Skip to content

Commit 3be5e28

Browse files
laurentsimonlaurentsimon
committed
update
1 parent e3dfe05 commit 3be5e28

File tree

6 files changed

+43
-22
lines changed

6 files changed

+43
-22
lines changed

‎cli/slsa-verifier/main_test.go

+12-3
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,6 @@ import (
99

1010
"golang.org/x/mod/semver"
1111

12-
serrors "github.com/slsa-framework/slsa-verifier/errors"
13-
1412
"github.com/google/go-cmp/cmp"
1513
"github.com/google/go-cmp/cmp/cmpopts"
1614
)
@@ -43,6 +41,7 @@ func Test_runVerify(t *testing.T) {
4341
ptag *string
4442
pversiontag *string
4543
pbuilderID *string
44+
builderID string
4645
err error
4746
// noversion is a special case where we are not testing all builder versions
4847
// for example, testdata for the builder at head in trusted repo workflows
@@ -344,6 +343,7 @@ func Test_runVerify(t *testing.T) {
344343
minversion: "v1.2.0",
345344
builders: []string{"generic"},
346345
pbuilderID: pString("https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml"),
346+
builderID: "https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@refs/heads/main",
347347
},
348348
// Special case of the e2e test repository building builder from head.
349349
{
@@ -352,6 +352,7 @@ func Test_runVerify(t *testing.T) {
352352
source: "github.com/slsa-framework/example-package",
353353
branch: "main",
354354
noversion: true,
355+
builderID: "https://github.com/slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@refs/heads/main",
355356
},
356357
// Malicious builders and workflows.
357358
{
@@ -434,14 +435,22 @@ func Test_runVerify(t *testing.T) {
434435
artifactPath := filepath.Clean(filepath.Join(TEST_DIR, v, tt.artifact))
435436
provenancePath := fmt.Sprintf("%s.intoto.jsonl", artifactPath)
436437

437-
_, _, err := runVerify(artifactPath,
438+
_, builderID, err := runVerify(artifactPath,
438439
provenancePath,
439440
tt.source, branch, tt.pbuilderID,
440441
tt.ptag, tt.pversiontag)
441442

442443
if !errCmp(err, tt.err) {
443444
t.Errorf(cmp.Diff(err, tt.err, cmpopts.EquateErrors()))
444445
}
446+
447+
if err != nil {
448+
return
449+
}
450+
451+
if tt.builderID != "" && builderID != tt.builderID {
452+
t.Errorf(cmp.Diff(builderID, tt.builderID))
453+
}
445454
}
446455
})
447456
}

‎options/options.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ type ProvenanceOpts struct {
1919
ExpectedVersionedTag *string
2020

2121
// ExpectedBuilderID is the expected builder ID.
22-
ExpectedBuilderID *string
22+
ExpectedBuilderID string
2323
}
2424

2525
// BuildOpts are the options for checking the builder.

‎verifiers/internal/gha/builder.go

+2-1
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,8 @@ func VerifyWorkflowIdentity(id *WorkflowIdentity,
5959
expectedSource, id.CallerRepository)
6060
}
6161

62-
return builderID, nil
62+
// Return the builder and its tag.
63+
return builderID + "@" + workflowPath[1], nil
6364
}
6465

6566
func verifyTrustedBuilderID(path string, builderID *string) (string, error) {

