`gh attestation verify` policy enforcement refactor #9848

malancas · 2024-10-30T17:30:51Z

This is an initial refactor of how gh attestation verify handles policy enforcement. It consolidates the logic used to evaluate policy options into a single struct.

cc #9850

Signed-off-by: Meredith Lancaster <[email protected]>

…or-policy

Signed-off-by: Meredith Lancaster <[email protected]>

phillmv

I left a ton of comments but I am liking where this is heading!

phillmv · 2024-10-31T18:52:59Z

pkg/cmd/attestation/verification/policy.go

+}
+
+type EnforcementCriteria struct {
+	Extensions    Extensions


Why not literally embed the CertificateSummary? & store the SANRegex separately. That way we get every field by default.

Suggested change

Extensions Extensions

Certificate certificate.Summary

or w/e

phillmv · 2024-10-31T18:54:15Z

pkg/cmd/attestation/verification/policy.go

+	Extensions    Extensions
+	PredicateType string
+	Artifact      artifact.DigestedArtifact
+	OIDCIssuer    string


On the topic of embedding the CertificateSummary, since we have to compare the Issuer every time, we can move this inside the Certificate

phillmv · 2024-10-31T19:38:03Z

pkg/cmd/attestation/verification/extensions.go

-			return fmt.Errorf("expected Issuer to be %s, got %s -- if you have a custom OIDC issuer policy for your enterprise, use the --cert-oidc-issuer flag with your expected issuer", want, certIssuer)
-		} else {
-			return fmt.Errorf("expected Issuer to be %s, got %s", want, certIssuer)
+	if c.OIDCIssuer != "" {


Since we don't check it elsewhere, c.OIDCIssuer being blank is an error condition 🤔 .

Like, if it is == "" then we should throw an error kind of thing. What are you verifying?

phillmv · 2024-10-31T19:40:00Z

pkg/cmd/attestation/verify/policy.go

+	// if tenant is provided, select the appropriate default based on the tenant
+	// otherwise, use the provided OIDCIssuer
+	if opts.Tenant != "" {
+		c.OIDCIssuer = fmt.Sprintf(verification.GitHubTenantOIDCIssuer, opts.Tenant)


This is not a clean mapping of the logic. If you have a tenant you may still specify a custom OIDC issuer, contrast with:

if issuer != GitHubOIDCIssuer { want = issuer } else { if tenant != "" { want = fmt.Sprintf(GitHubTenantOIDCIssuer, tenant) } else { want = GitHubOIDCIssuer } }

(if no tests are failing because of this then we should add one)

phillmv · 2024-10-31T19:55:40Z

pkg/cmd/attestation/verify/policy.go


-	return verify.SubjectAlternativeNameMatcher{}, nil
+	if opts.DenySelfHostedRunner {
+		c.Extensions.RunnerEnvironment = GitHubRunner


let's preserve the comment re: the empty string matching for AnyRunner

pkg/cmd/attestation/verification/extensions.go

phillmv · 2024-10-31T20:09:36Z

pkg/cmd/attestation/verify/policy.go


-func buildSANMatcher(opts *Options) (verify.SubjectAlternativeNameMatcher, error) {
+func newEnforcementCriteria(opts *Options, a artifact.DigestedArtifact) (verification.EnforcementCriteria, error) {
+	c := verification.EnforcementCriteria{


The Enforcement criteria maps Options to strings we're verifying. What does having artifact in here buy us?

like, the contents of the opts will never modify the DigestedArtifact, right? so why is it EC's responsibility to be a container for it?

