF0ZQIUH7swiMTn+svhcDh80OeZccDTj7AwCgYIKoZIzj0EAwMEZjBkAjAQH0aBVwChU2PyObRfc/IhAUomT9utw9qcUI6HSORN9WuFXjmhOlS6n7NzkMpTNegCMC0mpbCY7D+4wcEsmzcuibQNib7P08MBb9W27TKPHqVeovHnF9SmlVmakhpLqyELfA=="}]}},"dsseEnvelope":{"payload":"ewogICJwcmVkaWNhdGVUeXBlIjogImh0dHBzOi8vZG9jcy5vYXNpcy1vcGVuLm9yZy9vcGVuZW94L2NvcmUvdjEuMCIsCiAgInByZWRpY2F0ZSI6IHsKICAgICIkc2NoZW1hIjogImh0dHBzOi8vZG9jcy5vYXNpcy1vcGVuLm9yZy9vcGVuZW94L3RiZC9zY2hlbWEvY29yZS5qc29uIiwKICAgICJlbmRfb2ZfbGlmZSI6ICIyMDMwLTAxLTAxVDAwOjAwOjAwWiIsCiAgICAiZW5kX29mX3NlY3VyaXR5X3N1cHBvcnQiOiAiMjAzMC0wMS0wMVQwMDowMDowMFoiLAogICAgImxhc3RfdXBkYXRlZCI6ICIyMDI1LTA1LTE4VDEyOjMyOjAwWiIKICB9LAogICJ0eXBlIjogImh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLAogICJzdWJqZWN0IjogWwogICAgewogICAgICAibmFtZSI6ICJiZTU3OGViMjM0MzFhM2JkMDVmMGUwMjJjYWQ3NGMwYzY1YjAyMmE4IiwKICAgICAgInVyaSI6ICJnaXQraHR0cHM6Ly9naXRodWIuY29tL29wZW52ZXgvZ28tdmV4QGJlNTc4ZWIyMzQzMWEzYmQwNWYwZTAyMmNhZDc0YzBjNjViMDIyYTgiLAogICAgICAiZGlnZXN0IjogewogICAgICAgICJnaXRDb21taXQiOiAiYmU1NzhlYjIzNDMxYTNiZDA1ZjBlMDIyY2FkNzRjMGM2NWIwMjJhOCIsCiAgICAgICAgInNoYTEiOiAiYmU1NzhlYjIzNDMxYTNiZDA1ZjBlMDIyY2FkNzRjMGM2NWIwMjJhOCIKICAgICAgfQogICAgfQogIF0KfQo=","payloadType":"application/vnd.in-toto+json","signatures":[{"sig":"MEUCIQDVFsSHJSolpy2UbKNdFy+yEMaJhSRsojkdsZmWpECrBAIgIL8Y+UISYm71Dt4VPwG6ywfidBCP30+ukCAF8z2XaE8="}]}} +{"mediaType":"application/vnd.dev.sigstore.bundle.v0.3+json","verificationMaterial":{"certificate":{"rawBytes":"MIIGpDCCBiugAwIBAgIUJ9Uvmcd5GG3AYeQ/8nsxVd0uCJEwCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjUwNTE5MTUxNTMzWhcNMjUwNTE5MTUyNTMzWjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEkzRJkKAfNVQbcbMBiV625IbRfF2zjEnNyVjfX5++hlEXJ7WvAseuk2NO92fPK+8dk/N99bmVzcVBypnjTINtZqOCBUowggVGMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUnbr7ZVsb0G/wkt/8IqQg/tdJI0owHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wYQYDVR0RAQH/BFcwVYZTaHR0cHM6Ly9naXRodWIuY29tL29wZW52ZXgvZ28tdmV4Ly5naXRodWIvd29ya2Zsb3dzL2NvbXBsaWFuY2UueWFtbEByZWZzL2hlYWRzL21haW4wOQYKKwYBBAGDvzABAQQraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTASBgorBgEEAYO/MAECBARwdXNoMDYGCisGAQQBg78wAQMEKGJlNTc4ZWIyMzQzMWEzYmQwNWYwZTAyMmNhZDc0YzBjNjViMDIyYTgwHQYKKwYBBAGDvzABBAQPT1NQUyBDb21wbGlhbmNlMBwGCisGAQQBg78wAQUEDm9wZW52ZXgvZ28tdmV4MB0GCisGAQQBg78wAQYED3JlZnMvaGVhZHMvbWFpbjA7BgorBgEEAYO/MAEIBC0MK2h0dHBzOi8vdG9rZW4uYWN0aW9ucy5naXRodWJ1c2VyY29udGVudC5jb20wYwYKKwYBBAGDvzABCQRVDFNodHRwczovL2dpdGh1Yi5jb20vb3BlbnZleC9nby12ZXgvLmdpdGh1Yi93b3JrZmxvd3MvY29tcGxpYW5jZS55YW1sQHJlZnMvaGVhZHMvbWFpbjA4BgorBgEEAYO/MAEKBCoMKGJlNTc4ZWIyMzQzMWEzYmQwNWYwZTAyMmNhZDc0YzBjNjViMDIyYTgwHQYKKwYBBAGDvzABCwQPDA1naXRodWItaG9zdGVkMDEGCisGAQQBg78wAQwEIwwhaHR0cHM6Ly9naXRodWIuY29tL29wZW52ZXgvZ28tdmV4MDgGCisGAQQBg78wAQ0EKgwoYmU1NzhlYjIzNDMxYTNiZDA1ZjBlMDIyY2FkNzRjMGM2NWIwMjJhODAfBgorBgEEAYO/MAEOBBEMD3JlZnMvaGVhZHMvbWFpbjAZBgorBgEEAYO/MAEPBAsMCTU4NzEwMDUyNjAqBgorBgEEAYO/MAEQBBwMGmh0dHBzOi8vZ2l0aHViLmNvbS9vcGVudmV4MBkGCisGAQQBg78wAREECwwJMTIxMzYxMTY0MGMGCisGAQQBg78wARIEVQxTaHR0cHM6Ly9naXRodWIuY29tL29wZW52ZXgvZ28tdmV4Ly5naXRodWIvd29ya2Zsb3dzL2NvbXBsaWFuY2UueWFtbEByZWZzL2hlYWRzL21haW4wOAYKKwYBBAGDvzABEwQqDChiZTU3OGViMjM0MzFhM2JkMDVmMGUwMjJjYWQ3NGMwYzY1YjAyMmE4MBQGCisGAQQBg78wARQEBgwEcHVzaDBVBgorBgEEAYO/MAEVBEcMRWh0dHBzOi8vZ2l0aHViLmNvbS9vcGVudmV4L2dvLXZleC9hY3Rpb25zL3J1bnMvMTUxMTY3MTMwNjMvYXR0ZW1wdHMvMTAWBgorBgEEAYO/MAEWBAgMBnB1YmxpYzCBiQYKKwYBBAHWeQIEAgR7BHkAdwB1AN09MGrGxxEyYxkeHJlnNwKiSl643jyt/4eKcoAvKe6OAAABlukdS4sAAAQDAEYwRAIgVfXkADNRRlmvvAs120X8FfUB6Bxc++Pdblh78uIA8OgCIBOOmp2Kyr1ybWGRv/++opqCk6cbh6FeI28sHESZxx0LMAoGCCqGSM49BAMDA2cAMGQCMDw6h08yAjV2qkn921dmd5JaNn5bH4tfbtQqPY3pIoEWa+o2RLdQHEh/TIEY2C3rrQIwODzRzFoJROpQVpVm1eitvd1GXq7u4VUFS0qKB0hjxed5M+87i+RXDgtQZyoBoIht"},"tlogEntries":[{"logIndex":"215150910","logId":{"keyId":"wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0="},"kindVersion":{"kind":"dsse","version":"0.0.1"},"integratedTime":"1747667733","inclusionPromise":{"signedEntryTimestamp":"MEUCIAmH7MU8oLNoDYvSW5w7vrj6zK+UWDvdWHYb55/Vy/2HAiEAsQQQKVaynNH7Rz1zQ93gNFsAVl2/loJkZoIN7JPEpQM="},"inclusionProof":{"logIndex":"93246648","rootHash":"2RI+WgZtr1ToYgY/fvy1lMTiyjlk+zjcXQABQgMpas8=","treeSize":"93246652","hashes":["lZI9pIcgKkvaAczk4zDqUH1yGwOmDMREp09cGlR9Cgc=","M32QqpVXvu/bi2f/YDFzoxTkp1N04lzX1JXQpxpLCYM=","iBjhCFt0/ykMaj42solJksOTTGETJx4lGyjk4KVBd9E=","q7sgL3AVlH8l4qfN4tM+HuCws4oBwi44u7282VSaiTU=","tLRThpbEBk59hExWItDkr+uA4kIlrnnte7glx+vweV8=","yo+2jPhKsuz/CtMu4IrnJOKbPk0+Ld24oQmamgqrk9w=","yE/bG+8P1uXiHlkuy+KclStPT+MKJEEyX4kzoOuKZgQ=","042DYR2d1hwvoL0HQbthgDNoQ1HSPnc0KgG0Ng7OIRc=","6IuKpfamF5MnXbiV7ZkiPNLe5s0ITFqh7+dz0NyQ7OA=","oGyx4R/A6Ag6s0TRt4mm4oxGmfF7f+xkF+zKu/qXqiw=","y21aAimBjVROsW/BCWkp05AFH6eiZQ/3gF4VOzAXAAQ=","W9wJ9WSCVQtk9KyFvgvUeSTSdIlinFsIzc4CRRneqqE=","wEs+MEa1o73p8j5DbGsLUnaP98q0PK8ZBoqwDPyZLIw=","h5VTNNCORtYrwvf9h5wlAx+k3+9SY5/VIETuNnly6Xk=","++1LMuz3tIdW1/pfEfhPfXC4ot1AwDAXDcPyfibzGyc=","7v8qPHNDLerpduaMx06eb/MwgoQwczTn/cYGKX/9wZ4="],"checkpoint":{"envelope":"rekor.sigstore.dev - 1193050959916656506\n93246652\n2RI+WgZtr1ToYgY/fvy1lMTiyjlk+zjcXQABQgMpas8=\n\n— rekor.sigstore.dev wNI9ajBFAiBp6tfJ8YOxTqQMOEBxE70U2BT4jt1uuyCL8HxrjYa9JQIhAPG2oQ1JcfEd3SbvOIBT9MN4Fm/VnSsGoPLZt/kIlnd/\n"}},"canonicalizedBody":"eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiZHNzZSIsInNwZWMiOnsiZW52ZWxvcGVIYXNoIjp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiZDk3NDlmYTIxOTIzNTE0Njk4OGUzYzJiYjJhNDUyNWQ0MWQxNjQzYjgxY2RhMjViMzRlYjNkNGExMjI0OWYyMyJ9LCJwYXlsb2FkSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImJiMTUxY2RkMTk2MjY4MGMxMmY0ZTljYzM5OTY3MjEzYjgwMjRlY2NhZDIxNTZlMzBhMjE5NjVkNzZjZDJjMjgifSwic2lnbmF0dXJlcyI6W3sic2lnbmF0dXJlIjoiTUVVQ0lGeE5oSDcwbWxGR0pSTUs2VWhKSjR3TkxsM0JweWN5clVENGlZbHNpUDVSQWlFQTBNZURKcDhJOU8wOUMrY0FwdStwaGpUTHNOTTY0NXZVTWJWZzMwZnc1aVk9IiwidmVyaWZpZXIiOiJMUzB0TFMxQ1JVZEpUaUJEUlZKVVNVWkpRMEZVUlMwdExTMHRDazFKU1Vkd1JFTkRRbWwxWjBGM1NVSkJaMGxWU2psVmRtMWpaRFZIUnpOQldXVlJMemh1YzNoV1pEQjFRMHBGZDBObldVbExiMXBKZW1vd1JVRjNUWGNLVG5wRlZrMUNUVWRCTVZWRlEyaE5UV015Ykc1ak0xSjJZMjFWZFZwSFZqSk5ValIzU0VGWlJGWlJVVVJGZUZaNllWZGtlbVJIT1hsYVV6RndZbTVTYkFwamJURnNXa2RzYUdSSFZYZElhR05PVFdwVmQwNVVSVFZOVkZWNFRsUk5lbGRvWTA1TmFsVjNUbFJGTlUxVVZYbE9WRTE2VjJwQlFVMUdhM2RGZDFsSUNrdHZXa2w2YWpCRFFWRlpTVXR2V2tsNmFqQkVRVkZqUkZGblFVVnJlbEpLYTB0QlprNVdVV0pqWWsxQ2FWWTJNalZKWWxKbVJqSjZha1Z1VG5sV2FtWUtXRFVySzJoc1JWaEtOMWQyUVhObGRXc3lUazg1TW1aUVN5czRaR3N2VGprNVltMVdlbU5XUW5sd2JtcFVTVTUwV25GUFEwSlZiM2RuWjFaSFRVRTBSd3BCTVZWa1JIZEZRaTkzVVVWQmQwbElaMFJCVkVKblRsWklVMVZGUkVSQlMwSm5aM0pDWjBWR1FsRmpSRUY2UVdSQ1owNVdTRkUwUlVablVWVnVZbkkzQ2xwV2MySXdSeTkzYTNRdk9FbHhVV2N2ZEdSS1NUQnZkMGgzV1VSV1VqQnFRa0puZDBadlFWVXpPVkJ3ZWpGWmEwVmFZalZ4VG1wd1MwWlhhWGhwTkZrS1drUTRkMWxSV1VSV1VqQlNRVkZJTDBKR1kzZFdXVnBVWVVoU01HTklUVFpNZVRsdVlWaFNiMlJYU1hWWk1qbDBUREk1ZDFwWE5USmFXR2QyV2pJNGRBcGtiVlkwVEhrMWJtRllVbTlrVjBsMlpESTVlV0V5V25OaU0yUjZUREpPZG1KWVFuTmhWMFoxV1RKVmRXVlhSblJpUlVKNVdsZGFla3d5YUd4WlYxSjZDa3d5TVdoaFZ6UjNUMUZaUzB0M1dVSkNRVWRFZG5wQlFrRlJVWEpoU0ZJd1kwaE5Oa3g1T1RCaU1uUnNZbWsxYUZrelVuQmlNalY2VEcxa2NHUkhhREVLV1c1V2VscFlTbXBpTWpVd1dsYzFNRXh0VG5aaVZFRlRRbWR2Y2tKblJVVkJXVTh2VFVGRlEwSkJVbmRrV0U1dlRVUlpSME5wYzBkQlVWRkNaemM0ZHdwQlVVMUZTMGRLYkU1VVl6UmFWMGw1VFhwUmVrMVhSWHBaYlZGM1RsZFpkMXBVUVhsTmJVNW9Xa1JqTUZsNlFtcE9hbFpwVFVSSmVWbFVaM2RJVVZsTENrdDNXVUpDUVVkRWRucEJRa0pCVVZCVU1VNVJWWGxDUkdJeU1YZGlSMnhvWW0xT2JFMUNkMGREYVhOSFFWRlJRbWMzT0hkQlVWVkZSRzA1ZDFwWE5USUtXbGhuZGxveU9IUmtiVlkwVFVJd1IwTnBjMGRCVVZGQ1p6YzRkMEZSV1VWRU0wcHNXbTVOZG1GSFZtaGFTRTEyWWxkR2NHSnFRVGRDWjI5eVFtZEZSUXBCV1U4dlRVRkZTVUpETUUxTE1tZ3daRWhDZWs5cE9IWmtSemx5V2xjMGRWbFhUakJoVnpsMVkzazFibUZZVW05a1Ywb3hZekpXZVZreU9YVmtSMVoxQ21SRE5XcGlNakIzV1hkWlMwdDNXVUpDUVVkRWRucEJRa05SVWxaRVJrNXZaRWhTZDJONmIzWk1NbVJ3WkVkb01WbHBOV3BpTWpCMllqTkNiR0p1V213S1pVTTVibUo1TVRKYVdHZDJURzFrY0dSSGFERlphVGt6WWpOS2NscHRlSFprTTAxMldUSTVkR05IZUhCWlZ6VnFXbE0xTlZsWE1YTlJTRXBzV201TmRncGhSMVpvV2toTmRtSlhSbkJpYWtFMFFtZHZja0puUlVWQldVOHZUVUZGUzBKRGIwMUxSMHBzVGxSak5GcFhTWGxOZWxGNlRWZEZlbGx0VVhkT1YxbDNDbHBVUVhsTmJVNW9Xa1JqTUZsNlFtcE9hbFpwVFVSSmVWbFVaM2RJVVZsTFMzZFpRa0pCUjBSMmVrRkNRM2RSVUVSQk1XNWhXRkp2WkZkSmRHRkhPWG9LWkVkV2EwMUVSVWREYVhOSFFWRlJRbWMzT0hkQlVYZEZTWGQzYUdGSVVqQmpTRTAyVEhrNWJtRllVbTlrVjBsMVdUSTVkRXd5T1hkYVZ6VXlXbGhuZGdwYU1qaDBaRzFXTkUxRVowZERhWE5IUVZGUlFtYzNPSGRCVVRCRlMyZDNiMWx0VlRGT2VtaHNXV3BKZWs1RVRYaFpWRTVwV2tSQk1WcHFRbXhOUkVsNUNsa3lSbXRPZWxKcVRVZE5NazVYU1hkTmFrcG9UMFJCWmtKbmIzSkNaMFZGUVZsUEwwMUJSVTlDUWtWTlJETktiRnB1VFhaaFIxWm9Xa2hOZG1KWFJuQUtZbXBCV2tKbmIzSkNaMFZGUVZsUEwwMUJSVkJDUVhOTlExUlZORTU2UlhkTlJGVjVUbXBCY1VKbmIzSkNaMFZGUVZsUEwwMUJSVkZDUW5kTlIyMW9NQXBrU0VKNlQyazRkbG95YkRCaFNGWnBURzFPZG1KVE9YWmpSMVoxWkcxV05FMUNhMGREYVhOSFFWRlJRbWMzT0hkQlVrVkZRM2QzU2sxVVNYaE5lbGw0Q2sxVVdUQk5SMDFIUTJselIwRlJVVUpuTnpoM1FWSkpSVlpSZUZSaFNGSXdZMGhOTmt4NU9XNWhXRkp2WkZkSmRWa3lPWFJNTWpsM1dsYzFNbHBZWjNZS1dqSTRkR1J0VmpSTWVUVnVZVmhTYjJSWFNYWmtNamw1WVRKYWMySXpaSHBNTWs1MllsaENjMkZYUm5WWk1sVjFaVmRHZEdKRlFubGFWMXA2VERKb2JBcFpWMUo2VERJeGFHRlhOSGRQUVZsTFMzZFpRa0pCUjBSMmVrRkNSWGRSY1VSRGFHbGFWRlV6VDBkV2FVMXFUVEJOZWtab1RUSkthMDFFVm0xTlIxVjNDazFxU21wWlYxRXpUa2ROZDFsNldURlpha0Y1VFcxRk5FMUNVVWREYVhOSFFWRlJRbWMzT0hkQlVsRkZRbWQzUldOSVZucGhSRUpXUW1kdmNrSm5SVVVLUVZsUEwwMUJSVlpDUldOTlVsZG9NR1JJUW5wUGFUaDJXakpzTUdGSVZtbE1iVTUyWWxNNWRtTkhWblZrYlZZMFRESmtka3hZV214bFF6bG9XVE5TY0FwaU1qVjZURE5LTVdKdVRYWk5WRlY0VFZSWk0wMVVUWGRPYWsxMldWaFNNRnBYTVhka1NFMTJUVlJCVjBKbmIzSkNaMFZGUVZsUEwwMUJSVmRDUVdkTkNrSnVRakZaYlhod1dYcERRbWxSV1V0TGQxbENRa0ZJVjJWUlNVVkJaMUkzUWtoclFXUjNRakZCVGpBNVRVZHlSM2g0UlhsWmVHdGxTRXBzYms1M1Mya0tVMncyTkROcWVYUXZOR1ZMWTI5QmRrdGxOazlCUVVGQ2JIVnJaRk0wYzBGQlFWRkVRVVZaZDFKQlNXZFdabGhyUVVST1VsSnNiWFoyUVhNeE1qQllPQXBHWmxWQ05rSjRZeXNyVUdSaWJHZzNPSFZKUVRoUFowTkpRazlQYlhBeVMzbHlNWGxpVjBkU2RpOHJLMjl3Y1VOck5tTmlhRFpHWlVreU9ITklSVk5hQ25oNE1FeE5RVzlIUTBOeFIxTk5ORGxDUVUxRVFUSmpRVTFIVVVOTlJIYzJhREE0ZVVGcVZqSnhhMjQ1TWpGa2JXUTFTbUZPYmpWaVNEUjBabUowVVhFS1VGa3pjRWx2UlZkaEsyOHlVa3hrVVVoRmFDOVVTVVZaTWtNemNuSlJTWGRQUkhwU2VrWnZTbEpQY0ZGV2NGWnRNV1ZwZEhaa01VZFljVGQxTkZaVlJncFRNSEZMUWpCb2FuaGxaRFZOS3pnM2FTdFNXRVJuZEZGYWVXOUNiMGxvZEFvdExTMHRMVVZPUkNCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2c9PSJ9XX19"}],"timestampVerificationData":{"rfc3161Timestamps":[{"signedTimestamp":"MIIC0TADAgEAMIICyAYJKoZIhvcNAQcCoIICuTCCArUCAQMxDTALBglghkgBZQMEAgIwgbwGCyqGSIb3DQEJEAEEoIGsBIGpMIGmAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQgHLyts8fwvSuDs7gJPsP8qQRPcSGc11VmatYnd0Tl7WkCFQDbu5+3WwpwPx4oieNCvG0NU+1JcxgPMjAyNTA1MTkxNTE1MzNaMAMCAQGgNqQ0MDIxFTATBgNVBAoTDEdpdEh1YiwgSW5jLjEZMBcGA1UEAxMQVFNBIFRpbWVzdGFtcGluZ6AAMYIB3jCCAdoCAQEwSjAyMRUwEwYDVQQKEwxHaXRIdWIsIEluYy4xGTAXBgNVBAMTEFRTQSBpbnRlcm1lZGlhdGUCFB+7MIjE5/rL4XA4fNDnmXHA04+wMAsGCWCGSAFlAwQCAqCCAQUwGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEEMBwGCSqGSIb3DQEJBTEPFw0yNTA1MTkxNTE1MzNaMD8GCSqGSIb3DQEJBDEyBDBDh2bczKDpk7dIfoByPQQyirwtJp9XlCTzHfYGdK4GWfggoQdlnqTzk5Oe73kS7PMwgYcGCyqGSIb3DQEJEAIvMXgwdjB0MHIEIHuISsKSyiJtlhGjT+RyS+tYQ7iwCMsMCTGmz2NK3D7DME4wNqQ0MDIxFTATBgNVBAoTDEdpdEh1YiwgSW5jLjEZMBcGA1UEAxMQVFNBIGludGVybWVkaWF0ZQIUH7swiMTn+svhcDh80OeZccDTj7AwCgYIKoZIzj0EAwMEZzBlAjARdjFxi9YnLpZqSPm9JoTnYEIWWvDi/V3hlNNGPPgRDC/6ZdV0yS6O0txfBltEJh8CMQCtZ7lOUbxzRyMlBYjO2JQL+ha3fIE3OLw4ulYtDb87+Iam3clX4voTbtIgabyXY50="}]}},"dsseEnvelope":{"payload":"ewogICJwcmVkaWNhdGVUeXBlIjogImh0dHBzOi8vb3BlbnZleC5kZXYvbnMvdjAuMi4wIiwKICAicHJlZGljYXRlIjogewogICAgIkBjb250ZXh0IjogImh0dHBzOi8vb3BlbnZleC5kZXYvbnMvdjAuMi4wIiwKICAgICJAaWQiOiAiaHR0cHM6Ly9vcGVudmV4LmRldi9kb2NzL3B1YmxpYy92ZXgtMjNkMTUyM2EwYzVkMzdlY2RjNDliZTNkOGViYjNlOTk2NmZjOGEyODBiMGIxMjA5MTEwNzg0OGYzODk0YzdkYSIsCiAgICAiYXV0aG9yIjogIlVua25vd24gQXV0aG9yIiwKICAgICJ0aW1lc3RhbXAiOiAiMjAyNS0wNS0xOVQxNToxNTozMy4xNjM2OTM4MzNaIiwKICAgICJ2ZXJzaW9uIjogMSwKICAgICJ0b29saW5nIjogImh0dHA6Ly9naXRodWIuY29tL2NhcmFiaW5lci1kZXYvdmV4ZmxvdyIsCiAgICAic3RhdGVtZW50cyI6IFtdCiAgfSwKICAidHlwZSI6ICJodHRwczovL2luLXRvdG8uaW8vU3RhdGVtZW50L3YxIiwKICAic3ViamVjdCI6IFsKICAgIHsKICAgICAgImRpZ2VzdCI6IHsKICAgICAgICAic2hhMSI6ICJiZTU3OGViMjM0MzFhM2JkMDVmMGUwMjJjYWQ3NGMwYzY1YjAyMmE4IgogICAgICB9CiAgICB9CiAgXQp9Cg==","payloadType":"application/vnd.in-toto+json","signatures":[{"sig":"MEUCIFxNhH70mlFGJRMK6UhJJ4wNLl3BpycyrUD4iYlsiP5RAiEA0MeDJp8I9O09C+cApu+phjTLsNM645vUMbVg30fw5iY="}]}} diff --git a/internal/cmd/testdata/single.bundle.json b/internal/cmd/testdata/single.bundle.json new file mode 100644 index 0000000..6a0d72d --- /dev/null +++ b/internal/cmd/testdata/single.bundle.json @@ -0,0 +1 @@ +{"mediaType":"application/vnd.dev.sigstore.bundle.v0.3+json","verificationMaterial":{"certificate":{"rawBytes":"MIIGpzCCBi2gAwIBAgIUSrH0nWmVlIImJPR0Rdb1cJPA92owCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjUwNTE5MTUxNTA3WhcNMjUwNTE5MTUyNTA3WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEjPP4QzHPhrXfPjnCQadid6ViiihQHSJcC+Zcwytcm3Q0dJA4OaQm0KLRaNYJxg8GvM5X47qh6fsZjqGYPRh+JKOCBUwwggVIMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUzyk0nVfOtPmUGJUTJnNSWGoWitYwHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wYQYDVR0RAQH/BFcwVYZTaHR0cHM6Ly9naXRodWIuY29tL29wZW52ZXgvZ28tdmV4Ly5naXRodWIvd29ya2Zsb3dzL2NvbXBsaWFuY2UueWFtbEByZWZzL2hlYWRzL21haW4wOQYKKwYBBAGDvzABAQQraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTASBgorBgEEAYO/MAECBARwdXNoMDYGCisGAQQBg78wAQMEKGJlNTc4ZWIyMzQzMWEzYmQwNWYwZTAyMmNhZDc0YzBjNjViMDIyYTgwHQYKKwYBBAGDvzABBAQPT1NQUyBDb21wbGlhbmNlMBwGCisGAQQBg78wAQUEDm9wZW52ZXgvZ28tdmV4MB0GCisGAQQBg78wAQYED3JlZnMvaGVhZHMvbWFpbjA7BgorBgEEAYO/MAEIBC0MK2h0dHBzOi8vdG9rZW4uYWN0aW9ucy5naXRodWJ1c2VyY29udGVudC5jb20wYwYKKwYBBAGDvzABCQRVDFNodHRwczovL2dpdGh1Yi5jb20vb3BlbnZleC9nby12ZXgvLmdpdGh1Yi93b3JrZmxvd3MvY29tcGxpYW5jZS55YW1sQHJlZnMvaGVhZHMvbWFpbjA4BgorBgEEAYO/MAEKBCoMKGJlNTc4ZWIyMzQzMWEzYmQwNWYwZTAyMmNhZDc0YzBjNjViMDIyYTgwHQYKKwYBBAGDvzABCwQPDA1naXRodWItaG9zdGVkMDEGCisGAQQBg78wAQwEIwwhaHR0cHM6Ly9naXRodWIuY29tL29wZW52ZXgvZ28tdmV4MDgGCisGAQQBg78wAQ0EKgwoYmU1NzhlYjIzNDMxYTNiZDA1ZjBlMDIyY2FkNzRjMGM2NWIwMjJhODAfBgorBgEEAYO/MAEOBBEMD3JlZnMvaGVhZHMvbWFpbjAZBgorBgEEAYO/MAEPBAsMCTU4NzEwMDUyNjAqBgorBgEEAYO/MAEQBBwMGmh0dHBzOi8vZ2l0aHViLmNvbS9vcGVudmV4MBkGCisGAQQBg78wAREECwwJMTIxMzYxMTY0MGMGCisGAQQBg78wARIEVQxTaHR0cHM6Ly9naXRodWIuY29tL29wZW52ZXgvZ28tdmV4Ly5naXRodWIvd29ya2Zsb3dzL2NvbXBsaWFuY2UueWFtbEByZWZzL2hlYWRzL21haW4wOAYKKwYBBAGDvzABEwQqDChiZTU3OGViMjM0MzFhM2JkMDVmMGUwMjJjYWQ3NGMwYzY1YjAyMmE4MBQGCisGAQQBg78wARQEBgwEcHVzaDBVBgorBgEEAYO/MAEVBEcMRWh0dHBzOi8vZ2l0aHViLmNvbS9vcGVudmV4L2dvLXZleC9hY3Rpb25zL3J1bnMvMTUxMTY3MTMwNjMvYXR0ZW1wdHMvMTAWBgorBgEEAYO/MAEWBAgMBnB1YmxpYzCBiwYKKwYBBAHWeQIEAgR9BHsAeQB3AN09MGrGxxEyYxkeHJlnNwKiSl643jyt/4eKcoAvKe6OAAABlukc5skAAAQDAEgwRgIhAPy20I6tU6w6DsAZORUPCBcQM1rTDtCIxeFu3SdvXGpEAiEA5oHiR+m8O6ARiYoeGciWjBf5UBJR3OxWvf7ml/Q32cowCgYIKoZIzj0EAwMDaAAwZQIwW07eEgTny+2RC3DhiMEzZqCCenACADE66oI6kwBwtuRV6duS3n3s4HOCl+8jC5pKAjEAhBos2gudTyY0jQ8mty7o1Yro9ztNaMFXe0tYubnD51z/Tov0BoZmogZnBFy6l18m"},"tlogEntries":[{"logIndex":"215150747","logId":{"keyId":"wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0="},"kindVersion":{"kind":"dsse","version":"0.0.1"},"integratedTime":"1747667707","inclusionPromise":{"signedEntryTimestamp":"MEQCIAP2lDo8u9Fz1wCo+x9GcGuRZ8ZYqgSh6CeklFbljeXeAiA79imFXi1TuFyW4hnpByRxJYVrGbo4/vbF7pBSlXZgmg=="},"inclusionProof":{"logIndex":"93246485","rootHash":"BYMejhrpNF6602PfYM9OD3FsnNfeo8kr4HifMTUHQmQ=","treeSize":"93246487","hashes":["pa2Ur2BO13jb72OqVwgkfYJucdDnebyuyYJegc9LuFU=","0VfTi1dEkAOS4ve/iZUhRf5n9s7uaEW1HqpsRCuNCTU=","qEJONCXQdyzmvHdzLJIfjEZCTH2HgoN5vzWSoR8bZDE=","Ld3G2AavYEqOe2kC/n39eODP2GNP0kbSe1ACwUzq7J0=","yE/bG+8P1uXiHlkuy+KclStPT+MKJEEyX4kzoOuKZgQ=","042DYR2d1hwvoL0HQbthgDNoQ1HSPnc0KgG0Ng7OIRc=","6IuKpfamF5MnXbiV7ZkiPNLe5s0ITFqh7+dz0NyQ7OA=","oGyx4R/A6Ag6s0TRt4mm4oxGmfF7f+xkF+zKu/qXqiw=","y21aAimBjVROsW/BCWkp05AFH6eiZQ/3gF4VOzAXAAQ=","W9wJ9WSCVQtk9KyFvgvUeSTSdIlinFsIzc4CRRneqqE=","wEs+MEa1o73p8j5DbGsLUnaP98q0PK8ZBoqwDPyZLIw=","h5VTNNCORtYrwvf9h5wlAx+k3+9SY5/VIETuNnly6Xk=","++1LMuz3tIdW1/pfEfhPfXC4ot1AwDAXDcPyfibzGyc=","7v8qPHNDLerpduaMx06eb/MwgoQwczTn/cYGKX/9wZ4="],"checkpoint":{"envelope":"rekor.sigstore.dev - 1193050959916656506\n93246487\nBYMejhrpNF6602PfYM9OD3FsnNfeo8kr4HifMTUHQmQ=\n\n— rekor.sigstore.dev wNI9ajBFAiEA+iLv8SPgYIZLSiWUIBMki1NCjeDH3HWLh6rVaepKdhQCIFktXIvu0TY289VjjNjs1V7JZsfqEFhb9nAdv0ZhLiWW\n"}},"canonicalizedBody":"eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiZHNzZSIsInNwZWMiOnsiZW52ZWxvcGVIYXNoIjp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiNDlmNjY5MzhjYWJmNzFmYTRlMDhmZWRiMzY1OGY1MzYzYzMyN2VhYTNjOTFiYzI0MjFjYjY3ZDBhYTA3NTgyMyJ9LCJwYXlsb2FkSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6ImViYTQ4M2QwOWE5ZTFhYWMwMWRlMjUxZDI0OGYyZTQ2MzgwMjZiMDljOWQxNWJkMTBjYTFmZGUzY2ZiNDMzOGEifSwic2lnbmF0dXJlcyI6W3sic2lnbmF0dXJlIjoiTUVVQ0lRRFZGc1NISlNvbHB5MlViS05kRnkreUVNYUpoU1Jzb2prZHNabVdwRUNyQkFJZ0lMOFkrVUlTWW03MUR0NFZQd0c2eXdmaWRCQ1AzMCt1a0NBRjh6MlhhRTg9IiwidmVyaWZpZXIiOiJMUzB0TFMxQ1JVZEpUaUJEUlZKVVNVWkpRMEZVUlMwdExTMHRDazFKU1Vkd2VrTkRRbWt5WjBGM1NVSkJaMGxWVTNKSU1HNVhiVlpzU1VsdFNsQlNNRkprWWpGalNsQkJPVEp2ZDBObldVbExiMXBKZW1vd1JVRjNUWGNLVG5wRlZrMUNUVWRCTVZWRlEyaE5UV015Ykc1ak0xSjJZMjFWZFZwSFZqSk5ValIzU0VGWlJGWlJVVVJGZUZaNllWZGtlbVJIT1hsYVV6RndZbTVTYkFwamJURnNXa2RzYUdSSFZYZElhR05PVFdwVmQwNVVSVFZOVkZWNFRsUkJNMWRvWTA1TmFsVjNUbFJGTlUxVVZYbE9WRUV6VjJwQlFVMUdhM2RGZDFsSUNrdHZXa2w2YWpCRFFWRlpTVXR2V2tsNmFqQkVRVkZqUkZGblFVVnFVRkEwVVhwSVVHaHlXR1pRYW01RFVXRmthV1EyVm1scGFXaFJTRk5LWTBNcldtTUtkM2wwWTIwelVUQmtTa0UwVDJGUmJUQkxURkpoVGxsS2VHYzRSM1pOTlZnME4zRm9ObVp6V21weFIxbFFVbWdyU2t0UFEwSlZkM2RuWjFaSlRVRTBSd3BCTVZWa1JIZEZRaTkzVVVWQmQwbElaMFJCVkVKblRsWklVMVZGUkVSQlMwSm5aM0pDWjBWR1FsRmpSRUY2UVdSQ1owNVdTRkUwUlVablVWVjZlV3N3Q201V1prOTBVRzFWUjBwVlZFcHVUbE5YUjI5WGFYUlpkMGgzV1VSV1VqQnFRa0puZDBadlFWVXpPVkJ3ZWpGWmEwVmFZalZ4VG1wd1MwWlhhWGhwTkZrS1drUTRkMWxSV1VSV1VqQlNRVkZJTDBKR1kzZFdXVnBVWVVoU01HTklUVFpNZVRsdVlWaFNiMlJYU1hWWk1qbDBUREk1ZDFwWE5USmFXR2QyV2pJNGRBcGtiVlkwVEhrMWJtRllVbTlrVjBsMlpESTVlV0V5V25OaU0yUjZUREpPZG1KWVFuTmhWMFoxV1RKVmRXVlhSblJpUlVKNVdsZGFla3d5YUd4WlYxSjZDa3d5TVdoaFZ6UjNUMUZaUzB0M1dVSkNRVWRFZG5wQlFrRlJVWEpoU0ZJd1kwaE5Oa3g1T1RCaU1uUnNZbWsxYUZrelVuQmlNalY2VEcxa2NHUkhhREVLV1c1V2VscFlTbXBpTWpVd1dsYzFNRXh0VG5aaVZFRlRRbWR2Y2tKblJVVkJXVTh2VFVGRlEwSkJVbmRrV0U1dlRVUlpSME5wYzBkQlVWRkNaemM0ZHdwQlVVMUZTMGRLYkU1VVl6UmFWMGw1VFhwUmVrMVhSWHBaYlZGM1RsZFpkMXBVUVhsTmJVNW9Xa1JqTUZsNlFtcE9hbFpwVFVSSmVWbFVaM2RJVVZsTENrdDNXVUpDUVVkRWRucEJRa0pCVVZCVU1VNVJWWGxDUkdJeU1YZGlSMnhvWW0xT2JFMUNkMGREYVhOSFFWRlJRbWMzT0hkQlVWVkZSRzA1ZDFwWE5USUtXbGhuZGxveU9IUmtiVlkwVFVJd1IwTnBjMGRCVVZGQ1p6YzRkMEZSV1VWRU0wcHNXbTVOZG1GSFZtaGFTRTEyWWxkR2NHSnFRVGRDWjI5eVFtZEZSUXBCV1U4dlRVRkZTVUpETUUxTE1tZ3daRWhDZWs5cE9IWmtSemx5V2xjMGRWbFhUakJoVnpsMVkzazFibUZZVW05a1Ywb3hZekpXZVZreU9YVmtSMVoxQ21SRE5XcGlNakIzV1hkWlMwdDNXVUpDUVVkRWRucEJRa05SVWxaRVJrNXZaRWhTZDJONmIzWk1NbVJ3WkVkb01WbHBOV3BpTWpCMllqTkNiR0p1V213S1pVTTVibUo1TVRKYVdHZDJURzFrY0dSSGFERlphVGt6WWpOS2NscHRlSFprTTAxMldUSTVkR05IZUhCWlZ6VnFXbE0xTlZsWE1YTlJTRXBzV201TmRncGhSMVpvV2toTmRtSlhSbkJpYWtFMFFtZHZja0puUlVWQldVOHZUVUZGUzBKRGIwMUxSMHBzVGxSak5GcFhTWGxOZWxGNlRWZEZlbGx0VVhkT1YxbDNDbHBVUVhsTmJVNW9Xa1JqTUZsNlFtcE9hbFpwVFVSSmVWbFVaM2RJVVZsTFMzZFpRa0pCUjBSMmVrRkNRM2RSVUVSQk1XNWhXRkp2WkZkSmRHRkhPWG9LWkVkV2EwMUVSVWREYVhOSFFWRlJRbWMzT0hkQlVYZEZTWGQzYUdGSVVqQmpTRTAyVEhrNWJtRllVbTlrVjBsMVdUSTVkRXd5T1hkYVZ6VXlXbGhuZGdwYU1qaDBaRzFXTkUxRVowZERhWE5IUVZGUlFtYzNPSGRCVVRCRlMyZDNiMWx0VlRGT2VtaHNXV3BKZWs1RVRYaFpWRTVwV2tSQk1WcHFRbXhOUkVsNUNsa3lSbXRPZWxKcVRVZE5NazVYU1hkTmFrcG9UMFJCWmtKbmIzSkNaMFZGUVZsUEwwMUJSVTlDUWtWTlJETktiRnB1VFhaaFIxWm9Xa2hOZG1KWFJuQUtZbXBCV2tKbmIzSkNaMFZGUVZsUEwwMUJSVkJDUVhOTlExUlZORTU2UlhkTlJGVjVUbXBCY1VKbmIzSkNaMFZGUVZsUEwwMUJSVkZDUW5kTlIyMW9NQXBrU0VKNlQyazRkbG95YkRCaFNGWnBURzFPZG1KVE9YWmpSMVoxWkcxV05FMUNhMGREYVhOSFFWRlJRbWMzT0hkQlVrVkZRM2QzU2sxVVNYaE5lbGw0Q2sxVVdUQk5SMDFIUTJselIwRlJVVUpuTnpoM1FWSkpSVlpSZUZSaFNGSXdZMGhOTmt4NU9XNWhXRkp2WkZkSmRWa3lPWFJNTWpsM1dsYzFNbHBZWjNZS1dqSTRkR1J0VmpSTWVUVnVZVmhTYjJSWFNYWmtNamw1WVRKYWMySXpaSHBNTWs1MllsaENjMkZYUm5WWk1sVjFaVmRHZEdKRlFubGFWMXA2VERKb2JBcFpWMUo2VERJeGFHRlhOSGRQUVZsTFMzZFpRa0pCUjBSMmVrRkNSWGRSY1VSRGFHbGFWRlV6VDBkV2FVMXFUVEJOZWtab1RUSkthMDFFVm0xTlIxVjNDazFxU21wWlYxRXpUa2ROZDFsNldURlpha0Y1VFcxRk5FMUNVVWREYVhOSFFWRlJRbWMzT0hkQlVsRkZRbWQzUldOSVZucGhSRUpXUW1kdmNrSm5SVVVLUVZsUEwwMUJSVlpDUldOTlVsZG9NR1JJUW5wUGFUaDJXakpzTUdGSVZtbE1iVTUyWWxNNWRtTkhWblZrYlZZMFRESmtka3hZV214bFF6bG9XVE5TY0FwaU1qVjZURE5LTVdKdVRYWk5WRlY0VFZSWk0wMVVUWGRPYWsxMldWaFNNRnBYTVhka1NFMTJUVlJCVjBKbmIzSkNaMFZGUVZsUEwwMUJSVmRDUVdkTkNrSnVRakZaYlhod1dYcERRbWwzV1V0TGQxbENRa0ZJVjJWUlNVVkJaMUk1UWtoelFXVlJRak5CVGpBNVRVZHlSM2g0UlhsWmVHdGxTRXBzYms1M1Mya0tVMncyTkROcWVYUXZOR1ZMWTI5QmRrdGxOazlCUVVGQ2JIVnJZelZ6YTBGQlFWRkVRVVZuZDFKblNXaEJVSGt5TUVrMmRGVTJkelpFYzBGYVQxSlZVQXBEUW1OUlRURnlWRVIwUTBsNFpVWjFNMU5rZGxoSGNFVkJhVVZCTlc5SWFWSXJiVGhQTmtGU2FWbHZaVWRqYVZkcVFtWTFWVUpLVWpOUGVGZDJaamR0Q213dlVUTXlZMjkzUTJkWlNVdHZXa2w2YWpCRlFYZE5SR0ZCUVhkYVVVbDNWekEzWlVWblZHNTVLekpTUXpORWFHbE5SWHBhY1VORFpXNUJRMEZFUlRZS05tOUpObXQzUW5kMGRWSldObVIxVXpOdU0zTTBTRTlEYkNzNGFrTTFjRXRCYWtWQmFFSnZjekpuZFdSVWVWa3dhbEU0YlhSNU4yOHhXWEp2T1hwMFRncGhUVVpZWlRCMFdYVmlia1ExTVhvdlZHOTJNRUp2V20xdloxcHVRa1o1Tm13eE9HMEtMUzB0TFMxRlRrUWdRMFZTVkVsR1NVTkJWRVV0TFMwdExRbz0ifV19fQ=="}],"timestampVerificationData":{"rfc3161Timestamps":[{"signedTimestamp":"MIIC0DADAgEAMIICxwYJKoZIhvcNAQcCoIICuDCCArQCAQMxDTALBglghkgBZQMEAgIwgbwGCyqGSIb3DQEJEAEEoIGsBIGpMIGmAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQgsfdMUSP10OOyhDMUa2TuZqtuxEqhdViOrfFehO+j/IACFQDIaCDkQsoyOse6qSi9RMu2nFV7AxgPMjAyNTA1MTkxNTE1MDdaMAMCAQGgNqQ0MDIxFTATBgNVBAoTDEdpdEh1YiwgSW5jLjEZMBcGA1UEAxMQVFNBIFRpbWVzdGFtcGluZ6AAMYIB3TCCAdkCAQEwSjAyMRUwEwYDVQQKEwxHaXRIdWIsIEluYy4xGTAXBgNVBAMTEFRTQSBpbnRlcm1lZGlhdGUCFB+7MIjE5/rL4XA4fNDnmXHA04+wMAsGCWCGSAFlAwQCAqCCAQUwGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEEMBwGCSqGSIb3DQEJBTEPFw0yNTA1MTkxNTE1MDdaMD8GCSqGSIb3DQEJBDEyBDC2/CamygPxYeiiVM6RotGLEuliqW+dHYD0KfhlrFBvYq99h2j1PPCs0wRDuPFM9tEwgYcGCyqGSIb3DQEJEAIvMXgwdjB0MHIEIHuISsKSyiJtlhGjT+RyS+tYQ7iwCMsMCTGmz2NK3D7DME4wNqQ0MDIxFTATBgNVBAoTDEdpdEh1YiwgSW5jLjEZMBcGA1UEAxMQVFNBIGludGVybWVkaWF0ZQIUH7swiMTn+svhcDh80OeZccDTj7AwCgYIKoZIzj0EAwMEZjBkAjAQH0aBVwChU2PyObRfc/IhAUomT9utw9qcUI6HSORN9WuFXjmhOlS6n7NzkMpTNegCMC0mpbCY7D+4wcEsmzcuibQNib7P08MBb9W27TKPHqVeovHnF9SmlVmakhpLqyELfA=="}]}},"dsseEnvelope":{"payload":"ewogICJwcmVkaWNhdGVUeXBlIjogImh0dHBzOi8vZG9jcy5vYXNpcy1vcGVuLm9yZy9vcGVuZW94L2NvcmUvdjEuMCIsCiAgInByZWRpY2F0ZSI6IHsKICAgICIkc2NoZW1hIjogImh0dHBzOi8vZG9jcy5vYXNpcy1vcGVuLm9yZy9vcGVuZW94L3RiZC9zY2hlbWEvY29yZS5qc29uIiwKICAgICJlbmRfb2ZfbGlmZSI6ICIyMDMwLTAxLTAxVDAwOjAwOjAwWiIsCiAgICAiZW5kX29mX3NlY3VyaXR5X3N1cHBvcnQiOiAiMjAzMC0wMS0wMVQwMDowMDowMFoiLAogICAgImxhc3RfdXBkYXRlZCI6ICIyMDI1LTA1LTE4VDEyOjMyOjAwWiIKICB9LAogICJ0eXBlIjogImh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLAogICJzdWJqZWN0IjogWwogICAgewogICAgICAibmFtZSI6ICJiZTU3OGViMjM0MzFhM2JkMDVmMGUwMjJjYWQ3NGMwYzY1YjAyMmE4IiwKICAgICAgInVyaSI6ICJnaXQraHR0cHM6Ly9naXRodWIuY29tL29wZW52ZXgvZ28tdmV4QGJlNTc4ZWIyMzQzMWEzYmQwNWYwZTAyMmNhZDc0YzBjNjViMDIyYTgiLAogICAgICAiZGlnZXN0IjogewogICAgICAgICJnaXRDb21taXQiOiAiYmU1NzhlYjIzNDMxYTNiZDA1ZjBlMDIyY2FkNzRjMGM2NWIwMjJhOCIsCiAgICAgICAgInNoYTEiOiAiYmU1NzhlYjIzNDMxYTNiZDA1ZjBlMDIyY2FkNzRjMGM2NWIwMjJhOCIKICAgICAgfQogICAgfQogIF0KfQo=","payloadType":"application/vnd.in-toto+json","signatures":[{"sig":"MEUCIQDVFsSHJSolpy2UbKNdFy+yEMaJhSRsojkdsZmWpECrBAIgIL8Y+UISYm71Dt4VPwG6ywfidBCP30+ukCAF8z2XaE8="}]}} From f3379a76249dbf540a0fba11f5cb9e8bc1cd56d7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Adolfo=20Garc=C3=ADa=20Veytia=20=28Puerco=29?= Date: Thu, 10 Sep 2026 23:36:06 -0600 Subject: [PATCH 2/3] Bump collector MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Adolfo García Veytia (Puerco) --- go.mod | 109 +++++++++++++++++++++++++++----- go.sum | 195 +++++++++++++++++++++++++++++++++++++++++++++------------ 2 files changed, 246 insertions(+), 58 deletions(-) diff --git a/go.mod b/go.mod index 8b30e5c..b160bad 100644 --- a/go.mod +++ b/go.mod @@ -4,7 +4,7 @@ go 1.26.5 require ( github.com/carabiner-dev/attestation v0.2.1 - github.com/carabiner-dev/collector v0.3.14 + github.com/carabiner-dev/collector v0.3.16 github.com/carabiner-dev/command v0.3.2 github.com/carabiner-dev/hasher v0.2.4 github.com/carabiner-dev/jsonl v0.2.2 @@ -24,26 +24,57 @@ require ( ) require ( - buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.11-20260415201107-50325440f8f2.1 // indirect + buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.12-20260825204119-511051f7f437.2 // indirect + cloud.google.com/go v0.123.0 // indirect + cloud.google.com/go/auth v0.20.0 // indirect + cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect + cloud.google.com/go/compute/metadata v0.9.0 // indirect + cloud.google.com/go/iam v1.13.0 // indirect + cloud.google.com/go/kms v1.33.0 // indirect + cloud.google.com/go/longrunning v1.2.0 // indirect dario.cat/mergo v1.0.2 // indirect - github.com/CycloneDX/cyclonedx-go v0.11.0 // indirect + filippo.io/edwards25519 v1.2.0 // indirect + github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0 // indirect + github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0 // indirect + github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0 // indirect + github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.5.0 // indirect + github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0 // indirect + github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect + github.com/AzureAD/microsoft-authentication-library-for-go v1.7.2 // indirect + github.com/CycloneDX/cyclonedx-go v0.12.0 // indirect github.com/Microsoft/go-winio v0.6.2 // indirect github.com/ProtonMail/go-crypto v1.4.1 // indirect github.com/anchore/go-struct-converter v0.1.0 // indirect github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect github.com/avast/retry-go/v4 v4.7.0 // indirect + github.com/aws/aws-sdk-go-v2 v1.43.0 // indirect + github.com/aws/aws-sdk-go-v2/config v1.32.31 // indirect + github.com/aws/aws-sdk-go-v2/credentials v1.19.30 // indirect + github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.31 // indirect + github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.31 // indirect + github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.31 // indirect + github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.32 // indirect + github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.13 // indirect + github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.31 // indirect + github.com/aws/aws-sdk-go-v2/service/kms v1.55.0 // indirect + github.com/aws/aws-sdk-go-v2/service/signin v1.5.0 // indirect + github.com/aws/aws-sdk-go-v2/service/sso v1.33.0 // indirect + github.com/aws/aws-sdk-go-v2/service/ssooidc v1.38.0 // indirect + github.com/aws/aws-sdk-go-v2/service/sts v1.45.0 // indirect + github.com/aws/smithy-go v1.27.3 // indirect github.com/blang/semver/v4 v4.0.0 // indirect github.com/carabiner-dev/deadrop v0.0.0-20260228173914-d95e9ea2877d // indirect github.com/carabiner-dev/ghrfs v0.3.7 // indirect github.com/carabiner-dev/github v0.2.3 // indirect github.com/carabiner-dev/openeox v1.0.0 // indirect github.com/carabiner-dev/osv v0.1.2 // indirect - github.com/carabiner-dev/policy v0.5.1 // indirect - github.com/carabiner-dev/predicates v0.5.0 // indirect + github.com/carabiner-dev/policy v0.5.5 // indirect + github.com/carabiner-dev/predicates v0.5.1 // indirect github.com/carabiner-dev/sbomfs v0.2.0 // indirect github.com/carabiner-dev/spdx3 v0.1.0 // indirect - github.com/carabiner-dev/stash v0.0.0-20260716192412-e2fe293d76a5 // indirect + github.com/carabiner-dev/stash v0.0.0-20260908191435-d6225e020426 // indirect github.com/carabiner-dev/vcslocator v0.5.0 // indirect + github.com/cenkalti/backoff/v4 v4.3.0 // indirect github.com/cenkalti/backoff/v5 v5.0.3 // indirect github.com/cespare/xxhash/v2 v2.3.0 // indirect github.com/chainguard-dev/clog v1.8.1 // indirect @@ -59,12 +90,15 @@ require ( github.com/docker/cli v29.7.2+incompatible // indirect github.com/docker/docker-credential-helpers v0.9.5 // indirect github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7 // indirect + github.com/dustin/go-humanize v1.0.1 // indirect github.com/emirpasic/gods v1.18.1 // indirect github.com/fatih/color v1.19.0 // indirect + github.com/felixge/httpsnoop v1.1.0 // indirect github.com/github/smimesign v0.2.0 // indirect + github.com/go-chi/chi/v5 v5.3.1 // indirect github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect github.com/go-git/go-billy/v5 v5.9.1 // indirect - github.com/go-jose/go-jose/v4 v4.1.4 // indirect + github.com/go-jose/go-jose/v4 v4.1.5 // indirect github.com/go-logr/logr v1.4.4 // indirect github.com/go-logr/stdr v1.2.2 // indirect github.com/go-openapi/analysis v0.26.0 // indirect @@ -89,24 +123,45 @@ require ( github.com/go-viper/mapstructure/v2 v2.5.0 // indirect github.com/goccy/go-json v0.10.6 // indirect github.com/gogo/protobuf v1.3.2 // indirect + github.com/golang-jwt/jwt/v5 v5.3.1 // indirect github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect + github.com/golang/snappy v1.0.0 // indirect github.com/google/certificate-transparency-go v1.3.3 // indirect github.com/google/go-cmp v0.7.0 // indirect - github.com/google/go-containerregistry v0.22.0 // indirect + github.com/google/go-containerregistry v0.22.1 // indirect + github.com/google/s2a-go v0.1.9 // indirect + github.com/google/trillian v1.7.3 // indirect github.com/google/uuid v1.6.0 // indirect + github.com/googleapis/enterprise-certificate-proxy v0.3.18 // indirect + github.com/googleapis/gax-go/v2 v2.23.0 // indirect + github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.3 // indirect github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 // indirect + github.com/hashicorp/errwrap v1.1.0 // indirect github.com/hashicorp/go-cleanhttp v0.5.2 // indirect + github.com/hashicorp/go-multierror v1.1.1 // indirect github.com/hashicorp/go-retryablehttp v0.7.8 // indirect + github.com/hashicorp/go-rootcerts v1.0.2 // indirect + github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0 // indirect + github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect + github.com/hashicorp/go-sockaddr v1.0.7 // indirect + github.com/hashicorp/hcl v1.0.1-vault-7 // indirect + github.com/hashicorp/vault/api v1.23.0 // indirect github.com/in-toto/in-toto-golang v0.11.0 // indirect github.com/inconshreveable/mousetrap v1.1.0 // indirect github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect github.com/jedisct1/go-minisign v0.0.0-20260527172527-a09352b57a22 // indirect + github.com/jellydator/ttlcache/v3 v3.4.1 // indirect github.com/kevinburke/ssh_config v1.6.0 // indirect github.com/klauspost/compress v1.19.2 // indirect github.com/klauspost/cpuid/v2 v2.3.0 // indirect + github.com/kylelemons/godebug v1.1.0 // indirect github.com/mattn/go-colorable v0.1.15 // indirect github.com/mattn/go-isatty v0.0.22 // indirect github.com/mattn/go-runewidth v0.0.24 // indirect + github.com/mitchellh/go-homedir v1.1.0 // indirect + github.com/mitchellh/mapstructure v1.5.1-0.20231216201459-8508981c8b6c // indirect + github.com/moby/term v0.5.2 // indirect + github.com/natefinch/atomic v1.0.1 // indirect github.com/nozzle/throttler v0.0.0-20180817012639-2ea982251481 // indirect github.com/oklog/ulid/v2 v2.1.2 // indirect github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6 // indirect @@ -115,39 +170,55 @@ require ( github.com/olekukonko/tablewriter v1.1.4 // indirect github.com/opencontainers/go-digest v1.0.0 // indirect github.com/opencontainers/image-spec v1.1.1 // indirect - github.com/openvex/go-vex v0.2.8 // indirect + github.com/openvex/go-vex v0.2.9 // indirect github.com/ossf/osv-schema/bindings/go v0.0.0-20260730052020-9509daabeece // indirect github.com/package-url/packageurl-go v0.1.7 // indirect github.com/pjbgf/sha1cd v0.6.0 // indirect github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect github.com/pkg/errors v0.9.1 // indirect - github.com/protobom/protobom v0.6.0 // indirect - github.com/regclient/regclient v0.11.5 // indirect + github.com/protobom/protobom v0.6.1 // indirect + github.com/regclient/regclient v0.11.6 // indirect github.com/rivo/uniseg v0.4.7 // indirect + github.com/ryanuber/go-glob v1.0.0 // indirect github.com/sassoftware/relic/v8 v8.2.0 // indirect - github.com/secure-systems-lab/go-securesystemslib v0.11.0 // indirect + github.com/secure-systems-lab/go-securesystemslib v0.11.1 // indirect github.com/sergi/go-diff v1.4.0 // indirect github.com/shibumi/go-pathspec v1.3.0 // indirect - github.com/sigstore/gitsign v0.16.0 // indirect + github.com/sigstore/cosign/v3 v3.1.2 // indirect + github.com/sigstore/gitsign v0.17.1 // indirect github.com/sigstore/rekor v1.5.4 // indirect github.com/sigstore/rekor-tiles/v2 v2.3.0 // indirect github.com/sigstore/sigstore v1.10.9 // indirect + github.com/sigstore/sigstore/pkg/signature/kms/aws v1.10.9 // indirect + github.com/sigstore/sigstore/pkg/signature/kms/azure v1.10.9 // indirect + github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.10.9 // indirect + github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.10.9 // indirect github.com/sigstore/timestamp-authority/v2 v2.1.3 // indirect github.com/skeema/knownhosts v1.3.2 // indirect github.com/spdx/tools-golang v0.5.7 // indirect github.com/spf13/pflag v1.0.10 // indirect github.com/spiffe/go-spiffe/v2 v2.8.1 // indirect + github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d // indirect github.com/theupdateframework/go-tuf v0.7.0 // indirect github.com/theupdateframework/go-tuf/v2 v2.4.2 // indirect + github.com/tink-crypto/tink-go-awskms/v3 v3.0.0 // indirect + github.com/tink-crypto/tink-go-gcpkms/v2 v2.4.0 // indirect + github.com/tink-crypto/tink-go/v2 v2.8.0 // indirect github.com/transparency-dev/formats v0.1.1 // indirect github.com/transparency-dev/merkle v0.0.2 // indirect - github.com/ulikunitz/xz v0.5.15 // indirect + github.com/ulikunitz/xz v0.5.16 // indirect github.com/xanzy/ssh-agent v0.3.3 // indirect github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect + go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.70.0 // indirect + go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0 // indirect go.opentelemetry.io/otel v1.45.0 // indirect go.opentelemetry.io/otel/metric v1.45.0 // indirect go.opentelemetry.io/otel/trace v1.45.0 // indirect + go.step.sm/crypto v0.87.0 // indirect + go.uber.org/multierr v1.11.0 // indirect + go.uber.org/zap v1.28.0 // indirect + go.yaml.in/yaml/v2 v2.4.4 // indirect go.yaml.in/yaml/v3 v3.0.5 // indirect golang.org/x/crypto v0.55.0 // indirect golang.org/x/mod v0.39.0 // indirect @@ -157,9 +228,13 @@ require ( golang.org/x/sys v0.47.0 // indirect golang.org/x/term v0.45.0 // indirect golang.org/x/text v0.41.0 // indirect - google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d // indirect - google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d // indirect - google.golang.org/grpc v1.83.0 // indirect + golang.org/x/time v0.15.0 // indirect + google.golang.org/api v0.290.0 // indirect + google.golang.org/genproto v0.0.0-20260622175928-b703f567277d // indirect + google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688 // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 // indirect + google.golang.org/grpc v1.83.2 // indirect gopkg.in/warnings.v0 v0.1.2 // indirect k8s.io/klog/v2 v2.140.0 // indirect + sigs.k8s.io/yaml v1.6.0 // indirect ) diff --git a/go.sum b/go.sum index 2b3389c..0f2fdd1 100644 --- a/go.sum +++ b/go.sum @@ -1,5 +1,5 @@ -buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.11-20260415201107-50325440f8f2.1 h1:s6hzCXtND/ICdGPTMGk7C+/BFlr2Jg5GyH0NKf4XGXg= -buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.11-20260415201107-50325440f8f2.1/go.mod