From 38779b931891cc2ffd6c97f3a93fd6ac2b75f975 Mon Sep 17 00:00:00 2001 From: Sanket Sudake Date: Mon, 9 Dec 2024 00:41:24 +0530 Subject: [PATCH] Add provenance steps for release (#3083) * Add provenance steps for release * Update release workflow * Fix branch filters * Cleanup release code * Fix attestation steps * Add SBOM and disable image provenance * Disable image provenance * fix sbom install * Add sboms to goreleaser * Update SLSA version to v2.0.0 --------- Signed-off-by: Sanket Sudake --- .github/workflows/codeql.yaml | 5 +- .github/workflows/push_pr.yaml | 3 +- .github/workflows/release.yaml | 117 +++++++++++++++++++++++++++- .github/workflows/upgrade_test.yaml | 3 +- .goreleaser.yml | 2 + 5 files changed, 121 insertions(+), 9 deletions(-) diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml index 7c9cc9dc..38e8356a 100644 --- a/.github/workflows/codeql.yaml +++ b/.github/workflows/codeql.yaml @@ -2,8 +2,9 @@ name: Code Scanning on: push: - branches-ignore: - - dependabot/** + branches: + - main + - '!dependabot/**' pull_request: branches: - main diff --git a/.github/workflows/push_pr.yaml b/.github/workflows/push_pr.yaml index 237aafd6..3e203cd8 100644 --- a/.github/workflows/push_pr.yaml +++ b/.github/workflows/push_pr.yaml @@ -4,8 +4,7 @@ on: push: branches: - main - branches-ignore: - - dependabot/** + - '!dependabot/**' paths: - "**.go" - "charts/**" diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 9f573d94..5070238c 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -10,13 +10,16 @@ env: KIND_NODE_IMAGE_TAG: v1.25.16 KIND_CLUSTER_NAME: kind -permissions: - contents: read jobs: create-draft-release: + outputs: + hashes: ${{ steps.binary.outputs.hashes }} + # image: ${{ steps.image.outputs.name }} + # digest: ${{ steps.image.outputs.digest }} permissions: contents: write # for goreleaser/goreleaser-action to create a GitHub release + packages: write # for goreleaser/goreleaser-action to upload artifacts to GitHub Packages runs-on: ubuntu-latest steps: - name: Harden Runner @@ -77,6 +80,8 @@ jobs: - name: Check cosign install! run: cosign version + - uses: anchore/sbom-action/download-syft@v0.17.8 + - name: Write cosign signing key to disk run: 'echo "$KEY" > cosign.key' shell: bash @@ -90,6 +95,7 @@ jobs: shell: bash - name: Run GoReleaser + id: goreleaser uses: goreleaser/goreleaser-action@286f3b13b1b49da4ac219696163fb8c1c93e1200 # v6.0.0 with: version: "~> v2" @@ -99,5 +105,110 @@ jobs: GORELEASER_CURRENT_TAG: ${{ steps.get_version.outputs.VERSION }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} DOCKER_CLI_EXPERIMENTAL: "enabled" + - name: Generate binary hashes + id: binary + env: + ARTIFACTS: "${{ steps.goreleaser.outputs.artifacts }}" + run: | + set -euo pipefail - #ToDo - Verify and upload releases + checksum_file=$(echo "$ARTIFACTS" | jq -r '.[] | select (.type=="Checksum") | .path') + echo "hashes=$(cat $checksum_file | base64 -w0)" >> "$GITHUB_OUTPUT" + # - name: Image digest + # id: image + # env: + # ARTIFACTS: "${{ steps.goreleaser.outputs.artifacts }}" + # run: | + # set -euo pipefail + # image_and_digest=$(echo "$ARTIFACTS" | jq -r '.