Fix SBOM and provenance for releases (#3124)

* Provenance generation fixes
* try sbom flags
* remove unwanted changes
* add container sbom support
* Fix more labels
* Fix env variable
* revert local changes

---------

Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>

.goreleaser.yml

@@ -1,11 +1,14 @@
 version: 2
 
+env:
+  - GHCR_REPO=ghcr.io/fission
+
 project_name: fission
 release:
   github:
     owner: fission
     name: fission
-  prerelease: true
+  prerelease: "true"
   draft: true
   header: |
     Release Highlights: https://fission.io/docs/releases/{{ .Tag }}/
@@ -75,10 +78,8 @@ dockers:
     ids:
       - builder
     image_templates:
-      - "fission/builder:latest-amd64"
-      - "fission/builder:{{ .Tag }}-amd64"
-      - "ghcr.io/fission/builder:latest-amd64"
-      - "ghcr.io/fission/builder:{{ .Tag }}-amd64"
+      - "{{ .Env.GHCR_REPO }}/builder:latest-amd64"
+      - "{{ .Env.GHCR_REPO }}/builder:{{ .Tag }}-amd64"
     dockerfile: cmd/builder/Dockerfile
     build_flag_templates:
       - "--label=org.opencontainers.image.description=The builder assists in building the fission function source code for deployment."
@@ -87,14 +88,15 @@ dockers:
       - "--label=org.opencontainers.image.created={{.Date}}"
       - "--label=org.opencontainers.image.revision={{.FullCommit}}"
       - "--label=org.opencontainers.image.version={{.Tag}}"
+      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
+      - "--label=org.opencontainers.image.vendor=Fission"
+      - "--label=org.opencontainers.image.url=https://fission.io/"
   - <<: *docker-amd64
     ids:
       - fetcher
     image_templates:
-      - "fission/fetcher:latest-amd64"
-      - "fission/fetcher:{{ .Tag }}-amd64"
-      - "ghcr.io/fission/fetcher:latest-amd64"
-      - "ghcr.io/fission/fetcher:{{ .Tag }}-amd64"
+      - "{{ .Env.GHCR_REPO }}/fetcher:latest-amd64"
+      - "{{ .Env.GHCR_REPO }}/fetcher:{{ .Tag }}-amd64"
     dockerfile: cmd/fetcher/Dockerfile
     build_flag_templates:
       - "--label=org.opencontainers.image.description=Fetcher is a lightweight component used by environment and builder pods. Fetcher helps in fetch and upload of source/deployment packages and specializing environments."
@@ -103,14 +105,15 @@ dockers:
       - "--label=org.opencontainers.image.created={{.Date}}"
       - "--label=org.opencontainers.image.revision={{.FullCommit}}"
       - "--label=org.opencontainers.image.version={{.Tag}}"
+      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
+      - "--label=org.opencontainers.image.vendor=Fission"
+      - "--label=org.opencontainers.image.url=https://fission.io/"
   - <<: *docker-amd64
     ids:
       - fission-bundle
     image_templates:
-      - "fission/fission-bundle:latest-amd64"
-      - "fission/fission-bundle:{{ .Tag }}-amd64"
-      - "ghcr.io/fission/fission-bundle:latest-amd64"
-      - "ghcr.io/fission/fission-bundle:{{ .Tag }}-amd64"
+      - "{{ .Env.GHCR_REPO }}/fission-bundle:latest-amd64"
+      - "{{ .Env.GHCR_REPO }}/fission-bundle:{{ .Tag }}-amd64"
     dockerfile: cmd/fission-bundle/Dockerfile
     build_flag_templates:
       - "--label=org.opencontainers.image.description=fission-bundle is a component which is a single binary for all components. Most server side components running on server side are fission-bundle binary wrapped in container and used with different arguments."
