Skip to content

Commit 4fe6cb8

Browse files
crazy-maxcrazy-max
committed
check dependencies signatures
Signed-off-by: CrazyMax <[email protected]>
1 parent 4d4e9f3 commit 4fe6cb8

File tree

2 files changed

+120
-6
lines changed

2 files changed

+120
-6
lines changed

‎.github/workflows/bake.yml‎

Lines changed: 60 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -138,10 +138,10 @@ on:
138138

139139
env:
140140
BUILDX_VERSION: "v0.30.1"
141-
BUILDKIT_IMAGE: "moby/buildkit:master@sha256:bdefeba47634c596286beabe68219708ed364c4f1a5e4e9a2e160274712a0e89" # TODO: pin to a specific version when signed gha cache feature is available
141+
BUILDKIT_IMAGE: "moby/buildkit:master@sha256:84014da3581b2ff2c14cb4f60029cf9caa272b79e58f2e89c651ea6966d7a505" # TODO: pin to a specific version when signed gha cache feature is available
142142
SBOM_IMAGE: "docker/buildkit-syft-scanner:1.9.0"
143143
BINFMT_IMAGE: "tonistiigi/binfmt:qemu-v10.0.4-56"
144-
DOCKER_ACTIONS_TOOLKIT_MODULE: "@docker/actions-toolkit@0.73.0"
144+
DOCKER_ACTIONS_TOOLKIT_MODULE: "@docker/actions-toolkit@0.74.0"
145145
COSIGN_VERSION: "v3.0.2"
146146
LOCAL_EXPORT_DIR: "/tmp/buildx-output"
147147
MATRIX_SIZE_LIMIT: "20"
@@ -162,6 +162,62 @@ jobs:
162162
with:
163163
script: |
164164
await exec.exec('npm', ['install', '--prefer-offline', '--ignore-scripts', core.getInput('dat-module')]);
165+
-
166+
name: Install Cosign
167+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
168+
env:
169+
INPUT_COSIGN-VERSION: ${{ env.COSIGN_VERSION }}
170+
with:
171+
script: |
172+
const { Cosign } = require('@docker/actions-toolkit/lib/cosign/cosign');
173+
const { Install } = require('@docker/actions-toolkit/lib/cosign/install');
174+
175+
const inpCosignVersion = core.getInput('cosign-version');
176+
177+
const cosignInstall = new Install();
178+
const cosignBinPath = await cosignInstall.download({
179+
version: core.getInput('cosign-version'),
180+
ghaNoCache: true,
181+
skipState: true,
182+
verifySignature: true
183+
});
184+
const cosignPath = await cosignInstall.install(cosignBinPath);
185+
186+
const cosign = new Cosign();
187+
await cosign.printVersion();
188+
-
189+
name: Set up Docker Buildx
190+
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
191+
with:
192+
version: ${{ env.BUILDX_VERSION }}
193+
cache-binary: false
194+
buildkitd-flags: --debug
195+
-
196+
name: Check dependencies signatures
197+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
198+
env:
199+
INPUT_IMAGES: |
200+
${{ env.BUILDKIT_IMAGE }}
201+
${{ env.SBOM_IMAGE }}
202+
${{ env.BINFMT_IMAGE }}
203+
with:
204+
script: |
205+
const { Sigstore } = require('@docker/actions-toolkit/lib/sigstore/sigstore');
206+
207+
const sigstore = new Sigstore();
208+
209+
for (const image of core.getMultilineInput('images')) {
210+
await core.group(`Verifying ${image}`, async () => {
211+
try {
212+
await sigstore.verifyImageAttestations(image, {
213+
certificateIdentityRegexp: `^https://github.com/docker/github-builder(-experimental)?/.github/workflows/bake.yml.*$`
214+
});
215+
} catch (error) {
216+
core.setFailed(error);
217+
return;
218+
}
219+
});
220+
}
165221
-
166222
name: Expose GitHub Runtime
167223
uses: crazy-max/ghaction-github-runtime@3cb05d89e1f492524af3d41a1c98c83bc3025124 # v3.1.0
@@ -691,7 +747,8 @@ jobs:
691747
});
692748
693749
const verifyResults = await sigstore.verifySignedManifests(signResults, {
694-
certificateIdentityRegexp: `^https://github.com/docker/github-builder-experimental/.github/workflows/bake.yml.*$`
750+
certificateIdentityRegexp: `^https://github.com/docker/github-builder-experimental/.github/workflows/bake.yml.*$`,
751+
retryOnManifestUnknown: true
695752
});
696753
697754
await core.group(`Verify commands`, async () => {