h1:tvtbpgaVXZX4g6Pn+AnzFycuRK3MOz5HJfEGeEllXYM= +buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.12-20260825204119-511051f7f437.2 h1:NbnlmV26O7oZ1iM5tsCI+GEx+3ZSdrhvnKQ/eWSrLiY= +buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.12-20260825204119-511051f7f437.2/go.mod h1:TCt1lluMFnctISJXvkIQ4x3ABrPuUKCWKyjKdkJNBpw= cloud.google.com/go v0.123.0 h1:2NAUJwPR47q+E35uaJeYoNhuNEM9kM8SjgRgdeOJUSE= cloud.google.com/go v0.123.0/go.mod h1:xBoMV08QcqUGuPW65Qfm1o9Y4zKZBpGS+7bImXLTAZU= cloud.google.com/go/auth v0.20.0 h1:kXTssoVb4azsVDoUiF8KvxAqrsQcQtB53DcSgta74CA= @@ -27,16 +27,22 @@ github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0 h1:aokoqcHvaGjiM3VpjKDfMMnF github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0/go.mod h1:/WYEx9pcM9Y+Dd/APJaNlSvVSvzl54rrMdZT5+Oi2LM= github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0 h1:CU4+EJeJi3TKYWEcYuSdWsjzw0nVsK/H0MSQOiPcymU= github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0/go.mod h1:q0+UTSRvShwUCrR/s5HtyInYphN7Wvxb7snFM3u+SLA= +github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.4.0 h1:xFaZZ+IubdftrDHnGGwZ6QvQ3KHTtWl2MCK+GMt2vxs= +github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.4.0/go.mod h1:mCBhUhlMjLLJKr5aqw2TNS/VqJOie8MzWq3DAMJeKso= github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0 h1:fhqpLE3UEXi9lPaBRpQ6XuRW0nU7hgg4zlmZZa+a9q4= github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0/go.mod h1:7dCRMLwisfRH3dBupKeNCioWYUZ4SS09Z14H+7i8ZoY= github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.5.0 h1:MaKvxE6D0KkjOg6Wd9M00iqP5PR0kUxCfiezes4JweM= github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.5.0/go.mod h1:i2h9fsTFKZorh8RdV2IcSUf/Qj98GlTkrTvUbX/s8as= github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0 h1:nCYfgcSyHZXJI8J0IWE5MsCGlb2xp9fJiXyxWgmOFg4= github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0/go.mod h1:ucUjca2JtSZboY8IoUqyQyuuXvwbMBVwFOm0vdQPNhA= +github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c h1:udKWzYgxTojEKWjV8V+WSxDXJ4NFATAsZjh8iIbsQIg= +github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E= +github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1 h1:WJTmL004Abzc5wDB5VtZG2PJk5ndYDgVacGqfirKxjM= +github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1/go.mod h1:tCcJZ0uHAmvjsVYzEFivsRTN00oz5BEsRgQHu5JZ9WE= github.com/AzureAD/microsoft-authentication-library-for-go v1.7.2 h1:RHK7bS+HQMslb1sZpAokUt+zTVmue0hKSs2C791hhzU= github.com/AzureAD/microsoft-authentication-library-for-go v1.7.2/go.mod h1:HKpQxkWaGLJ+D/5H8QRpyQXA1eKjxkFlOMwck5+33Jk= -github.com/CycloneDX/cyclonedx-go v0.11.0 h1:GokP8FiRC+foiuwWhSSLpSD5H4hSWtGnR3wo7apkBFI= -github.com/CycloneDX/cyclonedx-go v0.11.0/go.mod h1:vUvbCXQsEm48OI6oOlanxstwNByXjCZ2wuleUlwGEO8= +github.com/CycloneDX/cyclonedx-go v0.12.0 h1:/7Jum36UA6V043tQZ/fE3jf+Nf9gn/qxUFfd7QReMy8= +github.com/CycloneDX/cyclonedx-go v0.12.0/go.mod h1:V2577HhxDDCDLYfkm55WJrz16nHTfyQZwcWUBSG7Z28= github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY= github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY= github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU= @@ -86,10 +92,12 @@ github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ= github.com/bradleyjkemp/cupaloy/v2 v2.8.0 h1:any4BmKE+jGIaMpnU8YgH/I2LPiLBufr6oMMlVBbn9M= github.com/bradleyjkemp/cupaloy/v2 v2.8.0/go.mod h1:bm7JXdkRd4BHJk9HpwqAI8BoAY1lps46Enkdqw6aRX0= +github.com/c2sp/wycheproof v0.0.0-20260105152342-fca0d3ba9f12 h1:C34LW7dhWgjAaAOdNB8z2UCyJsXDjC6UTILljHuqOlI= +github.com/c2sp/wycheproof v0.0.0-20260105152342-fca0d3ba9f12/go.mod h1:U1QjrC6KepOmtVmJn3QsKOTd9HliGr/da5afPEhLRnk= github.com/carabiner-dev/attestation v0.2.1 h1:VhjV5YlO9TsW50Sr/Zd54bdbZhhDAqgxC3kB9z1I+3Q= github.com/carabiner-dev/attestation v0.2.1/go.mod h1:O84vF84RZG3pJO/6BYrPs718bZviHF5DKajP1HsrDpw= -github.com/carabiner-dev/collector v0.3.14 h1:6iGLcveyCd4Ep9PGdFoGP9jkcVO0bBIWLpQ1W2CDMeM= -github.com/carabiner-dev/collector v0.3.14/go.mod h1:IZvFW9Hn1/crw5g8RpT4hzcNrpqQ4C9qHXJtxTI/ViA= +github.com/carabiner-dev/collector v0.3.16 h1:Tatp4tK/xWDluFwDqGfPPcYd9crCWm/0Ma+XlDAZ2Xs= +github.com/carabiner-dev/collector v0.3.16/go.mod h1:G6neTqtRFOEjjOayE02bDWpLkcFB/gmbkfFteSliPcE= github.com/carabiner-dev/command v0.3.2 h1:lkmgr+Sj9OaPxKk2AHlitR76Mg+hqys6BK7071taywY= github.com/carabiner-dev/command v0.3.2/go.mod h1:ABHTlUZbUUq7LF1Xmlx01ZY8xMCv4eqleuVEO/LIifU= github.com/carabiner-dev/deadrop v0.0.0-20260228173914-d95e9ea2877d h1:Gl8o56PI73PE6YcDzUd49iJJBdp/ye/METanFm8gG64= @@ -106,18 +114,18 @@ github.com/carabiner-dev/openeox v1.0.0 h1:iVfs9jgu2s2Jrb95bJK5FWMx55qF3aHBk9RhU github.com/carabiner-dev/openeox v1.0.0/go.mod h1:+6i8M7PhtWk2jRtUC1anZnhmOr5cXKMLGYjwFcqPDa0= github.com/carabiner-dev/osv v0.1.2 h1:W5nZOGuygnqzB7YbGon6ab3iFHxFZZgzS3m7GEvYnfc= github.com/carabiner-dev/osv v0.1.2/go.mod h1:06cHx1aOdlb53feQxjBIRt3NSFfQKg1b1hrHHj/57QQ= -github.com/carabiner-dev/policy v0.5.1 h1:u6RN5mD+73NMHaRyg0CvsxwJRn+Qc+pNbS3SNxUdD00= -github.com/carabiner-dev/policy v0.5.1/go.mod h1:KmqdpxhKxKtlhCiFnBdb41uu8CBLCuNx6svbWnh+OCM= -github.com/carabiner-dev/predicates v0.5.0 h1:CG2xO5xTXWXakjJkAFuS2xSA2olP9Ew25k6CAyL8waI= -github.com/carabiner-dev/predicates v0.5.0/go.mod h1:EUm2p0CwKoUuc+OLbGkoxLdRqBrg/r957b8iN/ACWSA= +github.com/carabiner-dev/policy v0.5.5 h1:+UU9awmI77uL5tBhl44eKF3iPcU0/WGsnITOQNFxY5M= +github.com/carabiner-dev/policy v0.5.5/go.mod h1:JVGoDp9BRtW6meaZPNE9DbcHasDWjeN3Aei4qiHOlpo= +github.com/carabiner-dev/predicates v0.5.1 h1:eKWvGLMYmB+taCf2ozNc4QikOZIj1vNYfXKb2e8XCuM= +github.com/carabiner-dev/predicates v0.5.1/go.mod h1:kvGSWOl6OaUJ7b2FH0XDpTQ8ERcFXN6HzJx8ph90bWk= github.com/carabiner-dev/sbomfs v0.2.0 h1:7OG0Su6iz9sPWcAFzSsaauVZQpKayzrJvGWe0NoxbPw= github.com/carabiner-dev/sbomfs v0.2.0/go.mod h1:KaTNcHjm5qbu5G0RCc/7uo3U1KZj1IqRZLFiG+nwC8g= github.com/carabiner-dev/signer v0.6.2 h1:Tww40YP4RKjLSKdgT5nXVRiqd3Czjvkwd2WRDE7ecJ0= github.com/carabiner-dev/signer v0.6.2/go.mod h1:xIeR0GMK3Hp9gYsd7dGO9W8EwjftWBk3/+flEle6o0Y= github.com/carabiner-dev/spdx3 v0.1.0 h1:Q6nMLXV0BhtqDQuwRDOaJDZR670TK4jdOvZqvTW/ctY= github.com/carabiner-dev/spdx3 v0.1.0/go.mod h1:d/t010TrZvYZBeYGpvHeId6QpRvGLlqK7cy0E81npPA= -github.com/carabiner-dev/stash v0.0.0-20260716192412-e2fe293d76a5 h1:ZPlLrqZAZLf8iuJAReJjOTHM8gL3BeVpXtto5+KRDm0= -github.com/carabiner-dev/stash v0.0.0-20260716192412-e2fe293d76a5/go.mod h1:2RhCP3fDQ9TEuGBhxkd+gWDOlzQYkNSXvmjr8fxfAR4= +github.com/carabiner-dev/stash v0.0.0-20260908191435-d6225e020426 h1:OpWSJwPUe5cwDLRS52AIG5UlvEjnA3NClq+nQO74HZI= +github.com/carabiner-dev/stash v0.0.0-20260908191435-d6225e020426/go.mod h1:a3y+CMfB8JcwycV3dMGJ9sskLpamxzLFEW1cMJoaTc8= github.com/carabiner-dev/termtable v1.1.0 h1:b/7IqM52Wqwi9njjnAEIDddUYyX23msFkQVihkwarDs= github.com/carabiner-dev/termtable v1.1.0/go.mod h1:f2kBeZo0N9vQEMhfDfxv+DdXXy7eb9Wvu9u1sSyvR2A= github.com/carabiner-dev/vcslocator v0.5.0 h1:UpqilJXRJBgwzQHk0MsD03w+8/0GcyC1HbXxX0wZKcU= @@ -131,12 +139,17 @@ github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UF github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= github.com/chainguard-dev/clog v1.8.1 h1:Lab3GEDsVm1J9XGlpWEBuzXX7eETRmd0vN5PYoNyT+Y= github.com/chainguard-dev/clog v1.8.1/go.mod h1:5MQOZi+Iu7fV7GcJG8ag8rCB5elEOpqRMKEASgnGVdo= +github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI= +github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI= +github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU= github.com/clipperhouse/displaywidth v0.11.0 h1:lBc6kY44VFw+TDx4I8opi/EtL9m20WSEFgwIwO+UVM8= github.com/clipperhouse/displaywidth v0.11.0/go.mod h1:bkrFNkf81G8HyVqmKGxsPufD3JhNl3dSqnGhOoSD/o0= github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk= github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM= github.com/cloudflare/circl v1.6.5 h1:O64F26HEqNhznd/hrC5KZXVKYuKM2rx4deZDTc4ihQA= github.com/cloudflare/circl v1.6.5/go.mod h1:h5LNyxAc5nTue9DS5jT+48en2PSDYt3zdGnz5OstK6c= +github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2 h1:aBangftG7EVZoUb69Os8IaYg++6uMOdKK83QtkkvJik= +github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2/go.mod h1:qwXFYgsP6T7XnJtbKlf1HP8AjxZZyzxMmc+Lq5GjlU4= github.com/codahale/rfc6979 v0.0.0-20141003034818-6a90f24967eb h1:EDmT6Q9Zs+SbUoc7Ik9EfrFqcylYqgPZ9ANSbTAntnE= github.com/codahale/rfc6979 v0.0.0-20141003034818-6a90f24967eb/go.mod h1:ZjrT6AXHbDs86ZSdt/osfBi5qfexBrKUdONk989Wnk4= github.com/common-nighthawk/go-figure v0.0.0-20210622060536-734e95fb86be h1:J5BL2kskAlV9ckgEsNQXscjIaLiOYiZ75d4e94E6dcQ= @@ -144,6 +157,8 @@ github.com/common-nighthawk/go-figure v0.0.0-20210622060536-734e95fb86be/go.mod github.com/coreos/go-oidc/v3 v3.20.0 h1:EtE0WIBHk03N+DqGkY4+UONzzZHk7amKt6IyNd7OsZE= github.com/coreos/go-oidc/v3 v3.20.