e2e-verify.common.sh

#!/usr/bin/env bash
#
# This file contains tests for common fields of Github Actions provenance.

# shellcheck source=/dev/null
source "./.github/workflows/scripts/e2e-utils.sh"

# Runs all generic SLSA checks that shouldn't change on a per-builder basis.
# $1: the attestation content
e2e_verify_common_all() {
    e2e_verify_common_builder "$1"
    e2e_verify_common_invocation "$1"
    e2e_verify_common_metadata "$1"
    e2e_verify_common_materials "$1"
}

# Verifies the builder for generic provenance.
# $1: the attestation content
e2e_verify_common_builder() {
    :
}

# Verifies the invocation for generic provenance.
# $1: the attestation content
e2e_verify_common_invocation() {
    e2e_verify_predicate_invocation_configSource "$1" "{\"uri\":\"git+https://github.com/$GITHUB_REPOSITORY@$GITHUB_REF\",\"digest\":{\"sha1\":\"$GITHUB_SHA\"},\"entryPoint\":\".github/workflows/$(e2e_this_file)\"}"

    e2e_verify_predicate_invocation_environment "$1" "github_actor" "$GITHUB_ACTOR"
    e2e_verify_predicate_invocation_environment "$1" "github_sha1" "$GITHUB_SHA"
    e2e_verify_predicate_invocation_environment "$1" "github_event_name" "$GITHUB_EVENT_NAME"
    e2e_verify_predicate_invocation_environment "$1" "github_ref" "$GITHUB_REF"
    e2e_verify_predicate_invocation_environment "$1" "github_ref_type" "$GITHUB_REF_TYPE"
    e2e_verify_predicate_invocation_environment "$1" "github_run_id" "$GITHUB_RUN_ID"
    e2e_verify_predicate_invocation_environment "$1" "github_run_number" "$GITHUB_RUN_NUMBER"
    e2e_verify_predicate_invocation_environment "$1" "github_run_attempt" "$GITHUB_RUN_ATTEMPT"
    ACTOR_ID=$(gh api -H "Accept: application/vnd.github.v3+json" /users/"$GITHUB_ACTOR" | jq -r '.id')
    OWNER_ID=$(gh api -H "Accept: application/vnd.github.v3+json" /users/"$GITHUB_REPOSITORY_OWNER" | jq -r '.id')
    REPO_ID=$(gh api -H "Accept: application/vnd.github.v3+json" /repos/"$GITHUB_REPOSITORY" | jq -r '.id')
    e2e_verify_predicate_invocation_environment "$1" "github_actor_id" "$ACTOR_ID"
    e2e_verify_predicate_invocation_environment "$1" "github_repository_owner_id" "$OWNER_ID"
    e2e_verify_predicate_invocation_environment "$1" "github_repository_id" "$REPO_ID"
}

# Verifies the expected metadata.
# $1: the attestation content
e2e_verify_common_metadata() {
    e2e_verify_predicate_metadata "$1" "{\"buildInvocationID\":\"$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT\",\"completeness\":{\"parameters\":true,\"environment\":false,\"materials\":false},\"reproducible\":false}"
}

# Verifies the materials include the GitHub repository.
# $1: the attestation content
e2e_verify_common_materials() {
    e2e_verify_predicate_materials "$1" "{\"uri\":\"git+https://github.com/$GITHUB_REPOSITORY@$GITHUB_REF\",\"digest\":{\"sha1\":\"$GITHUB_SHA\"}}"
}

# e2e_get_payload prints the provenance payload in JSON format.
# $1: File containing the DSSE envelope.
e2e_get_payload() {
    jq -r '.payload' <"$1" | base64 -d
}

# e2e_set_payload overwrites the provenance payload with other provenance and
# prints it.
# $1: File containing the DSSE envelope.
# $2: The new provenance payload.
e2e_set_payload() {
    build_type=$(echo "$THIS_FILE" | cut -d '.' -f2)
    if [[ "$build_type" == "gcb" ]]; then
        jq -c ".provenance_summary.provenance[0].envelope.payload = \"$(echo "$2" | base64 -w0)\"" <"$1"
    else
        jq -c ".payload = \"$(echo "$2" | base64 -w0)\"" <"$1"
    fi
}

