feat: support for GCB v0.3 verification (#248)

* update

* update

* update

* update

Author: laurentsimon

errors/errors.go

@@ -6,10 +6,12 @@ var (
 	ErrorInvalidDssePayload        = errors.New("invalid DSSE envelope payload")
 	ErrorMismatchBranch            = errors.New("branch used to generate the binary does not match provenance")
 	ErrorMismatchBuilderID         = errors.New("builderID does not match provenance")
+	ErrorInvalidBuilderID          = errors.New("builderID is invalid")
 	ErrorMismatchSource            = errors.New("source used to generate the binary does not match provenance")
 	ErrorMismatchWorkflowInputs    = errors.New("workflow input does not match")
 	ErrorMalformedURI              = errors.New("URI is malformed")
 	ErrorMismatchTag               = errors.New("tag used to generate the binary does not match provenance")
+	ErrorInvalidRecipe             = errors.New("the recipe is invalid")
 	ErrorMismatchVersionedTag      = errors.New("tag used to generate the binary does not match provenance")
 	ErrorInvalidSemver             = errors.New("invalid semantic version")
 	ErrorRekorSearch               = errors.New("error searching rekor entries")

verifiers/internal/gcb/provenance.go

@@ -21,7 +21,10 @@ import (
 	"github.com/slsa-framework/slsa-verifier/verifiers/internal/gcb/keys"
 )
 
-var GCBBuilderIDs = []string{"https://cloudbuild.googleapis.com/[email protected]"}
+var GCBBuilderIDs = []string{
+	"https://cloudbuild.googleapis.com/[email protected]",
+	"https://cloudbuild.googleapis.com/[email protected]",
+}
 
 type v01IntotoStatement struct {
 	intoto.StatementHeader
@@ -215,7 +218,53 @@ func isValidBuilderID(id string) error {
 			return nil
 		}
 	}
-	return serrors.ErrorMismatchBuilderID
+	return serrors.ErrorInvalidBuilderID
+}
+
+func getBuilderVersion(builderID string) (string, error) {
+	parts := strings.Split(builderID, "@")
+	if len(parts) != 2 {
+		return "", fmt.Errorf("%w: '%s'", serrors.ErrorInvalidFormat, parts)
+	}
+	return parts[1], nil
+}
+
+func validateRecipeType(builderID, recipeType string) error {
+	v, err := getBuilderVersion(builderID)
+	if err != nil {
+		return err
+	}
+	switch v {
+	case "v0.2":
+		// In this version, the recipe type should be the same as
+		// the builder ID.
+		if builderID == recipeType {
+			return nil
+		}
+		err = fmt.Errorf("%w: expected '%s', got '%s'",
+			serrors.ErrorInvalidRecipe, builderID, recipeType)
+
+	case "v0.3":
+		// In this version, two recipe types are allowed, depending how the
+		// build was made. We don't verify the version of the recipes,
+		// because it's not super important and would add complexity.
+		recipes := []string{
+			"https://cloudbuild.googleapis.com/CloudBuildYaml@",
+			"https://cloudbuild.googleapis.com/CloudBuildSteps@",
+		}
+		for _, r := range recipes {
+			if strings.HasPrefix(recipeType, r) {
+				return nil
+			}
+		}
+		err = fmt.Errorf("%w: expected on of '%s', got '%s'",
+			serrors.ErrorInvalidRecipe, strings.Join(recipes, ","), recipeType)
+	default:
+		err = fmt.Errorf("%w: version '%s'",
+			serrors.ErrorInvalidBuilderID, v)
+	}
+
+	return err
 }
 
 // VerifyBuilder verifies the builder in the DSSE payload:
@@ -243,10 +292,9 @@ func (self *Provenance) VerifyBuilder(builderOpts *options.BuilderOpts) (string,
 		}
 	}
 
-	// Valiate that the recipe type is consistent.
-	if predicateBuilderID != statement.Predicate.Recipe.Type {
-		return "", fmt.Errorf("%w: expected '%s', got '%s'", serrors.ErrorMismatchBuilderID,
-			predicateBuilderID, statement.Predicate.Recipe.Type)
+	// Valiate the recipe type.
+	if err := validateRecipeType(predicateBuilderID, statement.Predicate.Recipe.Type); err != nil {
+		return "", err
 	}
 
