Skip to content

Final prerelease tasks - #5

Merged
puerco merged 4 commits into
mainfrom
final-bumps
Oct 4, 2026
Merged

puerco merged 4 commits into
mainfrom
final-bumps

Conversation

@puerco

@puerco puerco commented Oct 4, 2026

Copy link
Copy Markdown
Member

This pull request introduces a new README.md that provides comprehensive documentation for the slsa-attester tool and library, including installation, usage, and contribution guidelines. Additionally, it updates several dependencies in go.mod to newer versions, including both direct and indirect dependencies.

The most important changes are:

Documentation

  • Added a detailed README.md covering installation, usage as a CLI and library, signing, verifying, and contribution guidelines for slsa-attester.

Dependency Updates

  • Updated direct dependencies to newer versions, such as github.com/carabiner-dev/command (v0.3.2 → v0.3.3).
  • Updated indirect dependencies to newer versions, including:
    • github.com/ProtonMail/go-crypto (v1.4.1 → v1.5.2)
    • github.com/carabiner-dev/stash and github.com/carabiner-dev/vcslocator
    • github.com/olekukonko/tablewriter
    • github.com/spiffe/go-spiffe/v2
    • golang.org/x/crypto, golang.org/x/net, golang.org/x/term
    • google.golang.org/grpc
    • sigs.k8s.io/release-utils [1] [2] [3] [4] [5]
  • Added new indirect dependencies from the policylabs organization, such as github.com/policylabs/attestation, github.com/policylabs/collector, github.com/policylabs/policy, github.com/policylabs/predicates, and github.com/policylabs/signer.

puerco added 4 commits October 4, 2026 23:42
Signed-off-by: Adolfo Garcia Veytia (puerco) <puerco@carabiner.dev>
Signed-off-by: Adolfo Garcia Veytia (puerco) <puerco@carabiner.dev>
Signed-off-by: Adolfo Garcia Veytia (puerco) <puerco@carabiner.dev>
The bumped command module uses policylabs/signer, and the
attester still imported carabiner-dev/signer: two module paths for
the same code, whose types do not mix, so the build failed. Import
signer, attestation and collector by their new names.

Signed-off-by: Adolfo Garcia Veytia (puerco) <puerco@carabiner.dev>
@puerco
puerco merged commit 248d070 into main Oct 4, 2026
9 checks passed
@puerco
puerco deleted the final-bumps branch October 4, 2026 22:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant