vendor: github.com/in-toto/in-toto-golang v0.5.0

[thaJeztah]

switch to a tagged release.

in-toto/in-toto-golang@fa494aa...v0.5.0

[thaJeztah]

Looks like fixes are needed somewhere to make sure BuildKit is compatible with their current release;

#13 [stage-0 5/6] RUN --mount=target=/go/src/github.com/moby/buildkit --mount=target=/root/.cache,type=cache   GOARCH=amd64 golangci-lint run &&   GOARCH=arm64 golangci-lint run
#13 136.5 solver/llbsolver/provenance/predicate.go:61:42: ProvenanceMaterial not declared by package v02 (typecheck)
#13 136.5 func slsaMaterials(srcs Sources) ([]slsa.ProvenanceMaterial, error) {
#13 136.5                                          ^
#13 136.5 solver/llbsolver/provenance/predicate.go:115:52: ProvenanceMaterial not declared by package v02 (typecheck)
#13 136.5 func findMaterial(srcs Sources, uri string) (*slsa.ProvenanceMaterial, bool) {
#13 136.5                                                    ^
#13 136.5 solver/llbsolver/provenance/predicate.go:63:21: ProvenanceMaterial not declared by package v02 (typecheck)
#13 136.5 	out := make([]slsa.ProvenanceMaterial, 0, count)
#13 136.5 	                   ^
#13 136.5 solver/llbsolver/provenance/predicate.go:72:17: DigestSet not declared by package v02 (typecheck)
#13 136.5 			Digest: slsa.DigestSet{
#13 136.5 			             ^
#13 136.5 solver/llbsolver/provenance/predicate.go:81:17: DigestSet not declared by package v02 (typecheck)
#13 136.5 			Digest: slsa.DigestSet{
#13 136.5 			             ^
#13 136.5 solver/llbsolver/provenance/predicate.go:90:17: DigestSet not declared by package v02 (typecheck)
#13 136.5 			Digest: slsa.DigestSet{
#13 136.5 			             ^
#13 ERROR: process "/bin/sh -c GOARCH=amd64 golangci-lint run &&   GOARCH=arm64 golangci-lint run" did not complete successfully: exit code: 1
------
 > [stage-0 5/6] RUN --mount=target=/go/src/github.com/moby/buildkit --mount=target=/root/.cache,type=cache   GOARCH=amd64 golangci-lint run &&   GOARCH=arm64 golangci-lint run:
#13 136.5 	                   ^
#13 136.5 solver/llbsolver/provenance/predicate.go:72:17: DigestSet not declared by package v02 (typecheck)
#13 136.5 			Digest: slsa.DigestSet{
#13 136.5 			             ^
#13 136.5 solver/llbsolver/provenance/predicate.go:81:17: DigestSet not declared by package v02 (typecheck)
#13 136.5 			Digest: slsa.DigestSet{
#13 136.5 			             ^
#13 136.5 solver/llbsolver/provenance/predicate.go:90:17: DigestSet not declared by package v02 (typecheck)
#13 136.5 			Digest: slsa.DigestSet{
#13 136.5 			             ^

[errordeveloper]

@thaJeztah the culprit is that types been moved to a common subpackage https://pkg.go.dev/github.com/in-toto/in-toto-golang@v0.5.0/in_toto/slsa_provenance/common

[thaJeztah]

Thanks for digging, @errordeveloper ! I updated the PR; let's see if it's happy now 😅

[thaJeztah]

Looks like the project itself uses slsa02 as alias; let me update it here as well to stay consistent and prevent confusion.

[thaJeztah]

🎉 looks like it's green now; I just pushed the last change to rename the aliases, but this should be good for review 👍

[jedevc]

Thanks @thaJeztah ❤️

PTAL @tonistiigi

[tonistiigi]

Why the prefix numbers? That is not the real pkg name anyway.

[tonistiigi]

Looks like vendor changes are only in comments. But not sure why we are making it less readable with the pkg name numbers.

[thaJeztah]

Why the prefix numbers? That is not the real pkg name anyway.

@tonistiigi I picked that alias to match what they use in their repo #3415 (comment). Overall it's a bit weird to version packages like that within a module, but 🤷‍♂️

See https://github.com/in-toto/in-toto-golang/blob/3d5537e8b005677f36fe836d15260adc65322f3e/in_toto/model.go#L18-L20

	"github.com/in-toto/in-toto-golang/in_toto/slsa_provenance/common"
	slsa01 "github.com/in-toto/in-toto-golang/in_toto/slsa_provenance/v0.1"
	slsa02 "github.com/in-toto/in-toto-golang/in_toto/slsa_provenance/v0.2"

[tonistiigi]

@thaJeztah I can see how this is required when both versions are included but we never import v1 at all.

[thaJeztah]

Not saying I like the slsa01 / slsa02 aliases, but given that both v0.1 and v0.2 have types with the same name (ProvenancePredicate), I think it helps to be consistent, so that whenever you'd encounter slsa02.ProvenancePredicate, you know we're talking about the same thing as the module itself does.