[feature][byob] verification for sha1 provided by TRW for v0.2

[laurentsimon]

verification counterpart for slsa-framework/slsa-github-generator#2079

To think about: if the sha1 != GitHub event, options like --source-branch, --source-tag or another source option should fail because we can no longer trust the event?

For generators, I think it's fine to trust keep the code as-is because the options refer to the trigger workflow. For builders, I think we need to fail.

[ianlewis]

For generators, I think it's fine to trust keep the code as-is because the options refer to the trigger workflow. For builders, I think we need to fail.

Doesn't that break our main use case which was for things like jReleaser which would be a builder rather than a generator?

[laurentsimon]

sorry. I meant we need to fail if options like --source-branch, --source-tag are passed, since we cannot relate the tag / branch to the sha1 we built from. If none of these options are passed, we allow it, including for builders

[laurentsimon]

blocked on #604

[ianlewis]

verification counterpart for slsa-framework/slsa-github-generator#2079

To think about: if the sha1 != GitHub event, options like --source-branch, --source-tag or another source option should fail because we can no longer trust the event?

If we are allowing users to specify a different sha1 then probably we shouldn't look at the GitHub event's ref and instead use the ref that's set on the materials[].uri?

[laurentsimon]

If we are allowing users to specify a different sha1 then probably we shouldn't look at the GitHub event's ref and instead use the ref that's set on the materials[].uri?

Correct. For BYOB, we should allow that. Today we verify both, we'll have to relax the verification on the GitHub event's ref.

[ianlewis]

Correct. For BYOB, we should allow that. Today we verify both, we'll have to relax the verification on the GitHub event's ref.

I found that while we do verify that both had the same repository, we didn't really verify that the sha or tag/branch ref were the same between the source and trigger. Though I believe that the builders have always specified the same values, we just never verified it.

[ianlewis]

Blocked on slsa-framework/github-actions-buildtypes#4