Skip to content

Commit 8ed86a8

Browse files
crazy-maxcrazy-max
committed
check dependencies signatures
Signed-off-by: CrazyMax <[email protected]>
1 parent a019f2d commit 8ed86a8

File tree

2 files changed

+106
-4
lines changed

2 files changed

+106
-4
lines changed

‎.github/workflows/bake.yml‎

Lines changed: 53 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -138,10 +138,10 @@ on:
138138

139139
env:
140140
BUILDX_VERSION: "v0.30.1"
141-
BUILDKIT_IMAGE: "moby/buildkit:master@sha256:bdefeba47634c596286beabe68219708ed364c4f1a5e4e9a2e160274712a0e89" # TODO: pin to a specific version when signed gha cache feature is available
141+
BUILDKIT_IMAGE: "moby/buildkit:master@sha256:84014da3581b2ff2c14cb4f60029cf9caa272b79e58f2e89c651ea6966d7a505" # TODO: pin to a specific version when signed gha cache feature is available
142142
SBOM_IMAGE: "docker/buildkit-syft-scanner:1.10.0"
143143
BINFMT_IMAGE: "tonistiigi/binfmt:qemu-v10.0.4-56"
144-
DOCKER_ACTIONS_TOOLKIT_MODULE: "@docker/actions-toolkit@0.74.0"
144+
DOCKER_ACTIONS_TOOLKIT_MODULE: "@docker/actions-toolkit@0.75.0"
145145
COSIGN_VERSION: "v3.0.2"
146146
LOCAL_EXPORT_DIR: "/tmp/buildx-output"
147147
MATRIX_SIZE_LIMIT: "20"
@@ -162,6 +162,57 @@ jobs:
162162
with:
163163
script: |
164164
await exec.exec('npm', ['install', '--prefer-offline', '--ignore-scripts', core.getInput('dat-module')]);
165+
-
166+
name: Install Cosign
167+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
168+
env:
169+
INPUT_COSIGN-VERSION: ${{ env.COSIGN_VERSION }}
170+
with:
171+
script: |
172+
const { Cosign } = require('@docker/actions-toolkit/lib/cosign/cosign');
173+
const { Install } = require('@docker/actions-toolkit/lib/cosign/install');
174+
175+
const inpCosignVersion = core.getInput('cosign-version');
176+
177+
const cosignInstall = new Install();
178+
const cosignBinPath = await cosignInstall.download({
179+
version: core.getInput('cosign-version'),
180+
ghaNoCache: true,
181+
skipState: true,
182+
verifySignature: true
183+
});
184+
const cosignPath = await cosignInstall.install(cosignBinPath);
185+
186+
const cosign = new Cosign();
187+
await cosign.printVersion();
188+
-
189+
name: Check dependencies signatures
190+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
191+
env:
192+
INPUT_IMAGES: |
193+
${{ env.BUILDKIT_IMAGE }}
194+
${{ env.SBOM_IMAGE }}
195+
${{ env.BINFMT_IMAGE }}
196+
with:
197+
script: |
198+
const { OCI } = require('@docker/actions-toolkit/lib/oci/oci');
199+
const { Sigstore } = require('@docker/actions-toolkit/lib/sigstore/sigstore');
200+
201+
const sigstore = new Sigstore();
202+
203+
for (const image of core.getMultilineInput('images')) {
204+
await core.group(`Verifying ${image}`, async () => {
205+
try {
206+
await sigstore.verifyImageAttestations(image, {
207+
certificateIdentityRegexp: `^https://github.com/docker/github-builder(-experimental)?/.github/workflows/bake.yml.*$`,
208+
platform: OCI.defaultPlatform()
209+
});
210+
} catch (error) {
211+
core.setFailed(error);
212+
return;
213+
}
214+
});
215+
}
165216
-
166217
name: Expose GitHub Runtime
167218
uses: crazy-max/ghaction-github-runtime@3cb05d89e1f492524af3d41a1c98c83bc3025124 # v3.1.0

‎.github/workflows/build.yml‎

Lines changed: 53 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -145,10 +145,10 @@ on:
145145

146146
env:
147147
BUILDX_VERSION: "v0.30.1"
148-
BUILDKIT_IMAGE: "moby/buildkit:master@sha256:bdefeba47634c596286beabe68219708ed364c4f1a5e4e9a2e160274712a0e89" # TODO: pin to a specific version when signed gha cache feature is available
148+
BUILDKIT_IMAGE: "moby/buildkit:master@sha256:84014da3581b2ff2c14cb4f60029cf9caa272b79e58f2e89c651ea6966d7a505" # TODO: pin to a specific version when signed gha cache feature is available
149149
SBOM_IMAGE: "docker/buildkit-syft-scanner:1.10.0"
150150
BINFMT_IMAGE: "tonistiigi/binfmt:qemu-v10.0.4-56"
151-
DOCKER_ACTIONS_TOOLKIT_MODULE: "@docker/actions-toolkit@0.74.0"
151+
DOCKER_ACTIONS_TOOLKIT_MODULE: "@docker/actions-toolkit@0.75.0"
152152
COSIGN_VERSION: "v3.0.2"
153153
LOCAL_EXPORT_DIR: "/tmp/buildx-output"
154154
MATRIX_SIZE_LIMIT: "20"
@@ -170,6 +170,57 @@ jobs:
170170
with:
171171
script: |
172172
await exec.exec('npm', ['install', '--prefer-offline', '--ignore-scripts', core.getInput('dat-module')]);
173+
-
174+
name: Install Cosign
175+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
176+
env:
177+
INPUT_COSIGN-VERSION: ${{ env.COSIGN_VERSION }}
178+
with:
179+
script: |
180+
const { Cosign } = require('@docker/actions-toolkit/lib/cosign/cosign');
181+
const { Install } = require('@docker/actions-toolkit/lib/cosign/install');
182+
183+
const inpCosignVersion = core.getInput('cosign-version');
184+
185+
const cosignInstall = new Install();
186+
const cosignBinPath = await cosignInstall.download({
187+
version: core.getInput('cosign-version'),
188+
ghaNoCache: true,
189+
skipState: true,
190+
verifySignature: true
191+
});
192+
const cosignPath = await cosignInstall.install(cosignBinPath);
193+
194+
const cosign = new Cosign();
195+
await cosign.printVersion();
196+
-
197+
name: Check dependencies signatures
198+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
199+
env:
200+
INPUT_IMAGES: |
201+
${{ env.BUILDKIT_IMAGE }}
202+
${{ env.SBOM_IMAGE }}
203+
${{ env.BINFMT_IMAGE }}
204+
with:
205+
script: |
206+
const { OCI } = require('@docker/actions-toolkit/lib/oci/oci');
207+
const { Sigstore } = require('@docker/actions-toolkit/lib/sigstore/sigstore');
208+
209+
const sigstore = new Sigstore();
210+
211+
for (const image of core.getMultilineInput('images')) {
212+
await core.group(`Verifying ${image}`, async () => {
213+
try {
214+
await sigstore.verifyImageAttestations(image, {
215+
certificateIdentityRegexp: `^https://github.com/docker/github-builder(-experimental)?/.github/workflows/bake.yml.*$`,
216+
platform: OCI.defaultPlatform()
217+
});
218+
} catch (error) {
219+
core.setFailed(error);
220+
return;
221+
}
222+
});
223+
}
173224
-
174225
name: Expose GitHub Runtime
175226
uses: crazy-max/ghaction-github-runtime@3cb05d89e1f492524af3d41a1c98c83bc3025124 # v3.1.0

0 commit comments

Comments
 (0)