feat: verify provenance for bcr modules produced by trusted reusable workflows (#840)

@fweikert these are the changes I think might be needed to get this to
work (it's somewhat hacky, I'm not sure I've fully covered what's
needed).

@ramonpetgrave64 is this kinda what's needed?

This now adds the `verify-github-attestation` sub command. Use this
instead of `verify-artifact`.

---------

Signed-off-by: Appu Goundan <appu@google.com>
Signed-off-by: Appu <appu@google.com>
Co-authored-by: Ramon Petgrave <32398091+ramonpetgrave64@users.noreply.github.com>

Author: loosebazooka

cli/slsa-verifier/main.go

@@ -35,6 +35,7 @@ For more information on SLSA, visit https://slsa.dev`,
 	}
 	c.AddCommand(version.Version())
 	c.AddCommand(verifyArtifactCmd())
+	c.AddCommand(verifyGithubAttestation())
 	c.AddCommand(verifyImageCmd())
 	c.AddCommand(verifyNpmPackageCmd())
 	c.AddCommand(verifyVSACmd())

cli/slsa-verifier/main_regression_test.go

@@ -1510,6 +1510,75 @@ func Test_runVerifyGHAContainerBased(t *testing.T) {
 	}
 }
 
+func Test_runVerifyGithubAttestation(t *testing.T) {
+	t.Parallel()
+	os.Setenv("SLSA_VERIFIER_EXPERIMENTAL", "1")
+
+	bcrReleaserBuilderID := "https://github.com/bazel-contrib/.github/.github/workflows/release_ruleset.yaml"
+	bcrPublisherBuilderID := "https://github.com/bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml"
+
+	tests := []struct {
+		name      string
+		artifact  string
+		source    string
+		builderID string
+		err       error
+	}{
+		{
+			name:      "module.bazel using publishing builder",
+			artifact:  "MODULE.bazel",
+			source:    "github.com/aspect-build/rules_lint",
+			builderID: bcrPublisherBuilderID,
+		},
+		{
+			name:      "source archive using release builder",
+			artifact:  "rules_lint-v1.3.1.tar.gz",
+			source:    "github.com/aspect-build/rules_lint",
+			builderID: bcrReleaserBuilderID,
+		},
+		{
+			name:      "module.bazel wrong signer",
+			artifact:  "MODULE-wrong-signer.bazel",
+			source:    "github.com/aspect-build/rules_lint",
+			builderID: bcrPublisherBuilderID,
+			err:       serrors.ErrorUntrustedReusableWorkflow,
+		},
+		{
+			name:     "module.bazel no builder id",
+			artifact: "MODULE.bazel",
+			source:   "github.com/aspect-build/rules_lint",
+			err:      serrors.ErrorUntrustedReusableWorkflow,
+		},
+		{
+			name:     "source archive no builder id",
+			artifact: "rules_lint-v1.3.1.tar.gz",
+			source:   "github.com/aspect-build/rules_lint",
+			err:      serrors.ErrorUntrustedReusableWorkflow,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			artifactPath := filepath.Clean(filepath.Join(TEST_DIR, "bcr", tt.artifact))
+			// we treat these single entry *.intoto.jsonl bundles as single attestations
+			attestationPath := fmt.Sprintf("%s.intoto.jsonl", artifactPath)
+			cmd := verify.VerifyGithubAttestationCommand{
+				AttestationPath: attestationPath,
+				BuilderID:       &tt.builderID,
+				SourceURI:       tt.source,
+			}
+
+			_, err := cmd.Exec(context.Background(), artifactPath)
+			if !errCmp(tt.err, err) {
+				t.Errorf("unexpected error (-want +got):\n%s", cmp.Diff(err, tt.err, cmpopts.EquateErrors()))
+			}
+		})
+	}
+
+}
+
 func Test_runVerifyNpmPackage(t *testing.T) {
 	// We cannot use t.Setenv due to parallelized tests.
 	os.Setenv("SLSA_VERIFIER_EXPERIMENTAL", "1")
@@ -2063,3 +2132,15 @@ func Test_runVerifyVSA(t *testing.T) {
 func pointerTo[K any](object K) *K {
 	return &object
 }
+
+func unwrapFull(t *testing.T, err error) error {
+	for err != nil {
+		t.Logf("%v", err)
+		unwrapped := errors.Unwrap(err)
+		if unwrapped == nil {
+			return err
+		}
+		err = unwrapped
+	}
+	return nil
+}

