feat: BYOB verification support

[laurentsimon]

closes #601

CLI e2e tests will be tacked as part of #603

[laurentsimon]

@ianlewis do you know what's happening with https://github.com/slsa-framework/slsa-verifier/actions/runs/5019866408/jobs/9000799655?pr=604?

[ianlewis]

Ok, so I assume that for BYOB that we'll expect the user to always provide the provenance as a sigstore bundle? As it stands you need to provide the full sigstore bundle in order for the verifier to be able to find the rekor entry.

[ianlewis]

@ianlewis do you know what's happening with https://github.com/slsa-framework/slsa-verifier/actions/runs/5019866408/jobs/9000799655?pr=604?

You need to add go: 1.18 to the golangci-lint config since you're using generics.
golangci/golangci-lint#2664 (comment)

[laurentsimon]

Ok, so I assume that for BYOB that we'll expect the user to always provide the provenance as a sigstore bundle

For now yes. When we create new BYOB builders and / or migrate our existing ones, I'll update the code.
I have not thought thru the implications of trusting our byob by default...

[laurentsimon]

@ianlewis I made the change to use 1.18 go, but still encountering the same problem. Any ideas?

[ianlewis]

@ianlewis I made the change to use 1.18 go, but still encountering the same problem. Any ideas?

I think they disable checks that don't support generics yet when you set that, but they missed gocritic since I think it's not enabled by default. Let's just update golangci-lint since I think this issue is already fixed.

[laurentsimon]

@ianlewis I made the change to use 1.18 go, but still encountering the same problem. Any ideas?

I think they disable checks that don't support generics yet when you set that, but they missed gocritic since I think it's not enabled by default. Let's just update golangci-lint since I think this issue is already fixed.

Thanks!

[laurentsimon]

@ianlewis I made the change to use 1.18 go, but still encountering the same problem. Any ideas?

I think they disable checks that don't support generics yet when you set that, but they missed gocritic since I think it's not enabled by default. Let's just update golangci-lint since I think this issue is already fixed.

Thanks!

It's now failing with non-wrapping format verb for fmt.Errorf. Use %w to format errors (errorlint). Shall I add a //nolint:errorlint? I don't see what's wrong with the code, ie it's already using %w

[ianlewis]

It's now failing with non-wrapping format verb for fmt.Errorf. Use %w to format errors (errorlint). Shall I add a //nolint:errorlint? I don't see what's wrong with the code, ie it's already using %w

Yeah, It's complaining because Go 1.20 allows you to wrap multiple errors (aside: which obviates the need to have the wrappableError in the generators). I guess the linter doesn't know we're still using Go 1.18. I added a config to ignore it for now.

[laurentsimon]

It's now failing with non-wrapping format verb for fmt.Errorf. Use %w to format errors (errorlint). Shall I add a //nolint:errorlint? I don't see what's wrong with the code, ie it's already using %w

Yeah, It's complaining because Go 1.20 allows you to wrap multiple errors (aside: which obviates the need to have the wrappableError in the generators). I guess the linter doesn't know we're still using Go 1.18. I added a config to ignore it for now.

Thanks. can't wait to use 1.20!