1. VerifyMergeable was incorrectly returning an error when no verifiers were
found (for an unprotected base branch).
2. Policy's searcher interface was also returning the wrong error when the
latest policy or attestation entry was not found.
3. A verify-mergeable command has been added to simplify debugging.
Signed-off-by: Aditya Sirish A Yelgundhalli <ayelgundhall@bloomberg.net>
These workflows have some shortcomings, as discussed in
https://github.com/gittuf/gittuf/issues/384#issuecomment-2099153472.
verify-commit doesn't currently do enough to ensure the right policy is
identified for when a commit is first introduced. verify-ref, with some
enhancements, is better.
verify-tag implements a subset of verify-ref already because it recognizes tags
are refs. Thus, verify-ref is again a better option.
Signed-off-by: Aditya Sirish A Yelgundhalli <ayelgundhall@bloomberg.net>
In addition to gittuf verify-tag workflows, this commit fixes the RSL to
be more generic. An RSL entry no longer exclusively requires a commit
ID.
Signed-off-by: Aditya Sirish <aditya@saky.in>
This is a full fledged refactor of the cmd package based on this comment:
https://github.com/adityasaky/gittuf/pull/41#discussion_r1198995982.
First, the dev subcommand is retired as it was necessary to test certain
RSL functions which have now been built. The subcommand also printed out
the git config, again something we no longer need. To that end,
GetConfig() in gitinterface has been made private.
Second, the trust and policy subcommands have been reimplemented using
the recommended structure with specific packages that construct them
with their options.
Finally, the cmd package has been moved to the internal namespace.
Signed-off-by: Aditya Sirish <aditya@saky.in>
