fix: upgrade cosign 2.6.0 to 2.6.2 (#1537)

Signed-off-by: Anitha Natarajan <anataraj@redhat.com>

Author: anithapriyanatarajan

.github/workflows/lint.yaml

@@ -27,20 +27,22 @@ jobs:
           go-version: "1.23"
 
       - uses: actions/checkout@6d193bf28034eafb982f37bd894289fe649468fc # v4.1.7
+        with:
+          fetch-depth: 0
 
       - name: golangci-lint
         uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0
         with:
           # Optional: version of golangci-lint to use in form of v1.2 or v1.2.3 or `latest` to use the latest version
           version: latest
-
+          args: --new-from-merge-base=origin/${{ github.base_ref }} --timeout=10m
           # Optional: working directory, useful for monorepos
           # working-directory: somedir
 
           # Optional: golangci-lint command line arguments.
 
           # Optional: show only new issues if it's a pull request. The default value is `false`.
-          only-new-issues: true
+          # only-new-issues: true
 
           # Optional: if set to true then the all caching functionality will be complete disabled,
           #           takes precedence over all other caching options.

go.mod

@@ -326,7 +326,7 @@ func isValidArtifactOutput(res objects.Result) (bool, error) {
 		return false, fmt.Errorf("%s should have digest field: %v", res.Name, res.Value.ObjectVal)
 	}
 	if _, _, err := ParseDigest(res.Value.ObjectVal["digest"]); err != nil {
-		return false, fmt.Errorf("error getting digest %s: %v", res.Value.ObjectVal["digest"], err)
+		return false, fmt.Errorf("error getting digest %s: %w", res.Value.ObjectVal["digest"], err)
 	}
 	return true, nil
 }

go.sum

@@ -127,7 +127,7 @@ func SPDXGit(url, revision string) string {
 		url = artifacts.GitSchemePrefix + url
 	}
 	if !strings.HasSuffix(url, ".git") {
-		url = url + ".git"
+		url += ".git"
 	}
 	if revision == "" {
 		return url

pkg/artifacts/signable.go

@@ -27,6 +27,7 @@ import (
 	"github.com/tektoncd/chains/pkg/chains/formats/slsa/internal/artifact"
 	"github.com/tektoncd/chains/pkg/chains/formats/slsa/internal/slsaconfig"
 	"github.com/tektoncd/chains/pkg/chains/objects"
+	v1 "github.com/tektoncd/pipeline/pkg/apis/pipeline/v1"
 	"knative.dev/pkg/logging"
 )
 
@@ -70,7 +71,9 @@ func PipelineMaterials(ctx context.Context, pro *objects.PipelineRunObjectV1, sl
 	}
 	pSpec := pro.Status.PipelineSpec
 	if pSpec != nil {
-		pipelineTasks := append(pSpec.Tasks, pSpec.Finally...)
+		pipelineTasks := make([]v1.PipelineTask, 0, len(pSpec.Tasks)+len(pSpec.Finally))
+		pipelineTasks = append(pipelineTasks, pSpec.Tasks...)
+		pipelineTasks = append(pipelineTasks, pSpec.Finally...)
 		for _, t := range pipelineTasks {
 			taskRuns := pro.GetTaskRunsFromTask(t.Name)
 			if len(taskRuns) == 0 {
@@ -255,7 +258,9 @@ func FromPipelineParamsAndResults(ctx context.Context, pro *objects.PipelineRunO
 		// search type hinting param/results from each individual taskruns
 		if slsaconfig.DeepInspectionEnabled {
 			logger := logging.FromContext(ctx)
-			pipelineTasks := append(pSpec.Tasks, pSpec.Finally...)
+			pipelineTasks := make([]v1.PipelineTask, 0, len(pSpec.Tasks)+len(pSpec.Finally))
+			pipelineTasks = append(pipelineTasks, pSpec.Tasks...)
+			pipelineTasks = append(pipelineTasks, pSpec.Finally...)
 			for _, t := range pipelineTasks {
 				taskRuns := pro.GetTaskRunsFromTask(t.Name)
 				if len(taskRuns) == 0 {

pkg/chains/formats/slsa/attest/attest.go

@@ -558,10 +558,8 @@ func TestCreatePayloadError(t *testing.T) {
 		}
 		if err == nil {
 			t.Errorf("Expected error")
-		} else {
-			if err.Error() != "intoto does not support type: not a task ref" {
-				t.Errorf("wrong error returned: '%s'", err.Error())
-			}
+		} else if err.Error() != "intoto does not support type: not a task ref" {
+			t.Errorf("wrong error returned: '%s'", err.Error())
 		}
 	})
 

pkg/chains/formats/slsa/internal/material/material.go

@@ -101,7 +101,9 @@ func buildConfig(ctx context.Context, pro *objects.PipelineRunObjectV1) BuildCon
 	if pSpec == nil {
 		return BuildConfig{}
 	}
-	pipelineTasks := append(pSpec.Tasks, pSpec.Finally...)
+	pipelineTasks := make([]v1.PipelineTask, 0, len(pSpec.Tasks)+len(pSpec.Finally))
+	pipelineTasks = append(pipelineTasks, pSpec.Tasks...)
+	pipelineTasks = append(pipelineTasks, pSpec.Finally...)
 