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26KVTCI9SrY4= github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g= +github.com/creack/pty v1.1.19 h1:tUN6H7LWqNx4hQVxomd0CVsDwaDr9gaRQaI4GpSmrsA= +github.com/creack/pty v1.1.19/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4= github.com/cyberphone/json-canonicalization v0.0.0-20241213102144-19d51d7fe467 h1:uX1JmpONuD549D73r6cgnxyUu18Zb7yHAy5AYU0Pm4Q= github.com/cyberphone/json-canonicalization v0.0.0-20241213102144-19d51d7fe467/go.mod h1:uzvlm1mxhHkdfqitSA92i7Se+S9ksOn3a3qmv/kyOCw= github.com/cyphar/filepath-securejoin v0.6.1 h1:5CeZ1jPXEiYt3+Z6zqprSAgSWiggmpVyciv8syjIpVE= @@ -165,14 +180,26 @@ github.com/docker/docker-credential-helpers v0.9.5 h1:EFNN8DHvaiK8zVqFA2DT6BjXE0 github.com/docker/docker-credential-helpers v0.9.5/go.mod h1:v1S+hepowrQXITkEfw6o4+BMbGot02wiKpzWhGUZK6c= github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7 h1:UhxFibDNY/bfvqU5CAUmr9zpesgbU6SWc8/B4mflAE4= github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7/go.mod h1:cyGadeNEkKy96OOhEzfZl+yxihPEzKnqJwvfuSUqbZE= +github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY= +github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto= github.com/elazarl/goproxy v1.7.2 h1:Y2o6urb7Eule09PjlhQRGNsqRfPmYI3KKQLFpCAV3+o= github.com/elazarl/goproxy v1.7.2/go.mod h1:82vkLNir0ALaW14Rc399OTTjyNREgmdL2cVoIbS6XaE= github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc= github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ= +github.com/envoyproxy/go-control-plane v0.14.0 h1:hbG2kr4RuFj222B6+7T83thSPqLjwBIfQawTkC++2HA= +github.com/envoyproxy/go-control-plane/envoy v1.37.0 h1:u3riX6BoYRfF4Dr7dwSOroNfdSbEPe9Yyl09/B6wBrQ= +github.com/envoyproxy/go-control-plane/envoy v1.37.0/go.mod h1:DReE9MMrmecPy+YvQOAOHNYMALuowAnbjjEMkkWOi6A= +github.com/envoyproxy/protoc-gen-validate v1.3.3 h1:MVQghNeW+LZcmXe7SY1V36Z+WFMDjpqGAGacLe2T0ds= +github.com/envoyproxy/protoc-gen-validate v1.3.3/go.mod h1:TsndJ/ngyIdQRhMcVVGDDHINPLWB7C82oDArY51KfB0= github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w= github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE= github.com/felixge/httpsnoop v1.1.0 h1:3YtUj32ZZkqZtt3sZZsClsymw/QDuVfpNhoA31zeORc= github.com/felixge/httpsnoop v1.1.0/go.mod h1:Zqxgdd+1Rkcz8euOqdr7lqgCRJztwr5hp9vDSi5UZCE= +github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo= +github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ= +github.com/fsnotify/fsnotify v1.5.4/go.mod h1:OVB6XrOHzAwXMpEM7uPOzcehqUV2UqJxmVXmkdnm1bU= +github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx59Ho= +github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo= github.com/github/smimesign v0.2.0 h1:Hho4YcX5N1I9XNqhq0fNx0Sts8MhLonHd+HRXVGNjvk= github.com/github/smimesign v0.2.0/go.mod h1:iZiiwNT4HbtGRVqCQu7uJPEZCuEE5sfSSttcnePkDl4= github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c= @@ -187,8 +214,8 @@ github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMj github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII= github.com/go-git/go-git/v5 v5.19.2 h1:wkfn7vOlUBu8ivAWKBWisTiwJK4jYHzTF8Ndv1LyGqY= github.com/go-git/go-git/v5 v5.19.2/go.mod h1:QqCBE1EFN5ddFmrliLQ3/ntRCUjZU3EJuwuB/jWEHjk= -github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA= -github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08= +github.com/go-jose/go-jose/v4 v4.1.5 h1:RjgjO2LOtWOJKUC5wpwY9LR3B3vwVAz6JS2YHfYU6eA= +github.com/go-jose/go-jose/v4 v4.1.5/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08= github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8= github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= @@ -241,6 +268,9 @@ github.com/go-openapi/validate v0.26.3 h1:OkfZgLvLDnGP2hrRGD+42WBiPWWkoHomTJ+IVI github.com/go-openapi/validate v0.26.3/go.mod h1:7DOOa4raU6NRe7A8VQSKbm3VcuUIioREYHFt+er9Sk8= github.com/go-rod/rod v0.116.2 h1:A5t2Ky2A+5eD/ZJQr1EfsQSe5rms5Xof/qj296e+ZqA= github.com/go-rod/rod v0.116.2/go.mod h1:H+CMO9SCNc2TJ2WfrG+pKhITz57uGNYU43qYHh438Mg= +github.com/go-sql-driver/mysql v1.10.0 h1:Q+1LV8DkHJvSYAdR83XzuhDaTykuDx0l6fkXxoWCWfw= +github.com/go-sql-driver/mysql v1.10.0/go.mod h1:M+cqaI7+xxXGG9swrdeUIoPG3Y3KCkF0pZej+SK+nWk= +github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE= github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U= github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE= github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro= @@ -257,16 +287,35 @@ github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63Y github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE= github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 h1:f+oWsMOmNPc8JmEHVZIycC7hBoQxHH9pNKQORJNozsQ= github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8/go.mod h1:wcDNUvekVysuuOpQKo3191zZyTpiI6se1N1ULghS0sw= +github.com/golang/mock v1.7.0-rc.1 h1:YojYx61/OLFsiv6Rw1Z96LpldJIy31o+UHmwAUMJ6/U= +github.com/golang/mock v1.7.0-rc.1/go.mod h1:s42URUywIqd+OcERslBJvOjepvNymP31m3q8d/GkuRs= +github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= +github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8= +github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA= +github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs= +github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w= +github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0= +github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI= +github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk= +github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY= github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek= github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps= +github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q= +github.com/golang/snappy v1.0.0 h1:Oy607GVXHs7RtbggtPBnr2RmDArIsAefDwvrdWvRhGs= +github.com/golang/snappy v1.0.0/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q= github.com/google/certificate-transparency-go v1.3.3 h1:hq/rSxztSkXN2tx/3jQqF6Xc0O565UQPdHrOWvZwybo= github.com/google/certificate-transparency-go v1.3.3/go.mod h1:iR17ZgSaXRzSa5qvjFl8TnVD5h8ky2JMVio+dzoKMgA= +github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU= +github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU= +github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= +github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= -github.com/google/go-containerregistry v0.22.0 h1:eGbCiPeYxAH/7WLLq6zTBALP0tUIFsoyRauhxXDJ53I= -github.com/google/go-containerregistry v0.22.0/go.mod h1:bJR35SK8XgisYmhg/FMQ/5RK0S/XrOAqLBV5/LR2XE0= +github.com/google/go-containerregistry v0.22.1 h1:RZuuSYhTvlDvtsK+NkutoCZ//C0X2ebLK8X8l3ULs84= +github.com/google/go-containerregistry v0.22.1/go.mod h1:bJR35SK8XgisYmhg/FMQ/5RK0S/XrOAqLBV5/LR2XE0= github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0= github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= +github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE= github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0= github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM= github.com/google/trillian v1.7.3 h1:hziW+vo4czis48tzx2GK5xRBl/ZxBA9B0/UR5avXOro= @@ -277,11 +326,11 @@ github.com/googleapis/enterprise-certificate-proxy v0.3.18 h1:hvVi34VucdrV1IIsiW github.com/googleapis/enterprise-certificate-proxy v0.3.18/go.mod h1:rSEsBUemEBZEexP2y6jPp16LUmUbjmSbcPMQizR0o4k= github.com/googleapis/gax-go/v2 v2.23.0 h1:Tchl7qkvE7Ip3y+ztvNufYFvkfqTe7NfLTYGIdJRLuE= github.com/googleapis/gax-go/v2 v2.23.0/go.mod h1:rBQKOVJCdb8IFEzg+FCwlt1LP/xMDGuqUXhUG+XMXEg= -github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 h1:UH//fgunKIs4JdUbpDl1VZCDaL56wXCB/5+wF6uHfaI= github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.3 h1:B+8ClL/kCQkRiU82d9xajRPKYMrB7E0MbtzWVi1K4ns= github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.3/go.mod h1:NbCUVmiS4foBGBHOYlCT25+YmGpJ32dZPi75pGEUpj4= github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 h1:/Tnpcb2E0Pz/tN9s3bfEY2Q8ePCEX9iuS+cneUwncnw= github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0/go.mod h1:zOBXOsUaBSjKgmH4OGzV1esUpR3oUSCPYVd2cUBjKYY= +github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4= github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I= github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4= github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ= @@ -306,6 +355,8 @@ github.com/hashicorp/vault/api v1.23.0 h1:gXgluBsSECfRWTSW9niY2jwg2e9mMJc4WoHNv4 github.com/hashicorp/vault/api v1.23.0/go.mod h1:zransKiB9ftp+kgY8ydjnvCU7Wk8i9L0DYWpXeMj9ko= github.com/howeyc/gopass v0.0.0-20210920133722-c8aef6fb66ef h1:A9HsByNhogrvm9cWb28sjiS3i7tcKCkflWFEkHfuAgM= github.com/howeyc/gopass v0.0.0-20210920133722-c8aef6fb66ef/go.mod h1:lADxMC39cJJqL93Duh1xhAs4I2Zs8mKS89XWXFGp9cs= +github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU= +github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc= github.com/in-toto/attestation