phillmv · 2024-10-31T20:15:20Z

pkg/cmd/attestation/verify/policy.go

-
-func buildVerifyPolicy(opts *Options, a artifact.DigestedArtifact) (verify.PolicyBuilder, error) {
-	artifactDigestPolicyOption, err := verification.BuildDigestPolicyOption(a)
+func SigstorePolicy(c verification.EnforcementCriteria) (verify.PolicyBuilder, error) {


so here I'd say either

NewSigstoreVerifyPolicy or buildSigstoreVerifyPolicy,

and

i feel like it should take the artifact as a param, so we can liberate the enforcement criteria from having to care about the artifact

phillmv · 2024-10-31T20:19:59Z

pkg/cmd/attestation/verify/verify.go

-	policy, err := buildVerifyPolicy(opts, *artifact)
+	opts.Logger.VerbosePrintf("Verifying attestations with predicate type: %s\n", opts.PredicateType)
+
+	ec, err := newEnforcementCriteria(opts, *artifact)


imho:

this should happen before we even load the bundles. The PredicateType in FilterAttestations should be coming from the ec, not from opts

like, even before we digest the artifact. nothing in the EC depends on the artifact or a network call, right?

and then right after we call newEnforcementCriteria we should call err := Valid() or w/e.

here I am thinking that ec.Validate() is separate from newEC only in so far that it might be easier to check for invalid states separately from setting them the flags.

for example, if the OIDCIssuer/Certificate.Issuer is empty on the Valid() call then that's an error! but it might not be obvious where to stick that check in the new func.

I ended up creating a separate EnforcementCriteria#Valid method for checking that all required fields are set. It felt a little too crowded doing it in the constructor.

Signed-off-by: Meredith Lancaster <[email protected]>

Co-authored-by: Phill MV <[email protected]>

Signed-off-by: Meredith Lancaster <[email protected]>

malancas · 2024-11-01T00:25:35Z

pkg/cmd/attestation/verify/policy.go

+func newEnforcementCriteria(opts *Options) (verification.EnforcementCriteria, error) {
+	c := verification.EnforcementCriteria{}
+
+	// Set SANRegex using either the opts.SignerRepo or opts.SignerWorkflow values


This section of setting SAN and/or SANRegex is using logic originally from

cli/pkg/cmd/attestation/verify/policy.go

Lines 28 to 44 in 30066b0

func buildSANMatcher(opts *Options) (verify.SubjectAlternativeNameMatcher, error) {

if opts.SignerRepo != "" {

signedRepoRegex := expandToGitHubURL(opts.Tenant, opts.SignerRepo)

return verify.NewSANMatcher("", signedRepoRegex)

} else if opts.SignerWorkflow != "" {

validatedWorkflowRegex, err := validateSignerWorkflow(opts)

if err != nil {

return verify.SubjectAlternativeNameMatcher{}, err

}

return verify.NewSANMatcher("", validatedWorkflowRegex)

} else if opts.SAN != "" || opts.SANRegex != "" {

return verify.NewSANMatcher(opts.SAN, opts.SANRegex)

}

return verify.SubjectAlternativeNameMatcher{}, nil

}

malancas · 2024-11-01T00:26:33Z

pkg/cmd/attestation/verify/policy.go

+		c.Certificate.RunnerEnvironment = ""
+	}
+
+	// If the Repo option is provided, set the SourceRepositoryURI extension


A lot of the logic originally in https://github.com/cli/cli/blob/30066b0042d0c5928d959e288144300cb28196c9/pkg/cmd/attestation/verification/extensions.go has been moved to here.

phillmv · 2024-11-01T14:13:00Z

pkg/cmd/attestation/verification/extensions.go

-			return fmt.Errorf("expected Issuer to be %s, got %s -- if you have a custom OIDC issuer policy for your enterprise, use the --cert-oidc-issuer flag with your expected issuer", want, certIssuer)
-		} else {
-			return fmt.Errorf("expected Issuer to be %s, got %s", want, certIssuer)
+	if criteria.Certificate.Issuer != "" {


imho skip the empty check here,: criteria.Certificate.Issuer == "" is always going to be an invalid state.

we now validate this, so it's less risky but, i feel like,

a) this should never generate an error so it's safe to always check, and
b) if this does ever generate an error that'll tell us about a bug somewhere else

🤔

I lean towards not checking for the empty string because of (b) since it exposes a bug and feels less risky now that we have a validation function for the struct.

