Skip to content

Commit 0013967

Browse files
author
Ian Lewis
authored
Combine common checks (slsa-framework#187)
* Combine common checks * fix buildType check * move e2e_this_file * Add environment checks
1 parent 9735199 commit 0013967

8 files changed

+162
-138
lines changed

‎.github/workflows/pre-submit.e2e.generic.workflow.yml renamed to ‎.github/workflows/pre-submit.e2e.generic.default.yml

+5-4
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
1-
name: pre-submit e2e generic workflow
1+
name: pre-submit e2e generic default
22
on:
33
pull_request:
44
branches: [main]
55

66
env:
7-
THIS_FILE: pre-submit.e2e.generic.workflow.yml
7+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
88

99
jobs:
1010
build:
@@ -15,7 +15,7 @@ jobs:
1515
uses: ./.github/workflows/slsa2_provenance.yml
1616
with:
1717
# echo "2e0390eb024a52963db7b95e84a9c2b12c004054a7bad9a97ec0c7c89d4681d2 binary-name" | base64 -w0
18-
subjects: "MmUwMzkwZWIwMjRhNTI5NjNkYjdiOTVlODRhOWMyYjEyYzAwNDA1NGE3YmFkOWE5N2VjMGM3Yzg5ZDQ2ODFkMiAgICBiaW5hcnktbmFtZQo="
18+
base64-subjects: "MmUwMzkwZWIwMjRhNTI5NjNkYjdiOTVlODRhOWMyYjEyYzAwNDA1NGE3YmFkOWE5N2VjMGM3Yzg5ZDQ2ODFkMiAgICBiaW5hcnktbmFtZQo="
1919

2020
verify:
2121
runs-on: ubuntu-latest
@@ -26,5 +26,6 @@ jobs:
2626
with:
2727
name: ${{ needs.build.outputs.attestation-name }}
2828
- env:
29+
BINARY: "binary-name"
2930
PROVENANCE: ${{ needs.build.outputs.attestation-name }}
30-
run: "./.github/workflows/scripts/pre-submit.e2e.generic.workflow.sh"
31+
run: ./.github/workflows/scripts/pre-submit.e2e.generic.default.sh

‎.github/workflows/pre-submit.e2e.go.config-ldflags-main-dir.yml

+1-4
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,4 @@ jobs:
5050
- env:
5151
BINARY: ${{ needs.build.outputs.go-binary-name }}
5252
PROVENANCE: ${{ needs.build.outputs.go-binary-name }}.intoto.jsonl
53-
run: |
54-
set -euo pipefail
55-
56-
./.github/workflows/scripts/e2e-verify.sh
53+
run: ./.github/workflows/scripts/pre-submit.e2e.go.default.sh

‎.github/workflows/scripts/e2e-utils.sh

+11-5
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,12 @@
22

33
source "./.github/workflows/scripts/e2e-assert.sh"
44

5+
# Gets the name of the currently running workflow file.
6+
# Note: this requires GH_TOKEN to be set in the workflows.
7+
e2e_this_file() {
8+
gh api -H "Accept: application/vnd.github.v3+json" "/repos/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" | jq -r '.path' | cut -d '/' -f3
9+
}
10+
511
e2e_verify_predicate_subject_name() {
612
_e2e_verify_query "$1" "$2" '.subject[0].name'
713
}
@@ -10,7 +16,7 @@ e2e_verify_predicate_builder_id() {
1016
_e2e_verify_query "$1" "$2" '.predicate.builder.id'
1117
}
1218

13-
e2e_verify_predicate_builderType() {
19+
e2e_verify_predicate_buildType() {
1420
_e2e_verify_query "$1" "$2" '.predicate.buildType'
1521
}
1622

@@ -36,19 +42,19 @@ e2e_verify_predicate_buildConfig_step_command() {
3642
e2e_verify_predicate_buildConfig_step_env() {
3743
local attestation="$2"
3844
local expected="$(echo -n "$3" | jq -c '.| sort')"
39-
45+
4046
if [[ "${expected}" == "[]" ]]; then
41-
_e2e_verify_query "${attestation}" "null" ".predicate.buildConfig.steps[$1].env"
47+
_e2e_verify_query "${attestation}" "null" ".predicate.buildConfig.steps[$1].env"
4248
else
43-
_e2e_verify_query "${attestation}" "${expected}" ".predicate.buildConfig.steps[$1].env | sort"
49+
_e2e_verify_query "${attestation}" "${expected}" ".predicate.buildConfig.steps[$1].env | sort"
4450
fi
4551
}
4652

4753
# $1: step number
4854
# $2: the attestation content
4955
# $3: expected value.
5056
e2e_verify_predicate_buildConfig_step_workingDir() {
51-
_e2e_verify_query "$2" "$3" ".predicate.buildConfig.steps[$1].workingDir"
57+
_e2e_verify_query "$2" "$3" ".predicate.buildConfig.steps[$1].workingDir"
5258
}
5359

