Skip to content

Commit

Permalink
Merge branch 'main' into link-attestor
Browse files Browse the repository at this point in the history
Signed-off-by: John Kjell <john@testifysec.com>
  • Loading branch information
jkjell authored Apr 6, 2024
2 parents 51d0fa6 + 74f6c3d commit 9f16a4d
Show file tree
Hide file tree
Showing 15 changed files with 175 additions and 30 deletions.
13 changes: 8 additions & 5 deletions .github/dependabot.yml
Original file line number Diff line number Diff line change
Expand Up @@ -7,18 +7,21 @@ updates:
interval: "weekly"
commit-message:
prefix: "chore"
groups:
all-gha:
patterns:
- "*"

- package-ecosystem: "gomod"
directory: "/"
schedule:
interval: "weekly"
commit-message:
prefix: "chore"
ignore:
- dependency-name: "*"
update-types:
- "version-update:semver-major"
- "version-update:semver-minor"
groups:
all-go-mod:
patterns:
- "*"

- package-ecosystem: docker
directory: /
Expand Down
10 changes: 7 additions & 3 deletions .github/workflows/codeql.yml
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,10 @@ on:
pull_request:
# The branches below must be a subset of the branches above
branches: ["main"]
paths:
- "**.go"
- "go.mod"
- ".github/workflows/codeql.yml"
schedule:
- cron: "0 0 * * 1"

Expand Down Expand Up @@ -54,7 +58,7 @@ jobs:
go-version: 1.21.x
# Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL
uses: github/codeql-action/init@05963f47d870e2cb19a537396c1f668a348c7d8f # v3.24.8
uses: github/codeql-action/init@1b1aada464948af03b950897e5eb522f92603cc2 # v3.24.9
with:
languages: ${{ matrix.language }}
# If you wish to specify custom queries, you can do so here or in a config file.
Expand All @@ -64,7 +68,7 @@ jobs:
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
# If this step fails, then you should remove it and run the build manually (see below)
- name: Autobuild
uses: github/codeql-action/autobuild@05963f47d870e2cb19a537396c1f668a348c7d8f # v3.24.8
uses: github/codeql-action/autobuild@1b1aada464948af03b950897e5eb522f92603cc2 # v3.24.9

# ℹ️ Command-line programs to run using the OS shell.
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
Expand All @@ -77,6 +81,6 @@ jobs:
# ./location_of_script_within_repo/buildscript.sh

- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@05963f47d870e2cb19a537396c1f668a348c7d8f # v3.24.8
uses: github/codeql-action/analyze@1b1aada464948af03b950897e5eb522f92603cc2 # v3.24.9
with:
category: "/language:${{matrix.language}}"
2 changes: 1 addition & 1 deletion .github/workflows/dependency-review.yml
Original file line number Diff line number Diff line change
Expand Up @@ -24,4 +24,4 @@ jobs:
- name: 'Checkout Repository'
uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
- name: 'Dependency Review'
uses: actions/dependency-review-action@9129d7d40b8c12c1ed0f60400d00c92d437adcce # v4.1.3
uses: actions/dependency-review-action@5bbc3ba658137598168acb2ab73b21c432dd411b # v4.2.5
7 changes: 6 additions & 1 deletion .github/workflows/golangci-lint.yml
Original file line number Diff line number Diff line change
Expand Up @@ -4,9 +4,14 @@ on:
tags:
- v*
branches:
- master
- main
pull_request:
branches:
- main
paths:
- "**.go"
- "go.mod"
- ".github/workflows/golangci-lint.yml"
permissions:
contents: read
pull-requests: read
Expand Down
16 changes: 14 additions & 2 deletions .github/workflows/release.yml
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,19 @@
# limitations under the License.

name: release
on: [push, pull_request]
on:
push:
tags:
- v*
branches:
- main
pull_request:
branches:
- main
paths-ignore:
- "**.md"
- "docs/**"
- "docs-site/**"

permissions:
contents: read # This is required for actions/checkout
Expand Down Expand Up @@ -90,7 +102,7 @@ jobs:
uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
with:
go-version: 1.21.x
- uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319 # v4.0.1
- uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
with:
path: |
~/go/pkg/mod
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/scorecard.yml
Original file line number Diff line number Diff line change
Expand Up @@ -75,6 +75,6 @@ jobs:

