Add GitHub attestation to official Fleet and fleetd release binaries and images

[noahtalerman]

Goal

User story
As a Security Engineer using Fleet,
I want to prove that the binaries and images I am using to deploy Fleet have not been tampered with
so that I am confident the build artifacts I use are the same artifacts created by the associated GitHub workflow.

Key results

• Deliver customer promises and prioritized requests

Original requests

• Equip users who would like to verify fleetd releases #20219

Context

• Product designer: @lukeheath

Changes

Codename

Chain of Integrity and Provenance for Software (CHiPS)

Product

• UI changes: No changes
• CLI (fleetctl) usage changes: No changes
• YAML changes: No changes
• REST API changes: No changes
• Fleet's agent (fleetd) changes: No changes
• Activity changes: No changes
• Permissions changes: No changes
• Changes to paid features or tiers: No changes
• Other reference documentation changes: No changes.
• Once shipped, requester has been notified
• Once shipped, dogfooding issue has been filed

Engineering

• Feature guide changes: Write guide explaining what SLSA attestation is and how we have it implemented.
• Database schema migrations: None
• Load testing: None
• Update GitHub workflows to add a GitHub attestation step.
  • GoReleaser Orbit (fleetd binaries)
  • GoReleaser Fleet (Fleet binaries)
  • GoReleaser Docker Publish (Fleet server image)

ℹ️  Please read this issue carefully and understand it. Pay special attention to UI wireframes, especially "dev notes".

QA

Risk assessment

• Requires load testing: No
• Risk level: Low

Manual testing steps

1. Use the gh attestation command to validate that every binary and image generated in the specified workflows successfully provides attestation.

Testing notes

Confirmation

1. Engineer (@____): Added comment to user story confirming successful completion of QA.
2. QA (@____): Added comment to user story confirming successful completion of QA.

[noahtalerman]

Hey @lukeheath I think we need your help w/ this user story. Do you think you can own Product Designer responsibilities for it?

That includes writing the user story, updating the "Product" section, and being the first point of contact for product questions during the engineering sprint.

Assuming yes, I assigned you. Please feel free to pass it back to me if you don't have the capacity.

[lukeheath]

@noahtalerman No problem.

[noahtalerman]

Hey @lukeheath just a reminder to write up the user story for this and get it ready for estimation next week. We want to bring this customer promise into the next engineering sprint (last in Q4).

Please let me know how I can be helpful moving this one along!

[noahtalerman]

@lukeheath just giving you another ping! Please let me know how I can be helpful getting this story ready for estimation tomorrow.

[lukeheath]

@noahtalerman Thanks! Getting on this now.

[lukeheath]

@noahtalerman I've finished designing this story. Would you please take a look and make sure it looks correct?

From watching the initial request conversation, it seems to me that the customer is asking that all official Fleet and fleetd release binaries and images have attestation. It's straight-forward to add attestation to the GitHub workflows, so I've expanded the scope of this issue to include three different workflows (our three GoReleaser workflows) that produce the Fleet server binaries, fleetctl binaries, and fleetd binaries. Please let mek now if you think that's incorrect.

I'm also removing the #g-endpoint-ops label because I think this is something that would be great for @sgress454 to take on next sprint. I will estimate with him this week and we'll plan to deliver this at the end of next sprint. I'll track this on the #help-engineering board.

[noahtalerman]

@lukeheath looks good to me!

I'm also removing the #g-endpoint-ops label because I think this is something that would be great for @sgress454 to take on next sprint. I will estimate with him this week and we'll plan to deliver this at the end of next sprint. I'll track this on the #help-engineering board.

Sounds great 👍

[lukeheath]

@sgress454 Do we need to make any revisions to the implementation after trying to use it during the fleetd release?

[sgress454]

@sgress454 Do we need to make any revisions to the implementation after trying to use it during the fleetd release?

Mostly ensuring proper permissions. I'm readying a follow-up PR to do that, add better error-safety, and add attestation to the desktop and osquery binaries as Lucas suggested.

[lukeheath]

@noahtalerman @zayhanlon The first phase of attestation is complete: https://github.com/fleetdm/fleet/attestations/4319743

Beginning with 4.62.0, we are adding SLSA attestation to all archives and binaries attached to our releases.

Beginning with 4.63.0, we will be extending SLSA attestation to our container images. I will leave this issue open until then, but wanted to give a status update.