Skip to content

Commit ad28b37

Browse files
tianontianon
committed
Add a basic test of the provenance (both amd64 and windows, to illustrate/validate the inputs variance)
1 parent 96f29bc commit ad28b37

File tree

3 files changed

+301
-0
lines changed

3 files changed

+301
-0
lines changed

‎.test/provenance/in.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../builds.json

‎.test/provenance/out.json

Lines changed: 271 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,271 @@
1+
[
2+
{
3+
"_type": "https://in-toto.io/Statement/v1",
4+
"subject": [
5+
{
6+
"name": "pkg:docker/docker:24.0.7-cli?platform=linux%2Famd64",
7+
"digest": {
8+
"sha256": "153793dfbac130679ad1eebd9e88b3772c47d3903a3f299c49d5c3f23a6e35d2"
9+
}
10+
},
11+
{
12+
"name": "pkg:docker/docker:24.0-cli?platform=linux%2Famd64",
13+
"digest": {
14+
"sha256": "153793dfbac130679ad1eebd9e88b3772c47d3903a3f299c49d5c3f23a6e35d2"
15+
}
16+
},
17+
{
18+
"name": "pkg:docker/docker:24-cli?platform=linux%2Famd64",
19+
"digest": {
20+
"sha256": "153793dfbac130679ad1eebd9e88b3772c47d3903a3f299c49d5c3f23a6e35d2"
21+
}
22+
},
23+
{
24+
"name": "pkg:docker/docker:cli?platform=linux%2Famd64",
25+
"digest": {
26+
"sha256": "153793dfbac130679ad1eebd9e88b3772c47d3903a3f299c49d5c3f23a6e35d2"
27+
}
28+
},
29+
{
30+
"name": "pkg:docker/docker:24.0.7-cli-alpine3.18?platform=linux%2Famd64",
31+
"digest": {
32+
"sha256": "153793dfbac130679ad1eebd9e88b3772c47d3903a3f299c49d5c3f23a6e35d2"
33+
}
34+
},
35+
{
36+
"name": "pkg:docker/amd64/docker:24.0.7-cli?platform=linux%2Famd64",
37+
"digest": {
38+
"sha256": "153793dfbac130679ad1eebd9e88b3772c47d3903a3f299c49d5c3f23a6e35d2"
39+
}
40+
},
41+
{
42+
"name": "pkg:docker/amd64/docker:24.0-cli?platform=linux%2Famd64",
43+
"digest": {
44+
"sha256": "153793dfbac130679ad1eebd9e88b3772c47d3903a3f299c49d5c3f23a6e35d2"
45+
}
46+
},
47+
{
48+
"name": "pkg:docker/amd64/docker:24-cli?platform=linux%2Famd64",
49+
"digest": {
50+
"sha256": "153793dfbac130679ad1eebd9e88b3772c47d3903a3f299c49d5c3f23a6e35d2"
51+
}
52+
},
53+
{
54+
"name": "pkg:docker/amd64/docker:cli?platform=linux%2Famd64",
55+
"digest": {
56+
"sha256": "153793dfbac130679ad1eebd9e88b3772c47d3903a3f299c49d5c3f23a6e35d2"
57+
}
58+
},
59+
{
60+
"name": "pkg:docker/amd64/docker:24.0.7-cli-alpine3.18?platform=linux%2Famd64",
61+
"digest": {
62+
"sha256": "153793dfbac130679ad1eebd9e88b3772c47d3903a3f299c49d5c3f23a6e35d2"
63+
}
64+
},
65+
{
66+
"name": "pkg:docker/oisupport/staging-amd64:4b199ac326c74b3058a147e14f553af9e8e1659abc29bd3e82c9c9807b66ee43?platform=linux%2Famd64",
67+
"digest": {
68+
"sha256": "153793dfbac130679ad1eebd9e88b3772c47d3903a3f299c49d5c3f23a6e35d2"
69+
}
70+
}
71+
],
72+
"predicateType": "https://slsa.dev/provenance/v1",
73+
"predicate": {
74+
"buildDefinition": {
75+
"buildType": "https://actions.github.io/buildtypes/workflow/v1",
76+
"externalParameters": {
77+
"workflow": {
78+
"ref": "refs/heads/subset",
79+
"repository": "https://github.com/docker-library/meta",
80+
"path": ".github/workflows/build.yml",
81+
"digest": {
82+
"gitCommit": "0123456789abcdef0123456789abcdef01234567"
83+
}
84+
},
85+
"inputs": {
86+
"buildId": "4b199ac326c74b3058a147e14f553af9e8e1659abc29bd3e82c9c9807b66ee43",
87+
"bashbrewArch": "amd64",
88+
"firstTag": "docker:24.0.7-cli"
89+
}
90+
},
91+
"internalParameters": {
92+
"github": {
93+
"event_name": "workflow_dispatch",
94+
"repository_id": "1234",
95+
"repository_owner_id": "5678",
96+
"runner_environment": "github-hosted"
97+
}
98+
},
99+
"resolvedDependencies": [
100+
{
101+
"uri": "git+https://github.com/docker-library/meta@refs/heads/subset",
102+
"digest": {
103+
"gitCommit": "0123456789abcdef0123456789abcdef01234567"
104+
}
105+
}
106+
]
107+
},
108+
"runDetails": {
109+
"builder": {
110+
"id": "https://github.com/docker-library/meta/.github/workflows/build.yml@refs/heads/subset"
111+
},
112+
"metadata": {
113+
"invocationId": "https://github.com/docker-library/meta/actions/runs/9001/attempts/2"
114+
}
115+
}
116+
}
117+
},
118+
{
119+
"_type": "https://in-toto.io/Statement/v1",
120+
"subject": [
121+
{
122+
"name": "pkg:docker/docker:24.0.7-windowsservercore-ltsc2022?platform=windows%2Famd64",
123+
"digest": {
124+
"sha256": "69aba7120e3f4014bfa80f4eae2cfc9698dcb6b8a5d64daf06de4039a19846ce"
125+
}
126+
},
127+
{
128+
"name": "pkg:docker/docker:24.0-windowsservercore-ltsc2022?platform=windows%2Famd64",
129+
"digest": {
130+
"sha256": "69aba7120e3f4014bfa80f4eae2cfc9698dcb6b8a5d64daf06de4039a19846ce"
131+
}
132+
},
133+
{
134+
"name": "pkg:docker/docker:24-windowsservercore-ltsc2022?platform=windows%2Famd64",