# get_builder_id returns the build ID used for the test.
get_builder_id(){
    build_type=$(echo "$THIS_FILE" | cut -d '.' -f2)
    builder_id=""
    case $build_type in
        "go")
            builder_id="https://github.com/slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@refs/heads/main"
            ;;
        "generic")
            builder_id="https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@refs/heads/main" 
            ;;
        "gcb")
            builder_id="https://cloudbuild.googleapis.com/GoogleHostedWorker@v0.3"
            ;;
        "container")
            builder_id="https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@refs/heads/main" 
            ;;
        *)
            echo "unknown build_type: $build_type"
            exit 1
            ;;
    esac
    echo "$builder_id"
}

# assemble_minimum_builder_args assembles the minimum arguments
# number of arguments for the build ID.
assemble_minimum_builder_args(){
    build_type=$(echo "$THIS_FILE" | cut -d '.' -f2)
    builder_id=$(get_builder_id)
    if [[ "$build_type" == "gcb" ]]; then
        echo "--builder-id=$builder_id"
    fi
}

# assemble_raw_builder_args assembles 
# builder ID with the builder.id but without the tag.
assemble_raw_builder_args(){
    build_type=$(echo "$THIS_FILE" | cut -d '.' -f2)
    builder_id=$(get_builder_id)
    builder_raw_id=$(echo "$builder_id" | cut -f1 -d '@')
    if [[ "$build_type" == "gcb" ]]; then
        echo "--builder-id=$builder_id"
    else
        echo "--builder-id=$builder_raw_id"
    fi
}

# assemble_full_builder_args assembles 
# builder ID with the builder.id@tag.
assemble_full_builder_args(){
    build_type=$(echo "$THIS_FILE" | cut -d '.' -f2)
    builder_id=$(get_builder_id)
    echo "--builder-id=$builder_id"
}

# verify_provenance_authenticity is a function that verifies the authenticity of
# the provenance using slsa-verifier.
# $1: The path to the slsa-verifier binary.
# $2: The slsa-verifier version's git tag.
verify_provenance_authenticity() {
    local verifier="$1"
    local tag="$2"
    local annotated_tags
    local build_type
    annotated_tags=$(echo "$THIS_FILE" | cut -d '.' -f5 | grep annotated || true)
    build_type=$(echo "$THIS_FILE" | cut -d '.' -f2)
    
    verifierCmd="$verifier"
    # After version v1.3.X, we split into subcommands for artifacts and images
    if [[ "$tag" == "HEAD" ]] || version_ge "$tag" "v1.4"; then
        if [[ "$build_type" == "container" || "$build_type" == "gcb" ]]; then
            verifierCmd="$verifier verify-image"
        else
            verifierCmd="$verifier verify-artifact"
        fi
    fi
    # This transforms the argument name depending on the verifier tag.
    argr="$(e2e_verifier_arg_transformer "$tag")"
    read -ra sourceArg <<<"$($argr "source")"
    read -ra tagArg <<<"$($argr "tag")"
    read -ra branchArg <<<"$($argr "branch")"
    read -ra vTagArg <<<"$($argr "versioned-tag")"
    read -ra workflowInputArg <<<"$($argr "workflow-input")"

