Generate SLSA Provenance on Release using SLSA Go Releaser (#98)

* chore: configure slsa-provenance generation Signed-off-by: Joyce Brum <[email protected]> * chore: add SLSA Provenance to cross build Signed-off-by: Joyce Brum <[email protected]> * fix: .goreleaser.yml to ignore linux build Signed-off-by: Joyce Brum <[email protected]> * fix: trying to configure slsa-goreleaser at least to linux Signed-off-by: Joyce Brum <[email protected]> * feat: enable run on push Signed-off-by: Joyce Brum <[email protected]> * fix: use slsa git provenance generator 1.2.1 Signed-off-by: Joyce Brum <[email protected]> * fix: generate ldflags dynamically Signed-off-by: Joyce Brum <[email protected]> * feat: create darwin and windows slsa files Signed-off-by: Joyce Brum <[email protected]> * fix: windows build name on yml file Signed-off-by: Joyce Brum <[email protected]> * fix: restore run release on tag push only Signed-off-by: Joyce Brum <[email protected]> * fix: error on push releaser yml file Signed-off-by: Joyce Brum <[email protected]> * chore: update README file to mention the Provenance Signed-off-by: Joyce Brum <[email protected]> Signed-off-by: Joyce Brum <[email protected]> Signed-off-by: Joyce Brum <[email protected]>
sigstore · Nov 15, 2022 · 9ad46e4 · 9ad46e4
1 parent 43eab2f
commit 9ad46e4
Show file tree

