mirror of
https://github.com/flatcar/scripts.git
synced 2025-08-16 09:26:58 +02:00
Merge pull request #2027 from flatcar-linux/t-lo/slsa-record-provenance-main
Record SLSA provenance data by extending profile bashrc with phase hooks.
This commit is contained in:
Jeremi Piotrowski
GitHub
commit
39a5eddec4
@ -94,6 +94,9 @@ cros_pre_pkg_setup_sysroot_build_bin_dir() {
|
||||
PATH+=":${CROS_BUILD_BOARD_BIN}"
|
||||
}
|
||||
|
||||
# Source hooks for SLSA build provenance report generation
|
||||
source "${BASH_SOURCE[0]}.slsa-provenance"
|
||||
|
||||
# Insert our sysroot wrappers into the path
|
||||
SYSROOT_WRAPPERS_BIN="/usr/lib64/sysroot-wrappers/bin"
|
||||
if [[ "$PATH" != *"$SYSROOT_WRAPPERS_BIN"* ]]; then
|
||||
|
||||
194
sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/profile.bashrc.slsa-provenance
vendored
Normal file
194
sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/profile.bashrc.slsa-provenance
vendored
Normal file
@ -0,0 +1,194 @@
|
||||
# Build provenance hooks
|
||||
# ======================
|
||||
# The functions below hook into every ebuild's execution and generate provenance files
|
||||
# to meet the SLSA provenance requirements (https://slsa.dev/spec/v0.1/requirements#available).
|
||||
# All input files (source tarball / git commit hash) plus added patches / files,
|
||||
# and all resulting installation binaries and files are captured.
|
||||
# The information is emitted in SLSA provenance 0.2 format (see https://slsa.dev/provenance/v0.2)
|
||||
|
||||
|
||||
# We only record provenance when a package is actually being built.
|
||||
# See profiles/coreos/base/profile.bashrc for cros_...
|
||||
cros_post_src_configure_enable_slsa_provenance_report() {
|
||||
if [ "${GENERATE_SLSA_PROVENANCE:-}" != "true" ] ; then
|
||||
einfo "Provenance generation not requested by build; skipping."
|
||||
return 0
|
||||
fi
|
||||
export generate_slsa_provenance_report="yes"
|
||||
}
|
||||
# --
|
||||
|
||||
# Generate SLSA provenance 0.2 Subject information.
|
||||
# The information will cover all installation files shipped with a package.
|
||||
__slsa_provenance_subject() {
|
||||
local parallel="$(nproc)"
|
||||
local comma=""
|
||||
|
||||
einfo " Provenance: recording subject (output)"
|
||||
|
||||
echo ' "subject": ['
|
||||
|
||||
(
|
||||
cd "$D"
|
||||
find . -type f -print | sed 's:^./::' | xargs -P "$parallel" -L 1 sha512sum | sort -k2
|
||||
) | while read checksum filepath; do
|
||||
echo -en "${comma} {\"name\":\"/$filepath\", \"digest\":{\"sha512\":\"$checksum\"}}"
|
||||
if [ -z "$comma" ] ; then
|
||||
comma=',\n'
|
||||
fi
|
||||
done
|
||||
echo -en "\n ]"
|
||||
}
|
||||
# --
|
||||
|
||||
__slsa_provenance_materials() {
|
||||
local csum="" uri="" repo="" ebuild="" ebuildcsum=""
|
||||
|
||||
local ebuild="${CATEGORY}/${PN}/${PF}.ebuild"
|
||||
local repopath="$(portageq get_repo_path ${ROOT:-/} coreos)"
|
||||
if [ -f "${repopath}/${ebuild}" ] ; then
|
||||
repo="coreos-overlay"
|
||||
ebuildcsum=$(sha1sum - < "${repopath}/${ebuild}")
|
||||
else
|
||||
repopath="$(portageq get_repo_path ${ROOT:-/} portage-stable)"
|
||||
if [ -f "${repopath}/${ebuild}" ] ; then
|
||||
repo="portage-stable"
|
||||
ebuildcsum=$(sha1sum - < "${repopath}/${ebuild}")
|
||||
fi
|
||||
fi
|
||||
if [ -z "${repo}" ]; then
|
||||
die "SLSA provenance: Unable to detect ebuild repository for package '${ebuild}'"
|
||||
fi
|
||||
ebuildcsum=${ebuildcsum%% *}
|
||||
|
||||
einfo " Provenance: recording ebuild material (input) '${repo}/${ebuild}'"
|
||||
echo ' "materials": ['
|
||||
|
||||
# The ebuild. Since "configSource" in "invocation" cannot have more than one (top/level) entry
|
||||
# we add the ebuild and git repo checksum here, as a material.
|
||||
csum="$(cat "/mnt/host/source/src/scripts/.git/modules/sdk_container/src/third_party/${repo}/HEAD")"
|
||||
uri="git+https://github.com/flatcar-linux/${repo}.git@${csum}#${ebuild}"
|
||||
echo -e " { \"uri\": \"${uri}\","
|
||||
echo -n " \"digest\": {\"sha1\":\"${ebuildcsum}\"} }"
