fix jq for the sigstore bundles

Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
slsa-framework · Feb 24, 2025 · 0a5124b · 0a5124b
1 parent fbeecf0
commit 0a5124b
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/.github/actions/generate-builder/builder-fetch.sh b/.github/actions/generate-builder/builder-fetch.sh
@@ -101,7 +101,7 @@ chmod a+x "$VERIFIER_RELEASE_BINARY"
   "$BUILDER_RELEASE_BINARY" || exit 6
 
 builder_commit=$(gh api /repos/"$BUILDER_REPOSITORY"/git/ref/tags/"$builder_tag" | jq -r '.object.sha')
-provenance_commit=$(jq -r '.payload' <"$BUILDER_RELEASE_BINARY.intoto.jsonl" | base64 -d | jq -r '.predicate.materials[0].digest.sha1')
+provenance_commit=$(jq -r '.dsseEnvelope.payload' <"$BUILDER_RELEASE_BINARY.intoto.jsonl" | base64 -d | jq -r '.predicate.materials[0].digest.sha1')
 if [[ "$builder_commit" != "$provenance_commit" ]]; then
   echo "Builder commit sha $builder_commit != provenance material $provenance_commit"
   exit 5

diff --git a/internal/builders/generic/README.md b/internal/builders/generic/README.md
@@ -288,7 +288,7 @@ The project generates SLSA provenance with the following values.
 | `buildType`                  | `"https://github.com/slsa-framework/slsa-github-generator/generic@v1"` | Identifies a generic GitHub Actions build.                                                                                                                                                                             |
 | `metadata.buildInvocationID` | `"[run_id]-[run_attempt]"`                                             | The GitHub Actions [`run_id`](https://docs.github.com/en/actions/learn-github-actions/contexts#github-context) does not update when a workflow is re-run. Run attempt is added to make the build invocation ID unique. |
 
-**Note**: The generated provenance will probably be wrapped in a [DSSE](https://github.com/secure-systems-lab/dsse) envelope and encoded in base64. Check the human-readable result running `cat encoded-artifact.intoto.jsonl | jq -r '.payload' | base64 -d | jq`.
+**Note**: The generated provenance will probably be wrapped in a [DSSE](https://github.com/secure-systems-lab/dsse) envelope and encoded in base64. Check the human-readable result running `cat encoded-artifact.intoto.jsonl | jq -r '.dsseEnvelope.payload' | base64 -d | jq`.
 
 ### Provenance Example