# Upload the results to GitHub's code scanning dashboard.
- name: "Upload to code-scanning"
uses: github/codeql-action/upload-sarif@05963f47d870e2cb19a537396c1f668a348c7d8f # tag=v3.24.8
uses: github/codeql-action/upload-sarif@1b1aada464948af03b950897e5eb522f92603cc2 # tag=v3.24.9
with:
sarif_file: results.sarif
2 changes: 1 addition & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@

**[DOCS](https://witness.dev)
[CONTRIBUTING](/CONTRIBUTING.md)
[LICENSE](https://github.com/in-toto/witness/blob/main/LICENSE)
[LICENSE](https://github.com/in-toto/witness/blob/main/LICENSE)**

`bash <(curl -s https://raw.githubusercontent.com/in-toto/witness/main/install-witness.sh)`
</center>
Expand Down
75 changes: 75 additions & 0 deletions cmd/attestors.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,75 @@
// Copyright 2021 The Witness Contributors
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package cmd

import (
"context"
"fmt"
"os"

"github.com/in-toto/go-witness/attestation"
"github.com/in-toto/witness/options"
"github.com/olekukonko/tablewriter"
"github.com/spf13/cobra"
)

func AttestorsCmd() *cobra.Command {
cmd := &cobra.Command{
Use: "attestors",
Short: "List all available attestors",
Long: "Lists all the available attestors in Witness with supporting information",
SilenceErrors: true,
SilenceUsage: true,
DisableAutoGenTag: true,
RunE: func(cmd *cobra.Command, args []string) error {
return runAttestors(cmd.Context())
},
}

return cmd
}

func runAttestors(ctx context.Context) error {
items := [][]string{}
entries := attestation.RegistrationEntries()
for _, entry := range entries {
name := entry.Factory().Name()

for _, a := range alwaysRunAttestors {
if name == a.Name() || name == "command-run" {
name = name + " (always run)"
}
}

for _, a := range options.DefaultAttestors {
if name == a {
name = name + " (default)"
}
}

runType := entry.Factory().RunType()
item := []string{name, entry.Factory().Type(), fmt.Sprintf("%v", runType)}
items = append(items, item)
}

table := tablewriter.NewWriter(os.Stdout)
table.SetHeader([]string{"Name", "Type", "RunType"})
table.SetAutoMergeCells(false)
table.SetRowLine(false)
table.AppendBulk(items)
table.Render()

return nil
}
1 change: 1 addition & 0 deletions cmd/root.go
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,7 @@ func New() *cobra.Command {
cmd.AddCommand(RunCmd())
cmd.AddCommand(CompletionCmd())
cmd.AddCommand(versionCmd())
cmd.AddCommand(AttestorsCmd())
cobra.OnInitialize(func() { preRoot(cmd, ro, logger) })
return cmd
}
Expand Down
11 changes: 9 additions & 2 deletions cmd/run.go
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,8 @@ import (
"github.com/spf13/cobra"
)

var alwaysRunAttestors = []attestation.Attestor{product.New(), material.New()}

func RunCmd() *cobra.Command {
o := options.RunOptions{
AttestorOptSetters: make(map[string][]func(attestation.Attestor) (attestation.Attestor, error)),
Expand Down Expand Up @@ -74,17 +76,22 @@ func runRun(ctx context.Context, ro options.RunOptions, args []string, signers .
timestampers = append(timestampers, timestamp.NewTimestamper(timestamp.TimestampWithUrl(url)))
}

attestors := []attestation.Attestor{product.New(), material.New()}
attestors := alwaysRunAttestors
if len(args) > 0 {
attestors = append(attestors, commandrun.New(commandrun.WithCommand(args), commandrun.WithTracing(ro.Tracing)))
}

for _, a := range ro.Attestations {
if a == "command-run" {
log.Warnf("'command-run' is a builtin attestor and cannot be called with --attestations flag")
continue
}