v1.2.0 h1:aPRUZ3azbqD7yEBD5fP3TD8Dszf+YHo284SOcpahjQk= github.com/in-toto/attestation v1.2.0/go.mod h1:r79G45gOmzPismgObLSL+rZTFxUgZLOQJI6LofTZgXk= github.com/in-toto/in-toto-golang v0.11.0 h1:nfidMYBFx+E0lnmX5KUnN2Pdm8zdNKal1ayjJuzzRoA= @@ -320,6 +371,8 @@ github.com/jellydator/ttlcache/v3 v3.4.1 h1:bOdXmXiycyK6E6Qjyuj5vl+/vU3SCOoDs8a8 github.com/jellydator/ttlcache/v3 v3.4.1/go.mod h1:j7LO12PNghFg5+0v9budMAT4rDK4JY969jb9vOdOBBk= github.com/kevinburke/ssh_config v1.6.0 h1:J1FBfmuVosPHf5GRdltRLhPJtJpTlMdKTBjRgTaQBFY= github.com/kevinburke/ssh_config v1.6.0/go.mod h1:q2RIzfka+BXARoNexmF9gkxEX7DmvbW9P4hIVx2Kg4M= +github.com/keybase/go-keychain v0.0.1 h1:way+bWYa6lDppZoZcgMbYsvC7GxljxrskdNInRtuthU= +github.com/keybase/go-keychain v0.0.1/go.mod h1:PdEILRW3i9D8JcdM+FmY6RwkHGnhHxXwkPPMeUgOK1k= github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= github.com/klauspost/compress v1.19.2 h1:hMRETovs/pu/dVWN7zIT1PGG8t509MwT6bO7XSi26R8= @@ -335,6 +388,8 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc= github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw= +github.com/lib/pq v1.12.0 h1:mC1zeiNamwKBecjHarAr26c/+d8V5w/u4J0I/yASbJo= +github.com/lib/pq v1.12.0/go.mod h1:/p+8NSbOcwzAEI7wiMXFlgydTwcgTr3OSKMsD2BitpA= github.com/mattn/go-colorable v0.1.15 h1:+u9SLTRGnXv73cEsnsmoZBom+dMU88B2M0aDcWy0/jY= github.com/mattn/go-colorable v0.1.15/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8= github.com/mattn/go-isatty v0.0.22 h1:j8l17JJ9i6VGPUFUYoTUKPSgKe/83EYU2zBC7YNKMw4= @@ -345,10 +400,16 @@ github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0= github.com/mitchellh/mapstructure v1.5.1-0.20231216201459-8508981c8b6c h1:cqn374mizHuIWj+OSJCajGr/phAmuMug9qIX3l9CflE= github.com/mitchellh/mapstructure v1.5.1-0.20231216201459-8508981c8b6c/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo= +github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ= +github.com/moby/term v0.5.2/go.mod h1:d3djjFCrjnB+fl8NJux+EJzu0msscUP+f8it8hPkFLc= github.com/natefinch/atomic v1.0.1 h1:ZPYKxkqQOx3KZ+RsbnP/YsgvxWQPGxjC0oBt2AhwV0A= github.com/natefinch/atomic v1.0.1/go.mod h1:N/D/ELrljoqDyT3rZrsUmtsuzvHkeB/wWjHV22AZRbM= github.com/nozzle/throttler v0.0.0-20180817012639-2ea982251481 h1:Up6+btDp321ZG5/zdSLo48H9Iaq0UQGthrhWC6pCxzE= github.com/nozzle/throttler v0.0.0-20180817012639-2ea982251481/go.mod h1:yKZQO8QE2bHlgozqWDiRVqTFlLQSj30K/6SAK8EeYFw= +github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A= +github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU= +github.com/nxadm/tail v1.4.11 h1:8feyoE3OzPrcshW5/MJ4sGESc5cqmGkGCWlco4l0bqY= +github.com/nxadm/tail v1.4.11/go.mod h1:OTaG3NK980DZzxbRq6lEuzgU+mug70nY11sMd4JXXHc= github.com/oklog/ulid/v2 v2.1.2 h1:IEclFb9JNvzYA6MW2SCxbLzcHTVsfqm3PrqGQJH5zec= github.com/oklog/ulid/v2 v2.1.2/go.mod h1:rcEKHmBBKfef9DhnvX7y1HZBYxjXb0cP5ExxNsTT1QQ= github.com/olareg/olareg v0.2.2 h1:H29V0+V2bIW4nRF3B1QAvooXts5eYS9dmQsD/chrBf0= @@ -361,14 +422,24 @@ github.com/olekukonko/ll v0.1.8 h1:ysHCJRGHYKzmBSdz9w5AySztx7lG8SQY+naTGYUbsz8= github.com/olekukonko/ll v0.1.8/go.mod h1:RPRC6UcscfFZgjo1nulkfMH5IM0QAYim0LfnMvUuozw= github.com/olekukonko/tablewriter v1.1.4 h1:ORUMI3dXbMnRlRggJX3+q7OzQFDdvgbN9nVWj1drm6I= github.com/olekukonko/tablewriter v1.1.4/go.mod h1:+kedxuyTtgoZLwif3P1Em4hARJs+mVnzKxmsCL/C5RY= +github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE= +github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk= +github.com/onsi/ginkgo v1.16.4/go.mod h1:dX+/inL/fNMqNlz0e9LfyB9TswhZpCVdJM/Z6Vvnwo0= +github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE= +github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU= +github.com/onsi/ginkgo/v2 v2.1.3/go.mod h1:vw5CSIxN1JObi/U8gcbwft7ZxR2dgaR70JSE3/PpL4c= +github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY= +github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo= +github.com/onsi/gomega v1.17.0/go.mod h1:HnhC7FXeEQY45zxNK3PPoIUhzk/80Xly9PcubAlGdZY= +github.com/onsi/gomega v1.19.0/go.mod h1:LY+I3pBVzYsTBU1AnDwOSxaYi9WoWiqgwooUqq9yPro= github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28= github.com/onsi/gomega v1.39.1/go.mod h1:hL6yVALoTOxeWudERyfppUcZXjMwIMLnuSfruD2lcfg= github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U= github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM= github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040= github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M= -github.com/openvex/go-vex v0.2.8 h1:m/iH6+0fc7QXwfx7vJ0UeT8Z1oN1zVcyHjcVK+UO11Y= -github.com/openvex/go-vex v0.2.8/go.mod h1:V09jOICYN/3VS4oU2hthSN8wGI6UAv3FvvYbpYS1xCE= +github.com/openvex/go-vex v0.2.9 h1:InBYPjk5FQtDjnSQ12RUyQcnMlDO5QAg4QK848LIFm8= +github.com/openvex/go-vex v0.2.9/go.mod h1:K7NfMaPzwZHZjg5xBvDzl4Wul4ojoNN4ICR5s4xbNHw= github.com/ossf/osv-schema/bindings/go v0.0.0-20260730052020-9509daabeece h1:PSGyVVj2mqBaGj9sa/8yv/XNni3JCPZC4xAVdnwww2M= github.com/ossf/osv-schema/bindings/go v0.0.0-20260730052020-9509daabeece/go.mod h1:IrUa4QzZUi03J3WXDzZYXVawYipHownNfqqZrqeGXfg= github.com/package-url/packageurl-go v0.1.7 h1:iFWg6tzAjLA6F/qX3M5nZaiMHJgc+p2zxVyr/fY+sZY= @@ -382,13 +453,15 @@ github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjL github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= +github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 h1:GFCKgmp0tecUJ0sJuv4pzYCqS9+RGSn52M3FUwPs+uo= +github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U= github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= -github.com/protobom/protobom v0.6.0 h1:0PpSy4O6Tc0Fc9aoMiDaG9KBFFXQ8J53ru+X3XdjScg= -github.com/protobom/protobom v0.6.0/go.mod h1:PyjBMH46jqt8qZnupipYG4xgkDjlH2aRdYoZ5wUxeRY= -github.com/regclient/regclient v0.11.5 h1:OHRsXO0F3qHGfa4HEUv+EkMH9NXNcCTBKjNzyC/UhIA= -github.com/regclient/regclient v0.11.5/go.mod h1:DZUOfIT14WFTK2Pj4vjd93avy9O4Fdpjrf9ir23TbRE= +github.com/protobom/protobom v0.6.1 h1:UyyhZ1d87K80NRPMrr3y4ki5iLS/iu7fRwYuFeZ8eyU= +github.com/protobom/protobom v0.6.1/go.mod h1:mgzA5aVpUs4S5Ac2Y0+8dLkbhaeYddxtVF+P+fZZ1Pg= +github.com/regclient/regclient v0.11.6 h1:IUcd3slMqo1CaLQ3JcE0W039gUv7uYZpY5FsyAYowXA= +github.com/regclient/regclient v0.11.6/go.mod h1:c20PYhof9UIPpWS6TgZq/qPt3vCdaU1TCbqauZ39iF0= github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= @@ -400,14 +473,16 @@ github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 h1:lZUw3E0/J3roVtGQ+SCrUrg3ON6Ng github.com/santhosh-tekuri/jsonschema/v5 v5.3.1/go.mod h1:uToXkOrWAZ6/Oc07xWQrPOhJotwFIyu2bBVN41fcDUY= github.com/sassoftware/relic/v8 v8.2.0 h1:9/L4S4I6an/JsPNhmcTpqfiOIsLb/iJaePZD1xR+ulE= github.com/sassoftware/relic/v8 v8.2.0/go.mod h1:pZy7hLT9WCOKPonV8G/fplvtBLOZd6/kWtKqeHR6nKc= -github.com/secure-systems-lab/go-securesystemslib v0.11.0 h1:iuCR9kcMFD4QurdKrGvPLoKZLv9YvwPYVr0473BdtFs= -github.com/secure-systems-lab/go-securesystemslib v0.11.0/go.mod h1:+PMOTjUGwHj2vcZ+TFKlb1tXRbrdWE1LYDT5i9JC80Q= +github.com/secure-systems-lab/go-securesystemslib v0.11.1 h1:ayahDPjfSIqKegyt5YVGEvQ7SAi72GHXTy+b2YjUd5w= +github.com/secure-systems-lab/go-securesystemslib v0.11.1/go.mod h1:UyOjhoZLi76ir63u1ptubEevVe6dlNPmNxwgVvKqFFY= github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw= github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4= github.com/shibumi/go-pathspec v1.3.0 h1:QUyMZhFo0Md5B8zV8x2tesohbb5kfbpTi9rBnKh5dkI= github.com/shibumi/go-pathspec v1.3.0/go.mod h1:Xutfslp817l2I1cZvgcfeMQJG5QnU2lh5tVaaMCl3jE= -github.com/sigstore/gitsign v0.16.0 h1:TapySQRakT+wZ/k73GrNz2cTltAf85KoFnW9vv4hgGQ= -github.com/sigstore/gitsign v0.16.0/go.mod h1:wuO13bQ/dyACiCRhxhDTH6mxykF5nLfWFXEKk6Egd2M= +github.com/sigstore/cosign/v3 v3.1.2 h1:AlWkztipzFHLGfLECkUwcC2a2EbpzKOsElge1vcRNcs= +github.com/sigstore/cosign/v3 v3.1.2/go.mod h1:BuXM5YXK96YuSih+9h1aMDgwdJDaZO9/8ZaPo/mUcr4= +github.com/sigstore/gitsign v0.17.1 h1:36xBG3tFHuJWzAtsm+CCy7zJac5RKr6hBZfGiT2V0Y4= +github.com/sigstore/gitsign v0.17.1/go.mod h1:YF2EGXv4hSRX+8Xf/E2B9LhNCWYE4T7LhRZOmcSKXZU= github.com/sigstore/protobuf-specs v0.5.2 h1:RSWWUY8QrVTxbYH00jY/jg2e7YnjzrpwP+PeHTMll0E= github.com/sigstore/protobuf-specs v0.5.2/go.mod h1:DRBzpFuE+LnvQMN10/dU6nBeKwVLGEQ6o2FovN2Rats= github.com/sigstore/rekor v1.5.4 h1:A9zITTrkRwO+8lfq7L/gBR7rDHHcBQJRI+a0JQo4xDM= @@ -446,12 +521,16 @@ github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+ github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs= github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4= +github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA= +github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals= github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= github.com/sudo-bmitch/oci-digest v0.1.2 h1:are0qzWTsFZGZ3Uvdi9OSztJszSWaab6iqquMEEB7rw= github.com/sudo-bmitch/oci-digest v0.1.2/go.mod