5460
e2e_verify_predicate_metadata() {

‎.github/workflows/scripts/e2e-verify.common.sh

+58
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
#!/usr/bin/env bash
2+
#
3+
# This file contains tests for common fields of Github Actions provenance.
4+
5+
source "./.github/workflows/scripts/e2e-utils.sh"
6+
7+
# Runs all generic SLSA checks that shouldn't change on a per-builder basis.
8+
# $1: the attestation content
9+
e2e_verify_common_all() {
10+
e2e_verify_common_builder "$1"
11+
e2e_verify_common_invocation "$1"
12+
e2e_verify_common_metadata "$1"
13+
e2e_verify_common_materials "$1"
14+
}
15+
16+
# Verifies the builder for generic provenance.
17+
# $1: the attestation content
18+
e2e_verify_common_builder() {
19+
e2e_verify_predicate_builder_id "$1" "https://github.com/Attestations/GitHubHostedActions@v1"
20+
}
21+
22+
# Verifies the invocation for generic provenance.
23+
# $1: the attestation content
24+
e2e_verify_common_invocation() {
25+
# NOTE: We set GITHUB_WORKFLOW to the entryPoint for pull_requests.
26+
# TODO(github.com/slsa-framework/slsa-github-generator/issues/131): support retrieving entryPoint in pull requests.
27+
e2e_verify_predicate_invocation_configSource "$1" "{\"uri\":\"git+https://github.com/$GITHUB_REPOSITORY@$GITHUB_REF\",\"digest\":{\"sha1\":\"$GITHUB_SHA\"},\"entryPoint\":\"$GITHUB_WORKFLOW\"}"
28+
29+
e2e_verify_predicate_invocation_environment "$1" "github_actor" "$GITHUB_ACTOR"
30+
e2e_verify_predicate_invocation_environment "$1" "github_sha1" "$GITHUB_SHA"
31+
# e2e_verify_predicate_invocation_environment "$1" "os" "ubuntu20"
32+
# e2e_verify_predicate_invocation_environment "$1" "arch" "X64"
33+
e2e_verify_predicate_invocation_environment "$1" "github_event_name" "$GITHUB_EVENT_NAME"
34+
e2e_verify_predicate_invocation_environment "$1" "github_ref" "$GITHUB_REF"
35+
e2e_verify_predicate_invocation_environment "$1" "github_ref_type" "$GITHUB_REF_TYPE"
36+
e2e_verify_predicate_invocation_environment "$1" "github_run_id" "$GITHUB_RUN_ID"
37+
e2e_verify_predicate_invocation_environment "$1" "github_run_number" "$GITHUB_RUN_NUMBER"
38+
e2e_verify_predicate_invocation_environment "$1" "github_run_attempt" "$GITHUB_RUN_ATTEMPT"
39+
# The checks below are commented out because they are populated via the OIDC token, which is not available in PRs.
40+
#ACTOR_ID=$(gh api -H "Accept: application/vnd.github.v3+json" /users/"$GITHUB_ACTOR" | jq -r '.id')
41+
#OWNER_ID=$(gh api -H "Accept: application/vnd.github.v3+json" /users/"$GITHUB_REPOSITORY_OWNER" | jq -r '.id')
42+
#REPO_ID=$(gh api -H "Accept: application/vnd.github.v3+json" /repos/"$GITHUB_REPOSITORY" | jq -r '.id')
43+
#e2e_verify_predicate_invocation_environment "$1" "github_actor_id" "$ACTOR_ID"
44+
#e2e_verify_predicate_invocation_environment "$1" "github_repository_owner_id" "$OWNER_ID"
45+
#e2e_verify_predicate_invocation_environment "$1" "github_repository_id" "$REPO_ID"
46+
}
47+
48+
# Verifies the expected metadata.
49+
# $1: the attestation content
50+
e2e_verify_common_metadata() {
51+
e2e_verify_predicate_metadata "$1" "{\"buildInvocationID\":\"$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT\",\"completeness\":{\"parameters\":true,\"environment\":false,\"materials\":false},\"reproducible\":false}"
52+
}
53+
54+
# Verifies the materials include the GitHub repository.
55+
# $1: the attestation content
56+
e2e_verify_common_materials() {
57+
e2e_verify_predicate_materials "$1" "{\"uri\":\"git+https://github.com/$GITHUB_REPOSITORY@$GITHUB_REF\",\"digest\":{\"sha1\":\"$GITHUB_SHA\"}}"
58+
}

‎.github/workflows/scripts/e2e-verify.sh

-78
This file was deleted.

