chore: improve release download script, update README to 1.3.0 release

Author: Thomas Neidhart

README.md

@@ -34,23 +34,22 @@ To download a release and perform verification whether the downloaded artifact h
 you should use the `download-github-release.sh` script (supported since `v1.2.0`):
 
 ```bash
-$ ./download-github-release.sh -v 1.2.0
+$ ./download-github-release.sh -v 1.3.0
 ```
 
-This will download the `1.2.0` release together with the provenance and perform verification (requires that the [slsa-verifier](https://github.com/slsa-framework/slsa-verifier) tool is installe):
+This will download the `1.3.0` release together with the provenance and perform verification (requires that the [slsa-verifier](https://github.com/slsa-framework/slsa-verifier) tool is installe):
 
 ```bash
-$ ./download-github-release.sh -v 1.2.0
+$ ./download-github-release.sh -v 1.3.0
 REPO = eclipse-cbi/macos-notarization-service
-VERSION = 1.2.0
+VERSION = 1.3.0
 ARTIFACT = macos-notarization-service
-Downloaded artifact 'macos-notarization-service-1.2.0.zip'
-Downloaded provenance 'macos-notarization-service-1.2.0.zip.intoto.jsonl'
-Verifying artifact 'macos-notarization-service-1.2.0.zip' using provenance 'macos-notarization-service-1.2.0.zip.intoto.jsonl':
+Downloaded artifact 'macos-notarization-service-1.3.0.zip'
+Downloaded provenance 'macos-notarization-service-1.3.0-attestation.intoto.build.slsa'
+Verifying artifact 'macos-notarization-service-1.3.0.zip' using provenance 'macos-notarization-service-1.3.0-attestation.intoto.build.slsa':
 
-Verified signature against tlog entry index 38470756 at URL: https://rekor.sigstore.dev/api/v1/log/entries/24296fb24b8ad77afd34aec2bf00e490c71f748ac30e5ea98054baf21276e5dc43bbd1653789b273
-Verified build using builder "https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@refs/tags/v1.9.0" at commit 5ad9cfe7d0a03ad3d7f58c1561b42f175b1d6850
-Verifying artifact macos-notarization-service-1.2.0.zip: PASSED
+Verified build using builder "https://github.com/jreleaser/release-action/.github/workflows/builder_slsa3.yml@refs/tags/v1.1.0-java" at commit 5325c11c611568f5e043d934185183783f228c0a
+Verifying artifact macos-notarization-service-1.3.0.zip: PASSED
 
 PASSED: Verified SLSA provenance
 ```

download-github-release.sh

@@ -35,7 +35,15 @@ download-provenance() {
 verify() {
   echo "Verifying artifact '${ARTIFACT_FILENAME}' using provenance '${PROVENANCE_FILENAME}':"
   echo ""
-  slsa-verifier verify-artifact --provenance-path ${PROVENANCE_FILENAME} ${ARTIFACT_FILENAME} --source-uri "github.com/${REPO}" --source-tag "v${VERSION}"
+
+  # disable --source-tag for now as jreleaser uses the main branch as sourceURI for now:
+  # --source-tag "v${VERSION}"
+
+  slsa-verifier verify-artifact \
+     --provenance-path ${PROVENANCE_FILENAME} \
+     --source-uri "github.com/${REPO}" \
+     --builder-id "https://github.com/jreleaser/release-action/.github/workflows/builder_slsa3.yml" \
+     ${ARTIFACT_FILENAME}
 }
 
 usage() {
@@ -49,7 +57,8 @@ Options:
   -a ARTIFACT    the artifact to download, e.g. macos-notarization-service
   -e EXTENSION   the extension to use, default: .zip
   -r REPO        the GitHub repo to use for download, format: owner/repo-name, e.g. eclipse-cbi/macos-notarization-service
-  -v VERSION     the release version to download, e.g. 1.2.0
+  -v VERSION     the release version to download, e.g. 1.3.0
+  -f             force downloading artifact and provenance
   -h             show this help
 
 "
@@ -64,12 +73,12 @@ then
     exit 1
 fi
 
-
 ARTIFACT="macos-notarization-service"
 EXTENSION=".zip"
 REPO="eclipse-cbi/macos-notarization-service"
+FORCE=false
 
-while getopts ":a:e:r:v:" o; do
+while getopts ":a:e:r:v:f" o; do
     case "${o}" in
         a)
             ARTIFACT=${OPTARG}
@@ -83,6 +92,9 @@ while getopts ":a:e:r:v:" o; do
         v)
             VERSION=${OPTARG}
             ;;
+        f)
+            FORCE=true
+            ;;
         *)
             usage
             ;;
@@ -102,7 +114,11 @@ echo "ARTIFACT = ${ARTIFACT}"
 ARTIFACT_FILENAME="${ARTIFACT}-${VERSION}${EXTENSION}"
 ARTIFACT_URL="https://github.com/${REPO}/releases/download/v${VERSION}/${ARTIFACT_FILENAME}"
 
-download-artifact
+if [ -f "$ARTIFACT_FILENAME" ] && [ "$FORCE" == false ]; then
+    echo "Using local artifact '${ARTIFACT_FILENAME}'"
+else
+  download-artifact
+fi
 
 FOUND=false
 # the attestation filename has changed after using jreleaser
@@ -112,6 +128,12 @@ do
   PROVENANCE_FILENAME="${ARTIFACT}-${VERSION}${SUFFIX}"
   PROVENANCE_URL="https://github.com/${REPO}/releases/download/v${VERSION}/${PROVENANCE_FILENAME}"
 
+  if [ -f "${PROVENANCE_FILENAME}" ] && [ "$FORCE" == false ]; then
+    echo "Using local provenance '${PROVENANCE_FILENAME}'"
+    FOUND=true
+    break
+  fi
+
   if download-provenance; then
     echo "Downloaded provenance '${PROVENANCE_FILENAME}'"
     FOUND=true