h1:SH6l5OIe0islKBZBedjiPOeET/0QwGL+/oYfQt51uQo= -github.com/terminalstatic/go-xsd-validate v0.1.6 h1:TenYeQ3eY631qNi1/cTmLH/s2slHPRKTTHT+XSHkepo= -github.com/terminalstatic/go-xsd-validate v0.1.6/go.mod h1:18lsvYFofBflqCrvo1umpABZ99+GneNTw2kEEc8UPJw= +github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d h1:vfofYNRScrDdvS342BElfbETmL1Aiz3i2t0zfRj16Hs= +github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d/go.mod h1:RRCYJbIwD5jmqPI9XoAFR0OcDxqUctll6zUj/+B4S48= +github.com/terminalstatic/go-xsd-validate v0.1.8 h1:UVrTCy1j3DhwaYTTUF+QYO/Nan13S0tf+Jwi+p45Bf0= +github.com/terminalstatic/go-xsd-validate v0.1.8/go.mod h1:1kb47fi2c6onlf+B7UrrQ9VYraOhcYwFm3iG+J6F4Zo= github.com/theupdateframework/go-tuf v0.7.0 h1:CqbQFrWo1ae3/I0UCblSbczevCCbS31Qvs5LdxRWqRI= github.com/theupdateframework/go-tuf v0.7.0/go.mod h1:uEB7WSY+7ZIugK6R1hiBMBjQftaFzn7ZCDJcp1tCUug= github.com/theupdateframework/go-tuf/v2 v2.4.2 h1:w7976/W8uTwlsegP5nRymlpjPgrwSh+AXUf85is6nJk= @@ -462,14 +541,14 @@ github.com/tink-crypto/tink-go-gcpkms/v2 v2.4.0 h1:xpI5pnEQ0erFCS3JmcEl7Blluo8Zi github.com/tink-crypto/tink-go-gcpkms/v2 v2.4.0/go.mod h1:wDDAhjfd1t4TjeJCSsmFK7CARPUs/ITi16ZZ8kmAaFQ= github.com/tink-crypto/tink-go-hcvault/v2 v2.5.0 h1:eXuNqgrcYelxU1MVikOJDP3wTS5lvihM4ntoAbAMfvs= github.com/tink-crypto/tink-go-hcvault/v2 v2.5.0/go.mod h1:3RhcxAqek6xUlRFmJifvU4CYLZN60KMQdIKqpZAZJG0= -github.com/tink-crypto/tink-go/v2 v2.7.0 h1:k7QnUXJ1cRDpvoy/5l1FimZqMAArRff8vjUqzi5N04o= -github.com/tink-crypto/tink-go/v2 v2.7.0/go.mod h1:cWNpQ/yAT/QHzAV0kBGMOSJzzYTKofDZdJaUqOPPWCI= +github.com/tink-crypto/tink-go/v2 v2.8.0 h1:1zODq1bZDqOQdNPjhvwGYLDw9On7mDWPnQf+4xXlpAc= +github.com/tink-crypto/tink-go/v2 v2.8.0/go.mod h1:aNXZeyxjQU9iqAeARRNmbESXUW6Mao1HRCCTY8B1TFM= github.com/transparency-dev/formats v0.1.1 h1:4bVHJc+KdBgpA1OJD1yjI+g0i5Z1graCppTMH8lWKJI= github.com/transparency-dev/formats v0.1.1/go.mod h1:qtZ8goRuJ8FTBG9c9+Bj0rn2rUG7eG/AUTkr+Aw3jFw= github.com/transparency-dev/merkle v0.0.2 h1:Q9nBoQcZcgPamMkGn7ghV8XiTZ/kRxn1yCG81+twTK4= github.com/transparency-dev/merkle v0.0.2/go.mod h1:pqSy+OXefQ1EDUVmAJ8MUhHB9TXGuzVAT58PqBoHz1A= -github.com/ulikunitz/xz v0.5.15 h1:9DNdB5s+SgV3bQ2ApL10xRc35ck0DuIX/isZvIk+ubY= -github.com/ulikunitz/xz v0.5.15/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14= +github.com/ulikunitz/xz v0.5.16 h1:ld6NyySjx5lowVKwJvMRLnW5nxKX/xnpSiFYZ/Lxur0= +github.com/ulikunitz/xz v0.5.16/go.mod h1:H9Rt/W6/Qj27PGauhQc6nfCDy7vHpzsOThBSaYDoEhw= github.com/xanzy/ssh-agent v0.3.3 h1:+/15pJfg/RsTxqYcX6fHqOXZwwMP+2VyYWJeWM2qQFM= github.com/xanzy/ssh-agent v0.3.3/go.mod h1:6dzNDKs0J9rVPHPhaGCukekBHKqfl+L3KghI1Bc68Uw= github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb h1:zGWFAtiMcyryUHoUjUJX0/lt1H2+i2Ka2n+D3DImSNo= @@ -506,8 +585,8 @@ go.opentelemetry.io/otel/metric v1.45.0 h1:7Eg1uH7CJ5cXv9is6tnBe1FI6rj1nwUdbFypR go.opentelemetry.io/otel/metric v1.45.0/go.mod h1:HAPbm1nd3p1PmFH7v2dR+6BjXxw+Lq4a2+pndMAm08s= go.opentelemetry.io/otel/sdk v1.45.0 h1:4VVSMgQ83dUgW2aoX5f6JgLvHwIvzcuLnF9lUdCSpCw= go.opentelemetry.io/otel/sdk v1.45.0/go.mod h1:Sr40LgXV7DsKMMJMKOhUWOgMWTfAaqvm2kF0g7ilwuA= -go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI= -go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA= +go.opentelemetry.io/otel/sdk/metric v1.45.0 h1:oVFszMfyj1Am6s24Vtc7wBb8BKLcwepJjNEYILuiE3o= +go.opentelemetry.io/otel/sdk/metric v1.45.0/go.mod h1:vUWUxDZvu1WVRj8JA8S0AdhsPrZoDpA2DdZauIh4mDA= go.opentelemetry.io/otel/trace v1.45.0 h1:l/mP6Uv7oNO7/TblbhpbgMidxhq1uO/rPsikOyVhxag= go.opentelemetry.io/otel/trace v1.45.0/go.mod h1:qoJJA2xNMnxRrdISU/kLtfUH2wNeQbiv+jhs/CxI8bc= go.step.sm/crypto v0.87.0 h1:+u0pDz1OV9M/SswA6KtcQ3GSrYMMelbL//0W/ceJVYI= @@ -534,38 +613,57 @@ golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.39.0 h1:UF5zwQdCRRUpHfyPwr7d4UrGiVeldIsogtzWVnczL74= golang.org/x/mod v0.39.0/go.mod h1:bvIbwjQ0HUFFf5AKukeeYQG4ZBUG9yxQbR9aEweIwYY= +golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= +golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= +golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk= golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= +golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk= +golang.org/x/net v0.0.0-20220607020251-c690dde0001d/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To= golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= +golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek= golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= +golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20210112080510-489259a85091/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.0.0-20220412211240-33da011f77ad/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= +golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0= golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= +golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8= golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M= golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U= @@ -573,11 +671,13 @@ golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= +golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= +golang.org/x/xerrors v0.0.0-20220517211312-f3a8303e98df/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8= golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da h1:noIWHXmPHxILtqtCOPIhSt0ABwskkZKjD3bXGnZGpNY= golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da/go.mod h1:NDW/Ps6MPRej6fsCIbMTohpP40sJ/P/vI1MoTEGwX90= gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= @@ -586,21 +686,34 @@ google.golang.org/api v0.290.0 h1:eMw0Xo+IfbbMlKmW7aHvpyQRv9RCXuWx/vs8AD+0x9A= google.golang.org/api v0.290.0/go.mod h1:weJZ3lldHFYI0DBFNKpJelUDNnusTt5YaOEgxvt8ci8= google.golang.org/genproto v0.0.0-20260622175928-b703f567277d h1:CP5omUq8AJTiWMrPKM1WRLJ7zZeXd9OPcQD3TbBNAyY= google.golang.org/genproto v0.0.0-20260622175928-b703f567277d/go.mod h1:DrwuGJgFSEVNpv3S5Q5VxhRTvdnjauw9GtvwVOEARfA= -google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d h1:FarXi840EJWSHYTN3ERkADbPWjl307+FGrA22KAVjjc= -google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d/go.mod h1:K/+WGbmBY7aNW1HDw1fJnKYo10i0DkAX6pows00dLig= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d h1:IL4hdHzcUv2l/gcg98/Rj3FbtE6axwqslOW8SW0C+S0= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= -google.golang.org/grpc v1.83.0 h1:JeNZEKJFbQxArAMl+hiytHauacDNqJUllNfmIMmpqnQ= -google.golang.org/grpc v1.83.0/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4JGwzQ= +google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688 h1:ax2KzoSRIZU/M0cIxri3pKxy99vniH1PVxWC6si/eZI= +google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688/go.mod h1:1RJ9BQGyNdZwkGc1eTqkErfRZ6RJyYPHZo73BZ1vQqI= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 h1:cYNAzI2sUwhmCcoj9TxvihSrqsxt6uIkj3rDRhSDmW4= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688/go.mod h1:DjtHYE8FKJLivXcBEjGwndXfIC23G0VpXiXKqG179uA= +google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU= +google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8= +google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8= +google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0= +google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM= +google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE= +google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo= +google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU= +google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw= +google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc= google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc= google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q= +gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys= +gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ= +gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw= gopkg.in/warnings.v0 v0.1.2 h1:wFXVbFY8DY5/xOe1ECiWdKCzZlxgshcYVNkBHstARME= gopkg.in/warnings.v0 v0.1.2/go.mod h1:jksf8JmL6Qr/oQM2OXTHunEvvTAsrWBLb6OOjuVWRNI= gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= +gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= +gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= From 03d400b3cb124dc50ad5e132b979ce314024cbe7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Adolfo=20Garc=C3=ADa=20Veytia=20=28Puerco=29?= Date: Thu, 10 Sep 2026 23:37:40 -0600 Subject: [PATCH 3/3] Cut patch release MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This is an intentionally empty commit that records release intent. It makes no source changes, its only payload is the git trailers below, which the Carabiner tagger reads when the pull request is merged to create a signed, policy-checked semantic version tag. Removing this commit before merge simply cancels the release request. Tag-commit-as: patch Signed-off-by: Adolfo García Veytia (Puerco)