Signed-off-by: Meredith Lancaster <[email protected]>

pkg/cmd/attestation/verify/verify.go

phillmv

This looks good to me! I think we landed in a nice clean place that centralizes the logic & makes enforcement decisions easier to reason about & expose to the user (in a future PR).

I'm only not approving because I haven't had the time/mental energy rn to read thru the tests 😄.

Co-authored-by: Phill MV <[email protected]>

Signed-off-by: Meredith Lancaster <[email protected]>

ejahnGithub

lgtm

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [cli/cli](https://github.com/cli/cli) | minor | `v2.59.0` -> `v2.62.0` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>cli/cli (cli/cli)</summary> ### [`v2.62.0`](https://github.com/cli/cli/releases/tag/v2.62.0): GitHub CLI 2.62.0 [Compare Source](cli/cli@v2.61.0...v2.62.0) #### What's Changed - Update monotonic verification logic and testing by [@malancas](https://github.com/malancas) in cli/cli#9856 - Check extension for latest version when executed by [@andyfeller](https://github.com/andyfeller) in cli/cli#9866 - Shorten extension release checking from 3s to 1s by [@andyfeller](https://github.com/andyfeller) in cli/cli#9914 - Mention GitHub CLI team on discussion issues by [@andyfeller](https://github.com/andyfeller) in cli/cli#9920 **Full Changelog**: cli/cli@v2.61.0...v2.62.0 #### Security - A security vulnerability has been identified in GitHub CLI that could allow remote code execution (RCE) when users connect to a malicious Codespace SSH server and use the `gh codespace ssh` or `gh codespace logs` commands. For more information, see GHSA-p2h2-3vg9-4p87 #### GitHub CLI notifies users about latest extension upgrades Similar to the notification of latest `gh` releases, the `v2.62.0` version of GitHub CLI will notify users about latest extension upgrades when the extension is used: ```shell $ gh ado2gh ... A new release of ado2gh is available: 1.7.0 → 1.8.0 To upgrade, run: gh extension upgrade ado2gh --force https://github.com/github/gh-ado2gh ``` ##### Why does this matter? This removes a common pain point of extension authors as they have had to reverse engineer and implement a similar mechanism within their extensions directly. With this quality of life improvement, there are 2 big benefits: 1. Extension authors will hopefully see increased adoption of newer releases while having lower bar to maintaining their extensions. 2. GitHub CLI users will have greater awareness of new features, bug fixes, and security fixes to the extensions used. ##### What do you need to do? Extension authors should review their extensions and consider removing any custom logic previously implemented to notify users of new releases. ### [`v2.61.0`](https://github.com/cli/cli/releases/tag/v2.61.0): GitHub CLI 2.61.0 [Compare Source](cli/cli@v2.60.1...v2.61.0) #### Ensure users understand consequences before making repository visibility changes In `v2.61.0`, `gh repo edit` command has been enhanced to inform users about [consequences of changing visibility](https://gh.io/setting-repository-visibility) and ensure users are intentional before making irreversible changes: 1. Interactive `gh repo edit` visibility change requires confirmation when changing from `public`, `private`, or `internal` 2. Non-interactive `gh repo edit --visibility` change requires new `--accept-visibility-change-consequences` flag to confirm 3. New content to inform users of consequences - Incorporate [GitHub Docs content](https://gh.io/setting-repository-visibility) into help usage and interactive `gh repo edit` experience - Expanded help usage to call out most concerning consequences - Display repository star and watcher counts to understand impact before confirming #### What's Changed - Add acceptance test for `project` command by [@jtmcg](https://github.com/jtmcg) in cli/cli#9816 - Add comprehensive testscript for `gh ruleset` by [@andyfeller](https://github.com/andyfeller) in cli/cli#9815 - Add comprehensive testscript for gh ext commandset by [@andyfeller](https://github.com/andyfeller) in cli/cli#9810 - Require visibility confirmation in `gh repo edit` by [@andyfeller](https://github.com/andyfeller) in cli/cli#9845 - Clean up skipped online tests for `gh attestation verify` by [@malancas](https://github.com/malancas) in cli/cli#9838 - `gh attestation verify` should only verify provenance attestations by default by [@malancas](https://github.com/malancas) in cli/cli#9825 - Set `dnf5` commands as default by [@its-miroma](https://github.com/its-miroma) in cli/cli#9844 - Fix verbiage for deleting workflow runs by [@akx](https://github.com/akx) in