@macula-io/martha 1.0.1 → 1.0.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -17,6 +17,7 @@ const manifest = createRequire(import.meta.url)('../package.json')
|
|
|
17
17
|
* @property {string} issuer the OIDC issuer of the signing certificate
|
|
18
18
|
* @property {string} command the command an installed release puts on PATH
|
|
19
19
|
* @property {string} releaseFolder the one top-level folder a release's layer holds
|
|
20
|
+
* @property {string} pinFile the file the packer generates in that folder: the installer a release pins
|
|
20
21
|
* @property {string} releaseTagPrefix what a release tag starts with
|
|
21
22
|
* @property {string} installerTagPrefix what an installer tag starts with
|
|
22
23
|
* @property {string} installerPublishWorkflow the workflow whose run publishes this installer, and signs that publish
|
package/npm-shrinkwrap.json
CHANGED
|
@@ -1,12 +1,12 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@macula-io/martha",
|
|
3
|
-
"version": "1.0.
|
|
3
|
+
"version": "1.0.2",
|
|
4
4
|
"lockfileVersion": 3,
|
|
5
5
|
"requires": true,
|
|
6
6
|
"packages": {
|
|
7
7
|
"": {
|
|
8
8
|
"name": "@macula-io/martha",
|
|
9
|
-
"version": "1.0.
|
|
9
|
+
"version": "1.0.2",
|
|
10
10
|
"bundleDependencies": [
|
|
11
11
|
"sigstore"
|
|
12
12
|
],
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@macula-io/martha",
|
|
3
|
-
"version": "1.0.
|
|
3
|
+
"version": "1.0.2",
|
|
4
4
|
"description": "Install Martha from its signed public package: verifies the release's sigstore signature, then installs it",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"license": "Apache-2.0",
|
|
@@ -59,6 +59,7 @@
|
|
|
59
59
|
"releaseTagPrefix": "v",
|
|
60
60
|
"installerTagPrefix": "installer-v",
|
|
61
61
|
"releaseFolder": "martha",
|
|
62
|
+
"pinFile": "installer.json",
|
|
62
63
|
"dryRunTagPrefix": "dry-run-",
|
|
63
64
|
"installerPublishWorkflow": ".github/workflows/installer.yml"
|
|
64
65
|
}
|
|
@@ -156,7 +156,7 @@ async function failure ({ bundle, sha, ref, source, makeVerifier, tufCachePath }
|
|
|
156
156
|
* { sha } of the listed signer whose identity one of `bundles` verifies under, for `version` of `digest`; or
|
|
157
157
|
* { reasons } saying why each try failed. A trust root that could not be fetched throws CouldNotCheck instead.
|
|
158
158
|
* `ref` is refs/tags/v<version>; only the release dry run, from a test file, names its branch's ref.
|
|
159
|
-
* @param {{ bundles: any[], digest: string, version: string, signers: string[], source?: string, ref?: string, makeVerifier?: MakeVerifier, tufCachePath?: string | undefined }} request
|
|
159
|
+
* @param {{ bundles: any[], digest: string, version: string, signers: string[], source?: string, ref?: string | undefined, makeVerifier?: MakeVerifier, tufCachePath?: string | undefined }} request
|
|
160
160
|
* @returns {Promise<{ sha: string } | { reasons: string[] }>}
|
|
161
161
|
*/
|
|
162
162
|
export async function signedBy ({ bundles, digest, version, signers, source = NAMES.sourceRepository, ref = releaseRef(version), makeVerifier = createVerifier, tufCachePath }) {
|