    # Only versions v1.4+ of the verifier can verify containers.
    if [[ "$build_type" == "container" || "$build_type" == "gcb" ]] && version_lt "$tag" "v1.4" && [[ "$tag" != "HEAD" ]]; then
        echo "  INFO: image verification at $tag: skipping due to lack of support"
        return 0
    fi

    if version_le "$tag" "v1.0.0"; then
        if [[ "$GITHUB_EVENT_NAME" == "release" ]]; then
            echo "  INFO: release trigger at v1.0.0: skipping authenticity verification due to lack of support (https://github.com/slsa-framework/slsa-verifier/pull/89)"
            return 0
        fi
    fi

    multi_subjects=$(echo "$THIS_FILE" | cut -d '.' -f5 | grep multi-subjects)
    if [[ -n "$multi_subjects" ]] && version_lt "$tag" "v1.2.0" && [[ "$tag" != "HEAD" ]]; then
        echo "  INFO: multiple subject verification at $tag: skipping due to lack of support (https://github.com/slsa-framework/slsa-verifier/pull/112)"
        return 0
    fi

    # Assemble artifact args depending on whether this is a container or binary artifact.
    if [[ "$build_type" == "container" || "$build_type" == "gcb" ]]; then
        read -ra artifactArg <<<"${CONTAINER}"
    else
        read -ra artifactArg <<<"$($argr "artifact-path") ${BINARY}"
    fi

    # Assemble the provenance args: for container builds it is attached.
    if [[ "$build_type" != "container" ]]; then
        read -ra provenanceArg <<<"$($argr "provenance") ${PROVENANCE}"
    else
        read -ra provenanceArg <<<""
    fi

    # Assemble the builder arguments.
    artifactAndbuilderMinArgs=("${artifactArg[@]}")
    artifactAndbuilderRawArgs=("${artifactArg[@]}")
    artifactAndbuilderFullArgs=("${artifactArg[@]}")
    # We added support for builder id in v2 or so, but definitely for GCB.
    if version_ge "$tag" "v2" || [[ "$tag" == "HEAD" ]]; then
        echo "Testing against builder args"
        tmp_min=$(assemble_minimum_builder_args)
        if [[ -n "$tmp_min" ]]; then
            artifactAndbuilderMinArgs+=("$tmp_min")
        fi
        tmp_raw=$(assemble_raw_builder_args)
        if [[ -n "$tmp_raw" ]]; then
            artifactAndbuilderRawArgs+=("$tmp_raw")
        fi
        tmp_full=$(assemble_full_builder_args)
        if [[ -n "$tmp_full" ]]; then
            artifactAndbuilderFullArgs+=("$tmp_full")
        fi
    fi

    # Default parameters.
    # After v1.2, branch verification is optional, so we can always verify,
    # regardless of the branch value.
    # https://github.com/slsa-framework/slsa-verifier/pull/192
    if [[ "$tag" == "HEAD" ]] || version_ge "$tag" "v1.3"; then
        echo "  **** Default parameters (annotated tags) *****"
        
        echo $verifierCmd "${artifactAndbuilderMinArgs[@]}" "${provenanceArg[@]}" "${sourceArg[@]}" "github.com/$GITHUB_REPOSITORY"

        $verifierCmd "${artifactAndbuilderMinArgs[@]}" "${provenanceArg[@]}" "${sourceArg[@]}" "github.com/$GITHUB_REPOSITORY"
        e2e_assert_eq "$?" "0" "not main default parameters (annotated_tags)"
    elif [[ -z "$annotated_tags" ]]; then
        # Up until v1.3, we verified the default branch as "main".
        if [[ "$BRANCH" == "main" ]]; then
            echo "  **** Default parameters (main) *****"
            $verifierCmd "${artifactAndbuilderMinArgs[@]}" "${provenanceArg[@]}" "${sourceArg[@]}" "github.com/$GITHUB_REPOSITORY"
            e2e_assert_eq "$?" "0" "main default parameters"
        else
            echo "  **** Default parameters *****"
            $verifierCmd "${artifactAndbuilderMinArgs[@]}" "${provenanceArg[@]}" "${sourceArg[@]}" "github.com/$GITHUB_REPOSITORY"
            e2e_assert_not_eq "$?" "0" "not main default parameters"
        fi
    fi

    branchOpts=("${branchArg[@]}")
    branchOpts+=("$BRANCH")
    if [[ -n "$annotated_tags" ]]; then
        branchOpts=()
        # Annotated tags don't have a branch to verify, so we bail early for versions that always verify the branch.
        # See https://github.com/slsa-framework/slsa-verifier/issues/193.
        if version_lt "$tag" "v1.3"  && [[ "$tag" != "HEAD" ]]; then
            echo "  INFO: annotated tag verification at $tag: skipping due to lack of support (https://github.com/slsa-framework/slsa-verifier/issues/193)"
            return 0
        fi
    fi
    if [[ "$build_type" == "gcb" ]]; then
        # GCB does not support branch verification.
        branchOpts=()
    fi