cli/cli#9876 - Bump github.com/creack/pty from 1.1.23 to 1.1.24 by [@dependabot](https://github.com/dependabot) in cli/cli#9862 - `gh attestation verify` policy enforcement refactor by [@malancas](https://github.com/malancas) in cli/cli#9848 - Simplify Sigstore verification result handling in `gh attestation verify` by [@malancas](https://github.com/malancas) in cli/cli#9877 - Print empty array for `gh cache list` when `--json` is provided by [@williammartin](https://github.com/williammartin) in cli/cli#9883 - Bump actions/attest-build-provenance from 1.4.3 to 1.4.4 by [@dependabot](https://github.com/dependabot) in cli/cli#9884 - Create the automatic key when specified with -i by [@cmbrose](https://github.com/cmbrose) in cli/cli#9881 - fix: `gh pr create -w` ignore template flag by [@nilvng](https://github.com/nilvng) in cli/cli#9863 #### New Contributors - [@akx](https://github.com/akx) made their first contribution in cli/cli#9876 - [@nilvng](https://github.com/nilvng) made their first contribution in cli/cli#9863 **Full Changelog**: cli/cli@v2.60.1...v2.61.0 ### [`v2.60.1`](https://github.com/cli/cli/releases/tag/v2.60.1): GitHub CLI 2.60.1 [Compare Source](cli/cli@v2.60.0...v2.60.1) This is a small patch release to fix installing `gh` via `go install` which was broken with v2.60.0. #### What's Changed - Update testscript to use hard fork by [@williammartin](https://github.com/williammartin) in cli/cli#9821 **Full Changelog**: cli/cli@v2.60.0...v2.60.1 ### [`v2.60.0`](https://github.com/cli/cli/releases/tag/v2.60.0): GitHub CLI 2.60.0 [Compare Source](cli/cli@v2.59.0...v2.60.0) #### What's Changed - Add ArchivedAt field by [@tsukasaI](https://github.com/tsukasaI) in cli/cli#9790 - Include startedAt, completedAt in run steps data by [@andyfeller](https://github.com/andyfeller) in cli/cli#9774 - Adjust environment help for host and tokens by [@williammartin](https://github.com/williammartin) in cli/cli#9809 - Add handling of empty titles for Issues and MRs by [@jtmcg](https://github.com/jtmcg) in cli/cli#9701 - `LiveSigstoreVerifier.Verify` should error if no attestations are present by [@phillmv](https://github.com/phillmv) in cli/cli#9742 - `gh at verify` retries fetching attestations if it receives a 5xx by [@phillmv](https://github.com/phillmv) in cli/cli#9797 - Prevent local extension installations with invalid names and conflicts with core commands and other extensions by [@BagToad](https://github.com/BagToad) in cli/cli#9794 - Rewrite a sentence in CONTRIBUTING.md by [@muzimuzhi](https://github.com/muzimuzhi) in cli/cli#9772 - Use new GitHub preview terms in `working-with-us.md` by [@BagToad](https://github.com/BagToad) in cli/cli#9800 - Use new GitHub previews terminology in attestation commands' help docs by [@BagToad](https://github.com/BagToad) in cli/cli#9799 - Clarify in README that `gh` is supported on GitHub Enterprise Cloud by [@BagToad](https://github.com/BagToad) in cli/cli#9805 - build(deps): bump github.com/gabriel-vasile/mimetype from 1.4.5 to 1.4.6 by [@dependabot](https://github.com/dependabot) in cli/cli#9752 ##### Acceptance Test Changes - Add acceptance tests for `workflow`, `run`, and `cache` commands by [@BagToad](https://github.com/BagToad) in cli/cli#9766 - Add basic `api` acceptance tests by [@BagToad](https://github.com/BagToad) in cli/cli#9770 - Add acceptance tests for `release` commands by [@BagToad](https://github.com/BagToad) in cli/cli#9771 - Add acceptance tests for `org` and `ssh-key` commands by [@BagToad](https://github.com/BagToad) in cli/cli#9812 - Add acceptance tests for `gh auth` commands by [@jtmcg](https://github.com/jtmcg) in cli/cli#9787 - Add acceptance tests for `repo` commands by [@jtmcg](https://github.com/jtmcg) in cli/cli#9783 - Add acceptance tests for `search` command by [@BagToad](https://github.com/BagToad) in cli/cli#9786 - Add acceptance tests for `variable` commands by [@andyfeller](https://github.com/andyfeller) in cli/cli#978 - Add testscripts for gpg-key and label commands by [@williammartin](https://github.com/williammartin) in cli/cli#9811 - Use forked testscript for token redaction by [@williammartin](https://github.com/williammartin) in cli/cli#9804 - Add acceptance tests for `secret` commands by [@andyfeller](https://github.com/andyfeller) in cli/cli#9782 - Note token redaction in Acceptance test README by [@williammartin](https://github.com/williammartin) in cli/cli#9813 #### New Contributors - [@tsukasaI](https://github.com/tsukasaI) made their first contribution in cli/cli#9790 **Full Changelog**: cli/cli@v2.59.0...v2.60.0 </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