duplicate := false
for _, att := range attestors {
if a != att.Name() {
} else {
log.Warnf("Attestator %s already declared, skipping", a)
log.Warnf("Attestor %s already declared, skipping", a)
duplicate = true
break
}
Expand Down
22 changes: 11 additions & 11 deletions docs-website/yarn.lock
Original file line number Diff line number Diff line change
Expand Up @@ -3213,10 +3213,10 @@ cookie-signature@1.0.6:
resolved "https://registry.yarnpkg.com/cookie-signature/-/cookie-signature-1.0.6.tgz#e303a882b342cc3ee8ca513a79999734dab3ae2c"
integrity sha512-QADzlaHc8icV8I7vbaJXJwod9HWYp8uCqf1xa4OfNu1T7JVxQIrUgOWtHdNDtPiywmFbiS12VjotIXLrKM3orQ==

cookie@0.5.0:
version "0.5.0"
resolved "https://registry.yarnpkg.com/cookie/-/cookie-0.5.0.tgz#d1f5d71adec6558c58f389987c366aa47e994f8b"
integrity sha512-YZ3GUyn/o8gfKJlnlX7g7xq4gyO6OSuhGPKaaGssGB2qgDUS0gPgtTvoyZLTt9Ab6dC4hfc9dV5arkvc/OCmrw==
cookie@0.6.0:
version "0.6.0"
resolved "https://registry.yarnpkg.com/cookie/-/cookie-0.6.0.tgz#2798b04b071b0ecbff0dbb62a505a8efa4e19051"
integrity sha512-U71cyTamuh1CRNCfpGY6to28lxvNwPG4Guz/EVjgf3Jmzv0vlDp1atT9eS5dDjMYHucpHbWns6Lwf3BKz6svdw==

copy-text-to-clipboard@^3.2.0:
version "3.2.0"
Expand Down Expand Up @@ -3950,16 +3950,16 @@ execa@^5.0.0:
strip-final-newline "^2.0.0"

express@^4.17.3:
version "4.18.3"
resolved "https://registry.yarnpkg.com/express/-/express-4.18.3.tgz#6870746f3ff904dee1819b82e4b51509afffb0d4"
integrity sha512-6VyCijWQ+9O7WuVMTRBTl+cjNNIzD5cY5mQ1WM8r/LEkI2u8EYpOotESNwzNlyCn3g+dmjKYI6BmNneSr/FSRw==
version "4.19.2"
resolved "https://registry.yarnpkg.com/express/-/express-4.19.2.tgz#e25437827a3aa7f2a827bc8171bbbb664a356465"
integrity sha512-5T6nhjsT+EOMzuck8JjBHARTHfMht0POzlA60WV2pMD3gyXw2LZnZ+ueGdNxG+0calOJcWKbpFcuzLZ91YWq9Q==
dependencies:
accepts "~1.3.8"
array-flatten "1.1.1"
body-parser "1.20.2"
content-disposition "0.5.4"
content-type "~1.0.4"
cookie "0.5.0"
cookie "0.6.0"
cookie-signature "1.0.6"
debug "2.6.9"
depd "2.0.0"
Expand Down Expand Up @@ -8304,9 +8304,9 @@ webpack-bundle-analyzer@^4.9.0:
ws "^7.3.1"

webpack-dev-middleware@^5.3.1:
version "5.3.3"
resolved "https://registry.yarnpkg.com/webpack-dev-middleware/-/webpack-dev-middleware-5.3.3.tgz#efae67c2793908e7311f1d9b06f2a08dcc97e51f"
integrity sha512-hj5CYrY0bZLB+eTO+x/j67Pkrquiy7kWepMHmUMoPsmcUaeEnQJqFzHJOyxgWlq746/wUuA64p9ta34Kyb01pA==
version "5.3.4"
resolved "https://registry.yarnpkg.com/webpack-dev-middleware/-/webpack-dev-middleware-5.3.4.tgz#eb7b39281cbce10e104eb2b8bf2b63fce49a3517"
integrity sha512-BVdTqhhs+0IfoeAf7EoH5WE+exCmqGerHfDM0IL096Px60Tq2Mn9MAbnaGUe6HiMa41KMCYF19gyzZmBcq/o4Q==
dependencies:
colorette "^2.0.10"
memfs "^3.4.3"
Expand Down
29 changes: 29 additions & 0 deletions docs/commands.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,35 @@

This is the reference for the Witness command line tool, generated by [Cobra](https://cobra.dev/).

