Add functionality to output the UUID for log lookup purposes

[daoauth]

Summary

Add functionality to output the UUID for log lookup purposes. The provenance-rekor-uuid parameter represents the Rekor UUID, a unique identifier that can be used to search for and view specific log entry details on the Rekor Search UI.

Testing Process

Forked the branch and conducted unit tests to verify the output of the UUID.

Checklist

• Review the contributing guidelines
• Add a reference to related issues in the PR description.
• Update documentation if applicable.
• Add unit tests if applicable.
• Add changes to the CHANGELOG if applicable.

[laurentsimon]

Thanks for the PR

[ramonpetgrave64]

Thanks for implementing. Please use the PR template in this PR's description.

[daoauth]

Thanks for implementing. Please use the PR template in this PR's description.

Thank you for the feedback. I have made the requested changes

[ramonpetgrave64]

Thanks for finding a way to test, can you show us an example run in your fork?

[daoauth]

Thanks for finding a way to test, can you show us an example run in your fork?

I renamed slsa-framework/slsa-github-generator/ to zktx-io/slsa-github-generator/ and created a release. Additionally, I downloaded slsa-generator-generic-linux-amd64, added it to the release, and modified the code to execute it as follows.

      - name: Create and sign provenance
        id: sign-prov
        continue-on-error: true
        # NOTE: Inputs and `github` context are set to environment variables in
        # order to avoid script injection.
        # See: https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#understanding-the-risk-of-script-injections
        env:
          GITHUB_CONTEXT: "${{ toJSON(github) }}"
          VARS_CONTEXT: "${{ toJSON(vars) }}"
          UNTRUSTED_PROVENANCE_NAME: "${{ inputs.provenance-name }}"
        run: |
          set -euo pipefail

          # I downloaded the files uploaded to the release and changed their attributes using chmod +x to make them executable.
          chmod +x "$GITHUB_WORKSPACE/$BUILDER_BINARY"
          untrusted_prov_name=""
          if [ "$UNTRUSTED_PROVENANCE_NAME" != "" ]; then
            untrusted_prov_name="$UNTRUSTED_PROVENANCE_NAME"
          fi
          # Create and sign provenance.
          # NOTE: The builder verifies that the provenance path is located
          # in the current directory.
          # NOTE: $untrusted_provenance_path may be empty. In this case the
          # attest command chooses a file name based on the subject name and
          # number of subjects based on in-toto attestation bundle file naming conventions.
          # See: https://github.com/in-toto/attestation/blob/main/spec/bundle.md#file-naming-convention
          # NOTE: The attest commmand outputs the provenance-name and provenance-sha256
          output=$("$GITHUB_WORKSPACE/$BUILDER_BINARY" attest --subjects-filename "${SUBJECTS_FILENAME}" -g "$untrusted_prov_name")
          echo "$output"
          uuid=$(echo "$output" | grep -oP 'UUID \K[0-9a-f]{80}')

          # I verified the output by printing the UUID.
          echo "$uuid"
          echo "uuid=$uuid" >> $GITHUB_OUTPUT

[ramonpetgrave64]

Sorry for not clarifying. If you ran the workflow on your own fork, can you provide us with a link so we can inspect the logs?

[daoauth]

Sorry for not clarifying. If you ran the workflow on your own fork, can you provide us with a link so we can inspect the logs?

1. This is the test repository where I forked slsa-github-generator: https://github.com/zktx-io/slsa-github-generator-test
2. This is the test repository for outputting logs: https://github.com/zktx-io/slsa-github-generator-test2/actions/runs/10091019235/job/27901935588

[ramonpetgrave64]

nonblocker: it seems the rekor UUID is meant to be 64 hex digits, not 80.

• https://github.com/sigstore/rekor/blob/5e502df5603712e553ab4a077793bdece66d4dbc/pkg/api/error.go#L42

[daoauth]

The length of the UUID generated in "create and sign provenance" is 80.

https://search.sigstore.dev/?uuid=24296fb24b8ad77a037b175b6a98db3d318ae8d94428f5be89eb07c8a6b70b58b54bdd32c7b15fb6

https://docs.sigstore.dev/logging/sharding/#identifier-definitions-entryid-uuid-logid-log-index

So, I think the UUID used as a search parameter in sigstore is actually an entry ID.

[haydentherapper]

The additional prefix digits are for distinguishing which log "shard" hosts the content.

[ramonpetgrave64]

@haydentherapper, @loosebazooka please take a look

[ramonpetgrave64]

Looks alright, just add the details to the list of unreleased changes.

• https://github.com/slsa-framework/slsa-github-generator/blob/main/CHANGELOG.md#unreleased-vars-context-recorded-in-provenance

[ramonpetgrave64]

Lint errors: please run make actionlint and make lint