    # Workflow inputs
    workflow_inputs=$(echo "$THIS_FILE" | cut -d '.' -f5 | grep workflow_inputs)
    if [[ -n "$workflow_inputs" ]] && ( version_ge "$tag" "v1.3" || [[ "$tag" == "HEAD" ]] ); then
        echo "  **** Correct Workflow Inputs *****"
        $verifierCmd "${branchOpts[@]}" "${artifactAndbuilderMinArgs[@]}" "${provenanceArg[@]}" "${sourceArg[@]}" "github.com/$GITHUB_REPOSITORY" "${workflowInputArg[@]}" test=true
        e2e_assert_eq "$?" "0" "should be workflow inputs"

        echo "  **** Wrong Workflow Inputs *****"
        $verifierCmd "${artifactAndbuilderMinArgs[@]}" "${provenanceArg[@]}" "${sourceArg[@]}" "github.com/$GITHUB_REPOSITORY" "${workflowInputArg[@]}" test=false
        e2e_assert_not_eq "$?" "0" "wrong workflow inputs"
    fi

    # Correct branch.
    echo "  **** Correct branch *****"
    $verifierCmd "${artifactAndbuilderMinArgs[@]}" "${branchOpts[@]}" "${provenanceArg[@]}" "${sourceArg[@]}" "github.com/$GITHUB_REPOSITORY"
    e2e_assert_eq "$?" "0" "should be branch $BRANCH"

    # Wrong branch
    echo "  **** Wrong branch *****"
    $verifierCmd "${branchArg[@]}" "not-$GITHUB_REF_NAME" "${artifactAndbuilderMinArgs[@]}" "${provenanceArg[@]}" "${sourceArg[@]}" "github.com/$GITHUB_REPOSITORY"
    e2e_assert_not_eq "$?" "0" "wrong branch"

    # Wrong tag
    echo "  **** Wrong tag *****"
    $verifierCmd "${tagArg[@]}" v1.2.3 "${artifactAndbuilderMinArgs[@]}" "${provenanceArg[@]}" "${sourceArg[@]}" "github.com/$GITHUB_REPOSITORY"
    e2e_assert_not_eq "$?" "0" "wrong tag"

    # Correct raw builder ID verification
    echo "  **** Correct raw builder.id *****"
    $verifierCmd "${artifactAndbuilderRawArgs[@]}" "${branchOpts[@]}" "${provenanceArg[@]}" "${sourceArg[@]}" "github.com/$GITHUB_REPOSITORY"
    e2e_assert_eq "$?" "0" "correct raw builder id"

    # Wrong raw builder ID verification
    echo "  **** Wrong raw builder.id *****"
    # shellcheck disable=SC2145 # We intend to alter the builder ID.
    $verifierCmd "${artifactAndbuilderRawArgs[@]}a" "${branchOpts[@]}" "${provenanceArg[@]}" "${sourceArg[@]}" "github.com/$GITHUB_REPOSITORY"
    e2e_assert_not_eq "$?" "0" "wrong raw builder id"
    
    # Correct full builder ID verification
    echo "  **** Correct full builder.id *****"
    $verifierCmd "${artifactAndbuilderFullArgs[@]}" "${branchOpts[@]}" "${provenanceArg[@]}" "${sourceArg[@]}" "github.com/$GITHUB_REPOSITORY"
    e2e_assert_eq "$?" "0" "correct full builder id"

