Skip to content

Commit 5a77b25

Browse files
asraaasraa
authored
fix: fix GCB verification with git material source prefix (#519)
Signed-off-by: Asra Ali <[email protected]>
1 parent 47495c7 commit 5a77b25

File tree

3 files changed

+131
-0
lines changed

3 files changed

+131
-0
lines changed

‎verifiers/internal/gcb/provenance.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -349,6 +349,7 @@ func (p *Provenance) VerifySourceURI(expectedSourceURI string, builderID utils.T
349349
return fmt.Errorf("%w: no materials", serrors.ErrorInvalidDssePayload)
350350
}
351351
uri := materials[0].URI
352+
uri = strings.TrimPrefix(uri, "git+")
352353

353354
// It is possible that GCS builds at level 2 use GCS sources, prefixed by gs://.
354355
if strings.HasPrefix(uri, "https://") && !strings.HasPrefix(expectedSourceURI, "https://") {

‎verifiers/internal/gcb/provenance_test.go

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -428,6 +428,12 @@ func Test_VerifySourceURI(t *testing.T) {
428428
builderID: "https://cloudbuild.googleapis.com/[email protected]",
429429
source: "https://github.com/laurentsimon/gcb-tests",
430430
},
431+
{
432+
name: "v0.3 valid gcb provenance with git prefix",
433+
path: "./testdata/gcloud-container-github-v03-git.json",
434+
builderID: "https://cloudbuild.googleapis.com/[email protected]",
435+
source: "https://github.com/slsa-framework/example-package",
436+
},
431437
{
432438
name: "v0.3 mismatch name",
433439
path: "./testdata/gcloud-container-github-v03.json",

