Skip to content

Commit d006a72

Browse files
revert: Revert "ci: Generate hashes for SLSA #153" (#280)
Co-authored-by: Daniel Elsner <daniel.elsner@quantco.com>
1 parent d2f1748 commit d006a72

File tree

3 files changed

+5
-60
lines changed

3 files changed

+5
-60
lines changed

.github/workflows/build.yml

Lines changed: 2 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -99,44 +99,9 @@ jobs:
9999
path: pixi-unpack-${{ matrix.target }}${{ endsWith(matrix.target, 'windows-msvc') && '.exe' || '' }}
100100
if-no-files-found: error
101101

102-
hashes:
103-
name: Compute hashes
104-
needs: [metadata, build]
105-
if: needs.metadata.outputs.release == 'true'
106-
runs-on: ubuntu-latest
107-
outputs:
108-
hashes: ${{ steps.hash.outputs.hashes }}
109-
steps:
110-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
111-
- name: Download artifacts
112-
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
113-
with:
114-
pattern: pixi-*
115-
merge-multiple: true
116-
- name: Compute hashes
117-
id: hash
118-
run: |
119-
set -exuo pipefail
120-
files=$(ls pixi-*)
121-
echo "hashes=$(sha256sum $files | base64 -w0)" >> "${GITHUB_OUTPUT}"
122-
123-
provenance:
124-
needs: [metadata, hashes]
125-
permissions:
126-
actions: read
127-
id-token: write
128-
contents: write
129-
if: needs.metadata.outputs.release == 'true'
130-
# This cannot be pinned: https://github.com/slsa-framework/slsa-github-generator?tab=readme-ov-file#referencing-slsa-builders-and-generators
131-
# https://github.com/slsa-framework/slsa-verifier/issues/12
132-
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
133-
with:
134-
base64-subjects: "${{ needs.hashes.outputs.hashes }}"
135-
upload-assets: false
136-
137102
release:
138103
name: Create Release
139-
needs: [metadata, build, provenance]
104+
needs: [metadata, build]
140105
if: needs.metadata.outputs.release == 'true'
141106
runs-on: ubuntu-latest
142107
permissions:
@@ -148,11 +113,6 @@ jobs:
148113
with:
149114
pattern: pixi-*
150115
merge-multiple: true
151-
- name: Download provenance
152-
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
153-
with:
154-
name: ${{ needs.provenance.outputs.provenance-name }}
155-
merge-multiple: true
156116
- name: Push v${{ needs.metadata.outputs.version }} tag
157117
run: |
158118
git tag v${{ needs.metadata.outputs.version }}
@@ -163,6 +123,4 @@ jobs:
163123
generate_release_notes: true
164124
tag_name: v${{ needs.metadata.outputs.version }}
165125
draft: true
166-
files: |
167-
${{ needs.provenance.outputs.provenance-name }}
168-
pixi-*
126+
files: pixi-*

.typos.toml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
11
[default.extend-words]
2-
intoto = "intoto"
32
concurreny = "concurreny" # xref: https://github.com/conda/rattler/pull/1479
43

54
[files]

README.md

Lines changed: 3 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -281,23 +281,11 @@ conda env create -p ./env --file environment.yml
281281
> - Add `pip` to your `pixi.lock` file using `pixi add pip`.
282282
> - Configuring `conda` (or `mamba`) to not install `pip` by default by running `conda config --set add_pip_as_python_dependency false` (or by adding `add_pip_as_python_dependency: False` to your `~/.condarc`)
283283
284-
## Build provenance
284+
## Build attestations
285285

286-
The builds that are uploaded to releases on GitHub have build provenance using [slsa.dev](https://slsa.dev/).
287-
You can verify their provenance using:
288-
289-
```
290-
pixi exec slsa-verifier verify-artifact pixi-pack-<architecture> \
291-
--provenance-path multiple.intoto.jsonl \
292-
--source-uri github.com/quantco/pixi-pack \
293-
--source-branch main
294-
```
295-
296-
Due to the setup of the release pipeline, the git tag is not part of the provenance but you can instead verify the commit id.
297-
298-
In addition to the `intoto` files, we also upload build attestations to GitHub.
286+
Build attestations are uploaded to GitHub Artifact Attestations.
299287
You can verify a binary using the `gh` CLI:
300288

301-
```
289+
```bash
302290
gh attestation verify --repo Quantco/pixi-pack pixi-pack-<architecture>
303291
```

0 commit comments

Comments
 (0)