‎verifiers/internal/gha/builder_test.go

+24-9
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,8 @@ func Test_VerifyWorkflowIdentity(t *testing.T) {
6565
Trigger: "workflow_dispatch",
6666
Issuer: "https://token.actions.githubusercontent.com",
6767
},
68-
source: trustedBuilderRepository,
68+
source: trustedBuilderRepository,
69+
builderID: "https://github.com/" + trustedBuilderRepository + "/.github/workflows/builder_go_slsa3.yml@refs/heads/main",
6970
},
7071
{
7172
name: "valid main ref for e2e test",
@@ -76,7 +77,8 @@ func Test_VerifyWorkflowIdentity(t *testing.T) {
7677
Trigger: "workflow_dispatch",
7778
Issuer: certOidcIssuer,
7879
},
79-
source: e2eTestRepository,
80+
source: e2eTestRepository,
81+
builderID: "https://github.com/" + trustedBuilderRepository + "/.github/workflows/builder_go_slsa3.yml@refs/heads/main",
8082
},
8183
{
8284
name: "valid main ref for e2e test - match builderID",
@@ -91,6 +93,7 @@ func Test_VerifyWorkflowIdentity(t *testing.T) {
9193
buildOpts: &options.BuilderOpts{
9294
ExpectedID: asStringPointer("https://github.com/" + trustedBuilderRepository + "/.github/workflows/builder_go_slsa3.yml"),
9395
},
96+
builderID: "https://github.com/" + trustedBuilderRepository + "/.github/workflows/builder_go_slsa3.yml@refs/heads/main",
9497
},
9598
{
9699
name: "valid main ref for e2e test - mismatch builderID",
@@ -116,8 +119,9 @@ func Test_VerifyWorkflowIdentity(t *testing.T) {
116119
Trigger: "workflow_dispatch",
117120
Issuer: certOidcIssuer,
118121
},
119-
source: "malicious/source",
120-
err: serrors.ErrorMismatchSource,
122+
source: "malicious/source",
123+
err: serrors.ErrorMismatchSource,
124+
builderID: "https://github.com/" + trustedBuilderRepository + "/.github/workflows/builder_go_slsa3.yml@refs/heads/main",
121125
},
122126
{
123127
name: "valid main ref for builder",
@@ -151,7 +155,8 @@ func Test_VerifyWorkflowIdentity(t *testing.T) {
151155
Trigger: "workflow_dispatch",
152156
Issuer: certOidcIssuer,
153157
},
154-
source: "asraa/slsa-on-github-test",
158+
source: "asraa/slsa-on-github-test",
159+
builderID: "https://github.com/" + trustedBuilderRepository + "/.github/workflows/builder_go_slsa3.yml@refs/tags/v1.2.3",
155160
},
156161
{
157162
name: "valid workflow identity - match builderID",
@@ -166,6 +171,7 @@ func Test_VerifyWorkflowIdentity(t *testing.T) {
166171
buildOpts: &options.BuilderOpts{
167172
ExpectedID: asStringPointer("https://github.com/" + trustedBuilderRepository + "/.github/workflows/builder_go_slsa3.yml"),
168173
},
174+
builderID: "https://github.com/" + trustedBuilderRepository + "/.github/workflows/builder_go_slsa3.yml@refs/tags/v1.2.3",
169175
},
170176
{
171177
name: "valid workflow identity - mismatch builderID",
@@ -191,8 +197,9 @@ func Test_VerifyWorkflowIdentity(t *testing.T) {
191197
Trigger: "workflow_dispatch",
192198
Issuer: certOidcIssuer,
193199
},
194-
source: "asraa/slsa-on-github-test",
195-
err: serrors.ErrorInvalidRef,
200+
source: "asraa/slsa-on-github-test",
201+
err: serrors.ErrorInvalidRef,
202+
builderID: "https://github.com/" + trustedBuilderRepository + "/.github/workflows/builder_go_slsa3.yml@refs/tags/v1.2.3-alpha",
196203
},
197204
{
198205
name: "invalid workflow identity with build",
@@ -227,7 +234,8 @@ func Test_VerifyWorkflowIdentity(t *testing.T) {
227234
Trigger: "workflow_dispatch",
228235
Issuer: certOidcIssuer,
229236
},
230-
source: "github.com/asraa/slsa-on-github-test",
237+
source: "github.com/asraa/slsa-on-github-test",
238+
builderID: "https://github.com/" + trustedBuilderRepository + "/.github/workflows/builder_go_slsa3.yml@refs/tags/v1.2.3",
231239
},
232240
{
233241
name: "valid workflow identity with fully qualified source - match builderID",
@@ -242,6 +250,7 @@ func Test_VerifyWorkflowIdentity(t *testing.T) {
242250
buildOpts: &options.BuilderOpts{
243251
ExpectedID: asStringPointer("https://github.com/" + trustedBuilderRepository + "/.github/workflows/builder_go_slsa3.yml"),
244252
},
253+
builderID: "https://github.com/" + trustedBuilderRepository + "/.github/workflows/builder_go_slsa3.yml@refs/tags/v1.2.3",
245254
},
246255
{
247256
name: "valid workflow identity with fully qualified source - mismatch builderID",
@@ -267,10 +276,16 @@ func Test_VerifyWorkflowIdentity(t *testing.T) {
267276
if opts == nil {
268277
opts = &options.BuilderOpts{}
269278
}
270-
_, err := VerifyWorkflowIdentity(tt.workflow, opts, tt.source)
279+
id, err := VerifyWorkflowIdentity(tt.workflow, opts, tt.source)
271280
if !errCmp(err, tt.err) {
272281
t.Errorf(cmp.Diff(err, tt.err, cmpopts.EquateErrors()))
273282
}
283+
if err != nil {
284+
return
285+
}
286+
if id != tt.builderID {
287+
t.Errorf(cmp.Diff(id, tt.builderID))
288+
}
274289
})
275290
}
276291
}

‎verifiers/internal/gha/provenance.go

+3-7
Original file line numberDiff line numberDiff line change
@@ -39,13 +39,9 @@ func provenanceFromEnv(env *dsselib.Envelope) (prov *intoto.ProvenanceStatement,
3939

4040
// Verify Builder ID in provenance statement.
4141
func verifyBuilderID(prov *intoto.ProvenanceStatement, builderID string) error {
42-
id, err := sourceFromURI(prov.Predicate.Builder.ID)
43-
if err != nil {
44-
return err
45-
}
46-
if !strings.EqualFold(id, builderID) {
42+
if !strings.EqualFold(prov.Predicate.Builder.ID, builderID) {
4743
return fmt.Errorf("%w: expected '%s' in builder.id, got '%s'", serrors.ErrorMismatchBuilderID,
48-
builderID, id)
44+
builderID, prov.Predicate.Builder.ID)
4945
}
5046
return nil
5147
}
@@ -178,7 +174,7 @@ func VerifyProvenance(env *dsselib.Envelope, provenanceOpts *options.ProvenanceO
178174
}
179175

180176
// Verify Builder ID.
181-
if err := verifyBuilderID(prov, *provenanceOpts.ExpectedBuilderID); err != nil {
177+
if err := verifyBuilderID(prov, provenanceOpts.ExpectedBuilderID); err != nil {
182178
return err
183179
}
184180

‎verifiers/internal/gha/verifier.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@ func (v *GHAVerifier) Verify(ctx context.Context,
6565

6666
/* Verify properties of the SLSA provenance. */
6767
// Unpack and verify info in the provenance, including the Subject Digest.
68-
provenanceOpts.ExpectedBuilderID = &builderID
68+
provenanceOpts.ExpectedBuilderID = builderID
6969
if err := VerifyProvenance(env, provenanceOpts); err != nil {
7070
return nil, "", err
7171
}

0 commit comments

Comments
 (0)