ci: Ensure SLSA Lvl 3 #904

viccuad · 2024-10-04T11:10:36Z

Description

Adapted the work already done by @jvanz from kubewarden/audit-scanner#387 (hence, set @jvanz as Co-authored-by).

Test

Tested by tagging on my fork as v1.18.0-viccuad.
See:
https://github.com/viccuad/kubewarden-controller/actions/runs/11294623076 (release only fails in the last bot pr step)
https://github.com/viccuad/kubewarden-controller/releases/tag/v1.18.0-viccuad7

Additional Information

Tradeoff

Potential improvement

codecov · 2024-10-04T11:14:46Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 70.53%. Comparing base (dfeb8e5) to head (08758a8).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #904   +/-   ##
=======================================
  Coverage   70.53%   70.53%           
=======================================
  Files          30       30           
  Lines        2559     2559           
=======================================
  Hits         1805     1805           
  Misses        584      584           
  Partials      170      170

Flag	Coverage Δ
integration-tests	`60.31% <ø> (ø)`
unit-tests	`39.21% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Signed-off-by: Víctor Cuadrado Juan <[email protected]>

.github/workflows/attestation.yml

README.md

pjbgf · 2024-10-08T14:58:38Z

.github/workflows/sign-image.yml

+
+          cosign verify \
+            --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
+            --certificate-identity-regexp="https://github.com/${{github.repository_owner}}/kubewarden-controller*" \


Please fully qualify the identity as per this comment.

pjbgf · 2024-10-08T15:02:48Z

README.md

-[release assets](https://github.com/kubewarden/kubewarden-controller/releases)
+```shell
+cosign verify-blob --certificate-oidc-issuer=https://token.actions.githubusercontent.com  \
+    --certificate-identity-regexp="https://github.com/kubewarden/kubewarden-controller*"  \


This example needs to be fully qualified, otherwise users may be checking against the wrong identity.

pjbgf · 2024-10-08T15:03:00Z

README.md

+
+```shell
+cosign verify --certificate-oidc-issuer=https://token.actions.githubusercontent.com  \
+    --certificate-identity-regexp="https://github.com/kubewarden/kubewarden-controller*" \


pjbgf · 2024-10-08T15:03:16Z

README.md

+}
+
+cosign verify --certificate-oidc-issuer=https://token.actions.githubusercontent.com  \
+    --certificate-identity-regexp="https://github.com/kubewarden/kubewarden-controller*" \


Signed-off-by: Víctor Cuadrado Juan <[email protected]>

jhkrug

Some minor suggestions for consideration.

README.md

viccuad · 2024-10-09T15:01:14Z

Applied suggestions and rebased, as it was easier to keep the Co-authored-by. Sorry for the inconvenience.
Now the cosign verify use the specific regexp matching the workflow, and the workflow generates a checksum.txt of the files and signs only that file.

jvanz · 2024-10-11T12:44:24Z

.github/workflows/attestation.yml

+      - name: Sign attestation manifest
+        run: |
+          cosign sign --yes \
+            ghcr.io/${{github.repository_owner}}/kubewarden-controller@${{ env.ATTESTATION_MANIFEST_DIGEST}}
+
+          cosign verify \
+            --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
+            --certificate-identity-regexp="https://github.com/${{github.repository_owner}}/kubewarden-controller/.github/workflows/attestation.yml@${{ github.ref }}" \
+            ghcr.io/${{github.repository_owner}}/kubewarden-controller@${{ env.ATTESTATION_MANIFEST_DIGEST}}


I've removed this signing from the audit-scanner and policy-server PR as suggested by @pjbgf

jvanz · 2024-10-11T12:44:43Z

.github/workflows/attestation.yml

+      - name: Sign SBOM layer
+        run: |
+          cosign sign --yes \
+          ghcr.io/${{github.repository_owner}}/kubewarden-controller@${{ env.SBOM_DIGEST}}
+
+      - name: Verify SBOM layer
+        run: |
+          cosign verify \
+            --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
+            --certificate-identity-regexp="https://github.com/${{github.repository_owner}}/kubewarden-controller/.github/workflows/attestation.yml@${{ github.ref }}" \
+            ghcr.io/${{github.repository_owner}}/kubewarden-controller@${{ env.SBOM_DIGEST}}


I've removed this signing from the audit-scanner and policy-server PR as suggested by @pjbgf

jvanz · 2024-10-11T12:47:31Z

.github/workflows/container-image.yml

+      - name: Sign container image
+        run: |


I think you need to run this step only if the container image is pushed to the repository. See the previous step building the container image. It has this if as well.

