buildsec / vendorme

vendorme

Vendorme is a tool that makes vendoring your project easier to do. It improves the developer workflow by giving you one single place to manage any vendored dependencies, and ensures that those are validated properly to improve the security around your supply chain.

Installation

With go 1.16 installed, run

go install github.com/buildsec/vendorme@latest

How it works

Vendorme takes a basic definition of what you want to vendor, and how to validate it. It will then go through your file - see example

Currently it only supports rekor validations.

Useage

vendorme pull will default to looking for a vendor.yaml

otherwise vendorme pull yourvendorfile.yaml

vendorme's Issues

Refactor testing

Testing doesn't follow idiomatic Go patterns very well, since tests are in a different package from the code being tested, and test data is mixed in the directory with the tests. Raising this issue as a future task for myself to refactor the test code with the following:

• Move data to testdata
• Move tests on functions to be in the same package next to that function
• Move end to end tests that call external hosts to run with a specific tag

Should we validate on digest only?

https://github.com/trmiller/vendorme/blob/0b7091a0736be19ca2fd0a3245d997356822ba07/cmd/cli/rekor/rekoruuid_validator.go#L59

The above will error on an image with the same digest but just a different URI, e.g. registry or name. I noticed this recently with gcr where they have both a global registry gcr.io as well as region specific subdomains like asia.gcr.io and

Separately do we want to just validate images in almost a reverse way? Ignore if the image isn't found in the release at all just ensure that all images inside a release have valid attestations associated with them? This would probably be difficult given the current setup as different images could have different attestations.

See: tektoncd/chains#305 as an example

Rekor validation currently broken

Upstream API changes need to be incorporated.