Repository: sigstore/cosign
Pull request #2110 (2022-07-28 16:12:58)

Bump google.golang.org/protobuf from 1.28.0 to 1.28.1
Bumps [google.golang.org/protobuf](https://github.com/protocolbuffers/protobuf-go) from 1.28.0 to 1.28.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/protocolbuffers/protobuf-go/releases">google.golang.org/protobuf's releases</a>.</em></p>
<blockquote>
<h2>v1.28.1</h2>
<p>This release contains protoc-gen-go binaries for arm64.</p>
<p>Notable changes since <a href="https://github.com/protocolbuffers/protobuf-go/releases/tag/v1.28.0">v1.28.0</a>:</p>
<ul>
<li><a href="https://golang.org/cl/418677">CL/418677</a>: internal/impl: improve MessageInfo.New performance</li>
<li><a href="https://golang.org/cl/411377">CL/411377</a>: proto: short-circuit Equal when inputs are identical</li>
<li><a href="https://golang.org/cl/419714">CL/419714</a>: all: Add prebuild binaries for arm64</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/protocolbuffers/protobuf-go/commit/6875c3d7242d1a3db910ce8a504f124cb840c23a"><code>6875c3d</code></a> all: release v1.28.1</li>
<li><a href="https://github.com/protocolbuffers/protobuf-go/commit/881da6ece0696714305aee39afcac17b6abe8e00"><code>881da6e</code></a> all: Add prebuild binaries for arm64</li>
<li><a href="https://github.com/protocolbuffers/protobuf-go/commit/2a74a0e82391d1fc344067bc6bfc4647cd8ae7d9"><code>2a74a0e</code></a> A+C: delete AUTHORS and CONTRIBUTORS</li>
<li><a href="https://github.com/protocolbuffers/protobuf-go/commit/de9682ad1656cd1ee6808865f7a42f5a5d79eb73"><code>de9682a</code></a> internal/impl: improve MessageInfo.New performance</li>
<li><a href="https://github.com/protocolbuffers/protobuf-go/commit/b0a944684d78a6b7c1f2bb6864fa910385d5b97a"><code>b0a9446</code></a> all: reformat with go1.19 gofmt</li>
<li><a href="https://github.com/protocolbuffers/protobuf-go/commit/c1bbc5d45b2b8a056496c3db183b24e7f9a22ff1"><code>c1bbc5d</code></a> all: make integration test work on darwin/arm64</li>
<li><a href="https://github.com/protocolbuffers/protobuf-go/commit/5f429f7042ff6743d1cd695281802b8c9b8d9395"><code>5f429f7</code></a> proto: fix compilation failure in tests</li>
<li><a href="https://github.com/protocolbuffers/protobuf-go/commit/fc44d00d5a99973a6deb0863d6aaa7446c016066"><code>fc44d00</code></a> proto: use reflect.Ptr for backward compatibility</li>
<li><a href="https://github.com/protocolbuffers/protobuf-go/commit/380c339ec12310c04cd1c399669ab0bce57b6cd6"><code>380c339</code></a> proto: short-circuit Equal when inputs are identical</li>
<li><a href="https://github.com/protocolbuffers/protobuf-go/commit/784c4825545540dc41a1dc85715d3251903bc8ce"><code>784c482</code></a> all: remove shorthand import aliases</li>
<li>Additional commits viewable in <a href="https://github.com/protocolbuffers/protobuf-go/compare/v1.28.0...v1.28.1">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/protobuf&package-manager=go_modules&previous-version=1.28.0&new-version=1.28.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>

codecov-commenter: # [Codecov](https://codecov.io/gh/sigstore/cosign/pull/2110?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore) Report
> Merging [#2110](https://codecov.io/gh/sigstore/cosign/pull/2110?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore) (aee86be) into [main](https://codecov.io/gh/sigstore/cosign/commit/98396dd8f232b22f3140611ca9ce38dd730be1b9?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore) (98396dd) will **not change** coverage.
> The diff coverage is `n/a`.

```diff
@@           Coverage Diff           @@
##             main    #2110   +/-   ##
=======================================
  Coverage   26.27%   26.27%           
=======================================
  Files         129      129           
  Lines        7574     7574           
=======================================
  Hits         1990     1990           
  Misses       5329     5329           
  Partials      255      255           
```



Help us with your feedback. Take ten seconds to tell us [how you rate us](https://about.codecov.io/nps?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore).


