Skip to content

Commit 635178a

Browse files
laurentsimonlaurentsimon
authored
✨ Pull builder's binary instead of compiling it (#86)
* updates * updates * updates * updates * updates * updates * updates * updates * updates * updates * updates * updates * updates * updates * updates * updates * updates * updates * updates * updates * updates * updates * updates * updates * updates * updates * updates * updates
1 parent 6293c4a commit 635178a

File tree

5 files changed

+168
-31
lines changed

5 files changed

+168
-31
lines changed

‎.github/workflows/builder_go_slsa3.yml‎

Lines changed: 41 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,13 @@ env:
2222
GENERATED_BINARY_NAME: compiled-binary
2323
# Builder
2424
BUILDER_BINARY: builder
25+
BUILDER_RELEASE_BINARY: slsa-builder-go-linux-amd64
26+
BUILDER_REPOSITORY: slsa-framework/slsa-github-generator
27+
# Verifier
28+
VERIFIER_REPOSITORY: slsa-framework/slsa-verifier
29+
VERIFIER_RELEASE_BINARY: slsa-verifier-linux-amd64
30+
VERIFIER_RELEASE_BINARY_SHA256: fb743bc6bb56908d590da66bfe5c266d003aa226b30fcada5f7b9e4aea43b52b
31+
VERIFIER_RELEASE: v0.0.1
2532
# Builder location
2633
BUILDER_DIR: builders
2734

@@ -34,11 +41,11 @@ on:
3441
workflow_call:
3542
inputs:
3643
go-version:
37-
description: "The go version to use"
44+
description: "The go version to use."
3845
required: true
3946
type: string
4047
upload-assets:
41-
description: "Whether to upload assets to a GitHub release or not"
48+
description: "Whether to upload assets to a GitHub release or not."
4249
required: false
4350
type: boolean
4451
default: true
@@ -48,12 +55,17 @@ on:
4855
type: string
4956
default: ".slsa-goreleaser.yml"
5057
evaluated-envs:
51-
description: "Evaluated env variables to pass to the builder"
58+
description: "Evaluated env variables to pass to the builder."
5259
required: false
5360
type: string
61+
compile-builder:
62+
description: "Build the builder from source. This increases build time by ~2mn."
63+
required: false
64+
type: boolean
65+
default: false
5466
outputs:
5567
go-binary-name:
56-
description: "The name of the generated binary uploaded to the artifact registry"
68+
description: "The name of the generated binary uploaded to the artifact registry."
5769
value: ${{ jobs.build-dry.outputs.go-binary-name }}
5870

5971
jobs:
@@ -125,40 +137,44 @@ jobs:
125137
with:
126138
go-version: 1.18
127139