    # Wrong full builder ID verification
    echo "  **** Wrong full builder.id *****"
    # shellcheck disable=SC2145 # We intend to alter the builder ID.
    $verifierCmd "${artifactAndbuilderFullArgs[@]}a" "${branchOpts[@]}" "${provenanceArg[@]}" "${sourceArg[@]}" "github.com/$GITHUB_REPOSITORY"
    e2e_assert_not_eq "$?" "0" "wrong full builder id"

    # Note that for containers with attached provenance, we will skip this test.
    # TODO(github.com/slsa-framework/example-package/issues/108):
    # Add a malicious container test that attaches bad provenance.
    if [[ "$build_type" != "container" ]]; then
        echo "  **** Wrong payload *****"
        local BAD_PROV
        BAD_PROV="$(mktemp -t slsa-e2e.XXXXXXXX)"
        e2e_set_payload "$PROVENANCE" '{"foo": "bar"}' >"$BAD_PROV"
        read -ra badProvenanceArg <<<"$($argr "provenance") ${BAD_PROV}"
        $verifierCmd "${artifactAndbuilderMinArgs[@]}" "${branchOpts[@]}" "${badProvenanceArg[@]}" "${sourceArg[@]}" "github.com/$GITHUB_REPOSITORY"
        e2e_assert_not_eq "$?" "0" "wrong payload"
    fi

    if [[ "$GITHUB_REF_TYPE" == "tag" ]]; then
        local SEMVER MAJOR MINOR PATCH
        SEMVER="$GITHUB_REF_NAME"
        MAJOR=$(version_major "$SEMVER")
        MINOR=$(version_minor "$SEMVER")
        PATCH=$(version_patch "$SEMVER")

        local MAJOR_LESS_ONE MINOR_LESS_ONE PATCH_LESS_ONE
        MAJOR_LESS_ONE=$((${MAJOR:-1} - 1))
        MINOR_LESS_ONE=$((${MINOR:-1} - 1))
        PATCH_LESS_ONE=$((${PATCH:-1} - 1))

        local MAJOR_PLUS_ONE MINOR_PLUS_ONE PATCH_PLUS_ONE
        MAJOR_PLUS_ONE=$((${MAJOR:-0} + 1))
        MINOR_PLUS_ONE=$((${MINOR:-0} + 1))
        PATCH_PLUS_ONE=$((${PATCH:-0} + 1))

        # Correct vM.N.P
        echo "  **** Correct vM.N.P *****"
        $verifierCmd "${branchOpts[@]}" "${vTagArg[@]}" "v$MAJOR.$MINOR.$PATCH" "${artifactAndbuilderMinArgs[@]}" "${provenanceArg[@]}" "${sourceArg[@]}" "github.com/$GITHUB_REPOSITORY"
        e2e_assert_eq "$?" "0" "$MAJOR.$MINOR.$PATCH versioned-tag vM.N.P ($MAJOR.$MINOR.$PATCH) should be correct"

        # Correct vM.N
        echo "  **** Correct vM.N *****"
        $verifierCmd "${branchOpts[@]}" "${vTagArg[@]}" "v$MAJOR.$MINOR" "${artifactAndbuilderMinArgs[@]}" "${provenanceArg[@]}" "${sourceArg[@]}" "github.com/$GITHUB_REPOSITORY"
        e2e_assert_eq "$?" "0" "$MAJOR.$MINOR versioned-tag vM.N ($MAJOR.$MINOR) should be correct"

        # Correct vM
        echo "  **** Correct vM *****"
        $verifierCmd "${branchOpts[@]}" "${vTagArg[@]}" "v$MAJOR" "${artifactAndbuilderMinArgs[@]}" "${provenanceArg[@]}" "${sourceArg[@]}" "github.com/$GITHUB_REPOSITORY"
        e2e_assert_eq "$?" "0" "$MAJOR versioned-tag vm ($MAJOR) should be correct"

