INNER CODE UNIT · Python

generate

94fzb/zrlog · shell/release/generate_trust_metadata.py:47

def generate(
    artifact: Path,
    *,
    source_commit: str,
    source_repository: str,
    workflow_url: str,
    build_timestamp: str,
) -> list[Path]:
    checksum = sha256_file(artifact)
    checksum_path = artifact.with_name(artifact.name + ".sha256")
    sbom_path = artifact.with_name(artifact.name + ".sbom.cdx.json")
    signature_path = artifact.with_name(artifact.name + ".sigstore.json")
    provenance_path = artifact.with_name(artifact.name + ".provenance.json")

    write_text(checksum_path, f"{checksum}  {artifact.name}\n")
    run(["syft", "scan", str(artifact), "-o", f"cyclonedx-json={sbom_path}"])
    run(["cosign", "sign-blob", "--yes", "--bundle", str(signature_path), str(artifact)])

View source record →