Suggested change

- name: Sign container image

run: |

- name: Sign container image

if: ${{ inputs.push-image }}

run: |

Signed-off-by: Víctor Cuadrado Juan <[email protected]> Co-authored-by: José Guilherme Vanz <[email protected]>

Signed-off-by: Víctor Cuadrado Juan <[email protected]>

Co-authored-by: John Krug <[email protected]> Signed-off-by: Víctor Cuadrado Juan <[email protected]>

Signed-off-by: Víctor Cuadrado Juan <[email protected]>

We are not making use of a regexp anymore and provide fully qualified identities. Signed-off-by: Víctor Cuadrado Juan <[email protected]>

viccuad requested a review from a team as a code owner October 4, 2024 11:10

viccuad marked this pull request as draft October 4, 2024 12:31

viccuad force-pushed the slsa branch 5 times, most recently from 7a8109e to 30fba55 Compare October 8, 2024 10:30

viccuad added 2 commits October 8, 2024 12:58

chore: Fix AS casing in Dockerfile

69dab49

Signed-off-by: Víctor Cuadrado Juan <[email protected]>

ci: Build docker image with SBOMs

2b3b76c

Signed-off-by: Víctor Cuadrado Juan <[email protected]>

viccuad force-pushed the slsa branch from 30fba55 to 6066471 Compare October 8, 2024 10:59

viccuad marked this pull request as ready for review October 8, 2024 11:00

viccuad self-assigned this Oct 8, 2024

jvanz reviewed Oct 8, 2024

View reviewed changes

.github/workflows/attestation.yml Outdated Show resolved Hide resolved

jvanz reviewed Oct 8, 2024

View reviewed changes

README.md Outdated Show resolved Hide resolved

pjbgf reviewed Oct 8, 2024

View reviewed changes

chore: set syntax for Dockerfile

e1b7335

Signed-off-by: Víctor Cuadrado Juan <[email protected]>

viccuad force-pushed the slsa branch 2 times, most recently from efac9fe to fe1f8c1 Compare October 9, 2024 12:22

jhkrug suggested changes Oct 9, 2024

View reviewed changes

README.md Outdated Show resolved Hide resolved

README.md Outdated Show resolved Hide resolved

README.md Outdated Show resolved Hide resolved

viccuad force-pushed the slsa branch from fe1f8c1 to 6f1fe0c Compare October 9, 2024 14:33

viccuad requested review from jvanz and pjbgf October 9, 2024 15:02

viccuad force-pushed the slsa branch from 8d88792 to 7dc8f50 Compare October 11, 2024 12:45

jvanz requested changes Oct 11, 2024

View reviewed changes

viccuad force-pushed the slsa branch 2 times, most recently from fe709c7 to c79fc29 Compare October 11, 2024 14:49

viccuad and others added 2 commits October 11, 2024 16:57

ci: Add attestation.yml to sign and upload provenance and SBOM

86c9a47

Signed-off-by: Víctor Cuadrado Juan <[email protected]> Co-authored-by: José Guilherme Vanz <[email protected]>

docs: Update README.md

1cba7d2

Signed-off-by: Víctor Cuadrado Juan <[email protected]> Co-authored-by: José Guilherme Vanz <[email protected]>

viccuad and others added 6 commits October 11, 2024 16:57

ci: Verify image at time of signing

d6936e0

Signed-off-by: Víctor Cuadrado Juan <[email protected]> Co-authored-by: José Guilherme Vanz <[email protected]>

ci: Drop syft-installer step, not needed

ffaebca

Signed-off-by: Víctor Cuadrado Juan <[email protected]>

Apply suggestions from code review

b09cff5

Co-authored-by: John Krug <[email protected]> Signed-off-by: Víctor Cuadrado Juan <[email protected]>

ci: Sign image on container--image workflow

e222e00

Signed-off-by: Víctor Cuadrado Juan <[email protected]>

ci: Use safer sha256sum instaed of md5sum

ac3e7e4

Signed-off-by: Víctor Cuadrado Juan <[email protected]>

ci: Use --certificate-identity instead of --certificate-identity-regexp

08758a8

We are not making use of a regexp anymore and provide fully qualified identities. Signed-off-by: Víctor Cuadrado Juan <[email protected]>

viccuad force-pushed the slsa branch from c79fc29 to 08758a8 Compare October 11, 2024 14:58

viccuad requested a review from jvanz October 11, 2024 14:59

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ci: Ensure SLSA Lvl 3 #904

ci: Ensure SLSA Lvl 3 #904

viccuad commented Oct 4, 2024 •

edited

Loading

codecov bot commented Oct 4, 2024 •

edited

Loading

pjbgf Oct 8, 2024

viccuad Oct 9, 2024

pjbgf Oct 8, 2024

viccuad Oct 9, 2024

pjbgf Oct 8, 2024

viccuad Oct 9, 2024

pjbgf Oct 8, 2024

viccuad Oct 9, 2024

jhkrug left a comment

viccuad commented Oct 9, 2024 •

edited

Loading

jvanz Oct 11, 2024

viccuad Oct 11, 2024

jvanz Oct 11, 2024

viccuad Oct 11, 2024

jvanz Oct 11, 2024

viccuad Oct 11, 2024

ci: Ensure SLSA Lvl 3 #904

Are you sure you want to change the base?

ci: Ensure SLSA Lvl 3 #904

Conversation

viccuad commented Oct 4, 2024 • edited Loading

Description

Test

Additional Information

Tradeoff

Potential improvement

codecov bot commented Oct 4, 2024 • edited Loading

Codecov Report

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jhkrug left a comment

Choose a reason for hiding this comment

viccuad commented Oct 9, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

viccuad commented Oct 4, 2024 •

edited

Loading

codecov bot commented Oct 4, 2024 •

edited

Loading

viccuad commented Oct 9, 2024 •

edited

Loading