Merge branch 'main' into maven-attestor-pom-fix

Signed-off-by: Tom Meadows <[email protected]>

.github/workflows/codeql.yml

@@ -64,7 +64,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@c0d1daa7f7e14667747d73a7dbbe8c074bc8bfe2 # v2.22.9
+        uses: github/codeql-action/init@e5f05b81d5b6ff8cfa111c80c22c5fd02a384118 # v3.23.0
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -74,7 +74,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@c0d1daa7f7e14667747d73a7dbbe8c074bc8bfe2 # v2.22.9
+        uses: github/codeql-action/autobuild@e5f05b81d5b6ff8cfa111c80c22c5fd02a384118 # v3.23.0
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -87,6 +87,6 @@ jobs:
       #   ./location_of_script_within_repo/buildscript.sh
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@c0d1daa7f7e14667747d73a7dbbe8c074bc8bfe2 # v2.22.9
+        uses: github/codeql-action/analyze@e5f05b81d5b6ff8cfa111c80c22c5fd02a384118 # v3.23.0
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/dependency-review.yml

@@ -38,4 +38,4 @@ jobs:
       - name: 'Checkout Repository'
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: 'Dependency Review'
-        uses: actions/dependency-review-action@01bc87099ba56df1e897b6874784491ea6309bc4 # v3.1.4
+        uses: actions/dependency-review-action@c74b580d73376b7750d3d2a50bfb8adc2c937507 # v3.1.5

.github/workflows/release.yml

@@ -12,14 +12,18 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-permissions:
-  id-token: write # This is required for requesting the JWT
-  contents: read  # This is required for actions/checkout
 name: release
 on: [push, pull_request]
+
+permissions:
+  contents: read
+
 jobs:
   fmt:
     uses: ./.github/workflows/witness.yml
+    permissions:
+      id-token: write # This is required for requesting the JWT
+      contents: read
     with:
       pull_request: ${{ github.event_name == 'pull_request' }}
       step: fmt
@@ -29,6 +33,9 @@ jobs:
   sast:
     needs: [fmt]
     uses: ./.github/workflows/witness.yml
+    permissions:
+      id-token: write # This is required for requesting the JWT
+      contents: read
     with:
       pull_request: ${{ github.event_name == 'pull_request' }}
       step: sast
@@ -38,6 +45,9 @@ jobs:
   unit-test:
     needs: [fmt]
     uses: ./.github/workflows/witness.yml
+    permissions:
+      id-token: write # This is required for requesting the JWT
+      contents: read
     with:
       pull_request: ${{ github.event_name == 'pull_request' }}
       step: unit-test

.github/workflows/scorecards.yml

@@ -77,14 +77,14 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
+        uses: actions/upload-artifact@1eb3cb2b3e0f29609092a73eb033bb759a334595 # v4.1.0
         with:
           name: SARIF file
           path: results.sarif
           retention-days: 5
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@c0d1daa7f7e14667747d73a7dbbe8c074bc8bfe2 # v2.22.9
+        uses: github/codeql-action/upload-sarif@e5f05b81d5b6ff8cfa111c80c22c5fd02a384118 # v3.23.0
         with:
           sarif_file: results.sarif

.github/workflows/verify-licence.yml

@@ -34,9 +34,9 @@ jobs:
         - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
           with:
-            go-version: '1.17.x'
+            go-version: '1.21.x'
         - name: Install addlicense
-          run: go install github.com/google/addlicense@latest
+          run: go install github.com/google/addlicense@v1.1.1
         - name: Check license headers
           run: |
             set -e

.github/workflows/witness.yml

@@ -40,9 +40,15 @@ on:
                 required: true
                 type: string
 
+permissions:
+  contents: read
+
 jobs:
     witness:
         runs-on: ubuntu-latest
+        permissions:
+            contents: read
+            id-token: write
         steps:
           - name: Harden Runner
             uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
@@ -55,7 +61,7 @@ jobs:
               go-version: 1.21.x
 
           - if: ${{ inputs.artifact-download != '' }}
-            uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
+            uses: actions/download-artifact@6b208ae046db98c579e8a3aa621ab581ff575935 # v4.1.1
             with:
               name: ${{ inputs.artifact-download }}
               path: /tmp
@@ -79,7 +85,7 @@ jobs:
             run: ${{ inputs.command }}
 
           - if: ${{ inputs.artifact-upload-path != '' && inputs.artifact-upload-name != ''}}
-            uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
+            uses: actions/upload-artifact@1eb3cb2b3e0f29609092a73eb033bb759a334595 # v4.1.0
             with:
               name: ${{ inputs.artifact-upload-name }}
               path: ${{ inputs.artifact-upload-path }}