‎.github/workflows/build.yml‎

Lines changed: 60 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -145,10 +145,10 @@ on:
145145

146146
env:
147147
BUILDX_VERSION: "v0.30.1"
148-
BUILDKIT_IMAGE: "moby/buildkit:master@sha256:bdefeba47634c596286beabe68219708ed364c4f1a5e4e9a2e160274712a0e89" # TODO: pin to a specific version when signed gha cache feature is available
148+
BUILDKIT_IMAGE: "moby/buildkit:master@sha256:84014da3581b2ff2c14cb4f60029cf9caa272b79e58f2e89c651ea6966d7a505" # TODO: pin to a specific version when signed gha cache feature is available
149149
SBOM_IMAGE: "docker/buildkit-syft-scanner:1.9.0"
150150
BINFMT_IMAGE: "tonistiigi/binfmt:qemu-v10.0.4-56"
151-
DOCKER_ACTIONS_TOOLKIT_MODULE: "@docker/actions-toolkit@0.73.0"
151+
DOCKER_ACTIONS_TOOLKIT_MODULE: "@docker/actions-toolkit@0.74.0"
152152
COSIGN_VERSION: "v3.0.2"
153153
LOCAL_EXPORT_DIR: "/tmp/buildx-output"
154154
MATRIX_SIZE_LIMIT: "20"
@@ -170,6 +170,62 @@ jobs:
170170
with:
171171
script: |
172172
await exec.exec('npm', ['install', '--prefer-offline', '--ignore-scripts', core.getInput('dat-module')]);
173+
-
174+
name: Install Cosign
175+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
176+
env:
177+
INPUT_COSIGN-VERSION: ${{ env.COSIGN_VERSION }}
178+
with:
179+
script: |
180+
const { Cosign } = require('@docker/actions-toolkit/lib/cosign/cosign');
181+
const { Install } = require('@docker/actions-toolkit/lib/cosign/install');
182+
183+
const inpCosignVersion = core.getInput('cosign-version');
184+
185+
const cosignInstall = new Install();
186+
const cosignBinPath = await cosignInstall.download({
187+
version: core.getInput('cosign-version'),
188+
ghaNoCache: true,
189+
skipState: true,
190+
verifySignature: true
191+
});
192+
const cosignPath = await cosignInstall.install(cosignBinPath);
193+
194+
const cosign = new Cosign();
195+
await cosign.printVersion();
196+
-
197+
name: Set up Docker Buildx
198+
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
199+
with:
200+
version: ${{ env.BUILDX_VERSION }}
201+
cache-binary: false
202+
buildkitd-flags: --debug
203+
-
204+
name: Check dependencies signatures
205+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
206+
env:
207+
INPUT_IMAGES: |
208+
${{ env.BUILDKIT_IMAGE }}
209+
${{ env.SBOM_IMAGE }}
210+
${{ env.BINFMT_IMAGE }}
211+
with:
212+
script: |
213+
const { Sigstore } = require('@docker/actions-toolkit/lib/sigstore/sigstore');
214+
215+
const sigstore = new Sigstore();
216+
217+
for (const image of core.getMultilineInput('images')) {
218+
await core.group(`Verifying ${image}`, async () => {
219+
try {
220+
await sigstore.verifyImageAttestations(image, {
221+
certificateIdentityRegexp: `^https://github.com/docker/github-builder(-experimental)?/.github/workflows/bake.yml.*$`
222+
});
223+
} catch (error) {
224+
core.setFailed(error);
225+
return;
226+
}
227+
});
228+
}
173229
-
174230
name: Expose GitHub Runtime
175231
uses: crazy-max/ghaction-github-runtime@3cb05d89e1f492524af3d41a1c98c83bc3025124 # v3.1.0
@@ -593,7 +649,8 @@ jobs:
593649
});
594650
595651
const verifyResults = await sigstore.verifySignedManifests(signResults, {
596-
certificateIdentityRegexp: `^https://github.com/docker/github-builder-experimental/.github/workflows/build.yml.*$`
652+
certificateIdentityRegexp: `^https://github.com/docker/github-builder-experimental/.github/workflows/build.yml.*$`,
653+
retryOnManifestUnknown: true
597654
});
598655
599656
await core.group(`Verify commands`, async () => {

0 commit comments

Comments
 (0)