malancas added 13 commits October 29, 2024 15:33

start building a separate policy struct

704de0c

Signed-off-by: Meredith Lancaster <[email protected]>

move policy functions into methods

e5b2b09

Signed-off-by: Meredith Lancaster <[email protected]>

cert extension funcs are now policy methods

e16b69b

Signed-off-by: Meredith Lancaster <[email protected]>

drop sigstore instance for now

41c3ba5

Signed-off-by: Meredith Lancaster <[email protected]>

simplify if else logic

3378b54

Signed-off-by: Meredith Lancaster <[email protected]>

undo policy method changes

b44c9d3

Signed-off-by: Meredith Lancaster <[email protected]>

use sigstore specific err

93c78a2

Signed-off-by: Meredith Lancaster <[email protected]>

Merge remote-tracking branch 'upstream/trunk' into attestation-refact…

fa2574c

…or-policy

update extensions test

4fa5f0c

Signed-off-by: Meredith Lancaster <[email protected]>

add tests for newEnforcementCriteria

8b02c43

Signed-off-by: Meredith Lancaster <[email protected]>

clean up extension verification tests

84c823c

Signed-off-by: Meredith Lancaster <[email protected]>

Merge branch 'trunk' into attestation-refactor-policy

bf4f04f

update extensions tests

318bd90

Signed-off-by: Meredith Lancaster <[email protected]>

malancas changed the title ~~Attestation refactor policy~~ gh attestation verify policy enforcement refactor Oct 30, 2024