cli/slsa-verifier/testdata/bcr/MODULE-wrong-signer.bazel

@@ -0,0 +1,34 @@
+"Bazel dependencies"
+
+module(
+    name = "aspect_rules_lint",
+    version = "1.3.1",
+    compatibility_level = 1,
+)
+
+bazel_dep(name = "aspect_bazel_lib", version = "2.7.7")
+
+# Needed in the root because we use js_lib_helpers in our aspect impl
+# Minimum version needs 'chore: bump bazel-lib to 2.0 by @alexeagle in #1311'
+# to allow users on bazel-lib 2.0
+bazel_dep(name = "aspect_rules_js", version = "1.40.0")
+bazel_dep(name = "bazel_features", version = "1.0.0")
+bazel_dep(name = "bazel_skylib", version = "1.4.2")
+bazel_dep(name = "platforms", version = "0.0.7")
+bazel_dep(name = "rules_multirun", version = "0.9.0")
+bazel_dep(name = "rules_multitool", version = "0.4.0")
+bazel_dep(name = "rules_diff", version = "1.0.0")
+
+# Needed in the root because we dereference ProtoInfo in our aspect impl
+bazel_dep(name = "rules_proto", version = "6.0.0")
+
+# Needed in the root because we dereference the toolchain in our aspect impl
+bazel_dep(name = "rules_buf", version = "0.1.1")
+bazel_dep(name = "toolchains_protoc", version = "0.2.1")
+
+multitool = use_extension("@rules_multitool//multitool:extension.bzl", "multitool")
+multitool.hub(lockfile = "//format:multitool.lock.json")
+multitool.hub(lockfile = "//lint:multitool.lock.json")
+use_repo(multitool, "multitool")
+
+bazel_dep(name = "stardoc", version = "0.7.0", dev_dependency = True, repo_name = "io_bazel_stardoc")

