Skip to content

Commit f89a0f4

Browse files
AdamKorczlaurentsimon
AdamKorcz
and
laurentsimon
authored
feat: update Gradle builder to accomodate for e2e test (#2636)
1. Add two public download actions 2. Add option for specifying a path to the Gradle project I found these changes to be necessary to run [the Gradle e2e test](slsa-framework/example-package#270). --------- Signed-off-by: AdamKorcz <[email protected]> Signed-off-by: AdamKorcz <[email protected]> Co-authored-by: laurentsimon <[email protected]>
1 parent 324ff12 commit f89a0f4

File tree

6 files changed

+125
-11
lines changed

6 files changed

+125
-11
lines changed

‎.github/workflows/builder_gradle_slsa3.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,11 @@ on:
3131
required: false
3232
default: 17
3333
type: number
34+
directory:
35+
description: "Sub-directory to launch the build from. Must be under the workspace. Relative from the root of the file directory when invoking the builder."
36+
required: false
37+
type: string
38+
default: "."
3439
outputs:
3540
provenance-name:
3641
description: "The file name of the attestation upload artifact."

‎actions/gradle/secure-download-attestations/action.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
# Copyright 2023 SLSA Authors
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
name: "Secure attestion download for maven builder"
16+
description: "Download the attestations-directory produced by the Maven builder and verify its SHA256"
17+
inputs:
18+
name:
19+
description: "Name of provenance directory. This is generated by the Maven builder."
20+
required: true
21+
path:
22+
description: "The path to download the attestations directory into. (Must be under the GITHUB_WORKSPACE)"
23+
required: true
24+
sha256:
25+
description: "SHA256 of the file for verification. This is generated by the Maven builder"
26+
required: true
27+
28+
runs:
29+
using: "composite"
30+
steps:
31+
- name: Download the attestation directory
32+
uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-folder@main
33+
with:
34+
name: ${{ inputs.name }}
35+
path: ${{ inputs.path }}
36+
sha256: ${{ inputs.sha256 }}

‎actions/gradle/secure-download-target/action.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
# Copyright 2023 SLSA Authors
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
name: "Secure target directory download for maven builder"
16+
description: "Download the 'target'-directory and verify its SHA256"
17+
inputs:
18+
name:
19+
description: "Name of the target directory. The Maven builder makes this 'target'."
20+
required: true
21+
path:
22+
description: "The path to download the target directory into. (Must be under the GITHUB_WORKSPACE)"
23+
required: true
24+
sha256:
25+
description: "SHA256 of the file for verification."
26+
required: true
27+
28+
runs:
29+
using: "composite"
30+
steps:
31+
- name: Download the target directory
32+
uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-folder@main
33+
with:
34+
name: ${{ inputs.name }}
35+
path: ${{ inputs.path }}
36+
sha256: ${{ inputs.sha256 }}