[] | select (.type=="Docker Manifest") | {name, "digest": (.extra.Digest // .extra.Checksum)} | select(.digest) | {name} + {digest} | join("@") | sub("^sha256:";"")') + # image=$(echo "${image_and_digest}" | grep ghcr.io | cut -d'@' -f1 | cut -d':' -f1) + # digest=$(echo "${image_and_digest}" | grep ghcr.io | cut -d'@' -f2) + # echo "name=$image" >> "$GITHUB_OUTPUT" + # echo "digest=$digest" >> "$GITHUB_OUTPUT" + + binary-provenance: + needs: [create-draft-release] + permissions: + actions: read # To read the workflow path. + id-token: write # To sign the provenance. + contents: write # To add assets to a release. + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0 + with: + base64-subjects: "${{ needs.create-draft-release.outputs.hashes }}" + provenance-name: "fission.intoto.jsonl" + upload-assets: true # upload to a new release + + # image-provenance: + # needs: [create-draft-release] + # permissions: + # actions: read + # id-token: write + # packages: write + # uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v1.9.0 + # with: + # image: ${{ needs.create-draft-release.outputs.image }} + # digest: ${{ needs.create-draft-release.outputs.digest }} + # registry-username: ${{ github.actor }} + # secrets: + # registry-password: ${{ secrets.GITHUB_TOKEN }} + + # verification-with-slsa-verifier: + # needs: [create-draft-release, binary-provenance] + # runs-on: ubuntu-latest + # permissions: read-all + # steps: + # - name: Install the verifier + # uses: slsa-framework/slsa-verifier/actions/installer@v2.6.0 + + # - name: Download assets + # env: + # GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + # PROVENANCE: "${{ needs.binary-provenance.outputs.provenance-name }}" + # run: | + # set -euo pipefail + # gh -R "$GITHUB_REPOSITORY" release download "$GITHUB_REF_NAME" -p "*.tar.gz" + # gh -R "$GITHUB_REPOSITORY" release download "$GITHUB_REF_NAME" -p "*.zip" + # gh -R "$GITHUB_REPOSITORY" release download "$GITHUB_REF_NAME" -p "$PROVENANCE" + # - name: Verify assets + # env: + # CHECKSUMS: ${{ needs.create-draft-release.outputs.hashes }} + # PROVENANCE: "${{ needs.binary-provenance.outputs.provenance-name }}" + # run: | + # set -euo pipefail + # checksums=$(echo "$CHECKSUMS" | base64 -d) + # while read -r line; do + # fn=$(echo $line | cut -d ' ' -f2) + # echo "Verifying $fn" + # slsa-verifier verify-artifact --provenance-path "$PROVENANCE" \ + # --source-uri "github.com/$GITHUB_REPOSITORY" \ + # --source-tag "$GITHUB_REF_NAME" \ + # "$fn" + # done <<<"$checksums" + + # verification-with-cosign: + # needs: [create-draft-release, image-provenance] + # runs-on: ubuntu-latest + # permissions: read-all + # steps: + # - name: Login + # uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0 + # with: + # registry: ghcr.io + # username: ${{ github.actor }} + # password: ${{ secrets.GITHUB_TOKEN }} + + # - name: Install Cosign + # uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0 + # with: + # cosign-release: "v2.2.1" + + # - name: Verify image + # env: + # IMAGE: ${{ needs.create-draft-release.outputs.image }} + # DIGEST: ${{ needs.create-draft-release.outputs.digest }} + # run: | + # cosign verify-attestation \ + # --type slsaprovenance \ + # --certificate-oidc-issuer https://token.actions.githubusercontent.com \ + # --certificate-identity-regexp '^https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@refs/tags/v[0-9]+.[0-9]+.[0-9]+$' \ + # $IMAGE@$DIGEST diff --git a/.github/workflows/upgrade_test.yaml b/.github/workflows/upgrade_test.yaml index adc31ef9..db428b14 100644 --- a/.github/workflows/upgrade_test.yaml +++ b/.github/workflows/upgrade_test.yaml @@ -4,8 +4,7 @@ on: push: branches: - main - branches-ignore: - - dependabot/** + - '!dependabot/**' paths: - "**.go" - "charts/**" diff --git a/.goreleaser.yml b/.goreleaser.yml index e4d05b95..35c28f95 100644 --- a/.goreleaser.yml +++ b/.goreleaser.yml @@ -354,3 +354,5 @@ docker_signs: - '--key=cosign.key' - '${artifact}' - '--yes' # needed for cosign 2.0.0+ +sboms: + - artifacts: archive