cli/slsa-verifier/testdata/bcr/MODULE-wrong-signer.bazel.intoto.jsonl

@@ -0,0 +1 @@
+{"mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json", "verificationMaterial": {"certificate": {"rawBytes": "MIIHEDCCBpagAwIBAgIURWOfSxuXPzVJEUYMqGSLmbg6RpMwCgYIKoZIzj0EAwMwNzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRlcm1lZGlhdGUwHhcNMjUwMzMxMTgzOTI4WhcNMjUwMzMxMTg0OTI4WjAAMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEOCxDx+2nw6V+7xh9entsHceuXRVU8YaKb+lhOGOmgpHksRuIpJQGad7mSjQuxTtHioli7VV8rccLtZHhmCBPS6OCBbUwggWxMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUv/8srKhGZWkYFCkJOTYsvXy4/qswHwYDVR0jBBgwFoAU39Ppz1YkEZb5qNjpKFWixi4YZD8wcgYDVR0RAQH/BGgwZoZkaHR0cHM6Ly9naXRodWIuY29tL2xvb3NlYmF6b29rYS9hYS10ZXN0Ly5naXRodWIvd29ya2Zsb3dzL21hbGljaW91c19hdHRlc3RhdGlvbi55YW1sQHJlZnMvaGVhZHMvbWFpbjA5BgorBgEEAYO/MAEBBCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMB8GCisGAQQBg78wAQIEEXdvcmtmbG93X2Rpc3BhdGNoMDYGCisGAQQBg78wAQMEKDliMDgwMGEyZTEzNmNiN2MzMjFiZmRmNDlmNzNkMDQyNWU1MDFjYzMwJQYKKwYBBAGDvzABBAQXR2VuZXJhdGUgUHJvdmVuYW5jZSBCWkwwIgYKKwYBBAGDvzABBQQUbG9vc2ViYXpvb2thL2FhLXRlc3QwHQYKKwYBBAGDvzABBgQPcmVmcy9oZWFkcy9tYWluMDsGCisGAQQBg78wAQgELQwraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTB0BgorBgEEAYO/MAEJBGYMZGh0dHBzOi8vZ2l0aHViLmNvbS9sb29zZWJhem9va2EvYWEtdGVzdC8uZ2l0aHViL3dvcmtmbG93cy9tYWxpY2lvdXNfYXR0ZXN0YXRpb24ueWFtbEByZWZzL2hlYWRzL21haW4wOAYKKwYBBAGDvzABCgQqDCg5YjA4MDBhMmUxMzZjYjdjMzIxYmZkZjQ5ZjczZDA0MjVlNTAxY2MzMB0GCisGAQQBg78wAQsEDwwNZ2l0aHViLWhvc3RlZDA3BgorBgEEAYO/MAEMBCkMJ2h0dHBzOi8vZ2l0aHViLmNvbS9sb29zZWJhem9va2EvYWEtdGVzdDA4BgorBgEEAYO/MAENBCoMKDliMDgwMGEyZTEzNmNiN2MzMjFiZmRmNDlmNzNkMDQyNWU1MDFjYzMwHwYKKwYBBAGDvzABDgQRDA9yZWZzL2hlYWRzL21haW4wGQYKKwYBBAGDvzABDwQLDAk4OTE3MTU0NDQwLwYKKwYBBAGDvzABEAQhDB9odHRwczovL2dpdGh1Yi5jb20vbG9vc2ViYXpvb2thMBcGCisGAQQBg78wAREECQwHMTMwNDgyNjB0BgorBgEEAYO/MAESBGYMZGh0dHBzOi8vZ2l0aHViLmNvbS9sb29zZWJhem9va2EvYWEtdGVzdC8uZ2l0aHViL3dvcmtmbG93cy9tYWxpY2lvdXNfYXR0ZXN0YXRpb24ueWFtbEByZWZzL2hlYWRzL21haW4wOAYKKwYBBAGDvzABEwQqDCg5YjA4MDBhMmUxMzZjYjdjMzIxYmZkZjQ5ZjczZDA0MjVlNTAxY2MzMCEGCisGAQQBg78wARQEEwwRd29ya2Zsb3dfZGlzcGF0Y2gwWwYKKwYBBAGDvzABFQRNDEtodHRwczovL2dpdGh1Yi5jb20vbG9vc2ViYXpvb2thL2FhLXRlc3QvYWN0aW9ucy9ydW5zLzE0MTc4ODgyMjQzL2F0dGVtcHRzLzEwFgYKKwYBBAGDvzABFgQIDAZwdWJsaWMwgYoGCisGAQQB1nkCBAIEfAR6AHgAdgDdPTBqxscRMmMZHhyZZzcCokpeuN48rf+HinKALynujgAAAZXtgGGXAAAEAwBHMEUCIQDqwWd8yF61K3dKLCB/i46M7ymBkahNINvmbpfCNlzW0AIgQZ60yZp5ZWstqPAa9dYVnX8oviLAsAXvdUAO5FC7NYQwCgYIKoZIzj0EAwMDaAAwZQIxALrB4Pjcq0KkvFgR73U1wd6QZDSp0Z/HANSbjuVB/83VH0XzYPlEtdt2wySEneKoQAIwHw3IJ7INdxLpxEGb3K4lbxInu/0+UpmMeY3+Fls3IttXbx+MPHB81w8mQB1eiCIG"}, "tlogEntries": [{"logIndex": "190354141", "logId": {"keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0="}, "kindVersion": {"kind": "dsse", "version": "0.0.1"}, "integratedTime": "1743446368", "inclusionPromise": {"signedEntryTimestamp": "MEUCIAEOAUBnT7rKlB8CSMdlCCer21mW6rGKAAbcYkDXxTUFAiEAiPIrf+ka631N0ZXh/AsB8R+rvyQ/PlaBzRfZvgNx/Bs="}, "inclusionProof": {"logIndex": "68449879", "rootHash": "Pzd//dVRqtUdThKMd4kGVa3Y9t4iLeoptGi36NF+VY8=", "treeSize": "68449881", "hashes": ["50T/EJW6zqoHIx8xcGy07kZ190X2nYCtkdNc9PUJESE=", "0dz1YfaxxbPQu0S6bQpbADyB+4i3ydMq4IBJ5d7PQ3Y=", "IkDlJAEXqhTIjv7cSMV/ZLReP9f5u19dSoXvCJYcb3k=", "LMtk0ptAdReAMDIjz1ifH2dudYcgWxtnS3csDHxvVes=", "yg6V8cwhqpomzaPkSK6b0sX+044T3mjzhoBAklRfV4E=", "MjSCQgjB/+NuOxwENKDgqhmyXQ67h78KtnaR372Drdk=", "j9N8wWyxTLYX9xvh+PJPTpIhkTkic5Xlq2QJ3o3qte8=", "5js2YKrmc9qbDWDZUiVRfr0Ztm1V/Y1KosqGkclaNX4=", "hXQdjV/Umh9w/HAl2zupeNXPFMcozJ4uJWIlyyyYHhc=", "/ilV47LabPcRkc0f8Q663uyjZxM/ejxeWxAp1ohU/ho=", "eD1nICgVTOrXeYUCWqRbxMeltN4yWQq4Kg7gO/3vNCA=", "9cebns9CaJpF5CqTGgcX8M1/t+C1dWLXTFlVwmx2OTI=", "0h8nhcle5C9UpTvzBlAM62Top+G4DS282xnhunrGDFs=", "7v8qPHNDLerpduaMx06eb/MwgoQwczTn/cYGKX/9wZ4="], "checkpoint": {"envelope": "rekor.sigstore.dev - 1193050959916656506\n68449881\nPzd//dVRqtUdThKMd4kGVa3Y9t4iLeoptGi36NF+VY8=\n\n\u2014 rekor.sigstore.dev wNI9ajBEAiARUbHw2zmjlI7RvDO6Pl79T8rHjyvyOJfmrUJA5AHgNgIgcaUU3d4+rAetQfcXyNRZYAgvQ1oXhrISK3iczotQy4Y=\n"}}, "canonicalizedBody": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiZHNzZSIsInNwZWMiOnsiZW52ZWxvcGVIYXNoIjp7ImFsZ29yaXRobSI6InNoYTI1NiIsInZhbHVlIjoiYzg5NjY2NWRhMGQ3OWJmN2FkM2M1NDJjODAxN2MzYTljNGJkYjdkMjYyZjQ3ZjE1MDBjY2ZiNmE0NjBiZTQzMCJ9LCJwYXlsb2FkSGFzaCI6eyJhbGdvcml0aG0iOiJzaGEyNTYiLCJ2YWx1ZSI6IjlmNzI4NzkxNzdkNDUxYzg3ZDYzOTM5MTI2Y2IyMjA4MDM3OTE0NDk5NmY3NzU2NmM4OTk1NDZjM2Q5MTU1ZGEifSwic2lnbmF0dXJlcyI6W3sic2lnbmF0dXJlIjoiTUVVQ0lRREVhRlA0RW02ejFOeEp2dWdMazJrWFV2VHp6NHdocXpKc0VXNlBGZEV0eEFJZ0ttOUZuOW81RE5ZaDROQnY2U1E1cGs2Q0s4cHpHZHRxRGtPNTUrYTFZVlU9IiwidmVyaWZpZXIiOiJMUzB0TFMxQ1JVZEpUaUJEUlZKVVNVWkpRMEZVUlMwdExTMHRDazFKU1VoRlJFTkRRbkJoWjBGM1NVSkJaMGxWVWxkUFpsTjRkVmhRZWxaS1JWVlpUWEZIVTB4dFltYzJVbkJOZDBObldVbExiMXBKZW1vd1JVRjNUWGNLVG5wRlZrMUNUVWRCTVZWRlEyaE5UV015Ykc1ak0xSjJZMjFWZFZwSFZqSk5ValIzU0VGWlJGWlJVVVJGZUZaNllWZGtlbVJIT1hsYVV6RndZbTVTYkFwamJURnNXa2RzYUdSSFZYZElhR05PVFdwVmQwMTZUWGhOVkdkNlQxUkpORmRvWTA1TmFsVjNUWHBOZUUxVVp6QlBWRWswVjJwQlFVMUdhM2RGZDFsSUNrdHZXa2w2YWpCRFFWRlpTVXR2V2tsNmFqQkVRVkZqUkZGblFVVlBRM2hFZUNzeWJuYzJWaXMzZUdnNVpXNTBjMGhqWlhWWVVsWlZPRmxoUzJJcmJHZ0tUMGRQYldkd1NHdHpVblZKY0VwUlIyRmtOMjFUYWxGMWVGUjBTR2x2YkdrM1ZsWTRjbU5qVEhSYVNHaHRRMEpRVXpaUFEwSmlWWGRuWjFkNFRVRTBSd3BCTVZWa1JIZEZRaTkzVVVWQmQwbElaMFJCVkVKblRsWklVMVZGUkVSQlMwSm5aM0pDWjBWR1FsRmpSRUY2UVdSQ1owNVdTRkUwUlVablVWVjJMemh6Q25KTGFFZGFWMnRaUmtOclNrOVVXWE4yV0hrMEwzRnpkMGgzV1VSV1VqQnFRa0puZDBadlFWVXpPVkJ3ZWpGWmEwVmFZalZ4VG1wd1MwWlhhWGhwTkZrS1drUTRkMk5uV1VSV1VqQlNRVkZJTDBKSFozZGFiMXByWVVoU01HTklUVFpNZVRsdVlWaFNiMlJYU1hWWk1qbDBUREo0ZG1JelRteFpiVVkyWWpJNWNncFpVemxvV1ZNeE1GcFlUakJNZVRWdVlWaFNiMlJYU1haa01qbDVZVEphYzJJelpIcE1NakZvWWtkc2FtRlhPVEZqTVRsb1pFaFNiR016VW1oa1IyeDJDbUpwTlRWWlZ6RnpVVWhLYkZwdVRYWmhSMVpvV2toTmRtSlhSbkJpYWtFMVFtZHZja0puUlVWQldVOHZUVUZGUWtKRGRHOWtTRkozWTNwdmRrd3pVbllLWVRKV2RVeHRSbXBrUjJ4MlltNU5kVm95YkRCaFNGWnBaRmhPYkdOdFRuWmlibEpzWW01UmRWa3lPWFJOUWpoSFEybHpSMEZSVVVKbk56aDNRVkZKUlFwRldHUjJZMjEwYldKSE9UTllNbEp3WXpOQ2FHUkhUbTlOUkZsSFEybHpSMEZSVVVKbk56aDNRVkZOUlV0RWJHbE5SR2QzVFVkRmVWcFVSWHBPYlU1cENrNHlUWHBOYWtacFdtMVNiVTVFYkcxT2VrNXJUVVJSZVU1WFZURk5SRVpxV1hwTmQwcFJXVXRMZDFsQ1FrRkhSSFo2UVVKQ1FWRllVakpXZFZwWVNtZ0taRWRWWjFWSVNuWmtiVloxV1ZjMWFscFRRa05YYTNkM1NXZFpTMHQzV1VKQ1FVZEVkbnBCUWtKUlVWVmlSemwyWXpKV2FWbFljSFppTW5Sb1RESkdhQXBNV0ZKc1l6TlJkMGhSV1V0TGQxbENRa0ZIUkhaNlFVSkNaMUZRWTIxV2JXTjVPVzlhVjBaclkzazVkRmxYYkhWTlJITkhRMmx6UjBGUlVVSm5OemgzQ2tGUlowVk1VWGR5WVVoU01HTklUVFpNZVRrd1lqSjBiR0pwTldoWk0xSndZakkxZWt4dFpIQmtSMmd4V1c1V2VscFlTbXBpTWpVd1dsYzFNRXh0VG5ZS1lsUkNNRUpuYjNKQ1owVkZRVmxQTDAxQlJVcENSMWxOV2tkb01HUklRbnBQYVRoMldqSnNNR0ZJVm1sTWJVNTJZbE01YzJJeU9YcGFWMHBvWlcwNWRncGhNa1YyV1ZkRmRHUkhWbnBrUXpoMVdqSnNNR0ZJVm1sTU0yUjJZMjEwYldKSE9UTmplVGwwV1ZkNGNGa3liSFprV0U1bVdWaFNNRnBZVGpCWldGSndDbUl5TkhWbFYwWjBZa1ZDZVZwWFducE1NbWhzV1ZkU2Vrd3lNV2hoVnpSM1QwRlpTMHQzV1VKQ1FVZEVkbnBCUWtOblVYRkVRMmMxV1dwQk5FMUVRbWdLVFcxVmVFMTZXbXBaYW1ScVRYcEplRmx0V210YWFsRTFXbXBqZWxwRVFUQk5hbFpzVGxSQmVGa3lUWHBOUWpCSFEybHpSMEZSVVVKbk56aDNRVkZ6UlFwRWQzZE9XakpzTUdGSVZtbE1WMmgyWXpOU2JGcEVRVE5DWjI5eVFtZEZSVUZaVHk5TlFVVk5Ra05yVFVveWFEQmtTRUo2VDJrNGRsb3liREJoU0ZacENreHRUblppVXpsellqSTVlbHBYU21obGJUbDJZVEpGZGxsWFJYUmtSMVo2WkVSQk5FSm5iM0pDWjBWRlFWbFBMMDFCUlU1Q1EyOU5TMFJzYVUxRVozY0tUVWRGZVZwVVJYcE9iVTVwVGpKTmVrMXFSbWxhYlZKdFRrUnNiVTU2VG10TlJGRjVUbGRWTVUxRVJtcFplazEzU0hkWlMwdDNXVUpDUVVkRWRucEJRZ3BFWjFGU1JFRTVlVnBYV25wTU1taHNXVmRTZWt3eU1XaGhWelIzUjFGWlMwdDNXVUpDUVVkRWRucEJRa1IzVVV4RVFXczBUMVJGTTAxVVZUQk9SRkYzQ2t4M1dVdExkMWxDUWtGSFJIWjZRVUpGUVZGb1JFSTViMlJJVW5kamVtOTJUREprY0dSSGFERlphVFZxWWpJd2RtSkhPWFpqTWxacFdWaHdkbUl5ZEdnS1RVSmpSME5wYzBkQlVWRkNaemM0ZDBGU1JVVkRVWGRJVFZSTmQwNUVaM2xPYWtJd1FtZHZja0puUlVWQldVOHZUVUZGVTBKSFdVMWFSMmd3WkVoQ2VncFBhVGgyV2pKc01HRklWbWxNYlU1MllsTTVjMkl5T1hwYVYwcG9aVzA1ZG1FeVJYWlpWMFYwWkVkV2VtUkRPSFZhTW13d1lVaFdhVXd6WkhaamJYUnRDbUpIT1ROamVUbDBXVmQ0Y0ZreWJIWmtXRTVtV1ZoU01GcFlUakJaV0ZKd1lqSTBkV1ZYUm5SaVJVSjVXbGRhZWt3eWFHeFpWMUo2VERJeGFHRlhOSGNLVDBGWlMwdDNXVUpDUVVkRWRucEJRa1YzVVhGRVEyYzFXV3BCTkUxRVFtaE5iVlY0VFhwYWFsbHFaR3BOZWtsNFdXMWFhMXBxVVRWYWFtTjZXa1JCTUFwTmFsWnNUbFJCZUZreVRYcE5RMFZIUTJselIwRlJVVUpuTnpoM1FWSlJSVVYzZDFKa01qbDVZVEphYzJJelpHWmFSMng2WTBkR01Ga3laM2RYZDFsTENrdDNXVUpDUVVkRWRucEJRa1pSVWs1RVJYUnZaRWhTZDJONmIzWk1NbVJ3WkVkb01WbHBOV3BpTWpCMllrYzVkbU15Vm1sWldIQjJZakowYUV3eVJtZ0tURmhTYkdNelVYWlpWMDR3WVZjNWRXTjVPWGxrVnpWNlRIcEZNRTFVWXpSUFJHZDVUV3BSZWt3eVJqQmtSMVowWTBoU2VreDZSWGRHWjFsTFMzZFpRZ3BDUVVkRWRucEJRa1puVVVsRVFWcDNaRmRLYzJGWFRYZG5XVzlIUTJselIwRlJVVUl4Ym10RFFrRkpSV1pCVWpaQlNHZEJaR2RFWkZCVVFuRjRjMk5TQ2sxdFRWcElhSGxhV25walEyOXJjR1YxVGpRNGNtWXJTR2x1UzBGTWVXNTFhbWRCUVVGYVdIUm5SMGRZUVVGQlJVRjNRa2hOUlZWRFNWRkVjWGRYWkRnS2VVWTJNVXN6WkV0TVEwSXZhVFEyVFRkNWJVSnJZV2hPU1U1MmJXSndaa05PYkhwWE1FRkpaMUZhTmpCNVduQTFXbGR6ZEhGUVFXRTVaRmxXYmxnNGJ3cDJhVXhCYzBGWWRtUlZRVTgxUmtNM1RsbFJkME5uV1VsTGIxcEplbW93UlVGM1RVUmhRVUYzV2xGSmVFRk1ja0kwVUdwamNUQkxhM1pHWjFJM00xVXhDbmRrTmxGYVJGTndNRm92U0VGT1UySnFkVlpDTHpnelZrZ3dXSHBaVUd4RmRHUjBNbmQ1VTBWdVpVdHZVVUZKZDBoM00wbEtOMGxPWkhoTWNIaEZSMklLTTBzMGJHSjRTVzUxTHpBclZYQnRUV1ZaTXl0R2JITXpTWFIwV0dKNEswMVFTRUk0TVhjNGJWRkNNV1ZwUTBsSENpMHRMUzB0UlU1RUlFTkZVbFJKUmtsRFFWUkZMUzB0TFMwSyJ9XX19"}], "timestampVerificationData": {}}, "dsseEnvelope": {"payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoiTU9EVUxFLmJhemVsIiwiZGlnZXN0Ijp7InNoYTI1NiI6IjA2Y2UzMzA5MDBhN2Q2NDAzYmM4ZDg4ZTVkZmFkNmFlZWI4YWU0MDE3OWY2NmJiODllNjljOGJmNmY2YjFhMGIifX1dLCJwcmVkaWNhdGVUeXBlIjoiaHR0cHM6Ly9zbHNhLmRldi9wcm92ZW5hbmNlL3YxIiwicHJlZGljYXRlIjp7ImJ1aWxkRGVmaW5pdGlvbiI6eyJidWlsZFR5cGUiOiJodHRwczovL2FjdGlvbnMuZ2l0aHViLmlvL2J1aWxkdHlwZXMvd29ya2Zsb3cvdjEiLCJleHRlcm5hbFBhcmFtZXRlcnMiOnsid29ya2Zsb3ciOnsicmVmIjoicmVmcy9oZWFkcy9wdWJsaXNoLXRvLWJjciIsInJlcG9zaXRvcnkiOiJodHRwczovL2dpdGh1Yi5jb20vYXNwZWN0LWJ1aWxkL3J1bGVzX2xpbnQiLCJwYXRoIjoiLmdpdGh1Yi93b3JrZmxvd3MvcmVsZWFzZS55bWwifX0sImludGVybmFsUGFyYW1ldGVycyI6eyJnaXRodWIiOnsiZXZlbnRfbmFtZSI6IndvcmtmbG93X2Rpc3BhdGNoIiwicmVwb3NpdG9yeV9pZCI6IjYzMTcxMDc0MSIsInJlcG9zaXRvcnlfb3duZXJfaWQiOiI2MDk1MTA5MCIsInJ1bm5lcl9lbnZpcm9ubWVudCI6ImdpdGh1Yi1ob3N0ZWQifX0sInJlc29sdmVkRGVwZW5kZW5jaWVzIjpbeyJ1cmkiOiJnaXQraHR0cHM6Ly9naXRodWIuY29tL2FzcGVjdC1idWlsZC9ydWxlc19saW50QHJlZnMvaGVhZHMvcHVibGlzaC10by1iY3IiLCJkaWdlc3QiOnsiZ2l0Q29tbWl0IjoiOGY3MDAwOWZkZTBjOTRhZGU2Y2UyYTA1NGI5NDcxOGM4MTkxMjZlYyJ9fV19LCJydW5EZXRhaWxzIjp7ImJ1aWxkZXIiOnsiaWQiOiJodHRwczovL2dpdGh1Yi5jb20vYmF6ZWwtY29udHJpYi9wdWJsaXNoLXRvLWJjci8uZ2l0aHViL3dvcmtmbG93cy9wdWJsaXNoLnlhbWxAcmVmcy90YWdzL3YwLjAuMSJ9LCJtZXRhZGF0YSI6eyJpbnZvY2F0aW9uSWQiOiJodHRwczovL2dpdGh1Yi5jb20vYXNwZWN0LWJ1aWxkL3J1bGVzX2xpbnQvYWN0aW9ucy9ydW5zLzE0MDk1NjExNjcxL2F0dGVtcHRzLzEifX19fQ==", "payloadType": "application/vnd.in-toto+json", "signatures": [{"sig": "MEUCIQDEaFP4Em6z1NxJvugLk2kXUvTzz4whqzJsEW6PFdEtxAIgKm9Fn9o5DNYh4NBv6SQ5pk6CK8pzGdtqDkO55+a1YVU="}]}}