        # Incorrect v(M-1)
        echo "  **** Incorrect v(M-1) *****"
        $verifierCmd "${branchOpts[@]}" "${vTagArg[@]}" "v$MAJOR_LESS_ONE" "${artifactAndbuilderMinArgs[@]}" "${provenanceArg[@]}" "${sourceArg[@]}" "github.com/$GITHUB_REPOSITORY"
        e2e_assert_not_eq "$?" "0" "$MAJOR_LESS_ONE versioned-tag should be incorrect"

        # Incorrect v(M-1).N
        echo "  **** Incorrect v(M-1).N *****"
        $verifierCmd "${branchOpts[@]}" "${vTagArg[@]}" "v$MAJOR_LESS_ONE.$MINOR" "${artifactAndbuilderMinArgs[@]}" "${provenanceArg[@]}" "${sourceArg[@]}" "github.com/$GITHUB_REPOSITORY"
        e2e_assert_not_eq "$?" "0" "$MAJOR_LESS_ONE.$MINOR versioned-tag should be incorrect"

        # Incorrect v(M-1).N.P
        echo "  **** Incorrect v(M-1).N.P *****"
        $verifierCmd "${branchOpts[@]}" "${vTagArg[@]}" "v$MAJOR_LESS_ONE.$MINOR.$PATCH" "${artifactAndbuilderMinArgs[@]}" "${provenanceArg[@]}" "${sourceArg[@]}" "github.com/$GITHUB_REPOSITORY"
        e2e_assert_not_eq "$?" "0" "$MAJOR_LESS_ONE.$MINOR.$PATCH versioned-tag should be incorrect"

        # Incorrect vM.(N-1)
        echo "  **** Incorrect vM.(N-1) *****"
        $verifierCmd "${branchOpts[@]}" "${vTagArg[@]}" "v$MAJOR.$MINOR_LESS_ONE" "${artifactAndbuilderMinArgs[@]}" "${provenanceArg[@]}" "${sourceArg[@]}" "github.com/$GITHUB_REPOSITORY"
        e2e_assert_not_eq "$?" "0" "$MAJOR.$MINOR_LESS_ONE versioned-tag should be incorrect"

        # Incorrect vM.(N-1).P
        echo "  **** Incorrect vM.(N-1).P *****"
        $verifierCmd "${branchOpts[@]}" "${vTagArg[@]}" "v$MAJOR.$MINOR_LESS_ONE.$PATCH" "${artifactAndbuilderMinArgs[@]}" "${provenanceArg[@]}" "${sourceArg[@]}" "github.com/$GITHUB_REPOSITORY"
        e2e_assert_not_eq "$?" "0" "$MAJOR.$MINOR_LESS_ONE.$PATCH versioned-tag should be incorrect"

        # Incorrect vM.N.(P-1)
        echo "  **** Incorrect vM.N.(P-1) *****"
        $verifierCmd "${branchOpts[@]}" "${vTagArg[@]}" "v$MAJOR.$MINOR.$PATCH_LESS_ONE" "${artifactAndbuilderMinArgs[@]}" "${provenanceArg[@]}" "${sourceArg[@]}" "github.com/$GITHUB_REPOSITORY"
        e2e_assert_not_eq "$?" "0" "$MAJOR.$MINOR.$PATCH_LESS_ONE versioned-tag should be incorrect"

        # Incorrect v(M+1)
        echo "  **** Incorrect v(M+1) *****"
        $verifierCmd "${branchOpts[@]}" "${vTagArg[@]}" "v$MAJOR_PLUS_ONE" "${artifactAndbuilderMinArgs[@]}" "${provenanceArg[@]}" "${sourceArg[@]}" "github.com/$GITHUB_REPOSITORY"
        e2e_assert_not_eq "$?" "0" "$MAJOR_PLUS_ONE versioned-tag should be incorrect"