malancas added 3 commits October 30, 2024 17:19

fix wrong field settings

bb0dcd9

Signed-off-by: Meredith Lancaster <[email protected]>

fix runner setting

61b60e9

Signed-off-by: Meredith Lancaster <[email protected]>

reorganize funcs

9cdeb31

Signed-off-by: Meredith Lancaster <[email protected]>

phillmv reviewed Oct 31, 2024

View reviewed changes

malancas and others added 6 commits October 31, 2024 16:07

remove artifact from EnforcementCriteria

6f4b5dd

Signed-off-by: Meredith Lancaster <[email protected]>

rename function

7948ce4

Signed-off-by: Meredith Lancaster <[email protected]>

Update pkg/cmd/attestation/verification/extensions.go

e6d0a06

Co-authored-by: Phill MV <[email protected]>

update VerifyCertExtensions args

a81cb73

Signed-off-by: Meredith Lancaster <[email protected]>

keep comment

9f3d009

Signed-off-by: Meredith Lancaster <[email protected]>

use sigstore-go certificate.Summary type for criteria

8336f79

Signed-off-by: Meredith Lancaster <[email protected]>

malancas marked this pull request as ready for review October 31, 2024 22:28

malancas requested a review from a team as a code owner October 31, 2024 22:28

cliAutomation added the external pull request originating outside of the CLI core team label Oct 31, 2024

malancas added 3 commits October 31, 2024 16:56

add Valid method for EnforcementCriteria

50cda0d

Signed-off-by: Meredith Lancaster <[email protected]>

check for SAN and SANRegex

a7a70fc

Signed-off-by: Meredith Lancaster <[email protected]>

comments

0fb82a6

Signed-off-by: Meredith Lancaster <[email protected]>

malancas commented Nov 1, 2024

View reviewed changes

phillmv reviewed Nov 1, 2024

View reviewed changes

malancas added 4 commits November 1, 2024 08:20

remove emtpy string checks

a5eca00

Signed-off-by: Meredith Lancaster <[email protected]>

update OIDC issuer logic

a6d15b4

Signed-off-by: Meredith Lancaster <[email protected]>

comment

bb1584b

Signed-off-by: Meredith Lancaster <[email protected]>

use predicate type stored in enforcementCriteria

43810a5

Signed-off-by: Meredith Lancaster <[email protected]>

phillmv reviewed Nov 1, 2024

View reviewed changes

pkg/cmd/attestation/verify/verify.go Outdated Show resolved Hide resolved

phillmv reviewed Nov 1, 2024

View reviewed changes

malancas and others added 3 commits November 1, 2024 09:51

Update pkg/cmd/attestation/verify/verify.go

91967cc

Co-authored-by: Phill MV <[email protected]>

simplify logic, add comments

3281bd4

Signed-off-by: Meredith Lancaster <[email protected]>

move comment

b9c9f0a

Signed-off-by: Meredith Lancaster <[email protected]>

ejahnGithub approved these changes Nov 4, 2024

View reviewed changes

malancas merged commit 446a0d5 into cli:trunk Nov 6, 2024

malancas deleted the attestation-refactor-policy branch November 6, 2024 14:50

	func buildSANMatcher(opts *Options) (verify.SubjectAlternativeNameMatcher, error) {
	if opts.SignerRepo != "" {
	signedRepoRegex := expandToGitHubURL(opts.Tenant, opts.SignerRepo)
	return verify.NewSANMatcher("", signedRepoRegex)
	} else if opts.SignerWorkflow != "" {
	validatedWorkflowRegex, err := validateSignerWorkflow(opts)
	if err != nil {
	return verify.SubjectAlternativeNameMatcher{}, err
	}

	return verify.NewSANMatcher("", validatedWorkflowRegex)
	} else if opts.SAN != "" \|\| opts.SANRegex != "" {
	return verify.NewSANMatcher(opts.SAN, opts.SANRegex)
	}

	return verify.SubjectAlternativeNameMatcher{}, nil
	}

Uh oh!

gh attestation verify policy enforcement refactor #9848

gh attestation verify policy enforcement refactor #9848

Uh oh!

Conversation

malancas commented Oct 30, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

phillmv left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

malancas Nov 1, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

malancas Nov 1, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

malancas Nov 1, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

phillmv left a comment

Choose a reason for hiding this comment

Uh oh!

ejahnGithub left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

`gh attestation verify` policy enforcement refactor #9848

`gh attestation verify` policy enforcement refactor #9848

malancas commented Oct 30, 2024 •

edited

Loading

malancas Nov 1, 2024 •

edited

Loading

malancas Nov 1, 2024 •

edited

Loading

malancas Nov 1, 2024 •

edited

Loading