Patch:
diff --git a/go.mod b/go.mod
index 2f04d9b8..a4344cd2 100644
--- a/go.mod
+++ b/go.mod
@@ -77,7 +77,7 @@ require (
 	golang.org/x/time v0.0.0-20220411224347-583f2d630306
 	google.golang.org/api v0.89.0
 	google.golang.org/grpc v1.48.0
-	google.golang.org/protobuf v1.28.0
+	google.golang.org/protobuf v1.28.1
 	gopkg.in/square/go-jose.v2 v2.6.0
 	gopkg.in/yaml.v2 v2.4.0
 	k8s.io/api v0.23.5
diff --git a/go.sum b/go.sum
index 2101a966..54ed4e29 100644
--- a/go.sum
+++ b/go.sum
@@ -3169,8 +3169,9 @@ google.golang.org/protobuf v1.25.1-0.20200805231151-a709e31e5d12/go.mod h1:9JNX7
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.28.0 h1:w43yiav+6bVFTBQFZX0r7ipe9JQ1QsbMgHwbBziscLw=
 google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+google.golang.org/protobuf v1.28.1 h1:d0NfwRgPtno5B1Wa6L2DAG+KivqkdutMf1UhdNx175w=
+google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 gopkg.in/airbrake/gobrake.v2 v2.0.9/go.mod h1:/h5ZAUhDkGaJfjzjKLSjv6zCL6O0LLBxU4K+aSYdM/U=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/alexcesaro/statsd.v2 v2.0.0 h1:FXkZSCZIH17vLCO5sO2UucTHsH9pc+17F6pl3JVCwMc=
diff --git a/pkg/oci/mutate/signatures.go b/pkg/oci/mutate/signatures.go
index 53f750d9..f5c24e92 100644
--- a/pkg/oci/mutate/signatures.go
+++ b/pkg/oci/mutate/signatures.go
@@ -16,6 +16,8 @@
 package mutate
 
 import (
+	"time"
+
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/google/go-containerregistry/pkg/v1/empty"
 	"github.com/google/go-containerregistry/pkg/v1/mutate"
@@ -36,10 +38,18 @@ func AppendSignatures(base oci.Signatures, sigs ...oci.Signature) (oci.Signature
 			Annotations: ann,
 		})
 	}
+
 	img, err := mutate.Append(base, adds...)
 	if err != nil {
 		return nil, err
 	}
+
+	// Set the Created date to time of execution
+	img, err = mutate.CreatedAt(img, v1.Time{Time: time.Now()})
+	if err != nil {
+		return nil, err
+	}
+
 	return &sigAppender{
 		Image: img,
 		base:  base,
diff --git a/pkg/oci/static/file.go b/pkg/oci/static/file.go
index 270b5a6b..d1d895bd 100644
--- a/pkg/oci/static/file.go
+++ b/pkg/oci/static/file.go
@@ -17,6 +17,7 @@ package static
 
 import (
 	"io"
+	"time"
 
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/google/go-containerregistry/pkg/v1/empty"
@@ -44,6 +45,12 @@ func NewFile(payload []byte, opts ...Option) (oci.File, error) {
 	if err != nil {
 		return nil, err
 	}
+
+	// Set the Created date to time of execution
+	img, err = mutate.CreatedAt(img, v1.Time{Time: time.Now()})
+	if err != nil {
+		return nil, err
+	}
 	return &file{
 		SignedImage: signed.Image(img),
 		layer:       layer,


Test patch:
diff --git a/pkg/oci/mutate/signatures_test.go b/pkg/oci/mutate/signatures_test.go
index 14978ce7..c1f0de9a 100644
--- a/pkg/oci/mutate/signatures_test.go
+++ b/pkg/oci/mutate/signatures_test.go
@@ -70,4 +70,10 @@ func TestAppendSignatures(t *testing.T) {
 	} else if got, want := len(sl), 3; got != want {
 		t.Errorf("len(Get()) = %d, wanted %d", got, want)
 	}
+
+	if testCfg, err := threeSig.ConfigFile(); err != nil {
+		t.Fatalf("ConfigFile() = %v", err)
+	} else if testCfg.Created.Time.IsZero() {
+		t.Errorf("Date of Signature was Zero")
+	}
 }
diff --git a/pkg/oci/static/file_test.go b/pkg/oci/static/file_test.go
index 8c074fbc..c652a7a3 100644
--- a/pkg/oci/static/file_test.go
+++ b/pkg/oci/static/file_test.go
@@ -120,4 +120,14 @@ func TestNewFile(t *testing.T) {
 			t.Errorf("Payload() = %s, wanted %s", got, want)
 		}
 	})
+
+	t.Run("check date", func(t *testing.T) {
+		fileCfg, err := file.ConfigFile()
+		if err != nil {
+			t.Fatalf("ConfigFile() = %v", err)
+		}
+		if fileCfg.Created.Time.IsZero() {
+			t.Errorf("Date of Signature was Zero")
+		}
+	})
 }