build(deps): migrate protovalidate to v1.1.0 and upgrade cosign to v3

app/artifact-cas/api/buf.gen.yaml

@@ -1,15 +1,14 @@
-version: v1
+version: v2
 plugins:
-  - name: go
+  - local: protoc-gen-go
     out: .
     opt: paths=source_relative
-  - name: go-errors
+  - local: protoc-gen-go-errors
     out: .
     opt: paths=source_relative
-  - name: go-grpc
+  - local: protoc-gen-go-grpc
     out: .
-    opt:
-      - paths=source_relative
-  - name: go-http
+    opt: paths=source_relative
+  - local: protoc-gen-go-http
     out: .
     opt: paths=source_relative

app/artifact-cas/cmd/main.go

@@ -20,7 +20,7 @@ import (
 	"os"
 	"time"
 
-	"github.com/bufbuild/protovalidate-go"
+	"buf.build/go/protovalidate"
 	"github.com/getsentry/sentry-go"
 
 	"github.com/chainloop-dev/chainloop/app/artifact-cas/internal/conf"
@@ -145,7 +145,7 @@ func main() {
 	}
 }
 
-func newProtoValidator() (*protovalidate.Validator, error) {
+func newProtoValidator() (protovalidate.Validator, error) {
 	return protovalidate.New()
 }
 

app/artifact-cas/internal/conf/buf.gen.yaml

@@ -1,5 +1,5 @@
-version: v1
+version: v2
 plugins:
-  - name: go
+  - local: protoc-gen-go
     out: .
     opt: paths=source_relative

app/artifact-cas/internal/server/grpc.go

@@ -35,7 +35,7 @@
 	"github.com/prometheus/client_golang/prometheus"
 	"google.golang.org/genproto/googleapis/bytestream"
 
-	"github.com/bufbuild/protovalidate-go"
+	"buf.build/go/protovalidate"
 	"github.com/go-kratos/kratos/v2/log"
 	"github.com/go-kratos/kratos/v2/middleware/logging"
 	"github.com/go-kratos/kratos/v2/middleware/recovery"
@@ -49,7 +49,7 @@
 )
 
 // NewGRPCServer new a gRPC server.
-func NewGRPCServer(c *conf.Server, authConf *conf.Auth, byteService *service.ByteStreamService, rSvc *service.ResourceService, providers backend.Providers, validator *protovalidate.Validator, logger log.Logger) (*grpc.Server, error) {
+func NewGRPCServer(c *conf.Server, authConf *conf.Auth, byteService *service.ByteStreamService, rSvc *service.ResourceService, providers backend.Providers, validator protovalidate.Validator, logger log.Logger) (*grpc.Server, error) {
 	log := log.NewHelper(logger)
 	// Load the key on initialization instead of on every request
 	// TODO: implement jwks endpoint
@@ -70,7 +70,7 @@
 		// Kratos middleware are in practice unary interceptors
 		grpc.Middleware(
 			recovery.Recovery(
 				recovery.WithHandler(func(ctx context.Context, req, err interface{}) error {
 					sentry.CaptureMessage(fmt.Sprintf("%v", err))
 					return errors.InternalServer("internal error", "there was an internal error")
 				}),
@@ -146,7 +146,7 @@
 	// Skip authentication on the status grpc service
 	const skipRegexp = "(cas.v1.StatusService/.*)"
 
 	return func(ctx context.Context, operation string) bool {
 		r := regexp.MustCompile(skipRegexp)
 		return !r.MatchString(operation)
 	}
@@ -162,7 +162,7 @@
 
 // load key for verification
 func loadPublicKey(rawKey []byte) jwt.Keyfunc {
 	return func(token *jwt.Token) (interface{}, error) {
 		return jwt.ParseECPublicKeyFromPEM(rawKey)
 	}
 }

app/cli/pkg/action/attestation_verify.go

@@ -22,7 +22,7 @@ import (
 
 	pb "github.com/chainloop-dev/chainloop/app/controlplane/api/controlplane/v1"
 	"github.com/chainloop-dev/chainloop/pkg/attestation/verifier"
-	"github.com/sigstore/cosign/v2/pkg/blob"
+	"github.com/sigstore/cosign/v3/pkg/blob"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 )

