-
Notifications
You must be signed in to change notification settings - Fork 400
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: generate SLSA provenance for release binaries (#730)
* Support for SLSA provenance generation * updates * updates * updates * updates * updates * comment * update * update * update * update * update * update * update * update * update
- Loading branch information
1 parent
f9b4471
commit 14b4fe1
Showing
2 changed files
with
93 additions
and
5 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -7,6 +7,9 @@ on: | |
|
||
jobs: | ||
goreleaser: | ||
outputs: | ||
hashes: ${{ steps.hash.outputs.hashes }} | ||
|
||
runs-on: ubuntu-latest | ||
steps: | ||
- uses: actions/checkout@v3 | ||
|
@@ -16,8 +19,79 @@ jobs: | |
go-version: 1.18 | ||
check-latest: true | ||
- uses: goreleaser/[email protected] | ||
id: run-goreleaser | ||
with: | ||
version: latest | ||
args: release --rm-dist | ||
env: | ||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
- name: Generate subject | ||
id: hash | ||
env: | ||
ARTIFACTS: "${{ steps.run-goreleaser.outputs.artifacts }}" | ||
run: | | ||
set -euo pipefail | ||
checksum_file=$(echo "$ARTIFACTS" | jq -r '.[] | select (.type=="Checksum") | .path') | ||
echo "::set-output name=hashes::$(cat $checksum_file | base64 -w0)" | ||
provenance: | ||
needs: [goreleaser] | ||
permissions: | ||
actions: read # To read the workflow path. | ||
id-token: write # To sign the provenance. | ||
contents: write # To add assets to a release. | ||
uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected] | ||
with: | ||
base64-subjects: "${{ needs.goreleaser.outputs.hashes }}" | ||
upload-assets: true | ||
|
||
verification: | ||
needs: [goreleaser, provenance] | ||
runs-on: ubuntu-latest | ||
permissions: read-all | ||
steps: | ||
# Note: this will be replaced with the GHA in the future. | ||
- name: Install the verifier | ||
env: | ||
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
run: | | ||
set -euo pipefail | ||
gh -R slsa-framework/slsa-verifier release download v1.2.0 -p "slsa-verifier-linux-amd64" | ||
chmod ug+x slsa-verifier-linux-amd64 | ||
# Note: see https://github.com/slsa-framework/slsa-verifier/blob/main/SHA256SUM.md | ||
COMPUTED_HASH=$(sha256sum slsa-verifier-linux-amd64 | cut -d ' ' -f1) | ||
EXPECTED_HASH="37db23392c7918bb4e243cdb097ed5f9d14b9b965dc1905b25bc2d1c0c91bf3d" | ||
if [[ "$EXPECTED_HASH" != "$COMPUTED_HASH" ]];then | ||
echo "error: expected $EXPECTED_HASH, computed $COMPUTED_HASH" | ||
exit 1 | ||
fi | ||
- name: Download assets | ||
env: | ||
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
run: | | ||
set -euo pipefail | ||
gh -R "$GITHUB_REPOSITORY" release download "$GITHUB_REF_NAME" -p "*.tar.gz" | ||
gh -R "$GITHUB_REPOSITORY" release download "$GITHUB_REF_NAME" -p "attestation.intoto.jsonl" | ||
- name: Verify assets | ||
env: | ||
CHECKSUMS: ${{ needs.goreleaser.outputs.hashes }} | ||
PROVENANCE: "${{ needs.provenance.outputs.attestation-name }}" | ||
run: | | ||
set -euo pipefail | ||
checksums=$(echo "$CHECKSUMS" | base64 -d) | ||
while read -r line; do | ||
fn=$(echo $line | cut -d ' ' -f2) | ||
echo "Verifying $fn" | ||
./slsa-verifier-linux-amd64 -artifact-path "$fn" \ | ||
-provenance "$PROVENANCE" \ | ||
-source "github.com/$GITHUB_REPOSITORY" \ | ||
-tag "$GITHUB_REF_NAME" | ||
done <<<"$checksums" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters