Skip to content

Commit fedc71f

Browse files
st3pentast3penta
authored
Merge pull request #1544 from st3penta/support-slsa-v1
Support for SLSA v1 in slsa_source_version_controlled and slsa_build_build_service
2 parents d4322fa + 95810bb commit fedc71f

File tree

4 files changed

+98
-13
lines changed

4 files changed

+98
-13
lines changed

‎policy/release/slsa_build_build_service/slsa_build_build_service.rego‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ import data.lib.json as j
3535
#
3636
deny contains result if {
3737
some att in lib.pipelinerun_attestations
38-
not att.statement.predicate.builder.id
38+
not _builder_id(att)
3939
result := lib.result_helper(rego.metadata.chain(), [])
4040
}
4141

@@ -61,7 +61,7 @@ deny contains result if {
6161
deny contains result if {
6262
allowed_builder_ids := lib.rule_data(_rule_data_key)
6363
some att in lib.pipelinerun_attestations
64-
builder_id := att.statement.predicate.builder.id
64+
builder_id := _builder_id(att)
6565
not builder_id in allowed_builder_ids
6666
result := lib.result_helper(rego.metadata.chain(), [builder_id])
6767
}
@@ -103,4 +103,12 @@ _rule_data_errors contains error if {
103103
}
104104
}
105105

106+
_builder_id(att) := builder_id if {
107+
# slsa v0.2
108+
builder_id := att.statement.predicate.builder.id
109+
} else := builder_id if {
110+
# slsa v1.0
111+
builder_id := att.statement.predicate.runDetails.builder.id
112+
}
113+
106114
_rule_data_key := "allowed_builder_ids"

‎policy/release/slsa_build_build_service/slsa_build_build_service_test.rego‎

Lines changed: 51 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7,11 +7,13 @@ import data.slsa_build_build_service
77

88
test_all_good if {
99
builder_id := lib.rule_data("allowed_builder_ids")[0]
10-
lib.assert_empty(slsa_build_build_service.deny) with input.attestations as [_mock_attestation(builder_id)]
10+
lib.assert_empty(slsa_build_build_service.deny) with input.attestations as [_mock_slsa_v02_attestation(builder_id)]
11+
12+
lib.assert_empty(slsa_build_build_service.deny) with input.attestations as [_mock_slsa_v1_attestation(builder_id)]
1113
}
1214

1315
test_slsa_builder_id_found if {
14-
attestations := [
16+
slsa_v02_attestations := [
1517
# Missing predicate.builder.id
1618
{"statement": {"predicate": {
1719
"builder": {},
@@ -21,12 +23,39 @@ test_slsa_builder_id_found if {
2123
{"statement": {"predicate": {"buildType": lib.tekton_pipeline_run}}},
2224
]
2325

26+
slsa_v1_attestations := [
27+
# Missing predicate.runDetails.builder.id
28+
{"statement": {
29+
"predicateType": "https://slsa.dev/provenance/v1",
30+
"predicate": {
31+
"buildDefinition": {
32+
"buildType": "https://tekton.dev/chains/v2/slsa",
33+
"externalParameters": {"runSpec": {"pipelineSpec": {}}},
34+
},
35+
"runDetails": {"builder": {}},
36+
},
37+
}},
38+
# Missing predicate.runDetails.builder
39+
{"statement": {
40+
"predicateType": "https://slsa.dev/provenance/v1",
41+
"predicate": {
42+
"buildDefinition": {
43+
"buildType": "https://tekton.dev/chains/v2/slsa",
44+
"externalParameters": {"runSpec": {"pipelineSpec": {}}},
45+
},
46+
"runDetails": {},
47+
},
48+
}},
49+
]
50+
2451
expected := {{
2552
"code": "slsa_build_build_service.slsa_builder_id_found",
2653
"msg": "Builder ID not set in attestation",
2754
}}
2855

29-
lib.assert_equal_results(expected, slsa_build_build_service.deny) with input.attestations as attestations
56+
lib.assert_equal_results(expected, slsa_build_build_service.deny) with input.attestations as slsa_v02_attestations
57+
58+
lib.assert_equal_results(expected, slsa_build_build_service.deny) with input.attestations as slsa_v1_attestations
3059
}
3160

3261
test_accepted_slsa_builder_id if {
@@ -38,7 +67,12 @@ test_accepted_slsa_builder_id if {
3867
lib.assert_equal_results(
3968
expected,
4069
slsa_build_build_service.deny,
41-
) with input.attestations as [_mock_attestation(builder_id)]
70+
) with input.attestations as [_mock_slsa_v02_attestation(builder_id)]
71+
72+
lib.assert_equal_results(
73+
expected,
74+
slsa_build_build_service.deny,
75+
) with input.attestations as [_mock_slsa_v1_attestation(builder_id)]
4276
}
4377

4478
test_rule_data_format if {
@@ -64,10 +98,21 @@ test_rule_data_format if {
6498
}
6599

66100
lib.assert_equal_results(slsa_build_build_service.deny, expected) with data.rule_data as d
67-
with input.attestations as [_mock_attestation("foo")]
101+
with input.attestations as [_mock_slsa_v02_attestation("foo")]
68102
}
69103

70-
_mock_attestation(builder_id) := {"statement": {"predicate": {
104+
_mock_slsa_v02_attestation(builder_id) := {"statement": {"predicate": {
71105
"builder": {"id": builder_id},
72106
"buildType": lib.tekton_pipeline_run,
73107
}}}
108+
109+
_mock_slsa_v1_attestation(builder_id) := {"statement": {
110+
"predicateType": "https://slsa.dev/provenance/v1",
111+
"predicate": {
112+
"buildDefinition": {
113+
"buildType": "https://tekton.dev/chains/v2/slsa",
114+
"externalParameters": {"runSpec": {"pipelineSpec": {}}},
115+
},
116+
"runDetails": {"builder": {"id": builder_id}},
117+
},
118+
}}

‎policy/release/slsa_source_version_controlled/slsa_source_version_controlled.rego‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -114,3 +114,10 @@ materials contains material if {
114114
material.uri
115115
material.digest.sha1
116116
}
117+
118+
materials contains material if {
119+
some attestation in lib.pipelinerun_attestations
120+
some material in attestation.statement.predicate.buildDefinition.resolvedDependencies
121+
material.uri
122+
material.digest.sha1
123+
}

‎policy/release/slsa_source_version_controlled/slsa_source_version_controlled_test.rego‎

Lines changed: 30 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,8 @@ test_all_good if {
1717
},
1818
]
1919

20-
lib.assert_empty(slsa_source_version_controlled.deny) with input.attestations as [_mock_attestation(materials)]
20+
lib.assert_empty(slsa_source_version_controlled.deny) with input.attestations as [_mock_slsa_v02_attestation(materials)] # regal ignore:line-length
21+
lib.assert_empty(slsa_source_version_controlled.deny) with input.attestations as [_mock_slsa_v1_attestation(materials)]
2122
}
2223

2324
test_non_git_uri if {
@@ -46,7 +47,12 @@ test_non_git_uri if {
4647
lib.assert_equal_results(
4748
expected,
4849
slsa_source_version_controlled.deny,
49-
) with input.attestations as [_mock_attestation(materials)]
50+
) with input.attestations as [_mock_slsa_v02_attestation(materials)]
51+
52+
lib.assert_equal_results(
53+
expected,
54+
slsa_source_version_controlled.deny,
55+
) with input.attestations as [_mock_slsa_v1_attestation(materials)]
5056
}
5157

5258
# regal ignore:rule-length
@@ -87,7 +93,12 @@ test_non_git_commit if {
8793
lib.assert_equal_results(
8894
expected,
8995
slsa_source_version_controlled.deny,
90-
) with input.attestations as [_mock_attestation(materials)]
96+
) with input.attestations as [_mock_slsa_v02_attestation(materials)]
97+
98+
lib.assert_equal_results(
99+
expected,
100+
slsa_source_version_controlled.deny,
101+
) with input.attestations as [_mock_slsa_v1_attestation(materials)]
91102
}
92103

93104
test_invalid_materials if {
@@ -108,10 +119,24 @@ test_invalid_materials if {
108119
lib.assert_equal_results(
109120
expected,
110121
slsa_source_version_controlled.deny,
111-
) with input.attestations as [_mock_attestation(materials)]
122+
) with input.attestations as [_mock_slsa_v02_attestation(materials)]
123+
124+
lib.assert_equal_results(
125+
expected,
126+
slsa_source_version_controlled.deny,
127+
) with input.attestations as [_mock_slsa_v1_attestation(materials)]
112128
}
113129

114-
_mock_attestation(materials) := {"statement": {"predicate": {
130+
_mock_slsa_v02_attestation(materials) := {"statement": {"predicate": {
115131
"buildType": lib.tekton_pipeline_run,
116132
"materials": materials,
117133
}}}
134+
135+
_mock_slsa_v1_attestation(materials) := {"statement": {
136+
"predicateType": "https://slsa.dev/provenance/v1",
137+
"predicate": {"buildDefinition": {
138+
"buildType": "https://tekton.dev/chains/v2/slsa",
139+
"externalParameters": {"runSpec": {"pipelineSpec": {}}},
140+
"resolvedDependencies": materials,
141+
}},
142+
}}

0 commit comments

Comments
 (0)