‎.github/workflows/scripts/pre-submit.e2e.generic.default.sh

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
#!/usr/bin/env bash
2+
#
3+
# Copyright 2022 SLSA Authors
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
set -euo pipefail
18+
19+
source "./.github/workflows/scripts/e2e-verify.common.sh"
20+
21+
# TODO(github.com/slsa-framework/slsa-github-generator/issues/129): Address base64 output format.
22+
ATTESTATION=$(cat "$PROVENANCE")
23+
24+
# Verify common provenance fields.
25+
e2e_verify_common_all "$ATTESTATION"
26+
27+
e2e_verify_predicate_subject_name "$ATTESTATION" "$BINARY"
28+
e2e_verify_predicate_buildType "$ATTESTATION" "https://github.com/slsa-framework/slsa-github-generator@v1"

‎.github/workflows/scripts/pre-submit.e2e.generic.workflow.sh

-47
This file was deleted.

‎.github/workflows/scripts/pre-submit.e2e.go.default.sh

+59
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
#!/usr/bin/env bash
2+
3+
# To test:
4+
# export GITHUB_SHA=6f3b6435f5a17a25ad6cf2704d0c192bcef8193f
5+
# export GITHUB_RUN_ID=2272442563
6+
# export GITHUB_ACTOR=laurentsimon
7+
# export GITHUB_RUN_ATTEMPT=1
8+
# export GITHUB_REF=refs/heads/branch-name or refs/tags/tag-name
9+
# export GITHUB_REF_TYPE=branch or tag
10+
# export GITHUB_REPOSITORY=slsa-framework/example-package
11+
# export GITHUB_REF_NAME=v1.2.3
12+
# export GITHUB_WORKFLOW=go schedule main SLSA3 config-noldflags
13+
# export THIS_FILE=e2e.go.workflow_dispatch.main.config-noldflags.slsa3.yml
14+
# export BINARY=binary-linux-amd64
15+
# export PROVENANCE=example.intoto.jsonl
16+
# export GITHUB_EVENT_NAME=pull_request
17+
18+
source "./.github/workflows/scripts/e2e-verify.common.sh"
19+
20+
BRANCH="main"
21+
22+
# Provenance content verification.
23+
ATTESTATION=$(base64 -d "$PROVENANCE")
24+
LDFLAGS=$(e2e_this_file | cut -d '.' -f4 | grep -v noldflags)
25+
26+
# Verify common provenance fields.
27+
e2e_verify_common_all "$ATTESTATION"
28+
29+
# Verify the subject and build type
30+
e2e_verify_predicate_subject_name "$ATTESTATION" "$BINARY"
31+
e2e_verify_predicate_buildType "$ATTESTATION" "https://github.com/slsa-framework/slsa-github-generator/go@v1"
32+
33+
# Verify extra invocation environment.
34+
e2e_verify_predicate_invocation_environment "$ATTESTATION" "os" "ubuntu20"
35+
e2e_verify_predicate_invocation_environment "$ATTESTATION" "arch" "X64"
36+
37+
# Verify the buildConfig
38+
39+
# First step is vendoring
40+
e2e_verify_predicate_buildConfig_step_command "0" "$ATTESTATION" "[\"mod\",\"vendor\"]"
41+
e2e_verify_predicate_buildConfig_step_env "0" "$ATTESTATION" "[]"
42+
e2e_verify_predicate_buildConfig_step_workingDir "0" "$ATTESTATION" "$PWD/internal/builders/go/e2e-presubmits"
43+
44+
# Second step is the actual compilation.
45+
e2e_verify_predicate_buildConfig_step_env "1" "$ATTESTATION" "[\"GOOS=linux\",\"GOARCH=amd64\",\"GO111MODULE=on\",\"CGO_ENABLED=0\"]"
46+
e2e_verify_predicate_buildConfig_step_workingDir "1" "$ATTESTATION" "$PWD/internal/builders/go/e2e-presubmits"
47+
48+
if [[ -n "$LDFLAGS" ]]; then
49+
e2e_verify_predicate_buildConfig_step_command "1" "$ATTESTATION" "[\"build\",\"-mod=vendor\",\"-trimpath\",\"-tags=netgo\",\"-ldflags=-X main.gitVersion=v1.2.3 -X main.gitCommit=abcdef -X main.gitBranch=$BRANCH\",\"-o\",\"$BINARY\",\"main.go\"]"
50+
chmod a+x ./"$BINARY"
51+
V=$(./"$BINARY" | grep 'GitVersion: v1.2.3')
52+
C=$(./"$BINARY" | grep 'GitCommit: abcdef')
53+
B=$(./"$BINARY" | grep "GitBranch: main")
54+
e2e_assert_not_eq "$V" "" "GitVersion should not be empty"
55+
e2e_assert_not_eq "$C" "" "GitCommit should not be empty"
56+
e2e_assert_not_eq "$B" "" "GitBranch should not be empty"
57+
else
58+
e2e_verify_predicate_buildConfig_step_command "1" "$ATTESTATION" "[\"build\",\"-mod=vendor\",\"-trimpath\",\"-tags=netgo\",\"-o\",\"$BINARY\",\"main.go\"]"
59+
fi

0 commit comments

Comments
 (0)