‎internal/builders/gradle/action.yml‎

Lines changed: 44 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -60,24 +60,59 @@ runs:
6060
java-version: ${{ fromJson(inputs.slsa-workflow-inputs).jdk-version }}
6161
- name: Setup Gradle
6262
uses: gradle/gradle-build-action@a4cf152f482c7ca97ef56ead29bf08bcd953284c # v2.7.0
63-
with:
64-
arguments: build -x test
63+
- name: Run gradle builder
64+
shell: bash
65+
env:
66+
UNTRUSTED_PROJECT_ROOT: ${{ fromJson(inputs.slsa-workflow-inputs).directory }}
67+
run: |
68+
# Ensure no directory traversal.
69+
# NOTE: the actions/download-artifact Action only creates files
70+
# in the workspace directory, but this may change in the future.
71+
# TODO(#1893): Consolidate directory traversal checks
72+
validate_path() {
73+
untrusted_path=$1
74+
resolved_dir=$(readlink -m "$untrusted_path")
75+
wd=$(readlink -m "${GITHUB_WORKSPACE}")
76+
if [[ "${resolved_dir}" != "${wd}"/* ]] && [[ "${resolved_dir}" != "${wd}" ]]; then
77+
if [[ "${RUNNER_TEMP}" != "" ]] && [[ "${resolved_dir}" != "${RUNNER_TEMP}"/* ]] && [[ "${resolved_dir}" != "${RUNNER_TEMP}" ]]; then
78+
if [[ "${resolved_dir}" != /tmp/* ]] && [[ "${resolved_dir}" != "/tmp" ]]; then
79+
echo "Path is not in the workspace or temp directory: $untrusted_path"
80+
exit 1
81+
fi
82+
fi
83+
fi
84+
}
85+
validate_path "${UNTRUSTED_PROJECT_ROOT}"
86+
# remove trailing "/"'s with `realpath`
87+
project_root=$(realpath "${UNTRUSTED_PROJECT_ROOT}")
88+
89+
cd "${project_root}" \
90+
&& ./gradlew build -x test
91+
6592
- name: Put release artifacts in one directory
6693
shell: bash
6794
env:
6895
SLSA_OUTPUTS_ARTIFACTS_FILE: ${{ inputs.slsa-layout-file }}
69-
ARTIFACT_LIST: ${{ fromJson(inputs.slsa-workflow-inputs).artifact-list }}
70-
run: ./../__TOOL_ACTION_DIR__/collect_release_artifacts.sh
71-
- name: Upload built artifacts from gradlew build
72-
uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
73-
with:
74-
path: ./release-files-for-slsa/*
96+
UNTRUSTED_ARTIFACT_LIST: ${{ fromJson(inputs.slsa-workflow-inputs).artifact-list }}
97+
PROJECT_ROOT: ${{ fromJson(inputs.slsa-workflow-inputs).directory }}
98+
run: |
99+
cd "${PROJECT_ROOT}" && "${GITHUB_WORKSPACE}"/../__TOOL_ACTION_DIR__/collect_release_artifacts.sh
75100
- name: Make outputs
76101
id: make-outputs
77102
shell: bash
78103
env:
79104
SLSA_OUTPUTS_ARTIFACTS_FILE: ${{ inputs.slsa-layout-file }}
80-
run: ./../__TOOL_ACTION_DIR__/create_attestation.sh
105+
PROJECT_ROOT: ${{ fromJson(inputs.slsa-workflow-inputs).directory }}
106+
run: |
107+
cd "${PROJECT_ROOT}" && "${GITHUB_WORKSPACE}"/../__TOOL_ACTION_DIR__/create_attestation.sh
108+
- name: Move build dir to avoid making it a sub-dir when uploading
109+
shell: bash
110+
env:
111+
# PROJECT_ROOT is generally untrusted, but the builder has validated
112+
# it in the 'Run gradle builder' step and is therefore trusted now.
113+
PROJECT_ROOT: ${{ fromJson(inputs.slsa-workflow-inputs).directory }}
114+
run: |
115+
mv "${PROJECT_ROOT}"/build "${GITHUB_WORKSPACE}"/
81116
- name: Upload build dir
82117
id: upload-build-dir
83118
uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-folder@main

‎internal/builders/gradle/collect_release_artifacts.sh‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ mkdir release-files-for-slsa
2020
GRADLE_VERSION=$(./gradlew properties -q | grep "version:" | awk '{print $2}')
2121

2222
# Move artifacts from the user-supplied artifact list
23-
IFS=',' read -ra artifact_array <<< "$ARTIFACT_LIST"
23+
IFS=',' read -ra artifact_array <<< "$UNTRUSTED_ARTIFACT_LIST"
2424
for i in "${artifact_array[@]}"
2525
do
2626
i="${i#"${i%%[![:space:]]*}"}" # trim leading whitespace
@@ -38,5 +38,5 @@ do
3838

3939
# Move the file
4040
bn=$(basename -- "$path_with_version")
41-
mv "$path_with_version" release-files-for-slsa/"$bn"
41+
cp "$path_with_version" release-files-for-slsa/"$bn"
4242
done

‎internal/builders/gradle/create_attestation.sh‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@
1616

1717
set -euo pipefail
1818

19+
SLSA_OUTPUTS_ARTIFACTS_FILE="${GITHUB_WORKSPACE}/${SLSA_OUTPUTS_ARTIFACTS_FILE}"
20+
1921
# "version" and "attestations" fields:
2022
echo -e -n "{\n \"version\": 1,\n \"attestations\": [" >> "$SLSA_OUTPUTS_ARTIFACTS_FILE"
2123

0 commit comments

Comments
 (0)