SHA256
1
0
forked from pool/rekor

Accepting request 939034 from home:msmeissn

first package of rekor transparency log server+client

OBS-URL: https://build.opensuse.org/request/show/939034
OBS-URL: https://build.opensuse.org/package/show/security/rekor?expand=0&rev=1
This commit is contained in:
Marcus Meissner 2021-12-10 09:11:57 +00:00 committed by Git OBS Bridge
commit 3dbaf89a4d
6 changed files with 100 additions and 0 deletions

23
.gitattributes vendored Normal file
View File

@ -0,0 +1,23 @@
## Default LFS
*.7z filter=lfs diff=lfs merge=lfs -text
*.bsp filter=lfs diff=lfs merge=lfs -text
*.bz2 filter=lfs diff=lfs merge=lfs -text
*.gem filter=lfs diff=lfs merge=lfs -text
*.gz filter=lfs diff=lfs merge=lfs -text
*.jar filter=lfs diff=lfs merge=lfs -text
*.lz filter=lfs diff=lfs merge=lfs -text
*.lzma filter=lfs diff=lfs merge=lfs -text
*.obscpio filter=lfs diff=lfs merge=lfs -text
*.oxt filter=lfs diff=lfs merge=lfs -text
*.pdf filter=lfs diff=lfs merge=lfs -text
*.png filter=lfs diff=lfs merge=lfs -text
*.rpm filter=lfs diff=lfs merge=lfs -text
*.tbz filter=lfs diff=lfs merge=lfs -text
*.tbz2 filter=lfs diff=lfs merge=lfs -text
*.tgz filter=lfs diff=lfs merge=lfs -text
*.ttf filter=lfs diff=lfs merge=lfs -text
*.txz filter=lfs diff=lfs merge=lfs -text
*.whl filter=lfs diff=lfs merge=lfs -text
*.xz filter=lfs diff=lfs merge=lfs -text
*.zip filter=lfs diff=lfs merge=lfs -text
*.zst filter=lfs diff=lfs merge=lfs -text

1
.gitignore vendored Normal file
View File

@ -0,0 +1 @@
.osc

3
rekor-0.3.0.tar.gz Normal file
View File

@ -0,0 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:13a320256b2dffb21dd97c95d7284c71e98d3f4f5a582f9e35cfe40852242ea8
size 558172

9
rekor.changes Normal file
View File

@ -0,0 +1,9 @@
-------------------------------------------------------------------
Wed Dec 8 16:58:06 UTC 2021 - Marcus Rueckert <mrueckert@suse.de>
- prepare building of the serve part
-------------------------------------------------------------------
Fri Nov 26 16:01:30 UTC 2021 - Marcus Rueckert <mrueckert@suse.de>
- initial package

61
rekor.spec Normal file
View File

@ -0,0 +1,61 @@
#
# Copyright (c) 2021 SUSE LLC
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
# upon. The license for this file, and modifications and additions to the
# file, is the same license as for the pristine package itself (unless the
# license for the pristine package is not an Open Source License, in which
# case the license is the MIT License). An "Open Source License" is a
# license that conforms to the Open Source Definition (Version 1.9)
# published by the Open Source Initiative.
# Please submit bugfixes or comments via https://bugs.opensuse.org/
#
%define apps cli
Name: rekor
Version: 0.3.0
Release: 0
%define revision e4303a8
Summary: Supply Chain Transparency Log
License: Apache-2.0
Url: https://github.com/sigstore/rekor
Source: https://github.com/sigstore/rekor/archive/refs/tags/v%{version}.tar.gz#/%{name}-%{version}.tar.gz
Source1: vendor.tar.xz
BuildRequires: golang(API)
BuildRequires: golang-packaging
%{go_nostrip}
%description
Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. Rekor will enable software maintainers and build systems to record signed metadata to an immutable record. Other parties can then query said metadata to enable them to make informed decisions on trust and non-repudiation of an object's lifecycle. For more details visit the sigstore website
The Rekor project provides a restful API based server for validation and a transparency log for storage. A CLI application is available to make and verify entries, query the transparency log for inclusion proof, integrity verification of the transparency log or retrieval of entries by either public key or artifact.
Rekor fulfils the signature transparency role of sigstore's software signing infrastructure. However, Rekor can be run on its own and is designed to be extensible to working with different manifest schemas and PKI tooling.
%prep
%autosetup -p1 -a1
%build
DATE_FMT="+%Y-%m-%dT%H:%M:%SZ"
BUILD_DATE=$(shell date -u -d "@${SOURCE_DATE_EPOCH}" "${DATE_FMT}" 2>/dev/null || date -u -r "${SOURCE_DATE_EPOCH}" "${DATE_FMT}" 2>/dev/null || date -u "${DATE_FMT}")
for app in %{apps} ; do
CLI_PKG=github.com/sigstore/rekor/cmd/rekor-${app}/app
CLI_LDFLAGS="-X ${CLI_PKG}.gitVersion=%{version} -X ${CLI_PKG}.gitCommit=%{revision} -X ${CLI_PKG}.gitTreeState=release -X ${CLI_PKG}.buildDate=${BUILD_DATE}"
go build -mod=vendor -buildmode=pie -ldflags "${CLI_LDFLAGS}" ./cmd/rekor-${app}
./rekor-${app} version
done
%install
for app in %{apps} ; do
install -D -m 0755 rekor-${app} %{buildroot}%{_bindir}/rekor-${app}
done
%files
%license LICENSE
%doc *.md
%{_bindir}/rekor-*
%changelog

3
vendor.tar.xz Normal file
View File

@ -0,0 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:ab786903baaacb88e7ae4b01f512e6b23697611aafb68fa412f612c765aeb48e
size 3407320