 	// Validate the recipe argument type.

verifiers/internal/gcb/provenance_test.go

@@ -120,9 +120,43 @@ func Test_VerifyBuilder(t *testing.T) {
 			expected: serrors.ErrorMismatchBuilderID,
 		},
 		{
-			name:     "mismatch recipe.type",
+			name:     "v0.2 mismatch recipe.type",
 			path:     "./testdata/gcloud-container-invalid-recipe.type.json",
-			expected: serrors.ErrorMismatchBuilderID,
+			expected: serrors.ErrorInvalidRecipe,
+		},
+		{
+			name:      "v0.1 invalid builder",
+			path:      "./testdata/gcloud-container-invalid-builderv01.json",
+			builderID: "http://cloudbuild.googleapis.com/[email protected]",
+			expected:  serrors.ErrorInvalidBuilderID,
+		},
+		{
+			name:      "invalid v0.2 recipe type CloudBuildSteps",
+			path:      "./testdata/gcloud-container-invalid-recipetypestepsv02.json",
+			builderID: "https://cloudbuild.googleapis.com/[email protected]",
+			expected:  serrors.ErrorInvalidRecipe,
+		},
+		{
+			name:      "invalid v0.2 recipe type CloudBuildYaml",
+			path:      "./testdata/gcloud-container-invalid-recipetypecloudv02.json",
+			builderID: "https://cloudbuild.googleapis.com/[email protected]",
+			expected:  serrors.ErrorInvalidRecipe,
+		},
+		{
+			name:      "valid v0.3 recipe type CloudBuildSteps",
+			path:      "./testdata/gcloud-container-invalid-recipetypestepsv03.json",
+			builderID: "https://cloudbuild.googleapis.com/[email protected]",
+		},
+		{
+			name:      "valid v0.3 recipe type CloudBuildYaml",
+			path:      "./testdata/gcloud-container-invalid-recipetypecloudv03.json",
+			builderID: "https://cloudbuild.googleapis.com/[email protected]",
+		},
+		{
+			name:      "invalid v0.3 recipe type random",
+			path:      "./testdata/gcloud-container-invalid-recipetyperandv03.json",
+			builderID: "https://cloudbuild.googleapis.com/[email protected]",
+			expected:  serrors.ErrorInvalidRecipe,
 		},
 	}
 	for _, tt := range tests {
@@ -164,6 +198,70 @@ func Test_VerifyBuilder(t *testing.T) {
 	}
 }
 
+func Test_validateRecipeType(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name       string
+		builderID  string
+		recipeType string
+		expected   error
+	}{
+		// v0.2 builder.
+		{
+			name:       "valid v0.2 recipe type",
+			builderID:  "https://cloudbuild.googleapis.com/[email protected]",
+			recipeType: "https://cloudbuild.googleapis.com/[email protected]",
+		},
+		{
+			name:       "invalid v0.2 recipe type CloudBuildYaml",
+			builderID:  "https://cloudbuild.googleapis.com/[email protected]",
+			recipeType: "https://cloudbuild.googleapis.com/[email protected]",
+			expected:   serrors.ErrorInvalidRecipe,
+		},
+		{
+			name:       "invalid v0.2 recipe type CloudBuildSteps",
+			builderID:  "https://cloudbuild.googleapis.com/[email protected]",
+			recipeType: "https://cloudbuild.googleapis.com/[email protected]",
+			expected:   serrors.ErrorInvalidRecipe,
+		},
+		// v0.3 builder.
+		{
+			name:       "valid v0.3 recipe type CloudBuildYaml",
+			builderID:  "https://cloudbuild.googleapis.com/[email protected]",
+			recipeType: "https://cloudbuild.googleapis.com/[email protected]",
+		},
+		{
+			name:       "valid v0.3 recipe type CloudBuildSteps",
+			builderID:  "https://cloudbuild.googleapis.com/[email protected]",
+			recipeType: "https://cloudbuild.googleapis.com/[email protected]",
+		},
+		{
+			name:       "invalid v0.3 recipe type GoogleHostedWorker",
+			builderID:  "https://cloudbuild.googleapis.com/[email protected]",
+			recipeType: "https://cloudbuild.googleapis.com/[email protected]",
+			expected:   serrors.ErrorInvalidRecipe,
+		},
+		// No version.
+		{
+			name:       "invalid builder version",
+			builderID:  "https://cloudbuild.googleapis.com/[email protected]",
+			recipeType: "https://cloudbuild.googleapis.com/[email protected]",
+			expected:   serrors.ErrorInvalidBuilderID,
+		},
+	}
+	for _, tt := range tests {
+		tt := tt // Re-initializing variable so it is not changed while executing the closure below
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			err := validateRecipeType(tt.builderID, tt.recipeType)
+			if !cmp.Equal(err, tt.expected, cmpopts.EquateErrors()) {
+				t.Errorf(cmp.Diff(err, tt.expected, cmpopts.EquateErrors()))
+			}
+		})
+	}
+}
+
 func Test_VerifySourceURI(t *testing.T) {
 	t.Parallel()
 	tests := []struct {

verifiers/internal/gcb/testdata/gcloud-container-invalid-builderv01.json

@@ -0,0 +1,94 @@
+{
+  "image_summary": {
+    "digest": "sha256:1a033b002f89ed2b8ea733162497fb70f1a4049a7f8602d6a33682b4ad9921fd",
+    "fully_qualified_digest": "us-west2-docker.pkg.dev/gosst-scare-sandbox/quickstart-docker-repo/quickstart-image@sha256:1a033b002f89ed2b8ea733162497fb70f1a4049a7f8602d6a33682b4ad9921fd",
+    "registry": "us-west2-docker.pkg.dev",
+    "repository": "quickstart-docker-repo"
+  },
+  "provenance_summary": {
+    "provenance": [
+      {
+        "build": {
+          "intotoStatement": {
+            "_type": "https://in-toto.io/Statement/v0.1",
+            "predicateType": "https://slsa.dev/provenance/v0.1",
+            "slsaProvenance": {
+              "builder": {
+                "id": "https://cloudbuild.googleapis.com/[email protected]"
+              },
+              "materials": [
+                {
+                  "uri": "https://github.com/laurentsimon/gcb-tests/commit/fbbb98765e85ad464302dc5977968104d36e455e"
+                }
+              ],
+              "metadata": {
+                "buildFinishedOn": "2022-08-15T22:43:34.366498Z",
+                "buildInvocationId": "b6e052a7-5aa4-41bf-a56b-9bc4e4f3058b",
+                "buildStartedOn": "2022-08-15T22:43:18.700638187Z"
+              },
+              "recipe": {
+                "arguments": {
+                  "@type": "type.googleapis.com/google.devtools.cloudbuild.v1.Build",
+                  "id": "b6e052a7-5aa4-41bf-a56b-9bc4e4f3058b",
+                  "options": {
+                    "dynamicSubstitutions": true,
+                    "logging": "LEGACY",
+                    "pool": {},
+                    "substitutionOption": "ALLOW_LOOSE"
+                  },
+                  "sourceProvenance": {},
+                  "steps": [
+                    {
+                      "args": [
+                        "build",
+                        "-t",
+                        "us-west2-docker.pkg.dev/gosst-scare-sandbox/quickstart-docker-repo/quickstart-image:v14",
+                        "."
+                      ],
+                      "name": "gcr.io/cloud-builders/docker",
+                      "pullTiming": {