@@ -119,14 +122,15 @@ dockers:
       - "--label=org.opencontainers.image.created={{.Date}}"
       - "--label=org.opencontainers.image.revision={{.FullCommit}}"
       - "--label=org.opencontainers.image.version={{.Tag}}"
+      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
+      - "--label=org.opencontainers.image.vendor=Fission"
+      - "--label=org.opencontainers.image.url=https://fission.io/"
   - <<: *docker-amd64
     ids:
       - pre-upgrade-checks
     image_templates:
-      - "fission/pre-upgrade-checks:latest-amd64"
-      - "fission/pre-upgrade-checks:{{ .Tag }}-amd64"
-      - "ghcr.io/fission/pre-upgrade-checks:latest-amd64"
-      - "ghcr.io/fission/pre-upgrade-checks:{{ .Tag }}-amd64"
+      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:latest-amd64"
+      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:{{ .Tag }}-amd64"
     dockerfile: cmd/preupgradechecks/Dockerfile
     build_flag_templates:
       - "--label=org.opencontainers.image.description=Preupgradechecks ensures that Fission is ready for the targeted version upgrade by performing checks beforehand."
@@ -135,14 +139,15 @@ dockers:
       - "--label=org.opencontainers.image.created={{.Date}}"
       - "--label=org.opencontainers.image.revision={{.FullCommit}}"
       - "--label=org.opencontainers.image.version={{.Tag}}"
+      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
+      - "--label=org.opencontainers.image.vendor=Fission"
+      - "--label=org.opencontainers.image.url=https://fission.io/"
   - <<: *docker-amd64
     ids:
       - reporter
     image_templates:
-      - "fission/reporter:latest-amd64"
-      - "fission/reporter:{{ .Tag }}-amd64"
-      - "ghcr.io/fission/reporter:latest-amd64"
-      - "ghcr.io/fission/reporter:{{ .Tag }}-amd64"
+      - "{{ .Env.GHCR_REPO }}/reporter:latest-amd64"
+      - "{{ .Env.GHCR_REPO }}/reporter:{{ .Tag }}-amd64"
     dockerfile: cmd/reporter/Dockerfile
     build_flag_templates:
       - "--label=org.opencontainers.image.description=The reporter gathers information that assists in improving fission."
@@ -151,6 +156,9 @@ dockers:
       - "--label=org.opencontainers.image.created={{.Date}}"
       - "--label=org.opencontainers.image.revision={{.FullCommit}}"
       - "--label=org.opencontainers.image.version={{.Tag}}"
+      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
+      - "--label=org.opencontainers.image.vendor=Fission"
+      - "--label=org.opencontainers.image.url=https://fission.io/"
   - &docker-arm64
     use: buildx
     goos: linux
@@ -158,10 +166,8 @@ dockers:
     ids:
       - builder
     image_templates:
-      - "fission/builder:latest-arm64"
-      - "fission/builder:{{ .Tag }}-arm64"
-      - "ghcr.io/fission/builder:latest-arm64"
-      - "ghcr.io/fission/builder:{{ .Tag }}-arm64"
+      - "{{ .Env.GHCR_REPO }}/builder:latest-arm64"
+      - "{{ .Env.GHCR_REPO }}/builder:{{ .Tag }}-arm64"
     dockerfile: cmd/builder/Dockerfile
     build_flag_templates:
       - "--label=org.opencontainers.image.description=The builder assists in building the fission function source code for deployment."
@@ -170,14 +176,15 @@ dockers:
       - "--label=org.opencontainers.image.created={{.Date}}"
       - "--label=org.opencontainers.image.revision={{.FullCommit}}"
       - "--label=org.opencontainers.image.version={{.Tag}}"
+      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
+      - "--label=org.opencontainers.image.vendor=Fission"
+      - "--label=org.opencontainers.image.url=https://fission.io/"
   - <<: *docker-arm64
     ids:
       - fetcher
     image_templates:
-      - "fission/fetcher:latest-arm64"
-      - "fission/fetcher:{{ .Tag }}-arm64"
-      - "ghcr.io/fission/fetcher:latest-arm64"
-      - "ghcr.io/fission/fetcher:{{ .Tag }}-arm64"
+      - "{{ .Env.GHCR_REPO }}/fetcher:latest-arm64"
+      - "{{ .Env.GHCR_REPO }}/fetcher:{{ .Tag }}-arm64"
     dockerfile: cmd/fetcher/Dockerfile
     build_flag_templates:
       - "--label=org.opencontainers.image.description=Fetcher is a lightweight component used by environment and builder pods. Fetcher helps in fetch and upload of source/deployment packages and specializing environments."