        # Incorrect v(M+1).N
        echo "  **** Incorrect v(M+1).N *****"
        $verifierCmd "${branchOpts[@]}" "${vTagArg[@]}" "v$MAJOR_PLUS_ONE.$MINOR" "${artifactAndbuilderMinArgs[@]}" "${provenanceArg[@]}" "${sourceArg[@]}" "github.com/$GITHUB_REPOSITORY"
        e2e_assert_not_eq "$?" "0" "$MAJOR_PLUS_ONE.$MINOR versioned-tag should be incorrect"

        # Incorrect v(M+1).N.P
        echo "  **** Incorrect v(M+1).N.P *****"
        $verifierCmd "${branchOpts[@]}" "${vTagArg[@]}" "v$MAJOR_PLUS_ONE.$MINOR.$PATCH" "${artifactAndbuilderMinArgs[@]}" "${provenanceArg[@]}" "${sourceArg[@]}" "github.com/$GITHUB_REPOSITORY"
        e2e_assert_not_eq "$?" "0" "$MAJOR_PLUS_ONE.$MINOR.$PATCH versioned-tag should be incorrect"

        # Incorrect vM.(N+1)
        echo "  **** Incorrect vM.(N+1) *****"
        $verifierCmd "${branchOpts[@]}" "${vTagArg[@]}" "v$MAJOR.$MINOR_PLUS_ONE" "${artifactAndbuilderMinArgs[@]}" "${provenanceArg[@]}" "${sourceArg[@]}" "github.com/$GITHUB_REPOSITORY"
        e2e_assert_not_eq "$?" "0" "$MAJOR.$MINOR_PLUS_ONE versioned-tag should be incorrect"

        # Incorrect vM.(N+1).P
        echo "  **** Incorrect vM.(N+1).P *****"
        $verifierCmd "${branchOpts[@]}" "${vTagArg[@]}" "v$MAJOR.$MINOR_PLUS_ONE.$PATCH" "${artifactAndbuilderMinArgs[@]}" "${provenanceArg[@]}" "${sourceArg[@]}" "github.com/$GITHUB_REPOSITORY"
        e2e_assert_not_eq "$?" "0" "$MAJOR.$MINOR_PLUS_ONE.$PATCH versioned-tag should be incorrect"

        # Incorrect vM.N.(P+1)
        echo "  **** Incorrect vM.N.(P+1) *****"
        $verifierCmd "${branchOpts[@]}" "${vTagArg[@]}" "v$MAJOR.$MINOR.$PATCH_PLUS_ONE" "${artifactAndbuilderMinArgs[@]}" "${provenanceArg[@]}" "${sourceArg[@]}" "github.com/$GITHUB_REPOSITORY"
        e2e_assert_not_eq "$?" "0" "$MAJOR.$MINOR.$PATCH_PLUS_ONE versioned-tag should be incorrect"
    else
        # Wrong versioned-tag
        echo "  **** Wrong versioned-tag *****"
        $verifierCmd "${branchOpts[@]}" "${vTagArg[@]}" v1.2.3 "${artifactAndbuilderMinArgs[@]}" "${provenanceArg[@]}" "${sourceArg[@]}" "github.com/$GITHUB_REPOSITORY"
        e2e_assert_not_eq "$?" "0" "wrong versioned-tag"
    fi
}

# Runs a verification command for each version of slsa-verifier.
# $1: The minimum verifier version to check. The minimum version can be "HEAD".
# $2: The maximum verifier version to check.
e2e_run_verifier_all_releases() {
    local VERIFIER_REPOSITORY="slsa-framework/slsa-verifier"
    local VERIFIER_BINARY="slsa-verifier-linux-amd64"

    # First, verify provenance with the verifier at HEAD.
    # TODO: Verify provenance with verifier at v1 HEAD?
    go env -w GOFLAGS=-mod=mod
    go install "github.com/$VERIFIER_REPOSITORY/v2/cli/slsa-verifier@main"
    echo "**** Verifying provenance authenticity with verifier at HEAD *****"
    verify_provenance_authenticity "slsa-verifier" "HEAD"

