7 Commits (release-4.3)

Author	SHA1	Message	Date
Ruslan Shaydullin	67d54fd880	fix(provenance): support GnuPG keybox (pubring.kbx) keyrings (#32281) ... * fix(provenance): support GnuPG keybox (pubring.kbx) keyrings Starting with GnuPG 2.1, file-backed public keyrings can use ~/.gnupg/pubring.kbx instead of the legacy pubring.gpg. Helm only read the legacy format, so chart and plugin verification failed on installations using the file-backed keybox. Make the keyring loader format-aware: - GnuPG keybox (pubring.kbx): extract OpenPGP keyblocks from the keybox container without adding a dependency. Skip ephemeral blobs, matching GnuPG's own read behavior. - ASCII-armored keyrings: load single or concatenated exports. - Legacy binary packet streams (pubring.gpg): retain the existing path. defaultKeyring() falls back to pubring.kbx when pubring.gpg is absent. pubring.gpg keeps precedence when both files exist. This change covers file-backed public keyrings. It does not read the SQLite database used by keyboxd, which needs a separate design. Related to #31836 Signed-off-by: Ruslan Shaydullin <shaydullin.r.d@outlook.com> * fix(provenance): treat only not-exist as keyring absence in defaultKeyring A stat error other than 'not exist' (e.g. a permission problem) meant the file may well be present, but defaultKeyring() skipped past it: an unreadable pubring.gpg silently lost precedence to pubring.kbx, and the surfaced error could point at the wrong file. Treat only fs.ErrNotExist as absence. For any other stat error, return that path unchanged so the real error surfaces when the keyring is opened. Signed-off-by: Ruslan Shaydullin <shaydullin.r.d@outlook.com> --------- Signed-off-by: Ruslan Shaydullin <shaydullin.r.d@outlook.com> Co-authored-by: George Jenkins <gvjenkins@gmail.com>	3 weeks ago
Matthieu MOREL	24bbb46c62	chore: fix gofumpt issues ... Signed-off-by: Matthieu MOREL <matthieu.morel35@gmail.com>	2 months ago
Matthieu MOREL	4073566e28	chore(pkg): refactor: convert tests to testify assert/require part 17 ... #### Description refactor: convert tests to testify assert/require in pkg/cmd Signed-off-by: Matthieu MOREL <matthieu.morel35@gmail.com>	2 months ago
Matthieu MOREL	9662fdd73b	refactor: enable several checks from gocritic ... Signed-off-by: Matthieu MOREL <matthieu.morel35@gmail.com>	2 months ago
Matt Farina	52267ee74b	Move repo package to versioned directory ... The repo package is internally versioned at v1. Repos were designed to be versioned. This change moves it to a versioned directory the same way other packages are now being handled. Signed-off-by: Matt Farina <matt.farina@suse.com>	1 year ago
Austin Abro	9f9eb28fed	merge ... Signed-off-by: Austin Abro <AustinAbro321@gmail.com>	2 years ago
Austin Abro	297f7b9acb	squash ... Signed-off-by: Austin Abro <AustinAbro321@gmail.com>	2 years ago