## witness attestors

List all available attestors

### Synopsis

Lists all the available attestors in Witness with supporting information

```
witness attestors [flags]
```

### Options

```
-h, --help help for attestors
```

### Options inherited from parent commands

```
-c, --config string Path to the witness config file (default ".witness.yaml")
-l, --log-level string Level of logging to output (debug, info, warn, error) (default "info")
```

### SEE ALSO

* [witness](witness.md) - Collect and verify attestations about your build environments

## witness run

Runs the provided command and records attestations about the execution
Expand Down
6 changes: 5 additions & 1 deletion go.mod
Original file line number Diff line number Diff line change
Expand Up @@ -2,13 +2,16 @@ module github.com/in-toto/witness

go 1.21

toolchain go1.21.4

require (
github.com/in-toto/go-witness v0.3.1
github.com/olekukonko/tablewriter v0.0.5
github.com/sirupsen/logrus v1.9.3
github.com/spf13/cobra v1.8.0
github.com/spf13/pflag v1.0.5
github.com/spf13/viper v1.18.2
github.com/stretchr/testify v1.8.4
github.com/stretchr/testify v1.9.0
k8s.io/apimachinery v0.29.3
)

Expand Down Expand Up @@ -92,6 +95,7 @@ require (
github.com/letsencrypt/boulder v0.0.0-20240226214708-a97e074b5a3e // indirect
github.com/magiconair/properties v1.8.7 // indirect
github.com/mattn/go-isatty v0.0.20 // indirect
github.com/mattn/go-runewidth v0.0.9 // indirect
github.com/mitchellh/go-homedir v1.1.0 // indirect
github.com/mitchellh/mapstructure v1.5.0 // indirect
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
Expand Down
5 changes: 4 additions & 1 deletion go.sum
Original file line number Diff line number Diff line change
Expand Up @@ -284,6 +284,8 @@ github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
github.com/olekukonko/tablewriter v0.0.5 h1:P2Ga83D34wi1o9J6Wh1mRuqd4mF/x/lgBS7N7AbDhec=
github.com/olekukonko/tablewriter v0.0.5/go.mod h1:hPp6KlRPjbx+hW8ykQs1w3UBbZlj6HuIJcUGPhkA7kY=
github.com/onsi/gomega v1.29.0 h1:KIA/t2t5UBzoirT4H9tsML45GEbo3ouUnBHsCfD2tVg=
github.com/onsi/gomega v1.29.0/go.mod h1:9sxs+SwGrKI0+PWe4Fxa9tFQQBG5xSsSbMXOI8PPpoQ=
github.com/open-policy-agent/opa v0.61.0 h1:nhncQ2CAYtQTV/SMBhDDPsCpCQsUW+zO/1j+T5V7oZg=
Expand Down Expand Up @@ -361,8 +363,9 @@ github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
github.com/tchap/go-patricia/v2 v2.3.1 h1:6rQp39lgIYZ+MHmdEq4xzuk1t7OdC35z/xm0BGhTkes=
Expand Down
4 changes: 3 additions & 1 deletion options/run.go
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,8 @@ import (
"github.com/spf13/cobra"
)

var DefaultAttestors = []string{"environment", "git"}

type RunOptions struct {
SignerOptions SignerOptions
KMSSignerProviderOptions KMSSignerProviderOptions
Expand All @@ -38,7 +40,7 @@ func (ro *RunOptions) AddFlags(cmd *cobra.Command) {
ro.SignerOptions.AddFlags(cmd)
ro.ArchivistaOptions.AddFlags(cmd)
cmd.Flags().StringVarP(&ro.WorkingDir, "workingdir", "d", "", "Directory from which commands will run")
cmd.Flags().StringSliceVarP(&ro.Attestations, "attestations", "a", []string{"environment", "git"}, "Attestations to record ('product' and 'material' are always recorded)")
cmd.Flags().StringSliceVarP(&ro.Attestations, "attestations", "a", DefaultAttestors, "Attestations to record ('product' and 'material' are always recorded)")
cmd.Flags().StringSliceVar(&ro.Hashes, "hashes", []string{"sha256"}, "Hashes selected for digest calculation. Defaults to SHA256")
cmd.Flags().StringVarP(&ro.OutFilePath, "outfile", "o", "", "File to which to write signed data. Defaults to stdout")
cmd.Flags().StringVarP(&ro.StepName, "step", "s", "", "Name of the step being run")
Expand Down

0 comments on commit 9f16a4d

Please sign in to comment.