135+
"digest": {
136+
"sha256": "69aba7120e3f4014bfa80f4eae2cfc9698dcb6b8a5d64daf06de4039a19846ce"
137+
}
138+
},
139+
{
140+
"name": "pkg:docker/docker:windowsservercore-ltsc2022?platform=windows%2Famd64",
141+
"digest": {
142+
"sha256": "69aba7120e3f4014bfa80f4eae2cfc9698dcb6b8a5d64daf06de4039a19846ce"
143+
}
144+
},
145+
{
146+
"name": "pkg:docker/docker:24.0.7-windowsservercore?platform=windows%2Famd64",
147+
"digest": {
148+
"sha256": "69aba7120e3f4014bfa80f4eae2cfc9698dcb6b8a5d64daf06de4039a19846ce"
149+
}
150+
},
151+
{
152+
"name": "pkg:docker/docker:24.0-windowsservercore?platform=windows%2Famd64",
153+
"digest": {
154+
"sha256": "69aba7120e3f4014bfa80f4eae2cfc9698dcb6b8a5d64daf06de4039a19846ce"
155+
}
156+
},
157+
{
158+
"name": "pkg:docker/docker:24-windowsservercore?platform=windows%2Famd64",
159+
"digest": {
160+
"sha256": "69aba7120e3f4014bfa80f4eae2cfc9698dcb6b8a5d64daf06de4039a19846ce"
161+
}
162+
},
163+
{
164+
"name": "pkg:docker/docker:windowsservercore?platform=windows%2Famd64",
165+
"digest": {
166+
"sha256": "69aba7120e3f4014bfa80f4eae2cfc9698dcb6b8a5d64daf06de4039a19846ce"
167+
}
168+
},
169+
{
170+
"name": "pkg:docker/winamd64/docker:24.0.7-windowsservercore-ltsc2022?platform=windows%2Famd64",
171+
"digest": {
172+
"sha256": "69aba7120e3f4014bfa80f4eae2cfc9698dcb6b8a5d64daf06de4039a19846ce"
173+
}
174+
},
175+
{
176+
"name": "pkg:docker/winamd64/docker:24.0-windowsservercore-ltsc2022?platform=windows%2Famd64",
177+
"digest": {
178+
"sha256": "69aba7120e3f4014bfa80f4eae2cfc9698dcb6b8a5d64daf06de4039a19846ce"
179+
}
180+
},
181+
{
182+
"name": "pkg:docker/winamd64/docker:24-windowsservercore-ltsc2022?platform=windows%2Famd64",
183+
"digest": {
184+
"sha256": "69aba7120e3f4014bfa80f4eae2cfc9698dcb6b8a5d64daf06de4039a19846ce"
185+
}
186+
},
187+
{
188+
"name": "pkg:docker/winamd64/docker:windowsservercore-ltsc2022?platform=windows%2Famd64",
189+
"digest": {
190+
"sha256": "69aba7120e3f4014bfa80f4eae2cfc9698dcb6b8a5d64daf06de4039a19846ce"
191+
}
192+
},
193+
{
194+
"name": "pkg:docker/winamd64/docker:24.0.7-windowsservercore?platform=windows%2Famd64",
195+
"digest": {
196+
"sha256": "69aba7120e3f4014bfa80f4eae2cfc9698dcb6b8a5d64daf06de4039a19846ce"
197+
}
198+
},
199+
{
200+
"name": "pkg:docker/winamd64/docker:24.0-windowsservercore?platform=windows%2Famd64",
201+
"digest": {
202+
"sha256": "69aba7120e3f4014bfa80f4eae2cfc9698dcb6b8a5d64daf06de4039a19846ce"
203+
}
204+
},
205+
{
206+
"name": "pkg:docker/winamd64/docker:24-windowsservercore?platform=windows%2Famd64",
207+
"digest": {
208+
"sha256": "69aba7120e3f4014bfa80f4eae2cfc9698dcb6b8a5d64daf06de4039a19846ce"
209+
}
210+
},
211+
{
212+
"name": "pkg:docker/winamd64/docker:windowsservercore?platform=windows%2Famd64",
213+
"digest": {
214+
"sha256": "69aba7120e3f4014bfa80f4eae2cfc9698dcb6b8a5d64daf06de4039a19846ce"
215+
}
216+
},
217+
{
218+
"name": "pkg:docker/oisupport/staging-windows-amd64:9b405cfa5b88ba65121aabdb95ae90fd2e1fee7582174de82ae861613ae3072e?platform=windows%2Famd64",
219+
"digest": {
220+
"sha256": "69aba7120e3f4014bfa80f4eae2cfc9698dcb6b8a5d64daf06de4039a19846ce"
221+
}
222+
}
223+
],
224+
"predicateType": "https://slsa.dev/provenance/v1",
225+
"predicate": {
226+
"buildDefinition": {
227+
"buildType": "https://actions.github.io/buildtypes/workflow/v1",
228+
"externalParameters": {
229+
"workflow": {
230+
"ref": "refs/heads/subset",
231+
"repository": "https://github.com/docker-library/meta",
232+
"path": ".github/workflows/build.yml",
233+
"digest": {
234+
"gitCommit": "0123456789abcdef0123456789abcdef01234567"
235+
}
236+
},
237+
"inputs": {
238+
"buildId": "9b405cfa5b88ba65121aabdb95ae90fd2e1fee7582174de82ae861613ae3072e",
239+
"bashbrewArch": "windows-amd64",
240+
"firstTag": "docker:24.0.7-windowsservercore-ltsc2022",
241+
"windowsVersion": "2022"
242+
}
243+
},
244+
"internalParameters": {
245+
"github": {
246+
"event_name": "workflow_dispatch",
247+
"repository_id": "1234",
248+
"repository_owner_id": "5678",
249+
"runner_environment": "github-hosted"
250+
}
251+
},
252+
"resolvedDependencies": [
253+
{
254+
"uri": "git+https://github.com/docker-library/meta@refs/heads/subset",
255+
"digest": {
256+
"gitCommit": "0123456789abcdef0123456789abcdef01234567"
257+
}
258+
}
259+
]
260+
},
261+
"runDetails": {
262+
"builder": {
263+
"id": "https://github.com/docker-library/meta/.github/workflows/build.yml@refs/heads/subset"
264+
},
265+
"metadata": {
266+
"invocationId": "https://github.com/docker-library/meta/actions/runs/9001/attempts/2"
267+
}
268+
}
269+
}
270+
}
271+
]

