docs: update provenance tutorial (#1110)

This PR updates the npm provenance discovery tutorial to include the newer discovery methods: PyPI and GitHub. The tutorial is updated to provide examples of provenance discovery for PyPI and GitHub using the toga PyPI library, which has provenance of either type available for discovery depending on the exact version specified. For GitHub attestation, a small code update is included to allow the repository URL and commit digest to be found from provenance. Also, the verify-provenance command line argument has been removed, making this action occur by default once again.

Signed-off-by: Ben Selwyn-Smith <[email protected]>

Author: benmss

docs/source/_static/images/tutorial_osi_toga.png

@@ -164,4 +164,4 @@ Future Work
 
 Mapping artifact to commits within repositories is a challenging endeavour. Macron's Commit Finder feature relies on repositories having and using version tags in a sensible way (a tag is considered sensible if it closely matches the version it represents). An alternative, or complimentary, approach would be to make use of the information found within provenance files, where information such as the commit hash used to create the artifact can potentially be found. Additionally, it should be noted that the Commit Finder feature was modelled on the intentions of developers (in terms of tag usage) within a large quantity of Java projects. As tag formatting is "generally" language agnostic in the same way that versioning schemes are, this feature should work well for other languages. However, there may be some improvements to be made by further testing on a large number of non-Java projects.
 
-.. note:: Macaron now supports extracting repository URLs and commit hashes from provenance files. This is demonstrated in a new tutorial: :doc:`npm_provenance </pages/tutorials/npm_provenance>`.
+.. note:: Macaron now supports extracting repository URLs and commit hashes from provenance files. This is demonstrated in a new tutorial: :doc:`provenance </pages/tutorials/provenance>`.

docs/source/_static/images/tutorial_semver_7.6.2_report.png renamed to docs/source/_static/images/tutorial_semver_7.7.2_report.png

@@ -20,7 +20,7 @@ For the full list of supported technologies, such as CI services, registries, an
    commit_finder
    detect_malicious_package
    detect_vulnerable_github_actions
-   npm_provenance
+   provenance
    detect_malicious_java_dep
    generate_verification_summary_attestation
    use_verification_summary_attestation