DEPENDENCY.md

@@ -0,0 +1,42 @@
+# Environment Dependencies Policy
+
+## Purpose
+
+This policy describes how Witness maintainers consume third-party packages.
+
+## Scope
+
+This policy applies to all Witness maintainers and all third-party packages used in the Witness project.
+
+## Policy
+
+Witness maintainers must follow these guidelines when consuming third-party packages:
+
+- Only use third-party packages that are necessary for the functionality of Witness.
+- Use the latest version of all third-party packages whenever possible.
+- Avoid using third-party packages that are known to have security vulnerabilities.
+- Pin all third-party packages to specific versions in the Witness codebase.
+- Use a dependency management tool, such as Go modules, to manage third-party dependencies.
+
+## Procedure
+
+When adding a new third-party package to Witness, maintainers must follow these steps:
+
+1. Evaluate the need for the package. Is it necessary for the functionality of Witness?
+2. Research the package. Is it well-maintained? Does it have a good reputation?
+3. Choose a version of the package. Use the latest version whenever possible.
+4. Pin the package to the specific version in the Witness codebase.
+5. Update the Witness documentation to reflect the new dependency.
+
+## Enforcement
+
+This policy is enforced by the Witness maintainers.
+Maintainers are expected to review each other's code changes to ensure that they comply with this policy.
+
+## Exceptions
+
+Exceptions to this policy may be granted by the Witness project lead on a case-by-case basis.
+
+## Credits
+
+This policy was adapted from the [Kubescape Community](https://github.com/kubescape/kubescape/blob/master/docs/environment-dependencies-policy.md)

README.md

@@ -19,7 +19,7 @@ This library is currently pre-1.0 and therefore the API may be subject to breaki
 - A selection of attestation sources to search for attestation collections
 
 ## Documentation
-For more detail regarding the library itself, we recommend viewing [pkg.go.dev](https://pkg.go.dev/github.com/testifysec/go-witness). For
+For more detail regarding the library itself, we recommend viewing [pkg.go.dev](https://pkg.go.dev/github.com/in-toto/go-witness). For
 the documentation of the witness project, please view [the main witness repository](https://github.com/in-toto/witness/tree/main/docs).
 
 ## Requirements

SECURITY-INSIGHTS.yml

@@ -15,10 +15,67 @@
 header:
   schema-version: 1.0.0
   expiration-date: '2024-08-31T10:10:09.000Z'
-  last-updated: '2023-12-06'
-  last-reviewed: '2023-12-06'
+  last-updated: '2023-12-20'
+  last-reviewed: '2023-12-20'
   commit-hash: cd0c222058a8830a8e190b840e466098b25a3c41
   project-url: https://github.com/in-toto/go-witness
-  project-release: 'v0.17.0'
-  changelog: https://github.com/in-toto/go-witness/releases/tag/v0.17.0
+  project-release: 'v0.2.0'
+  changelog: https://github.com/in-toto/go-witness/releases/tag/v0.2.0
   license: https://github.com/in-toto/go-witness/blob/main/LICENSE
+
+project-lifecycle:
+  status: active
+  roadmap: https://github.com/orgs/in-toto/projects/4/views/3
+  bug-fixes-only: false
+  core-maintainers:
+  - https://github.com/in-toto/go-witness/MAINTAINERS.md
+  release-cycle: https://github.com/in-toto/go-witness/releases
+
+contribution-policy:
+  accepts-pull-requests: true
+  accepts-automated-pull-requests: true
+  contributing-policy: https://github.com/in-toto/go-witness/blob/main/CONTRIBUTING.md
+  code-of-conduct: https://github.com/in-toto/go-witness/blob/main/CODE_OF_CONDUCT.md
+
+documentation:
+  - https://witness.dev
+
+distribution-points:
+  - https://github.com/in-toto/go-witness/releases
+
+security-testing:
+- tool-type: sca
+  tool-name: Dependabot
+  tool-version: 2
+  tool-url: https://github.com/dependabot
+  integration:
+    ad-hoc: false
+    ci: true
+    before-release: false
+
+security-contacts:
+- type: email
+  value: [email protected]
+  primary: true
+
+vulnerability-reporting:
+  accepts-vulnerability-reports: true
+  email-contact: [email protected]
+  security-policy: https://github.com/in-toto/go-witness/SECURITY.md
+
+dependencies:
+  third-party-packages: true
+  dependencies-lists:
+  - https://github.com/in-toto/go-witness/go.mod
+  sbom:
+  - sbom-file: https://foo.bar/sbom
+    sbom-format: CycloneDX
+    sbom-url: https://foo.bar
+  dependencies-lifecycle:
+    policy-url: https://github.com/in-toto/go-witness/SECURITY.md
+    comment: |
+      All dependencies are subject to the Witness Security Policy.
+  env-dependencies-policy:
+    policy-url: https://github.com/in-toto/go-witness/DEPENDENCY.md
+    comment: |
+      All dependencies are subject to the Witness Dependency Policy.