‎.test/provenance/test.jq

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
include "provenance";
2+
include "jenkins";
3+
4+
[
5+
first(.[] | select(.build.arch == "amd64" and .build.resolved)),
6+
first(.[] | select(.build.arch == "windows-amd64" and .build.resolved)),
7+
empty # trailing comma
8+
9+
| (.build.resolved.annotations["org.opencontainers.image.ref.name"] | split("@")[1]) as $digest
10+
11+
# some faked GitHub event data so we can ~test the provenance generation
12+
| gha_payload as $payload
13+
| {
14+
event: $payload,
15+
event_name: "workflow_dispatch",
16+
ref: "refs/heads/\($payload.ref)",
17+
repository: "docker-library/meta",
18+
repository_id: "1234",
19+
repository_owner_id: "5678",
20+
run_attempt: "2",
21+
run_id: "9001",
22+
server_url: "https://github.com",
23+
sha: "0123456789abcdef0123456789abcdef01234567",
24+
workflow_ref: "docker-library/meta/.github/workflows/build.yml@refs/heads/\($payload.ref)",
25+
workflow_sha: "0123456789abcdef0123456789abcdef01234567",
26+
} as $github
27+
28+
| github_actions_provenance($github; $digest)
29+
]

0 commit comments

Comments
 (0)