|
||||
|
||||
# The main sources
|
||||
if [ -n "${A}" ] ; then
|
||||
# Package is built from downloaded source tarball(s)
|
||||
# There can be multiple, and can be used conditionally based on use flags,
|
||||
# and even replaced with different local names ("http://... -> othername.tgz"). So
|
||||
# we go through what's actually used ($A), then find the corresponding source URI.
|
||||
local src="" prev_uri="" rename="false" orig_name=""
|
||||
for src in ${A}; do
|
||||
local found="false"
|
||||
for uri in ${SRC_URI}; do
|
||||
if [ "${uri}" = "->" ] ; then
|
||||
rename="true"
|
||||
continue
|
||||
fi
|
||||
if [ "${src}" = "$(basename "${uri}")" ] ; then
|
||||
orig_name="${src}"
|
||||
if [ "${rename}" = "true" ] ; then
|
||||
uri="${prev_uri}"
|
||||
orig_name="$(basename "${uri}")"
|
||||
fi
|
||||
einfo " Provenance: recording tarball material (input) '${src}' ('${orig_name}')"
|
||||
csum="$(sha512sum "${DISTDIR}/${src}" | cut -d' ' -f1)"
|
||||
echo -e ",\n { \"uri\": \"${uri}\","
|
||||
echo -n " \"digest\": {\"sha512\":\"${csum}\"} }"
|
||||
found="true"
|
||||
fi
|
||||
rename="false"
|
||||
prev_uri="${uri}"
|
||||
done
|
||||
if [ "${found}" != "true" ] ; then
|
||||
die "No SRC_URI found for source '${src}', unable to record provenance!"
|
||||
fi
|
||||
done
|
||||
elif [ -n "${EGIT_REPO_URI:-}" ] ; then
|
||||
# package is built from repo checkout (git)
|
||||
einfo " Provenance: recording GIT material (input) '${EGIT_REPO_URI}'"
|
||||
csum="${EGIT_COMMIT}"
|
||||
uri="${EGIT_REPO_URI}"
|
||||
echo -e ",\n { \"uri\": \"${uri}\","
|
||||
echo -n " \"digest\": {\"sha1\":\"$csum\"} }"
|
||||
fi
|
||||
|
||||
# Patches / files shipped with the ebuild (if any)
|
||||
csum="$(cat "/mnt/host/source/src/scripts/.git/modules/sdk_container/src/third_party/${repo}/HEAD")"
|
||||
uri="git+https://github.com/flatcar-linux/${repo}.git@${csum}#${CATEGORY}/${PN}/files"
|
||||
if [ -d "${FILESDIR}" ] ; then
|
||||
for file in $(cd "$FILESDIR" && find . -type f | sed 's:^./::') ; do
|
||||
csum="$(sha1sum - <"${FILESDIR}/${file}")"
|
||||
csum="${csum%% *}"
|
||||
einfo " Provenance: recording ebuild material (input) '${file}'"
|
||||
echo -e ",\n { \"uri\": \"${uri}/${file}\","
|
||||
echo -n " \"digest\": {\"sha1\":\"$csum\"} }"
|
||||
done
|
||||
fi
|
||||
|
||||
echo -ne '\n ]'
|
||||
}
|
||||
# --
|
||||
|
||||
__slsa_provenance_report() {
|
||||
local scripts_hash="$(cat "/mnt/host/source/src/scripts/.git/HEAD")"
|
||||
local buildcmd="emerge"
|
||||
# extract board from e.g. '/build/amd64-usr/build'. Empty if no board is set (SDK build).
|
||||
local board="$(echo "${CROS_BUILD_BOARD_TREE:-}" | sed -n 's:^/build/\([^/]\+\)/.*:\1:p')"
|
||||
if [ -n "$board" ] ; then
|
||||
buildcmd="emerge-${board}"
|
||||
fi
|
||||
if [[ "${scripts_hash}" == "ref:"* ]]; then
|
||||
scripts_hash="$(cat /mnt/host/source/src/scripts/.git/${scripts_hash#ref: })"
|
||||
fi
|
||||
|
||||
# FIXME: Supply SDK image ID and sha256 digest along with the version tag
|
||||
local sdk_version="$(source /mnt/host/source/.repo/manifests/version.txt; echo ${FLATCAR_SDK_VERSION})"
|
||||
|
||||
# FIXME: add builder ID
|
||||
cat <<EOF
|
||||
{
|
||||
"_type": "https://in-toto.io/Statement/v0.1",
|
||||
"predicateType": "https://slsa.dev/provenance/v0.2",
|
||||
"predicate": {
|
||||
"buildType": "ghcr.io/flatcar-linux/flatcar-sdk-all:${sdk_version}",
|
||||
"builder": {"id": "TODO - builder ID" },
|
||||
"invocation": {
|
||||
"configSource": {
|
||||
"uri": "https://github.com/flatcar-linux/scripts",
|
||||
"digest": {"sha1": "${scripts_hash}"}
|
||||
}
|
||||
},
|
||||
"buildConfig": {
|
||||
"commands": [
|
||||
"git checkout ${scripts_hash}",
|
||||
"git submodule init",
|
||||
"git submodule update",
|
||||
"./run_sdk_container ${buildcmd} =${CATEGORY}/${PF}"
|
||||
]
|
||||
},
|
||||
EOF
|
||||
__slsa_provenance_materials
|
||||
echo ","
|
||||
__slsa_provenance_subject
|
||||
echo ""
|
||||
cat <<EOF
|
||||
}
|
||||
}
|
||||
EOF
|
||||
}
|
||||
# --
|
||||
|
||||
cros_post_src_install_generate_slsa_provenance_report() {
|
||||
if [ "${generate_slsa_provenance_report:-no}" != "yes" ] ; then
|
||||
return
|
||||
fi
|
||||
|
||||
local report_file="${CATEGORY}_${PF}.json.bz2"
|
||||
local dest_dir="${D}/usr/share/SLSA/"
|
||||
|
||||
__slsa_provenance_report | jq | lbzip2 -9cz > "${T}/${report_file}"
|
||||
|
||||
mkdir -p "${dest_dir}"
|
||||
mv "${T}/${report_file}" "${dest_dir}"
|
||||
}
|
||||
Loading…
Reference in New Issue
Block a user