‎verifiers/internal/gcb/testdata/gcloud-container-github-v03-git.json

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
{
2+
"image_summary": {
3+
"digest": "sha256:2476c2e19b1459b0a0a6d3d214f96f0a0bf4d2071584b8feeebf51a68168bff2",
4+
"fully_qualified_digest": "us-west2-docker.pkg.dev/slsa-tooling/example-package-repo/e2e-gcb-tag-main-cloudbuild-slsa3@sha256:2476c2e19b1459b0a0a6d3d214f96f0a0bf4d2071584b8feeebf51a68168bff2",
5+
"registry": "us-west2-docker.pkg.dev",
6+
"repository": "example-package-repo"
7+
},
8+
"provenance_summary": {
9+
"provenance": [
10+
{
11+
"build": {
12+
"intotoStatement": {
13+
"_type": "https://in-toto.io/Statement/v0.1",
14+
"predicateType": "https://slsa.dev/provenance/v0.1",
15+
"slsaProvenance": {
16+
"builder": {
17+
"id": "https://cloudbuild.googleapis.com/[email protected]"
18+
},
19+
"materials": [
20+
{
21+
"digest": {
22+
"sha1": "d8e834cecc09efb7099196b005441606298e47b9"
23+
},
24+
"uri": "git+https://github.com/slsa-framework/example-package"
25+
}
26+
],
27+
"metadata": {
28+
"buildFinishedOn": "2023-03-08T21:38:05.119259Z",
29+
"buildInvocationId": "33fe59fd-19cb-4e85-b0b4-d58d8011a1de",
30+
"buildStartedOn": "2023-03-08T21:37:39.591139209Z"
31+
},
32+
"recipe": {
33+
"arguments": {
34+
"@type": "type.googleapis.com/google.devtools.cloudbuild.v1.Build",
35+
"id": "33fe59fd-19cb-4e85-b0b4-d58d8011a1de",
36+
"name": "projects/819720953812/locations/us-west2/builds/33fe59fd-19cb-4e85-b0b4-d58d8011a1de",
37+
"options": {
38+
"dynamicSubstitutions": true,
39+
"logging": "CLOUD_LOGGING_ONLY",
40+
"pool": {},
41+
"requestedVerifyOption": "VERIFIED",
42+
"sourceProvenanceHash": [
43+
"SHA256"
44+
],
45+
"substitutionOption": "ALLOW_LOOSE"
46+
},
47+
"sourceProvenance": {},
48+
"steps": [
49+
{
50+
"args": [
51+
"build",
52+
"-t",
53+
"us-west2-docker.pkg.dev/slsa-tooling/example-package-repo/e2e-gcb-tag-main-cloudbuild-slsa3",
54+
"."
55+
],
56+
"name": "gcr.io/cloud-builders/docker",
57+
"pullTiming": {
58+
"endTime": "2023-03-08T21:37:43.684787795Z",
59+
"startTime": "2023-03-08T21:37:43.681104885Z"
60+
},
61+
"status": "SUCCESS",
62+
"timing": {
63+
"endTime": "2023-03-08T21:38:03.167489646Z",
64+
"startTime": "2023-03-08T21:37:43.681104885Z"
65+
}
66+
}
67+
],
68+
"substitutions": {
69+
"COMMIT_SHA": "d8e834cecc09efb7099196b005441606298e47b9",
70+
"REF_NAME": "v33.0.3",
71+
"REPO_NAME": "example-package",
72+
"REVISION_ID": "d8e834cecc09efb7099196b005441606298e47b9",