SECURITY.md

@@ -0,0 +1,34 @@
+# Security Policy
+
+## Security Bulletins
+
+See current security bullentins on GitHub: https://github.com/in-toto/go-witness/security/advisories
+
+For information regarding the security of this project please join:
+
+* in-toto-witness on CNCF Slack
+
+## Reporting a Vulnerability
+
+Please use the below process to report a vulnerability to the project:
+
+Web Form:
+
+1. Please visit https://github.com/in-toto/go-witness/security/advisories/new
+   * You will receive a confirmation email upon submission
+1. You may be contacted by a maintainer to further discuss the reported item
+   within 3 days. Please bear with us as we seek to understand the breadth
+   and scope of the reported problem, recreate it, and confirm if there is an
+   vulnerability present.
+
+This project follows a 30 day disclosure timeline.
+
+## Supported Versions
+
+Information regarding supported versions of this project can be found on
+in the below table:
+
+| Version | Supported |
+| --- | --- |
+| Latest | :white_check_mark: |
+| <= Latest - 2 | :x: |

archivista/download.go

@@ -17,8 +17,8 @@ package archivista
 import (
 	"context"
 
-	archivistaapi "github.com/testifysec/archivista-api"
-	"github.com/testifysec/go-witness/dsse"
+	archivistaapi "github.com/in-toto/archivista/pkg/api"
+	"github.com/in-toto/go-witness/dsse"
 )
 
 func (c *Client) Download(ctx context.Context, gitoid string) (dsse.Envelope, error) {

archivista/searchgitoids.go

@@ -17,7 +17,7 @@ package archivista
 import (
 	"context"
 
-	archivistaapi "github.com/testifysec/archivista-api"
+	archivistaapi "github.com/in-toto/archivista/pkg/api"
 )
 
 type searchGitoidResponse struct {

archivista/store.go

@@ -17,8 +17,8 @@ package archivista
 import (
 	"context"
 
-	archivistaapi "github.com/testifysec/archivista-api"
-	"github.com/testifysec/go-witness/dsse"
+	archivistaapi "github.com/in-toto/archivista/pkg/api"
+	"github.com/in-toto/go-witness/dsse"
 )
 
 func (c *Client) Store(ctx context.Context, env dsse.Envelope) (string, error) {

attestation/aws-iid/aws-iid.go

@@ -27,9 +27,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/ec2metadata"
 	"github.com/aws/aws-sdk-go/aws/session"
-	"github.com/testifysec/go-witness/attestation"
-	"github.com/testifysec/go-witness/cryptoutil"
-	"github.com/testifysec/go-witness/log"
+	"github.com/in-toto/go-witness/attestation"
+	"github.com/in-toto/go-witness/cryptoutil"
+	"github.com/in-toto/go-witness/log"
 )
 
 const (
@@ -42,8 +42,8 @@ const (
 const (
 	docPath = "instance-identity/document"
 	sigPath = "instance-identity/signature"
-	//https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/verify-signature.html
-	//The following AWS public certificate is for all AWS Regions, except Hong Kong, Bahrain, China, and GovCloud.
+	// https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/verify-signature.html
+	// The following AWS public certificate is for all AWS Regions, except Hong Kong, Bahrain, China, and GovCloud.
 	awsCACertPEM = `-----BEGIN CERTIFICATE-----
 MIIDIjCCAougAwIBAgIJAKnL4UEDMN/FMA0GCSqGSIb3DQEBBQUAMGoxCzAJBgNV
 BAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdTZWF0dGxlMRgw

attestation/aws-iid/aws-iid_test.go

@@ -24,9 +24,9 @@ import (
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/session"
+	"github.com/in-toto/go-witness/attestation"
+	"github.com/in-toto/go-witness/cryptoutil"
 	"github.com/stretchr/testify/require"
-	"github.com/testifysec/go-witness/attestation"
-	"github.com/testifysec/go-witness/cryptoutil"
 )
 
 const iid = `{

attestation/collection.go

@@ -19,7 +19,7 @@ import (
 	"fmt"
 	"time"
 
-	"github.com/testifysec/go-witness/cryptoutil"
+	"github.com/in-toto/go-witness/cryptoutil"
 )
 
 const CollectionType = "https://witness.testifysec.com/attestation-collection/v0.1"

attestation/commandrun/commandrun.go

@@ -20,9 +20,9 @@ import (
 	"os"
 	"os/exec"
 
-	"github.com/testifysec/go-witness/attestation"
-	"github.com/testifysec/go-witness/attestation/environment"
-	"github.com/testifysec/go-witness/cryptoutil"
+	"github.com/in-toto/go-witness/attestation"
+	"github.com/in-toto/go-witness/attestation/environment"
+	"github.com/in-toto/go-witness/cryptoutil"
 )
 
 const (

attestation/commandrun/tracing_linux.go

@@ -26,10 +26,10 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/testifysec/go-witness/attestation"
-	"github.com/testifysec/go-witness/attestation/environment"
-	"github.com/testifysec/go-witness/cryptoutil"
-	"github.com/testifysec/go-witness/log"
+	"github.com/in-toto/go-witness/attestation"
+	"github.com/in-toto/go-witness/attestation/environment"
+	"github.com/in-toto/go-witness/cryptoutil"
+	"github.com/in-toto/go-witness/log"
 	"golang.org/x/sys/unix"
 )