release: add notes for release v1.2.0

[asraa]

Signed-off-by: Asra Ali [email protected]

This sets the expected sha256 of the v1.2.0 slsa-verifier released binary.

How to LGTM this PR (I'll work on a proper doc for this in slsa-framework/slsa-github-generator#112):

1. Download the binary and provenance from https://github.com/slsa-framework/slsa-verifier/releases/tag/v1.2.0
2. Clone the slsa-verifier repo, compile and verify the provenance:

$ git clone [email protected]:slsa-framework/slsa-verifier.git
$ cd slsa-verifier
$ (Optional: git checkout tags/v1.2.0)
$ go run . -provenance ~/Downloads/slsa-verifier-linux-amd64.intoto.jsonl -artifact-path ~/Downloads/slsa-verifier-linux-amd64 -source github.com/slsa-framework/slsa-verifier -tag v1.2.0

3. Get the hash.
   Either:

cat slsa-verifier-linux-amd64.intoto.jsonl | jq -r '.payload' | base64 -d | jq -r '.subject[0].digest.sha256'

or

sha256sum slsa-verifier-linux-amd64

The output hash should be the hash I'm updating to in this PR. If they match, LGTM. If they don't, someone tampered with the released binary and don't LGTM

---

Also sets missing v1.0.2

1. Download the binary and provenance from https://github.com/slsa-framework/slsa-verifier/releases/tag/v1.0.2
2. Clone the slsa-verifier repo, compile and verify the provenance:

$ git clone [email protected]:slsa-framework/slsa-verifier.git
$ cd slsa-verifier
$ (Optional: git checkout tags/v1.0.2)
$ go run . -provenance ~/Downloads/slsa-verifier-linux-amd64.intoto.jsonl -artifact-path ~/Downloads/slsa-verifier-linux-amd64 -source github.com/slsa-framework/slsa-verifier -tag v1.0.2 -branch release/v1.0

3. Get the hash.
   Either:

cat slsa-verifier-linux-amd64.intoto.jsonl | jq -r '.payload' | base64 -d | jq -r '.subject[0].digest.sha256'

or

sha256sum slsa-verifier-linux-amd64

[laurentsimon]

v1.2.0 verifies

go run . -provenance slsa-verifier-linux-amd64.intoto.jsonl -artifact-path slsa-verifier-linux-amd64 -source github.com/slsa-framework/slsa-verifier -tag v1.2.0 -print-provenance | jq -r '.subject[0].digest.sha256'
Verified signature against tlog entry index 3027785 at URL: https://rekor.sigstore.dev/api/v1/log/entries/0cdff5b6a013379f9c1c5c6c598ad73c60de5acd969ba70ea2e874098b6e789f
Verified build using builder https://github.com/slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@refs/tags/v1.1.1 at commit fb9aeaf6384fd588e56ad90978fe025b3fd44849
PASSED: Verified SLSA provenance
37db23392c7918bb4e243cdb097ed5f9d14b9b965dc1905b25bc2d1c0c91bf3d

and

sha256sum slsa-verifier-linux-amd64
37db23392c7918bb4e243cdb097ed5f9d14b9b965dc1905b25bc2d1c0c91bf3d

[laurentsimon]

v1.0.2 verifies

go run . -provenance slsa-verifier-linux-amd64.intoto.jsonl -artifact-path slsa-verifier-linux-amd64 -source github.com/slsa-framework/slsa-verifier -tag v1.0.2 -print-provenance -branch release/v1.0 | jq -r '.subject[0].digest.sha256'
Getting rekor entry error error creating intoto entry: no signing certificate found in intoto envelope, trying Redis search index to find entries by subject digest
Verified signature against tlog entry index 2924121 at URL: https://rekor.sigstore.dev/api/v1/log/entries/18b480ffea3e702fc4a0eaed5194361f3fd6989377d9d883c8ec971f1bad8454
Verified build using builder https://github.com/slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@refs/tags/v0.0.1 at commit ae29694378b726825f8ff792161df57a7eff8698
PASSED: Verified SLSA provenance
bcefa5173ad84fbb10d3aeae95c1087f6a61e51836b932c60be85c78d570c403

sha256sum slsa-verifier-linux-amd64
bcefa5173ad84fbb10d3aeae95c1087f6a61e51836b932c60be85c78d570c403  slsa-verifier-linux-amd64

[laurentsimon]

Thank you!