Publish [email protected]

[aspect-marvin]

Release: https://github.com/bazel-contrib/tar.bzl/releases/tag/v0.5.0

Automated by Publish to BCR

[bazel-io]

Hello @alexeagle, @thesayyn, modules you maintain (tar.bzl) have been updated in this PR.
Please review the changes. You can view a diff against the previous version in the "Generate module diff" check.

[fmeum]

@alexeagle I skipped the source repo check, but there are other issues.

[alexeagle]

The attestation must include the source url that's being attested, so changing that breaks the attestation.

slsa-verifier verify-github-attestation \
--
  | --attestation-path /tmp/tmpwt_76hy5/source.json.intoto.jsonl \
  | --source-uri github.com/bazel-contrib/tar.bzl \
  | --builder-id https://github.com/bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml \
  | modules/tar.bzl/0.5.0/source.json
  | BcrValidationResult.FAILED: [email protected]: SLSA verifier failed for source.json.intoto.jsonl:
  | Verifying artifact modules/tar.bzl/0.5.0/source.json: FAILED: expected hash '891084a72072cb32f26486919299ffcfce2ad5e4042658ac72e5758fe6d4b459' not found: artifact hash does not match provenance subject
  |  
  | FAILED: SLSA verification failed: expected hash '891084a72072cb32f26486919299ffcfce2ad5e4042658ac72e5758fe6d4b459' not found: artifact hash does not match provenance subject

I think that means we need to make other changes in the https://github.com/bazel-contrib/publish-to-bcr app to account for this...