+                        "endTime": "2022-08-15T22:43:21.662016533Z",
+                        "startTime": "2022-08-15T22:43:21.657262492Z"
+                      },
+                      "status": "SUCCESS",
+                      "timing": {
+                        "endTime": "2022-08-15T22:43:27.056377441Z",
+                        "startTime": "2022-08-15T22:43:21.657262492Z"
+                      }
+                    }
+                  ]
+                },
+                "entryPoint": "cloudbuild.yaml",
+                "type": "https://cloudbuild.googleapis.com/[email protected]"
+              }
+            },
+            "subject": [
+              {
+                "digest": {
+                  "sha256": "1a033b002f89ed2b8ea733162497fb70f1a4049a7f8602d6a33682b4ad9921fd"
+                },
+                "name": "https://us-west2-docker.pkg.dev/gosst-scare-sandbox/quickstart-docker-repo/quickstart-image:v14"
+              }
+            ]
+          }
+        },
+        "createTime": "2022-08-15T22:43:35.649016Z",
+        "envelope": {
+          "payload": "ewogICJfdHlwZSI6ICJodHRwczovL2luLXRvdG8uaW8vU3RhdGVtZW50L3YwLjEiLAogICJwcmVkaWNhdGUiOiB7CiAgICAiYnVpbGRlciI6IHsKICAgICAgImlkIjogImh0dHBzOi8vY2xvdWRidWlsZC5nb29nbGVhcGlzLmNvbS9Hb29nbGVIb3N0ZWRXb3JrZXJAdjAuMSIKICAgIH0sCiAgICAibWF0ZXJpYWxzIjogWwogICAgICB7CiAgICAgICAgInVyaSI6ICJodHRwczovL2dpdGh1Yi5jb20vbGF1cmVudHNpbW9uL2djYi10ZXN0cy9jb21taXQvZmJiYjk4NzY1ZTg1YWQ0NjQzMDJkYzU5Nzc5NjgxMDRkMzZlNDU1ZSIKICAgICAgfQogICAgXSwKICAgICJtZXRhZGF0YSI6IHsKICAgICAgImJ1aWxkRmluaXNoZWRPbiI6ICIyMDIyLTA4LTE1VDIyOjQzOjM0LjM2NjQ5OFoiLAogICAgICAiYnVpbGRJbnZvY2F0aW9uSWQiOiAiYjZlMDUyYTctNWFhNC00MWJmLWE1NmItOWJjNGU0ZjMwNThiIiwKICAgICAgImJ1aWxkU3RhcnRlZE9uIjogIjIwMjItMDgtMTVUMjI6NDM6MTguNzAwNjM4MTg3WiIKICAgIH0sCiAgICAicmVjaXBlIjogewogICAgICAiYXJndW1lbnRzIjogewogICAgICAgICJAdHlwZSI6ICJ0eXBlLmdvb2dsZWFwaXMuY29tL2dvb2dsZS5kZXZ0b29scy5jbG91ZGJ1aWxkLnYxLkJ1aWxkIiwKICAgICAgICAiaWQiOiAiYjZlMDUyYTctNWFhNC00MWJmLWE1NmItOWJjNGU0ZjMwNThiIiwKICAgICAgICAib3B0aW9ucyI6IHsKICAgICAgICAgICJkeW5hbWljU3Vic3RpdHV0aW9ucyI6IHRydWUsCiAgICAgICAgICAibG9nZ2luZyI6ICJMRUdBQ1kiLAogICAgICAgICAgInBvb2wiOiB7fSwKICAgICAgICAgICJzdWJzdGl0dXRpb25PcHRpb24iOiAiQUxMT1dfTE9PU0UiCiAgICAgICAgfSwKICAgICAgICAic291cmNlUHJvdmVuYW5jZSI6IHt9LAogICAgICAgICJzdGVwcyI6IFsKICAgICAgICAgIHsKICAgICAgICAgICAgImFyZ3MiOiBbCiAgICAgICAgICAgICAgImJ1aWxkIiwKICAgICAgICAgICAgICAiLXQiLAogICAgICAgICAgICAgICJ1cy13ZXN0Mi1kb2NrZXIucGtnLmRldi9nb3NzdC1zY2FyZS1zYW5kYm94L3F1aWNrc3RhcnQtZG9ja2VyLXJlcG8vcXVpY2tzdGFydC1pbWFnZTp2MTQiLAogICAgICAgICAgICAgICIuIgogICAgICAgICAgICBdLAogICAgICAgICAgICAibmFtZSI6ICJnY3IuaW8vY2xvdWQtYnVpbGRlcnMvZG9ja2VyIiwKICAgICAgICAgICAgInB1bGxUaW1pbmciOiB7CiAgICAgICAgICAgICAgImVuZFRpbWUiOiAiMjAyMi0wOC0xNVQyMjo0MzoyMS42NjIwMTY1MzNaIiwKICAgICAgICAgICAgICAic3RhcnRUaW1lIjogIjIwMjItMDgtMTVUMjI6NDM6MjEuNjU3MjYyNDkyWiIKICAgICAgICAgICAgfSwKICAgICAgICAgICAgInN0YXR1cyI6ICJTVUNDRVNTIiwKICAgICAgICAgICAgInRpbWluZyI6IHsKICAgICAgICAgICAgICAiZW5kVGltZSI6ICIyMDIyLTA4LTE1VDIyOjQzOjI3LjA1NjM3NzQ0MVoiLAogICAgICAgICAgICAgICJzdGFydFRpbWUiOiAiMjAyMi0wOC0xNVQyMjo0MzoyMS42NTcyNjI0OTJaIgogICAgICAgICAgICB9CiAgICAgICAgICB9CiAgICAgICAgXQogICAgICB9LAogICAgICAiZW50cnlQb2ludCI6ICJjbG91ZGJ1aWxkLnlhbWwiLAogICAgICAidHlwZSI6ICJodHRwczovL2Nsb3VkYnVpbGQuZ29vZ2xlYXBpcy5jb20vR29vZ2xlSG9zdGVkV29ya2VyQHYwLjIiCiAgICB9CiAgfSwKICAicHJlZGljYXRlVHlwZSI6ICJodHRwczovL3Nsc2EuZGV2L3Byb3ZlbmFuY2UvdjAuMSIsCiAgInNsc2FQcm92ZW5hbmNlIjogewogICAgImJ1aWxkZXIiOiB7CiAgICAgICJpZCI6ICJodHRwczovL2Nsb3VkYnVpbGQuZ29vZ2xlYXBpcy5jb20vR29vZ2xlSG9zdGVkV29ya2VyQHYwLjIiCiAgICB9LAogICAgIm1hdGVyaWFscyI6IFsKICAgICAgewogICAgICAgICJ1cmkiOiAiaHR0cHM6Ly9naXRodWIuY29tL2xhdXJlbnRzaW1vbi9nY2ItdGVzdHMvY29tbWl0L2ZiYmI5ODc2NWU4NWFkNDY0MzAyZGM1OTc3OTY4MTA0ZDM2ZTQ1NWUiCiAgICAgIH0KICAgIF0sCiAgICAibWV0YWRhdGEiOiB7CiAgICAgICJidWlsZEZpbmlzaGVkT24iOiAiMjAyMi0wOC0xNVQyMjo0MzozNC4zNjY0OThaIiwKICAgICAgImJ1aWxkSW52b2NhdGlvbklkIjogImI2ZTA1MmE3LTVhYTQtNDFiZi1hNTZiLTliYzRlNGYzMDU4YiIsCiAgICAgICJidWlsZFN0YXJ0ZWRPbiI6ICIyMDIyLTA4LTE1VDIyOjQzOjE4LjcwMDYzODE4N1oiCiAgICB9LAogICAgInJlY2lwZSI6IHsKICAgICAgImFyZ3VtZW50cyI6IHsKICAgICAgICAiQHR5cGUiOiAidHlwZS5nb29nbGVhcGlzLmNvbS9nb29nbGUuZGV2dG9vbHMuY2xvdWRidWlsZC52MS5CdWlsZCIsCiAgICAgICAgImlkIjogImI2ZTA1MmE3LTVhYTQtNDFiZi1hNTZiLTliYzRlNGYzMDU4YiIsCiAgICAgICAgIm9wdGlvbnMiOiB7CiAgICAgICAgICAiZHluYW1pY1N1YnN0aXR1dGlvbnMiOiB0cnVlLAogICAgICAgICAgImxvZ2dpbmciOiAiTEVHQUNZIiwKICAgICAgICAgICJwb29sIjoge30sCiAgICAgICAgICAic3Vic3RpdHV0aW9uT3B0aW9uIjogIkFMTE9XX0xPT1NFIgogICAgICAgIH0sCiAgICAgICAgInNvdXJjZVByb3ZlbmFuY2UiOiB7fSwKICAgICAgICAic