 	var last string
 	for i, t := range pipelineTasks {

pkg/chains/formats/slsa/v1/intotoite6_test.go

@@ -178,15 +178,15 @@ func TestPipelineRun_GetResults(t *testing.T) {
 		pr := NewPipelineRunObjectV1(getPipelineRun())
 		got := pr.GetResults()
 		assert.ElementsMatch(t, got, []Result{
-			Result{
+			{
 				Name: "img1_input_ARTIFACT_INPUTS",
 				Value: *v1.NewObject(map[string]string{
 					"uri":    "gcr.io/foo/bar",
 					"digest": "sha256:05f95b26ed10668b7183c1e2da98610e91372fa9f510046d4ce5812addad86b7",
 				}),
 			},
-			Result{Name: "mvn1_ARTIFACT_URI", Value: *v1.NewStructuredValues("projects/test-project/locations/us-west4/repositories/test-repo/mavenArtifacts/com.google.guava:guava:31.0-jre")},
-			Result{Name: "mvn1_ARTIFACT_DIGEST", Value: *v1.NewStructuredValues("sha256:05f95b26ed10668b7183c1e2da98610e91372fa9f510046d4ce5812addad86b5")},
+			{Name: "mvn1_ARTIFACT_URI", Value: *v1.NewStructuredValues("projects/test-project/locations/us-west4/repositories/test-repo/mavenArtifacts/com.google.guava:guava:31.0-jre")},
+			{Name: "mvn1_ARTIFACT_DIGEST", Value: *v1.NewStructuredValues("sha256:05f95b26ed10668b7183c1e2da98610e91372fa9f510046d4ce5812addad86b5")},
 		})
 	})
 

pkg/chains/formats/slsa/v1/pipelinerun/pipelinerun.go

@@ -54,12 +54,14 @@ MC4CAQAwBQYDK2VwBCIEIGQn0bJwshjwuVdnd/FylMk3Gvb89aGgH49bQpgzCY0n
 // python3 -c "import jwt; import time; private_key = open('/tmp/private.pem').read(); payload = {'iat': int(time.time()), 'exp': int(time.time()) + 3600 * 24 * 365 * 10, 'iss': 'user123'}; print(jwt.encode(payload, private_key, algorithm='RS256'))"
 const token = `eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE3NjIzMTIzOTQsImV4cCI6MjA3NzY3MjM5NCwiaXNzIjoidXNlcjEyMyJ9.Adm27mf955gZA2pcWLqF4LLrqzFbXYsdYNg1sScF9MbyeuE-4eVpqV91Rk-iRwwIrtKuOVkEDdulrAqeuIhMxGB7jNXWXxf6sVEHV57_QgB0KR_z-JVxEbTZBu6nIVBwDxmVFGQFVMtZbqsyX8J4F_jp0pSInFPqYQbS9xAGhvOnni_owp325Siev2Z-kWsnTTFOTi0C9g9BApPxXQEE17COYdXjxsBCJQQttb1Ww7IQLCf59wU5ZpNM7npzxvKuOBT1kmHPp1ZDCNxfA_a6JMIB4NQAzYV0ULRbXNftxwglFoyitWge-SyxohnTVfV1gplE8qi6kR2CQJORBMvx6w`
 
+const testTrueValue = "true"
+
 func TestCreateSignerFulcioEnabledDefaultTokenFileMissing(t *testing.T) {
 	ctx := logtesting.TestContextWithLogger(t)
 	d := t.TempDir()
 
 	data := make(map[string]string)
-	data["signers.x509.fulcio.enabled"] = "true"
+	data["signers.x509.fulcio.enabled"] = testTrueValue
 	cfg, err := config.NewConfigFromMap(data)
 	if err != nil {
 		t.Fatal(err)
@@ -88,7 +90,7 @@ func TestCreateSignerFulcioEnabled(t *testing.T) {
 	}
 
 	data := make(map[string]string)
-	data["signers.x509.fulcio.enabled"] = "true"
+	data["signers.x509.fulcio.enabled"] = testTrueValue
 	data["signers.x509.identity.token.file"] = tk
 	cfg, err := config.NewConfigFromMap(data)
 	if err != nil {
@@ -123,7 +125,7 @@ func TestCreateSignerFulcioEnabledFilesystemProvider(t *testing.T) {
 	}
 
 	data := make(map[string]string)
-	data["signers.x509.fulcio.enabled"] = "true"
+	data["signers.x509.fulcio.enabled"] = testTrueValue
 	data["signers.x509.identity.token.file"] = tk
 	data["signers.x509.fulcio.provider"] = "filesystem"
 	cfg, err := config.NewConfigFromMap(data)