diff --git a/client/client.go b/client/client.go index 784a1cc..fe9af3f 100644 --- a/client/client.go +++ b/client/client.go @@ -37,7 +37,7 @@ func (s *SecureClient) GroundTruth() *GroundTruth { // Verify fetches the latest verification information from GitHub and Sigstore and stores the ground truth results in the client func (s *SecureClient) Verify() (*GroundTruth, error) { - _, digest, err := github.FetchLatestRelease(s.repo) + digest, err := github.FetchLatestDigest(s.repo) if err != nil { return nil, fmt.Errorf("failed to fetch latest release: %v", err) } diff --git a/github/github.go b/github/github.go index eb64e1f..88edfe7 100644 --- a/github/github.go +++ b/github/github.go @@ -11,12 +11,12 @@ import ( "github.com/tinfoilsh/verifier/util" ) -// FetchLatestRelease gets the latest release and attestation digest of a repo -func FetchLatestRelease(repo string) (string, string, error) { +// FetchLatestDigest gets the latest release and attestation digest of a repo +func FetchLatestDigest(repo string) (string, error) { url := "https://api.github.com/repos/" + repo + "/releases/latest" releaseResponse, err := util.Get(url) if err != nil { - return "", "", err + return "", err } var responseJSON struct { @@ -24,30 +24,30 @@ func FetchLatestRelease(repo string) (string, string, error) { Body string `json:"body"` } if err := json.Unmarshal(releaseResponse, &responseJSON); err != nil { - return "", "", err + return "", err } // Backwards compatibility for old EIF releases eifRegex := regexp.MustCompile(`EIF hash: ([a-fA-F0-9]{64})`) matches := eifRegex.FindStringSubmatch(responseJSON.Body) if len(matches) > 1 { - return responseJSON.TagName, matches[1], nil + return matches[1], nil } url = fmt.Sprintf(`https://github.com/%s/releases/download/%s/tinfoil.hash`, repo, responseJSON.TagName) digestResp, err := http.Get(url) if err != nil { - return "", "", err + return "", err } if digestResp.StatusCode != 200 { - return "", "", fmt.Errorf("failed to fetch attestation digest: %s", digestResp.Status) + return "", fmt.Errorf("failed to fetch attestation digest: %s", digestResp.Status) } digest, err := io.ReadAll(digestResp.Body) if err != nil { - return "", "", err + return "", err } - return responseJSON.TagName, strings.TrimSpace(string(digest)), nil + return strings.TrimSpace(string(digest)), nil } // FetchAttestationBundle fetches the sigstore bundle from a repo for a given repo and EIF hash