128-
- name: Download dependencies
140+
- name: Build builder
129141
shell: bash
142+
id: builder-gen
143+
env:
144+
COMPILE_BUILDER: "${{ inputs.compile-builder }}"
145+
BUILDER_REF: "${{ needs.detect-env.outputs.builder_ref }}"
146+
# Needed for the gh CLI used in builder-fetch.sh.
147+
GH_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
130148
run: |
131149
set -euo pipefail
132150
133-
cd "$BUILDER_DIR"/go/
151+
if [[ "$COMPILE_BUILDER" = true ]]; then
152+
echo "Building the builder"
134153
135-
#TODO(reproducible)
136-
go mod vendor
154+
cd "$BUILDER_DIR"/go/
137155
138-
# TODO(hermeticity) OS-level.
139-
# - name: Disable hermeticity
140-
# uses: slsa/hermeticity@xxx
141-
# with:
142-
# to-state: enabled
156+
#TODO(reproducible)
157+
go mod vendor
143158
144-
- name: Build builder
145-
shell: bash
146-
id: builder-gen
147-
env:
148-
BUILDER_BINARY: "${{ env.BUILDER_BINARY }}"
149-
run: |
150-
set -euo pipefail
159+
# https://go.dev/ref/mod#build-commands.
160+
go build -mod=vendor -o "$BUILDER_BINARY"
161+
162+
mv "$BUILDER_BINARY" ../../"$BUILDER_BINARY"
151163
152-
cd "$BUILDER_DIR"/go/
164+
cd -
165+
else
166+
echo "Fetching the builder with ref: $BUILDER_REF"
167+
168+
.github/workflows/scripts/builder-fetch.sh
153169
154-
# https://go.dev/ref/mod#build-commands.
155-
go build -mod=vendor -o "$BUILDER_BINARY"
170+
mv "$BUILDER_RELEASE_BINARY" "$BUILDER_BINARY"
171+
172+
fi
173+
156174
BUILDER_DIGEST=$(sha256sum "$BUILDER_BINARY" | awk '{print $1}')
157175
echo "::set-output name=go-builder-sha256::$BUILDER_DIGEST"
158176
echo "hash of $BUILDER_BINARY is $BUILDER_DIGEST"
159177
160-
mv "$BUILDER_BINARY" ../../"$BUILDER_BINARY"
161-
162178
- name: Upload the builder
163179
uses: actions/upload-artifact@6673cd052c4cd6fcf4b4e6e60ea986c889389535 # v2.3.1
164180
with:
@@ -202,7 +218,6 @@ jobs:
202218
- name: Verify builder
203219
env:
204220
BUILDER_HASH: "${{ needs.builder.outputs.go-builder-sha256 }}"
205-
BUILDER_BINARY: "${{ env.BUILDER_BINARY }}"
206221
run: |
207222
set -euo pipefail
208223
@@ -221,7 +236,6 @@ jobs:
221236
id: build-dry
222237
shell: bash
223238
env:
224-
BUILDER_BINARY: "${{ env.BUILDER_BINARY }}"
225239
CONFIG_FILE: "${{ inputs.config-file }}"
226240
UNTRUSTED_ENVS: "${{ inputs.evaluated-envs }}"
227241
run: |
@@ -264,7 +278,6 @@ jobs:
264278
- name: Verify builder
265279
env:
266280
BUILDER_HASH: "${{ needs.builder.outputs.go-builder-sha256 }}"
267-
BUILDER_BINARY: "${{ env.BUILDER_BINARY }}"
268281
run: |
269282
set -euo pipefail
270283
@@ -300,7 +313,6 @@ jobs:
300313
id: build-gen
301314
shell: bash
302315
env:
303-
BUILDER_BINARY: "${{ env.BUILDER_BINARY }}"
304316
CONFIG_FILE: "${{ inputs.config-file }}"
305317
UNTRUSTED_ENVS: "${{ inputs.evaluated-envs }}"
306318
run: |
@@ -398,7 +410,6 @@ jobs:
398410
- name: Verify builder
399411
env:
400412
BUILDER_HASH: "${{ needs.builder.outputs.go-builder-sha256 }}"
401-
BUILDER_BINARY: "${{ env.BUILDER_BINARY }}"
402413
run: |
403414
set -euo pipefail
404415
@@ -422,7 +433,6 @@ jobs:
422433
UNTRUSTED_COMMAND: "${{ needs.build-dry.outputs.go-command }}"
423434
UNTRUSTED_ENV: "${{ needs.build-dry.outputs.go-env }}"
424435
UNTRUSTED_WORKING_DIR: "${{ needs.build-dry.outputs.go-working-dir }}"
425-
BUILDER_BINARY: "${{ env.BUILDER_BINARY }}"
426436
GITHUB_CONTEXT: "${{ toJSON(github) }}"
427437
run: |
428438
set -euo pipefail

‎.github/workflows/configs-go/config-release.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# Used for pre-submit tests.
2+
version: 1
3+
env:
4+
- GO111MODULE=on
5+
- CGO_ENABLED=0
6+
7+
flags:
8+
- -trimpath
9+
- -tags=netgo
10+
11+
goos: linux
12+
goarch: amd64
13+
dir: builders/go/
14+
binary: slsa-builder-go-{{ .Os }}-{{ .Arch }}

‎.github/workflows/pre-submit.e2e.go.config-ldflags-main-dir.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ jobs:
3333
go-version: 1.18
3434
config-file: .github/workflows/configs-go/config-ldflags-main-dir.yml
3535
evaluated-envs: "VERSION:${{needs.args.outputs.version}},COMMIT:${{needs.args.outputs.commit}},BRANCH:${{needs.args.outputs.branch}}"
36+
compile-builder: true
3637

3738
verify:
3839
runs-on: ubuntu-latest

‎.github/workflows/release.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
name: Builders realeaser
2+
3+
on:
4+
push:
5+
tags:
6+
- "*" # triggers only if push new tag version, like `0.8.4` or else
7+
8+
permissions: read-all
9+
10+
env:
11+
GH_TOKEN: ${{ secrets.E2E_GO_TOKEN }}
12+
13+
jobs:
14+
# Go builder.
15+
go-builder:
16+
permissions:
17+
id-token: write # For signing.
18+
contents: write # For asset uploads.
19+
uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@main
20+
with:
21+
go-version: 1.18
22+
config-file: .github/workflows/configs-go/config-release.yml
23+
compile-builder: true

