Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

docs: adding example output for PROVENANCE.md #268

Merged
merged 2 commits into from
Feb 22, 2024
Merged

docs: adding example output for PROVENANCE.md #268

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ff50b75
Adding example output for PROVENANCE.md
rsoberano-ld Feb 22, 2024
5eee8f2
Automatically update version
keelerm84 Feb 22, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 13 additions & 6 deletions PROVENANCE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,24 +2,31 @@

LaunchDarkly uses the [SLSA framework](https://slsa.dev/spec/v1.0/about) (Supply-chain Levels for Software Artifacts) to help developers make their supply chain more secure by ensuring the authenticity and build integrity of our published SDK packages.

As part of [SLSA requirements for level 3 compliance](https://slsa.dev/spec/v1.0/requirements), LaunchDarkly publishes provenance about our SDK package builds using [GitHub's generic SLSA3 provenance generator](https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/generic/README.md#generation-of-slsa3-provenance-for-arbitrary-projects) for distribution alongside our packages. These attestations are available for download from the GitHub release page for the release version under Assets > `multiple-provenance.intoto.jsonl`.
As part of [SLSA requirements for level 3 compliance](https://slsa.dev/spec/v1.0/requirements), LaunchDarkly publishes provenance about our SDK package builds using [GitHub's generic SLSA3 provenance generator](https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/generic/README.md#generation-of-slsa3-provenance-for-arbitrary-projects) for distribution alongside our packages. These attestations are available for download from the GitHub release page for the release version under Assets > `multiple.intoto.jsonl`.

To verify SLSA provenance attestations, we recommend using [slsa-verifier](https://github.com/slsa-framework/slsa-verifier). Example usage for verifying SDK packages is included below:

<!-- x-release-please-start-version -->
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@rsoberano-ld I added a commit to this PR. It configures release-please to update this file with the latest release version each time we cut a release. This way we don't have to update that version number manually. FYI for the next ones we do.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is great, thanks for adding this in! Do I need to replace 9.2.0 with a template variable, or will release-please know to replace that?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nope, this should be sufficient for it to update it.

```
# Download packages from PyPi
# Download package from PyPi
$ pip download --only-binary=:all: launchdarkly-server-sdk

# Download provenance from Github release
# Download provenance from Github release into same directory
$ curl --location -O \
https://github.com/launchdarkly/python-server-sdk/releases/download/VERSION/multiple.intoto.jsonl
https://github.com/launchdarkly/python-server-sdk/releases/download/9.2.0/multiple.intoto.jsonl

# Run slsa-verifier to verify provenance against package artifacts
$ slsa-verifier verify-artifact \
--provenance-path multiple-provenance.intoto.jsonl \
--provenance-path multiple.intoto.jsonl \
--source-uri github.com/launchdarkly/python-server-sdk \
launchdarkly_server_sdk-VERSION-py3-none-any.whl
launchdarkly_server_sdk-9.2.0-py3-none-any.whl
Verified signature against tlog entry index 71399397 at URL: https://rekor.sigstore.dev/api/v1/log/entries/24296fb24b8ad77a95c53f2cb33fe2e8c8fbc04591ebf26e4d2796fb2975c3ba377f1dc14507f421
Verified build using builder "https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@refs/tags/v1.7.0" at commit 5e818265c9f85ae9a111290bd6a4fad1a08786e9
Verifying artifact launchdarkly_server_sdk-9.2.0-py3-none-any.whl: PASSED

PASSED: Verified SLSA provenance
```
<!-- x-release-please-end -->

Alternatively, to verify the provenance manually, the SLSA framework specifies [recommendations for verifying build artifacts](https://slsa.dev/spec/v1.0/verifying-artifacts) in their documentation.

Expand Down
2 changes: 1 addition & 1 deletion release-please-config.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
"release-type": "python",
"versioning": "default",
"include-v-in-tag": false,
"extra-files": ["ldclient/version.py"],
"extra-files": ["ldclient/version.py", "PROVENANCE.md"],
"include-component-in-tag": false
}
}
Expand Down
Loading