Hide file tree

Showing 6 changed files with 189 additions and 83 deletions.
diff --git a/.github/workflows/slsa-goreleaser.yml b/.github/workflows/slsa-goreleaser.yml
@@ -0,0 +1,69 @@
+name: SLSA go releaser
+on:
+  push:
+    tags:
+      # available only for tags like `v1.2.3` or `v1.2.3-rc1`
+      - "v[0-9]+.[0-9]+.[0-9]+"
+      - "v[0-9]+.[0-9]+.[0-9]+-*"
+
+permissions: read-all
+
+jobs:
+  # Generate ldflags dynamically.
+  # Optional: only needed for ldflags.
+  args:
+    runs-on: ubuntu-latest
+    outputs:
+      commit-date: ${{ steps.ldflags.outputs.commit-date }}
+      commit: ${{ steps.ldflags.outputs.commit }}
+      version: ${{ steps.ldflags.outputs.version }}
+      tree-state: ${{ steps.ldflags.outputs.tree-state }}
+    steps:
+      - id: checkout
+        uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 # tag=v2.3.4
+        with:
+          fetch-depth: 0
+      - id: ldflags
+        run: |
+          echo "::set-output name=commit-date::$(git log --date=iso8601-strict -1 --pretty=%ct)"
+          echo "::set-output name=commit::$GITHUB_SHA"
+          echo "::set-output name=version::$(git describe --tags --always --dirty | cut -c2-)"
+          echo "::set-output name=tree-state::$(if git diff --quiet; then echo "clean"; else echo "dirty"; fi)"
+
+  # Trusted builder.
+  build-linux-amd64:
+    permissions:
+      id-token: write # To sign the provenance.
+      contents: write # To upload assets to release.
+      actions: read # To read the workflow path.
+    needs: args
+    uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
+    with:
+      config-file: .slsa-goreleaser-linux-amd64.yml
+      go-version: 1.18
+      evaluated-envs: "COMMIT_DATE:${{needs.args.outputs.commit-date}}, COMMIT:${{needs.args.outputs.commit}}, VERSION:${{needs.args.outputs.version}}, TREE_STATE:${{needs.args.outputs.tree-state}}"
+
+  build-darwin-amd64:
+    permissions:
+      id-token: write # To sign the provenance.
+      contents: write # To upload assets to release.
+      actions: read # To read the workflow path.
+    needs: args
+    uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
+    with:
+      config-file: .slsa-goreleaser-darwin-amd64.yml
+      go-version: 1.18
+      evaluated-envs: "COMMIT_DATE:${{needs.args.outputs.commit-date}}, COMMIT:${{needs.args.outputs.commit}}, VERSION:${{needs.args.outputs.version}}, TREE_STATE:${{needs.args.outputs.tree-state}}"
+
+  build-windows-amd64:
+    permissions:
+      id-token: write # To sign the provenance.
+      contents: write # To upload assets to release.
+      actions: read # To read the workflow path.
+    needs: args
+    uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
+    with:
+      config-file: .slsa-goreleaser-windows-amd64.yml
+      go-version: 1.18
+      evaluated-envs: "COMMIT_DATE:${{needs.args.outputs.commit-date}}, COMMIT:${{needs.args.outputs.commit}}, VERSION:${{needs.args.outputs.version}}, TREE_STATE:${{needs.args.outputs.tree-state}}"
+
diff --git a/.goreleaser.yml b/.goreleaser.yml
diff --git a/.slsa-goreleaser-darwin-amd64.yml b/.slsa-goreleaser-darwin-amd64.yml
@@ -0,0 +1,36 @@
+# Version for this file.
+version: 1
+
+# (Optional) List of env variables used during compilation.
+env:
+  - GO111MODULE=on
+  - CGO_ENABLED=0
+
+# (Optional) Flags for the compiler.
+flags:
+  - -trimpath
+  - -tags=netgo
+
+# The OS to compile for. `GOOS` env variable will be set to this value.
+goos: darwin
+
+# The architecture to compile for. `GOARCH` env variable will be set to this value.
+goarch: amd64
+
+# (Optional) Entrypoint to compile.
+main: ./cmd/kubectl-sigstore
+
+# (Optional) Working directory. (default: root of the project)
+# dir: ./relative/path/to/dir
+
+# Binary output name.
+# {{ .Os }} will be replaced by goos field in the config file.
+# {{ .Arch }} will be replaced by goarch field in the config file.
+binary: kubectl-sigstore-darwin-amd64
+
+# (Optional) ldflags generated dynamically in the workflow, and set as the `evaluated-envs` input variables in the workflow.
+ldflags:
+  - "-X main.Version={{ .Env.VERSION }}"
+  - "-X main.Commit={{ .Env.COMMIT }}"
+  - "-X main.CommitDate={{ .Env.COMMIT_DATE }}"
+  - "-X main.TreeState={{ .Env.TREE_STATE }}"
diff --git a/.slsa-goreleaser-linux-amd64.yml b/.slsa-goreleaser-linux-amd64.yml
@@ -0,0 +1,36 @@
+# Version for this file.
+version: 1
+
+# (Optional) List of env variables used during compilation.
+env:
+  - GO111MODULE=on
+  - CGO_ENABLED=0
+
+# (Optional) Flags for the compiler.
+flags:
+  - -trimpath
+  - -tags=netgo
+
+# The OS to compile for. `GOOS` env variable will be set to this value.
+goos: linux
+
+# The architecture to compile for. `GOARCH` env variable will be set to this value.
+goarch: amd64
+
+# (Optional) Entrypoint to compile.
+main: ./cmd/kubectl-sigstore
+
+# (Optional) Working directory. (default: root of the project)
+# dir: ./relative/path/to/dir
+
+# Binary output name.
+# {{ .Os }} will be replaced by goos field in the config file.
+# {{ .Arch }} will be replaced by goarch field in the config file.
+binary: kubectl-sigstore-linux-{{ .Arch }}
+
+# (Optional) ldflags generated dynamically in the workflow, and set as the `evaluated-envs` input variables in the workflow.
+ldflags:
+  - "-X main.Version={{ .Env.VERSION }}"
+  - "-X main.Commit={{ .Env.COMMIT }}"
+  - "-X main.CommitDate={{ .Env.COMMIT_DATE }}"
+  - "-X main.TreeState={{ .Env.TREE_STATE }}"
diff --git a/.slsa-goreleaser-windows-amd64.yml b/.slsa-goreleaser-windows-amd64.yml
@@ -0,0 +1,37 @@
+# Version for this file.
+version: 1
+
+# (Optional) List of env variables used during compilation.
+env:
+  - GO111MODULE=on
+  - CGO_ENABLED=0
+
+# (Optional) Flags for the compiler.
+flags:
+  - -trimpath
+  - -tags=netgo
+
+# The OS to compile for. `GOOS` env variable will be set to this value.
+goos: windows
+
+# The architecture to compile for. `GOARCH` env variable will be set to this value.
+goarch: amd64
+
+# (Optional) Entrypoint to compile.
+main: ./cmd/kubectl-sigstore
+
+# (Optional) Working directory. (default: root of the project)
+# dir: ./relative/path/to/dir
+
+# Binary output name.
+# {{ .Os }} will be replaced by goos field in the config file.
+# {{ .Arch }} will be replaced by goarch field in the config file.
+binary: kubectl-sigstore-windows-amd64
+
+# (Optional) ldflags generated dynamically in the workflow, and set as the `evaluated-envs` input variables in the workflow.
+ldflags:
+  - -buildmode=exe
+  - "-X main.Version={{ .Env.VERSION }}"
+  - "-X main.Commit={{ .Env.COMMIT }}"
+  - "-X main.CommitDate={{ .Env.COMMIT_DATE }}"
+  - "-X main.TreeState={{ .Env.TREE_STATE }}"
diff --git a/README.md b/README.md
@@ -1,5 +1,10 @@
 # k8s-manifest-sigstore
 
+===============
+<!--- @begin-badges@ --->
+[![SLSA](https://slsa.dev/images/gh-badge-level3.svg)](https://slsa.dev/)
+<!--- @end-badges@ --->
+
 kubectl plugin for signing Kubernetes manifest YAML files with sigstore
 
 > :warning: Still under developement, not ready for production use yet!
@@ -130,6 +135,12 @@ Flags:
   -o, --output string            output format string, either "json" or "yaml" (if empty, a result is shown as a table)
 ```
 
+### SLSA Provenance
+This project generates a SLSA provenance on its release! This enables you to verify the integrity
+of the downloaded artifacts and ensure that the binary's code really comes from this source code.
+
+To do so, please follow the instructions [here](https://github.com/slsa-framework/slsa-github-generator#verification-of-provenance).
+
 ## Security
 
 Should you discover any security issues, please refer to sigstore'ss [security