    # If the minimum version is HEAD then we are done.
    if [ "$1" == "HEAD" ]; then
        return 0
    fi

    # Second, retrieve all previous versions of the verifier,
    # and verify the provenance. This is essentially regression tests.
    local RELEASE_LIST
    RELEASE_LIST=$(gh release -R "$VERIFIER_REPOSITORY" -L 100 list)
    echo "Releases found:"
    echo "$RELEASE_LIST"
    echo

    while read -r line; do
        local TAG
        TAG=$(echo "$line" | cut -f1)

        # Check minimum verifier version
        if [ "$1" != "" ] && version_lt "$TAG" "$1"; then
            continue
        fi

        # Check maximum verifier version
        if [ "$2" != "" ] && version_gt "$TAG" "$2"; then
            continue
        fi

        # Check pre-release status
        local PRE_RELEASE
        PRE_RELEASE=$(echo "$line" | cut -f2)
        if [ "$PRE_RELEASE" == "Pre-release" ]; then
            continue
        fi

        # Check if a greater patch version exists
        MAJOR=$(version_major "$TAG")
        MINOR=$(version_minor "$TAG")
        PATCH=$(version_patch "$TAG")
        PATCH_PLUS_ONE=$((${PATCH:-0} + 1))
        if grep -q "v$MAJOR.$MINOR.$PATCH_PLUS_ONE" <<<"$RELEASE_LIST"; then
            continue
        fi

        echo "  *** Starting with verifier at $TAG ****"

        # Always remove the binary, because `gh release download` fails if the file already exists.
        if [[ -f "$VERIFIER_BINARY" ]]; then
            # Note: Don't quote `$VERIFIER_BINARY*`, as it will cause new lines to be inserted and
            # deletion will fail.
            rm $VERIFIER_BINARY*
        fi

        gh release -R "$VERIFIER_REPOSITORY" download "$TAG" -p "$VERIFIER_BINARY*" || exit 10

        # Use the compiled verifier at main to verify the provenance (Optional)
        slsa-verifier verify-artifact "$VERIFIER_BINARY" \
            --source-branch "main" \
            --source-tag "$TAG" \
            --provenance-path "$VERIFIER_BINARY.intoto.jsonl" \
            --source-uri "github.com/$VERIFIER_REPOSITORY" ||
            slsa-verifier verify-artifact "$VERIFIER_BINARY" \
                --source-branch "release/v$MAJOR.$MINOR" \
                --source-tag "$TAG" \
                --provenance-path "$VERIFIER_BINARY.intoto.jsonl" \
                --source-uri "github.com/$VERIFIER_REPOSITORY" || exit 6

        echo "**** Verifying provenance authenticity with verifier at $TAG ****"
        chmod a+x "./$VERIFIER_BINARY"
        verify_provenance_authenticity "./$VERIFIER_BINARY" "$TAG"
    done <<<"$RELEASE_LIST"
}

# e2e_verifier_arg_transformer returns an argument transformer
# $1
e2e_verifier_arg_transformer() {
    local tag="$1"
    if [[ "$tag" == "HEAD" ]] || version_ge "$tag" "v1.4"; then
        echo "_new_verifier_args"
    else
        echo "_old_verifier_args"
    fi
}

_old_verifier_args() {
    local arg="$1"
    case $arg in
    artifact-path) echo '--artifact-path' ;;
    provenance) echo '--provenance' ;;
    source) echo '--source' ;;
    tag) echo '--tag' ;;
    versioned-tag) echo '--versioned-tag' ;;
    workflow-input) echo '--workflow-input' ;;
    branch) echo '--branch' ;;
    esac
}

_new_verifier_args() {
    local arg="$1"
    case $arg in
    artifact-path) echo '' ;;
    provenance) echo '--provenance-path' ;;
    source) echo '--source-uri' ;;
    tag) echo '--source-tag' ;;
    versioned-tag) echo '--source-versioned-tag' ;;
    workflow-input) echo '--build-workflow-input' ;;
    branch) echo '--source-branch' ;;
    esac
}