‎.github/workflows/scripts/builder-fetch.sh‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
#!/usr/bin/env bash
2+
3+
set -euo pipefail
4+
5+
# Caller sets the following:
6+
#BUILDER_REPOSITORY="slsa-framework/slsa-github-generator"
7+
#BUILDER_TAG="v13.0.10" or "6a1e642a8689671a2cec9287149eb50bd9fe5ef6"
8+
#BUILDER_RELEASE_BINARY="builder-linux-amd64"
9+
#VERIFIER_REPOSITORY="slsa-framework/slsa-verifier"
10+
#VERIFIER_RELEASE="v13.0.10"
11+
#VERIFIER_RELEASE_BINARY="slsa-verifier-linux-amd64"
12+
#VERIFIER_RELEASE_BINARY_SHA256="89fbcba9aed67d5146ea99946c7e4e5a80e3767871f0e3ffcd0b582134efd010"
13+
14+
PREFIX="refs/tags/"
15+
16+
# Extract version.
17+
if [[ "$BUILDER_REF" =~ "^$PREFIX*" ]]; then
18+
echo "Invalid ref: $BUILDER_REF"
19+
exit 2
20+
fi
21+
22+
BUILDER_TAG="${BUILDER_REF#"$PREFIX"}"
23+
24+
if [[ "$BUILDER_TAG" = "$(echo -n "$BUILDER_TAG" | grep -P '^[a-f\d]{40}$')" ]]; then
25+
echo "Builder referenced by hash: $BUILDER_TAG"
26+
echo "Resolving..."
27+
28+
RELEASE_TAG=""
29+
30+
# List the releases and find the corepsonding hash.
31+
RELEASE_LIST=$(gh release -R "$BUILDER_REPOSITORY" -L 50 list)
32+
while read line; do
33+
TAG=$(echo "$line" | cut -f1)
34+
BRANCH=$(gh release -R "$BUILDER_REPOSITORY" view "$TAG" --json targetCommitish --jq '.targetCommitish')
35+
if [[ "$BRANCH" != "main" ]]; then
36+
continue
37+
fi
38+
COMMIT=$(gh api /repos/"$BUILDER_REPOSITORY"/git/ref/tags/"$TAG" | jq -r '.object.sha')
39+
if [[ "$COMMIT" == "$BUILDER_TAG" ]]; then
40+
RELEASE_TAG="$TAG"
41+
echo "Found tag $BUILDER_TAG match at tag $TAG and commit $COMMIT"
42+
break
43+
fi
44+
done <<< "$RELEASE_LIST"
45+
46+
if [[ -z "$RELEASE_TAG" ]]; then
47+
echo "Tag not found for $BUILDER_TAG"
48+
exit 3
49+
fi
50+
51+
BUILDER_TAG="$RELEASE_TAG"
52+
fi
53+
54+
if [[ "$BUILDER_TAG" != "$(echo -n "$BUILDER_TAG" | grep -P '^v\d*(\.([\d]{1,})){0,2}$')" ]]; then
55+
echo "Invalid ref: $BUILDER_TAG"
56+
exit 7
57+
fi
58+
59+
echo "Builder version: $BUILDER_TAG"
60+
61+
echo "BUILDER_REPOSITORY: $BUILDER_REPOSITORY"
62+
63+
# Fetch the release binary and provenance.
64+
gh release -R "$BUILDER_REPOSITORY" download "$BUILDER_TAG" -p "$BUILDER_RELEASE_BINARY*" || exit 10
65+
66+
# Fetch the verifier at the right hash.
67+
gh release -R "$VERIFIER_REPOSITORY" download "$VERIFIER_RELEASE" -p "$VERIFIER_RELEASE_BINARY" || exit 11
68+
COMPUTED_HASH=$(sha256sum "$VERIFIER_RELEASE_BINARY" | awk '{print $1}')
69+
echo "verifier hash computed is $COMPUTED_HASH"
70+
echo "$VERIFIER_RELEASE_BINARY_SHA256 $VERIFIER_RELEASE_BINARY" | sha256sum --strict --check --status || exit 4
71+
echo "verifier hash verification has passed"
72+
73+
# Verify the provenance of the builder.
74+
chmod a+x "$VERIFIER_RELEASE_BINARY"
75+
./"$VERIFIER_RELEASE_BINARY" --branch "main" \
76+
--tag "$BUILDER_TAG" \
77+
--artifact-path "$BUILDER_RELEASE_BINARY" \
78+
--provenance "$BUILDER_RELEASE_BINARY.intoto.jsonl" \
79+
--source "github.com/$BUILDER_REPOSITORY" || exit 6
80+
81+
BUILDER_COMMIT=$(gh api /repos/"$BUILDER_REPOSITORY"/git/ref/tags/"$BUILDER_TAG" | jq -r '.object.sha')
82+
PROVENANCE_COMMIT=$(cat "$BUILDER_RELEASE_BINARY.intoto.jsonl" | jq -r '.payload' | base64 -d | jq -r '.predicate.materials[0].digest.sha1')
83+
if [[ "$BUILDER_COMMIT" != "$PROVENANCE_COMMIT" ]]; then
84+
echo "Builder commit sha $BUILDER_COMMIT != provenance material $PROVENANCE_COMMIT"
85+
exit 5
86+
fi
87+
88+
#TODO: verify the command
89+
echo "Builder provenance verified at tag $BUILDER_TAG and commit $BUILDER_COMMIT"

0 commit comments

Comments
 (0)