@@ -186,14 +193,15 @@ dockers:
       - "--label=org.opencontainers.image.created={{.Date}}"
       - "--label=org.opencontainers.image.revision={{.FullCommit}}"
       - "--label=org.opencontainers.image.version={{.Tag}}"
+      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
+      - "--label=org.opencontainers.image.vendor=Fission"
+      - "--label=org.opencontainers.image.url=https://fission.io/"
   - <<: *docker-arm64
     ids:
       - fission-bundle
     image_templates:
-      - "fission/fission-bundle:latest-arm64"
-      - "fission/fission-bundle:{{ .Tag }}-arm64"
-      - "ghcr.io/fission/fission-bundle:latest-arm64"
-      - "ghcr.io/fission/fission-bundle:{{ .Tag }}-arm64"
+      - "{{ .Env.GHCR_REPO }}/fission-bundle:latest-arm64"
+      - "{{ .Env.GHCR_REPO }}/fission-bundle:{{ .Tag }}-arm64"
     dockerfile: cmd/fission-bundle/Dockerfile
     build_flag_templates:
       - "--label=org.opencontainers.image.description=fission-bundle is a component which is a single binary for all components. Most server side components running on server side are fission-bundle binary wrapped in container and used with different arguments."
@@ -202,14 +210,15 @@ dockers:
       - "--label=org.opencontainers.image.created={{.Date}}"
       - "--label=org.opencontainers.image.revision={{.FullCommit}}"
       - "--label=org.opencontainers.image.version={{.Tag}}"
+      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
+      - "--label=org.opencontainers.image.vendor=Fission"
+      - "--label=org.opencontainers.image.url=https://fission.io/"
   - <<: *docker-arm64
     ids:
       - pre-upgrade-checks
     image_templates:
-      - "fission/pre-upgrade-checks:latest-arm64"
-      - "fission/pre-upgrade-checks:{{ .Tag }}-arm64"
-      - "ghcr.io/fission/pre-upgrade-checks:latest-arm64"
-      - "ghcr.io/fission/pre-upgrade-checks:{{ .Tag }}-arm64"
+      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:latest-arm64"
+      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:{{ .Tag }}-arm64"
     dockerfile: cmd/preupgradechecks/Dockerfile
     build_flag_templates:
       - "--label=org.opencontainers.image.description=Preupgradechecks ensures that Fission is ready for the targeted version upgrade by performing checks beforehand."
@@ -218,14 +227,15 @@ dockers:
       - "--label=org.opencontainers.image.created={{.Date}}"
       - "--label=org.opencontainers.image.revision={{.FullCommit}}"
       - "--label=org.opencontainers.image.version={{.Tag}}"
+      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
+      - "--label=org.opencontainers.image.vendor=Fission"
+      - "--label=org.opencontainers.image.url=https://fission.io/"
   - <<: *docker-arm64
     ids:
       - reporter
     image_templates:
-      - "fission/reporter:latest-arm64"
-      - "fission/reporter:{{ .Tag }}-arm64"
-      - "ghcr.io/fission/reporter:latest-arm64"
-      - "ghcr.io/fission/reporter:{{ .Tag }}-arm64"
+      - "{{ .Env.GHCR_REPO }}/reporter:latest-arm64"
+      - "{{ .Env.GHCR_REPO }}/reporter:{{ .Tag }}-arm64"
     dockerfile: cmd/reporter/Dockerfile
     build_flag_templates:
       - "--label=org.opencontainers.image.description=The reporter gathers information that assists in improving fission."