cli/slsa-verifier/testdata/bcr/MODULE.bazel

@@ -0,0 +1,34 @@
+"Bazel dependencies"
+
+module(
+    name = "aspect_rules_lint",
+    version = "1.3.1",
+    compatibility_level = 1,
+)
+
+bazel_dep(name = "aspect_bazel_lib", version = "2.7.7")
+
+# Needed in the root because we use js_lib_helpers in our aspect impl
+# Minimum version needs 'chore: bump bazel-lib to 2.0 by @alexeagle in #1311'
+# to allow users on bazel-lib 2.0
+bazel_dep(name = "aspect_rules_js", version = "1.40.0")
+bazel_dep(name = "bazel_features", version = "1.0.0")
+bazel_dep(name = "bazel_skylib", version = "1.4.2")
+bazel_dep(name = "platforms", version = "0.0.7")
+bazel_dep(name = "rules_multirun", version = "0.9.0")
+bazel_dep(name = "rules_multitool", version = "0.4.0")
+bazel_dep(name = "rules_diff", version = "1.0.0")
+
+# Needed in the root because we dereference ProtoInfo in our aspect impl
+bazel_dep(name = "rules_proto", version = "6.0.0")
+
+# Needed in the root because we dereference the toolchain in our aspect impl
+bazel_dep(name = "rules_buf", version = "0.1.1")
+bazel_dep(name = "toolchains_protoc", version = "0.2.1")
+
+multitool = use_extension("@rules_multitool//multitool:extension.bzl", "multitool")
+multitool.hub(lockfile = "//format:multitool.lock.json")
+multitool.hub(lockfile = "//lint:multitool.lock.json")
+use_repo(multitool, "multitool")
+
+bazel_dep(name = "stardoc", version = "0.7.0", dev_dependency = True, repo_name = "io_bazel_stardoc")