DNM: output log information

Signed-off-by: Brandon Lum <lumjjb@gmail.com>

Author: lumjjb

go.mod

@@ -216,3 +216,5 @@ require (
 	golang.org/x/sys v0.0.0-20220209214540-3681064d5158 // indirect
 	golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
 )
+
+replace github.com/slsa-framework/slsa-github-generator => ../slsa-github-generator

main.go

@@ -89,7 +89,7 @@ func main() {
 			usage(os.Args[0])
 		}
 
-		attBytes, err := pkg.GenerateProvenance(*provenanceName, *provenanceDigest,
+		attBytes, logRef, err := pkg.GenerateProvenance(*provenanceName, *provenanceDigest,
 			*provenanceCommand, *provenanceEnv)
 		check(err)
 
@@ -103,6 +103,8 @@ func main() {
 		check(err)
 		fmt.Printf("::set-output name=signed-provenance-sha256::%s\n", h)
 
+		fmt.Printf("transparency log entry created at index: %s\n", logRef)
+
 	default:
 		fmt.Println("expected 'build' or 'provenance' subcommands")
 		os.Exit(1)

pkg/provenance.go

@@ -52,29 +52,30 @@ type (
 // GenerateProvenance translates github context into a SLSA provenance
 // attestation.
 // Spec: https://slsa.dev/provenance/v0.2
-func GenerateProvenance(name, digest, command, envs string) ([]byte, error) {
+// Returns the SLSA provenance statement, and a string containing log reference information
+func GenerateProvenance(name, digest, command, envs string) ([]byte, string, error) {
 	gh, err := github.GetWorkflowContext()
 	if err != nil {
-		return nil, err
+		return nil, "", err
 	}
 
 	if _, err := hex.DecodeString(digest); err != nil || len(digest) != 64 {
-		return nil, fmt.Errorf("sha256 digest is not valid: %s", digest)
+		return nil, "", fmt.Errorf("sha256 digest is not valid: %s", digest)
 	}
 
 	com, err := unmarshallList(command)
 	if err != nil {
-		return nil, err
+		return nil, "", err
 	}
 
 	env, err := unmarshallList(envs)
 	if err != nil {
-		return nil, err
+		return nil, "", err
 	}
 
 	c, err := github.NewOIDCClient()
 	if err != nil {
-		return nil, err
+		return nil, "", err
 	}
 
 	// Generate a basic WorkflowRun for our subject based on the github
@@ -106,7 +107,7 @@ func GenerateProvenance(name, digest, command, envs string) ([]byte, error) {
 	ctx := context.Background()
 	p, err := slsa.HostedActionsProvenance(ctx, wr, c)
 	if err != nil {
-		return nil, err
+		return nil, "", err
 	}
 
 	// Set the architecture based on the runner. Architecture should be the
@@ -123,15 +124,21 @@ func GenerateProvenance(name, digest, command, envs string) ([]byte, error) {
 	s := sigstore.NewDefaultSigner()
 	att, err := s.Sign(ctx, p)
 	if err != nil {
-		return nil, err
+		return nil, "", err
 	}
 
 	// Upload the signed attestation to recor.
-	if err := s.Upload(ctx, att); err != nil {
-		return nil, err
+	logEntry, err := s.Upload(ctx, att)
+	if err != nil {
+		return nil, "", err
+	}
+
+	if logEntry.LogIndex == nil || logEntry.LogID == nil {
+		return nil, "", fmt.Errorf("logEntry fields not present for tlog upload")
 	}
+	logRef := fmt.Sprintf("index:%d, logID:%s", *logEntry.LogIndex, *logEntry.LogID)
 
-	return att.Bytes(), nil
+	return att.Bytes(), logRef, nil
 }
 
 func unmarshallList(arg string) ([]string, error) {