@@ -234,87 +244,50 @@ dockers:
       - "--label=org.opencontainers.image.created={{.Date}}"
       - "--label=org.opencontainers.image.revision={{.FullCommit}}"
       - "--label=org.opencontainers.image.version={{.Tag}}"
+      - "--label=org.opencontainers.image.authors=The Fission Authors https://fission.io/"
+      - "--label=org.opencontainers.image.vendor=Fission"
+      - "--label=org.opencontainers.image.url=https://fission.io/"
 docker_manifests:
-  - name_template: ghcr.io/fission/builder:{{ .Tag }}
+  - name_template: "{{ .Env.GHCR_REPO }}/builder:{{ .Tag }}"
     image_templates:
-      - ghcr.io/fission/builder:{{ .Tag }}-amd64
-      - ghcr.io/fission/builder:{{ .Tag }}-arm64
-  - name_template: fission/builder:{{ .Tag }}
+      - "{{ .Env.GHCR_REPO }}/builder:{{ .Tag }}-amd64"
+      - "{{ .Env.GHCR_REPO }}/builder:{{ .Tag }}-arm64"
+  - name_template: "{{ .Env.GHCR_REPO }}/fetcher:{{ .Tag }}"
     image_templates:
-      - fission/builder:{{ .Tag }}-amd64
-      - fission/builder:{{ .Tag }}-arm64
-  - name_template: ghcr.io/fission/fetcher:{{ .Tag }}
+      - "{{ .Env.GHCR_REPO }}/fetcher:{{ .Tag }}-amd64"
+      - "{{ .Env.GHCR_REPO }}/fetcher:{{ .Tag }}-arm64"
+  - name_template: "{{ .Env.GHCR_REPO }}/fission-bundle:{{ .Tag }}"
     image_templates:
-      - ghcr.io/fission/fetcher:{{ .Tag }}-amd64
-      - ghcr.io/fission/fetcher:{{ .Tag }}-arm64
-  - name_template: fission/fetcher:{{ .Tag }}
+      - "{{ .Env.GHCR_REPO }}/fission-bundle:{{ .Tag }}-amd64"
+      - "{{ .Env.GHCR_REPO }}/fission-bundle:{{ .Tag }}-arm64"
+  - name_template: "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:{{ .Tag }}"
     image_templates:
-      - fission/fetcher:{{ .Tag }}-amd64
-      - fission/fetcher:{{ .Tag }}-arm64
-  - name_template: ghcr.io/fission/fission-bundle:{{ .Tag }}
+      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:{{ .Tag }}-amd64"
+      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:{{ .Tag }}-arm64"
+  - name_template: "{{ .Env.GHCR_REPO }}/reporter:{{ .Tag }}"
     image_templates:
-      - ghcr.io/fission/fission-bundle:{{ .Tag }}-amd64
-      - ghcr.io/fission/fission-bundle:{{ .Tag }}-arm64
-  - name_template: fission/fission-bundle:{{ .Tag }}
+      - "{{ .Env.GHCR_REPO }}/reporter:{{ .Tag }}-amd64"
+      - "{{ .Env.GHCR_REPO }}/reporter:{{ .Tag }}-arm64"
+  - name_template: "{{ .Env.GHCR_REPO }}/builder:latest"
     image_templates:
-      - fission/fission-bundle:{{ .Tag }}-amd64
-      - fission/fission-bundle:{{ .Tag }}-arm64
-  - name_template: ghcr.io/fission/pre-upgrade-checks:{{ .Tag }}
+      - "{{ .Env.GHCR_REPO }}/builder:latest-amd64"
+      - "{{ .Env.GHCR_REPO }}/builder:latest-arm64"
+  - name_template: "{{ .Env.GHCR_REPO }}/fetcher:latest"
     image_templates:
-      - ghcr.io/fission/pre-upgrade-checks:{{ .Tag }}-amd64
-      - ghcr.io/fission/pre-upgrade-checks:{{ .Tag }}-arm64
-  - name_template: fission/pre-upgrade-checks:{{ .Tag }}
+      - "{{ .Env.GHCR_REPO }}/fetcher:latest-amd64"
+      - "{{ .Env.GHCR_REPO }}/fetcher:latest-arm64"
+  - name_template: "{{ .Env.GHCR_REPO }}/fission-bundle:latest"
     image_templates:
-      - fission/pre-upgrade-checks:{{ .Tag }}-amd64
-      - fission/pre-upgrade-checks:{{ .Tag }}-arm64
-  - name_template: ghcr.io/fission/reporter:{{ .Tag }}
+      - "{{ .Env.GHCR_REPO }}/fission-bundle:latest-amd64"
+      - "{{ .Env.GHCR_REPO }}/fission-bundle:latest-arm64"
+  - name_template: "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:latest"
     image_templates:
-      - ghcr.io/fission/reporter:{{ .Tag }}-amd64
