Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Sign SBOM images #37

Merged
merged 4 commits into from
Mar 26, 2024
Merged

Sign SBOM images #37

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
0064e56
Sign sbom image
norbjd Mar 26, 2024
28cf929
Fix for PR
norbjd Mar 26, 2024
cd5aaa0
Fix crane command
norbjd Mar 26, 2024
521765e
Last changes before merging to main
norbjd Mar 26, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 17 additions & 0 deletions .github/workflows/release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,14 +20,21 @@ jobs:
outputs:
informer_image: ${{ steps.release.outputs.informer_image }}
informer_digest: ${{ steps.release.outputs.informer_digest }}
informer_sbom_image: ${{ steps.release.outputs.informer_sbom_image }}
informer_sbom_digest: ${{ steps.release.outputs.informer_sbom_digest }}

webhook_image: ${{ steps.release.outputs.webhook_image }}
webhook_digest: ${{ steps.release.outputs.webhook_digest }}
webhook_sbom_image: ${{ steps.release.outputs.webhook_sbom_image }}
webhook_sbom_digest: ${{ steps.release.outputs.webhook_sbom_digest }}

steps:
- uses: actions/setup-go@v4
with:
go-version: 1.21.x
- uses: ko-build/setup-ko@v0.6
- name: Install crane
run: go install github.com/google/go-containerregistry/cmd/crane@v0.19.1
- uses: actions/checkout@v4

- id: release
Expand All @@ -47,6 +54,14 @@ jobs:
digest=$(cat .digest| cut -d'@' -f2)
echo "${{ matrix.component }}_image=$image" >> "$GITHUB_OUTPUT"
echo "${{ matrix.component }}_digest=$digest" >> "$GITHUB_OUTPUT"

# this is probably not the best way to sign the SBOM:
# - requires crane to get the SBOM image pushed above
# - is vulnerable to TOCTOU attacks if someone updates the sbom between "ko build" and "crane digest"
# but, it's good enough for now, until I have a better solution
sbom_digest=$(crane digest $image:sha256-$(echo $digest | cut -d':' -f2).sbom)
echo "${{ matrix.component }}_sbom_image=$image" >> "$GITHUB_OUTPUT"
echo "${{ matrix.component }}_sbom_digest=$sbom_digest" >> "$GITHUB_OUTPUT"

# see https://github.com/slsa-framework/slsa-github-generator/blob/v1.10.0/internal/builders/container/README.md#ko
provenance:
Expand All @@ -56,7 +71,9 @@ jobs:
matrix:
component:
- informer
- informer_sbom
- webhook
- webhook_sbom
permissions:
actions: read
id-token: write
Expand Down
Loading