73+
"SHORT_SHA": "d8e834c",
74+
"TAG_NAME": "v33.0.3",
75+
"TRIGGER_BUILD_CONFIG_PATH": "cloudbuild.yaml",
76+
"TRIGGER_NAME": "push-tag",
77+
"_IMAGE_NAME": "slsa-tooling/example-package-repo/e2e-gcb-tag-main-cloudbuild-slsa3"
78+
}
79+
},
80+
"entryPoint": "cloudbuild.yaml",
81+
"type": "https://cloudbuild.googleapis.com/[email protected]"
82+
}
83+
},
84+
"subject": [
85+
{
86+
"digest": {
87+
"sha256": "2476c2e19b1459b0a0a6d3d214f96f0a0bf4d2071584b8feeebf51a68168bff2"
88+
},
89+
"name": "https://us-west2-docker.pkg.dev/slsa-tooling/example-package-repo/e2e-gcb-tag-main-cloudbuild-slsa3"
90+
},
91+
{
92+
"digest": {
93+
"sha256": "2476c2e19b1459b0a0a6d3d214f96f0a0bf4d2071584b8feeebf51a68168bff2"
94+
},
95+
"name": "https://us-west2-docker.pkg.dev/slsa-tooling/example-package-repo/e2e-gcb-tag-main-cloudbuild-slsa3:latest"
96+
}
97+
]
98+
}
99+
},
100+
"createTime": "2023-03-08T21:38:07.724936Z",
101+
"envelope": {
102+
"payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjAuMSIsInByZWRpY2F0ZSI6eyJidWlsZGVyIjp7ImlkIjoiaHR0cHM6Ly9jbG91ZGJ1aWxkLmdvb2dsZWFwaXMuY29tL0dvb2dsZUhvc3RlZFdvcmtlckB2MC4zIn0sIm1hdGVyaWFscyI6W3siZGlnZXN0Ijp7InNoYTEiOiJkOGU4MzRjZWNjMDllZmI3MDk5MTk2YjAwNTQ0MTYwNjI5OGU0N2I5In0sInVyaSI6ImdpdCtodHRwczovL2dpdGh1Yi5jb20vc2xzYS1mcmFtZXdvcmsvZXhhbXBsZS1wYWNrYWdlIn1dLCJtZXRhZGF0YSI6eyJidWlsZEZpbmlzaGVkT24iOiIyMDIzLTAzLTA4VDIxOjM4OjA1LjExOTI1OVoiLCJidWlsZEludm9jYXRpb25JZCI6IjMzZmU1OWZkLTE5Y2ItNGU4NS1iMGI0LWQ1OGQ4MDExYTFkZSIsImJ1aWxkU3RhcnRlZE9uIjoiMjAyMy0wMy0wOFQyMTozNzozOS41OTExMzkyMDlaIn0sInJlY2lwZSI6eyJhcmd1bWVudHMiOnsiQHR5cGUiOiJ0eXBlLmdvb2dsZWFwaXMuY29tL2dvb2dsZS5kZXZ0b29scy5jbG91ZGJ1aWxkLnYxLkJ1aWxkIiwiaWQiOiIzM2ZlNTlmZC0xOWNiLTRlODUtYjBiNC1kNThkODAxMWExZGUiLCJuYW1lIjoicHJvamVjdHMvODE5NzIwOTUzODEyL2xvY2F0aW9ucy91cy13ZXN0Mi9idWlsZHMvMzNmZTU5ZmQtMTljYi00ZTg1LWIwYjQtZDU4ZDgwMTFhMWRlIiwib3B0aW9ucyI6eyJkeW5hbWljU3Vic3RpdHV0aW9ucyI6dHJ1ZSwibG9nZ2luZyI6IkNMT1VEX0xPR0dJTkdfT05MWSIsInBvb2wiOnt9LCJyZXF1ZXN0ZWRWZXJpZnlPcHRpb24iOiJWRVJJRklFRCIsInNvdXJjZVByb3ZlbmFuY2VIYXNoIjpbIlNIQTI1NiJdLCJzdWJzdGl0dXRpb25PcHRpb24iOiJBTExPV19MT09TRSJ9LCJzb3VyY2VQcm92ZW5hbmNlIjp7fSwic3RlcHMiOlt7ImFyZ3MiOlsiYnVpbGQiLCItdCIsInVzLXdlc3QyLWRvY2tlci5wa2cuZGV2L3Nsc2EtdG9vbGluZy9leGFtcGxlLXBhY2thZ2UtcmVwby9lMmUtZ2NiLXRhZy1tYWluLWNsb3VkYnVpbGQtc2xzYTMiLCIuIl0sIm5hbWUiOiJnY3IuaW8vY2xvdWQtYnVpbGRlcnMvZG9ja2VyIiwicHVsbFRpbWluZyI6eyJlbmRUaW1lIjoiMjAyMy0wMy0wOFQyMTozNzo0My42ODQ3ODc3OTVaIiwic3RhcnRUaW1lIjoiMjAyMy0wMy0wOFQyMTozNzo0My42ODExMDQ4ODVaIn0sInN0YXR1cyI6IlNVQ0NFU1MiLCJ0aW1pbmciOnsiZW5kVGltZSI6IjIwMjMtMDMtMDhUMjE6Mzg6MDMuMTY3NDg5NjQ2WiIsInN0YXJ0VGltZSI6IjIwMjMtMDMtMDhUMjE6Mzc6NDMuNjgxMTA0ODg1WiJ9fV0sInN1YnN0aXR1dGlvbnMiOnsiQ09NTUlUX1NIQSI6ImQ4ZTgzNGNlY2MwOWVmYjcwOTkxOTZiMDA1NDQxNjA2Mjk4ZTQ3YjkiLCJSRUZfTkFNRSI6InYzMy4wLjMiLCJSRVBPX05BTUUiOiJleGFtcGxlLXBhY2thZ2UiLCJSRVZJU0lPTl9JRCI6ImQ4ZTgzNGNlY2MwOWVmYjcwOTkxOTZiMDA1NDQxNjA2Mjk4ZTQ3YjkiLCJTSE9SVF9TSEEiOiJkOGU4MzRjIiwiVEFHX05BTUUiOiJ2MzMuMC4zIiwiVFJJR0dFUl9CVUlMRF9DT05GSUdfUEFUSCI6ImNsb3VkYnVpbGQueWFtbCIsIlRSSUdHRVJfTkFNRSI6InB1c2gtdGFnIiwiX0lNQUdFX05BTUUiOiJzbHNhLXRvb2xpbmcvZXhhbXBsZS1wYWNrYWdlLXJlcG8vZTJlLWdjYi10YWctbWFpbi1jbG91ZGJ1aWxkLXNsc2EzIn19LCJlbnRyeVBvaW50IjoiY2xvdWRidWlsZC55YW1sIiwidHlwZSI6Imh0dHBzOi8vY2xvdWRidWlsZC5nb29nbGVhcGlzLmNvbS9DbG91ZEJ1aWxkWWFtbEB2MC4xIn19LCJwcmVkaWNhdGVUeXBlIjoiaHR0cHM6Ly9zbHNhLmRldi9wcm92ZW5hbmNlL3YwLjEiLCJzbHNhUHJvdmVuYW5jZSI6eyJidWlsZGVyIjp7ImlkIjoiaHR0cHM6Ly9jbG91ZGJ1aWxkLmdvb2dsZWFwaXMuY29tL0dvb2dsZUhvc3RlZFdvcmtlckB2MC4zIn0sIm1hdGVyaWFscyI6W3siZGlnZXN0Ijp7InNoYTEiOiJkOGU4MzRjZWNjMDllZmI3MDk5MTk2YjAwNTQ0MTYwNjI5OGU0N2I5In0sInVyaSI6ImdpdCtodHRwczovL2dpdGh1Yi5jb20vc2xzYS1mcmFtZXdvcmsvZXhhbXBsZS1wYWNrYWdlIn1dLCJtZXRhZGF0YSI6eyJidWlsZEZpbmlzaGVkT24iOiIyMDIzLTAzLTA4VDIxOjM4OjA1LjExOTI1OVoiLCJidWlsZEludm9jYXRpb25JZCI6IjMzZmU1OWZkLTE5Y2ItNGU4NS1iMGI0LWQ1OGQ4MDExYTFkZSIsImJ1aWxkU3RhcnRlZE9uIjoiMjAyMy0wMy0wOFQyMTozNzozOS41OTExMzkyMDlaIn0sInJlY2lwZSI6eyJhcmd1bWVudHMiOnsiQHR5cGUiOiJ0eXBlLmdvb2dsZWFwaXMuY29tL2dvb2dsZS5kZXZ0b29scy5jbG91ZGJ1aWxkLnYxLkJ1aWxkIiwiaWQiOiIzM2ZlNTlmZC0xOWNiLTRlODUtYjBiNC1kNThkODAxMWExZGUiLCJuYW1lIjoicHJvamVjdHMvODE5NzIwOTUzODEyL2xvY2F0aW9ucy91cy13ZXN0Mi9idWlsZHMvMzNmZTU5ZmQtMTljYi00ZTg1LWIwYjQtZDU4ZDgwMTFhMWRlIiwib3B0aW9ucyI6eyJkeW5hbWljU3Vic3RpdHV0aW9ucyI6dHJ1ZSwibG9nZ2luZyI6IkNMT1VEX0xPR0dJTkdfT05MWSIsInBvb2wiOnt9LCJyZXF1ZXN0ZWRWZXJpZnlPcHRpb24iOiJWRVJJRklFRCIsInNvdXJjZVByb3ZlbmFuY2VIYXNoIjpbIlNIQTI1NiJdLCJzdWJzdGl0dXRpb25PcHRpb24iOiJBTExPV19MT09TRSJ9LCJzb3VyY2VQcm92ZW5hbmNlIjp7fSwic3RlcHMiOlt7ImFyZ3MiOlsiYnVpbGQiLCItdCIsInVzLXdlc3QyLWRvY2tlci5wa2cuZGV2L3Nsc2EtdG9vbGluZy9leGFtcGxlLXBhY2thZ2UtcmVwby9lMmUtZ2NiLXRhZy1tYWluLWNsb3VkYnVpbGQtc2xzYTMiLCIuIl0sIm5hbWUiOiJnY3IuaW8vY2xvdWQtYnVpbGRlcnMvZG9ja2VyIiwicHVsbFRpbWluZyI6eyJlbmRUaW1lIjoiMjAyMy0wMy0wOFQyMTozNzo0My42ODQ3ODc3OTVaIiwic3RhcnRUaW1lIjoiMjAyMy0wMy0wOFQyMTozNzo0My42ODExMDQ4ODVaIn0sInN0YXR1cyI6IlNVQ0NFU1MiLCJ0aW1pbmciOnsiZW5kVGltZSI6IjIwMjMtMDMtMDhUMjE6Mzg6MDMuMTY3NDg5NjQ2WiIsInN0YXJ0VGltZSI6IjIwMjMtMDMtMDhUMjE6Mzc6NDMuNjgxMTA0ODg1WiJ9fV0sInN1YnN0aXR1dGlvbnMiOnsiQ09NTUlUX1NIQSI6ImQ4ZTgzNGNlY2MwOWVmYjcwOTkxOTZiMDA1NDQxNjA2Mjk4ZTQ3YjkiLCJSRUZfTkFNRSI6InYzMy4wLjMiLCJSRVBPX05BTUUiOiJleGFtcGxlLXBhY2thZ2UiLCJSRVZJU0lPTl9JRCI6ImQ4ZTgzNGNlY2MwOWVmYjcwOTkxOTZiMDA1NDQxNjA2Mjk4ZTQ3YjkiLCJTSE9SVF9TSEEiOiJkOGU4MzRjIiwiVEFHX05BTUUiOiJ2MzMuMC4zIiwiVFJJR0dFUl9CVUlMRF9DT05GSUdfUEFUSCI6ImNsb3VkYnVpbGQueWFtbCIsIlRSSUdHRVJfTkFNRSI6InB1c2gtdGFnIiwiX0lNQUdFX05BTUUiOiJzbHNhLXRvb2xpbmcvZXhhbXBsZS1wYWNrYWdlLXJlcG8vZTJlLWdjYi10YWctbWFpbi1jbG91ZGJ1aWxkLXNsc2EzIn19LCJlbnRyeVBvaW50IjoiY2xvdWRidWlsZC55YW1sIiwidHlwZSI6Imh0dHBzOi8vY2xvdWRidWlsZC5nb29nbGVhcGlzLmNvbS9DbG91ZEJ1aWxkWWFtbEB2MC4xIn19LCJzdWJqZWN0IjpbeyJkaWdlc3QiOnsic2hhMjU2IjoiMjQ3NmMyZTE5YjE0NTliMGEwYTZkM2QyMTRmOTZmMGEwYmY0ZDIwNzE1ODRiOGZlZWViZjUxYTY4MTY4YmZmMiJ9LCJuYW1lIjoiaHR0cHM6Ly91cy13ZXN0Mi1kb2NrZXIucGtnLmRldi9zbHNhLXRvb2xpbmcvZXhhbXBsZS1wYWNrYWdlLXJlcG8vZTJlLWdjYi10YWctbWFpbi1jbG91ZGJ1aWxkLXNsc2EzIn0seyJkaWdlc3QiOnsic2hhMjU2IjoiMjQ3NmMyZTE5YjE0NTliMGEwYTZkM2QyMTRmOTZmMGEwYmY0ZDIwNzE1ODRiOGZlZWViZjUxYTY4MTY4YmZmMiJ9LCJuYW1lIjoiaHR0cHM6Ly91cy13ZXN0Mi1kb2NrZXIucGtnLmRldi9zbHNhLXRvb2xpbmcvZXhhbXBsZS1wYWNrYWdlLXJlcG8vZTJlLWdjYi10YWctbWFpbi1jbG91ZGJ1aWxkLXNsc2EzOmxhdGVzdCJ9XX0=",
103+
"payloadType": "application/vnd.in-toto+json",
104+
"signatures": [
105+
{
106+
"keyid": "projects/verified-builder/locations/global/keyRings/attestor/cryptoKeys/provenanceSigner/cryptoKeyVersions/1",
107+
"sig": "MEYCIQCVf04enPAleDKUI0J3FXD73mhM3a5nzhJ7KAlJs8iCvwIhAKwSOTZ3rf3z2iYdZX37zGYHyQ9Q4xIiuJAH4ocJqHH0"
108+
},
109+
{
110+
"keyid": "projects/verified-builder/locations/us-west2/keyRings/attestor/cryptoKeys/builtByGCB/cryptoKeyVersions/1",
111+
"sig": "MEQCIC5f6PB6WB9sFALPP9grkM9BYK2qxpHuxT_fQQQuwTbBAiAiECAvXX0DZ-p7Hh0QZrtHZEeSd4JxwbP77i1pv_H6rA=="
112+
}
113+
]
114+
},
115+
"kind": "BUILD",
116+
"name": "projects/slsa-tooling/occurrences/defb50a3-4889-416b-a055-eb4695658db2",
117+
"noteName": "projects/verified-builder/notes/intoto_33fe59fd-19cb-4e85-b0b4-d58d8011a1de",
118+
"resourceUri": "https://us-west2-docker.pkg.dev/slsa-tooling/example-package-repo/e2e-gcb-tag-main-cloudbuild-slsa3@sha256:2476c2e19b1459b0a0a6d3d214f96f0a0bf4d2071584b8feeebf51a68168bff2",
119+
"updateTime": "2023-03-08T21:38:07.724936Z"
120+
}
121+
]
122+
}
123+
}
124+

0 commit comments

Comments
 (0)