3RlcHMiOiBbCiAgICAgICAgICB7CiAgICAgICAgICAgICJhcmdzIjogWwogICAgICAgICAgICAgICJidWlsZCIsCiAgICAgICAgICAgICAgIi10IiwKICAgICAgICAgICAgICAidXMtd2VzdDItZG9ja2VyLnBrZy5kZXYvZ29zc3Qtc2NhcmUtc2FuZGJveC9xdWlja3N0YXJ0LWRvY2tlci1yZXBvL3F1aWNrc3RhcnQtaW1hZ2U6djE0IiwKICAgICAgICAgICAgICAiLiIKICAgICAgICAgICAgXSwKICAgICAgICAgICAgIm5hbWUiOiAiZ2NyLmlvL2Nsb3VkLWJ1aWxkZXJzL2RvY2tlciIsCiAgICAgICAgICAgICJwdWxsVGltaW5nIjogewogICAgICAgICAgICAgICJlbmRUaW1lIjogIjIwMjItMDgtMTVUMjI6NDM6MjEuNjYyMDE2NTMzWiIsCiAgICAgICAgICAgICAgInN0YXJ0VGltZSI6ICIyMDIyLTA4LTE1VDIyOjQzOjIxLjY1NzI2MjQ5MloiCiAgICAgICAgICAgIH0sCiAgICAgICAgICAgICJzdGF0dXMiOiAiU1VDQ0VTUyIsCiAgICAgICAgICAgICJ0aW1pbmciOiB7CiAgICAgICAgICAgICAgImVuZFRpbWUiOiAiMjAyMi0wOC0xNVQyMjo0MzoyNy4wNTYzNzc0NDFaIiwKICAgICAgICAgICAgICAic3RhcnRUaW1lIjogIjIwMjItMDgtMTVUMjI6NDM6MjEuNjU3MjYyNDkyWiIKICAgICAgICAgICAgfQogICAgICAgICAgfQogICAgICAgIF0KICAgICAgfSwKICAgICAgImVudHJ5UG9pbnQiOiAiY2xvdWRidWlsZC55YW1sIiwKICAgICAgInR5cGUiOiAiaHR0cHM6Ly9jbG91ZGJ1aWxkLmdvb2dsZWFwaXMuY29tL0dvb2dsZUhvc3RlZFdvcmtlckB2MC4yIgogICAgfQogIH0sCiAgInN1YmplY3QiOiBbCiAgICB7CiAgICAgICJkaWdlc3QiOiB7CiAgICAgICAgInNoYTI1NiI6ICIxYTAzM2IwMDJmODllZDJiOGVhNzMzMTYyNDk3ZmI3MGYxYTQwNDlhN2Y4NjAyZDZhMzM2ODJiNGFkOTkyMWZkIgogICAgICB9LAogICAgICAibmFtZSI6ICJodHRwczovL3VzLXdlc3QyLWRvY2tlci5wa2cuZGV2L2dvc3N0LXNjYXJlLXNhbmRib3gvcXVpY2tzdGFydC1kb2NrZXItcmVwby9xdWlja3N0YXJ0LWltYWdlOnYxNCIKICAgIH0KICBdCn0=",
+          "payloadType": "application/vnd.in-toto+json",
+          "signatures": [
+            {
+              "keyid": "projects/verified-builder/locations/global/keyRings/attestor/cryptoKeys/builtByGCB/cryptoKeyVersions/1",
+              "sig": "MEYCIQD-0xUsdkYnsmKnQL_ndEvXknLfn82zsG-hGyYUd4aYsAIhAP4KSCxN2VPNc-dvfrQIGduMUNmAiHxLttdezqdrSf3F"
+            }
+          ]
+        },
+        "kind": "BUILD",
+        "name": "projects/gosst-scare-sandbox/occurrences/8ce06798-f94d-4772-a224-04e473163790",
+        "noteName": "projects/verified-builder/notes/intoto_b6e052a7-5aa4-41bf-a56b-9bc4e4f3058b",
+        "resourceUri": "https://us-west2-docker.pkg.dev/gosst-scare-sandbox/quickstart-docker-repo/quickstart-image@sha256:1a033b002f89ed2b8ea733162497fb70f1a4049a7f8602d6a33682b4ad9921fd",
+        "updateTime": "2022-08-15T22:43:35.649016Z"
+      }
+    ]
+  }
+}