-      - ghcr.io/fission/reporter:{{ .Tag }}-arm64
-  - name_template: fission/reporter:{{ .Tag }}
+      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:latest-amd64"
+      - "{{ .Env.GHCR_REPO }}/pre-upgrade-checks:latest-arm64"
+  - name_template: "{{ .Env.GHCR_REPO }}/reporter:latest"
     image_templates:
-      - fission/reporter:{{ .Tag }}-amd64
-      - fission/reporter:{{ .Tag }}-arm64
-  - name_template: ghcr.io/fission/builder:latest
-    image_templates:
-      - ghcr.io/fission/builder:latest-amd64
-      - ghcr.io/fission/builder:latest-arm64
-  - name_template: fission/builder:latest
-    image_templates:
-      - fission/builder:latest-amd64
-      - fission/builder:latest-arm64
-  - name_template: ghcr.io/fission/fetcher:latest
-    image_templates:
-      - ghcr.io/fission/fetcher:latest-amd64
-      - ghcr.io/fission/fetcher:latest-arm64
-  - name_template: fission/fetcher:latest
-    image_templates:
-      - fission/fetcher:latest-amd64
-      - fission/fetcher:latest-arm64
-  - name_template: ghcr.io/fission/fission-bundle:latest
-    image_templates:
-      - ghcr.io/fission/fission-bundle:latest-amd64
-      - ghcr.io/fission/fission-bundle:latest-arm64
-  - name_template: fission/fission-bundle:latest
-    image_templates:
-      - fission/fission-bundle:latest-amd64
-      - fission/fission-bundle:latest-arm64
-  - name_template: ghcr.io/fission/pre-upgrade-checks:latest
-    image_templates:
-      - ghcr.io/fission/pre-upgrade-checks:latest-amd64
-      - ghcr.io/fission/pre-upgrade-checks:latest-arm64
-  - name_template: fission/pre-upgrade-checks:latest
-    image_templates:
-      - fission/pre-upgrade-checks:latest-amd64
-      - fission/pre-upgrade-checks:latest-arm64
-  - name_template: ghcr.io/fission/reporter:latest
-    image_templates:
-      - ghcr.io/fission/reporter:latest-amd64
-      - ghcr.io/fission/reporter:latest-arm64
-  - name_template: fission/reporter:latest
-    image_templates:
-      - fission/reporter:latest-amd64
-      - fission/reporter:latest-arm64
+      - "{{ .Env.GHCR_REPO }}/reporter:latest-amd64"
+      - "{{ .Env.GHCR_REPO }}/reporter:latest-arm64"
 changelog:
   disable: true
 archives:
@@ -330,29 +303,37 @@ checksum:
 # signs the checksum file
 # https://goreleaser.com/customization/sign
 signs:
-- cmd: cosign
-  artifacts: all
-  stdin: '{{ .Env.COSIGN_PWD }}'
-  output: true
-  args:
-    - sign-blob
-    - '--key=cosign.key'
-    - '--output-certificate=${certificate}'
-    - '--output-signature=${signature}'
-    - '${artifact}'
-    - '--yes' # needed for cosign 2.0.0+
+  - id: cosign-binary
+    env:
+      - COSIGN_EXPERIMENTAL=1
+    certificate: "${artifact}.pem"
+    cmd: cosign
+    artifacts: binary
+    args:
+      - sign-blob
+      - "--output-signature=${signature}"
+      - "--output-certificate=${certificate}"
+      - "${artifact}"
+      - "--yes" # needed for cosign 2.0.0+
 
 # signs our docker image
 # https://goreleaser.com/customization/docker_sign
 docker_signs:
-- cmd: cosign
-  artifacts: all
-  stdin: '{{ .Env.COSIGN_PWD }}'
-  output: true
-  args:
-    - 'sign'
-    - '--key=cosign.key'
-    - '${artifact}'
-    - '--yes' # needed for cosign 2.0.0+
+  - cmd: cosign
+    env:
+      - COSIGN_EXPERIMENTAL=1
+    artifacts: all
+    args:
+      - sign
+      - "${artifact}"
+      - "--yes" # needed for cosign 2.0.0+
+
 sboms:
   - artifacts: archive
+    id: archive
+  - artifacts: source
+    id: source
+  - artifacts: binary
+    id: binary
+  - artifacts: package
+    id: package