app/cli/pkg/action/workflow_run_describe.go

@@ -29,9 +29,9 @@ import (
 	"github.com/chainloop-dev/chainloop/pkg/attestation/verifier"
 	intoto "github.com/in-toto/attestation/go/v1"
 	"github.com/secure-systems-lab/go-securesystemslib/dsse"
-	"github.com/sigstore/cosign/v2/pkg/blob"
-	"github.com/sigstore/cosign/v2/pkg/cosign"
-	sigs "github.com/sigstore/cosign/v2/pkg/signature"
+	"github.com/sigstore/cosign/v3/pkg/blob"
+	"github.com/sigstore/cosign/v3/pkg/cosign"
+	sigs "github.com/sigstore/cosign/v3/pkg/signature"
 	"github.com/sigstore/sigstore/pkg/cryptoutils"
 	"github.com/sigstore/sigstore/pkg/signature"
 	sigdsee "github.com/sigstore/sigstore/pkg/signature/dsse"

app/controlplane/api/buf.gen.yaml

@@ -1,27 +1,26 @@
-version: v1
+version: v2
 plugins:
-  - name: go
+  - local: protoc-gen-go
     out: .
     opt: paths=source_relative
-  - name: go-errors
+  - local: protoc-gen-go-errors
     out: .
     opt: paths=source_relative
-  - name: go-grpc
+  - local: protoc-gen-go-grpc
     out: .
-    opt:
-      - paths=source_relative
-  - name: go-http
+    opt: paths=source_relative
+  - local: protoc-gen-go-http
     out: .
     opt: paths=source_relative
-  - plugin: buf.build/community/stephenh-ts-proto:v1.151.1
+  - remote: buf.build/community/stephenh-ts-proto:v1.151.1
     out: ./gen/frontend
     opt:
-      - outputClientImpl=grpc-web # client implementation it generates
-      - esModuleInterop=true # use imports as required in modern ts setups
-      - useOptionals=messages # use optional TypeScript properties instead of undefined
-  - plugin: buf.build/bufbuild/protoschema-jsonschema:v0.2.0
+      - outputClientImpl=grpc-web
+      - esModuleInterop=true
+      - useOptionals=messages
+  - remote: buf.build/bufbuild/protoschema-jsonschema:v0.2.0
     out: ./gen/jsonschema
-  - plugin: buf.build/grpc-ecosystem/openapiv2:v2.26.3
+  - remote: buf.build/grpc-ecosystem/openapiv2:v2.26.3
     out: gen/temp-openapi
     opt:
       - allow_merge=true

app/controlplane/api/controlplane/v1/group.proto

@@ -103,9 +103,9 @@ message GroupServiceUpdateRequest {
   IdentityReference group_reference = 1 [(buf.validate.field).required = true];
 
   // New name for the group (if provided)
-  optional string new_name = 3 [(buf.validate.field).ignore_empty = true];
+  optional string new_name = 3 [(buf.validate.field).ignore = IGNORE_IF_ZERO_VALUE];
   // New description for the group (if provided)
-  optional string new_description = 4 [(buf.validate.field).ignore_empty = true];
+  optional string new_description = 4 [(buf.validate.field).ignore = IGNORE_IF_ZERO_VALUE];
 }
 
 // GroupServiceUpdateResponse contains the updated group information
@@ -135,9 +135,9 @@ message GroupServiceListMembersRequest {
   // IdentityReference is used to specify the group by either its ID or name
   IdentityReference group_reference = 1 [(buf.validate.field).required = true];
   // Optional filter to search only by maintainers or not
-  optional bool maintainers = 3 [(buf.validate.field).ignore_empty = true];
+  optional bool maintainers = 3 [(buf.validate.field).ignore = IGNORE_IF_ZERO_VALUE];
   // Optional filter to search by member email address
-  optional string member_email = 4 [(buf.validate.field).ignore_empty = true];
+  optional string member_email = 4 [(buf.validate.field).ignore = IGNORE_IF_ZERO_VALUE];
   // Pagination parameters to limit and offset results
   OffsetPaginationRequest pagination = 5;
 }

app/controlplane/api/controlplane/v1/integrations.proto

@@ -144,7 +144,7 @@ message IntegrationsServiceDetachResponse {}
 message ListAttachmentsRequest {
   // Filter by workflow
   string workflow_name = 1 [(buf.validate.field) = {
-    ignore_empty: true
+    ignore: IGNORE_IF_ZERO_VALUE
     cel: {
       message: "must contain only lowercase letters, numbers, and hyphens."
       expression: "this.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?$')"