Add capability to add provenance for building docker images

[marcofranssen]

When releasing docker images to various registries using various tags it would be good to be able to generate provenance using this action independent from the tooling/scripts that create the images and tags.

e.g.:

• goreleaser
• bash script

For each registry we would like to be able to generate provenance for the tags that are correlated to each other. We could leverage the docker image digest as a subject.

This provenance file could then be attached using cosign (sigstore) or notation (Notary Project).

ghcr.io/philips-labs/slsa-provenance:latest
ghcr.io/philips-labs/slsa-provenance:v0.2.0
ghcr.io/philips-labs/slsa-provenance:v0.2
ghcr.io/philips-labs/slsa-provenance:v0

philipssoftware/slsa-provenance:latest
philipssoftware/slsa-provenance:v0.2.0
philipssoftware/slsa-provenance:v0.2
philipssoftware/slsa-provenance:v0

In the current spec that would however be some duplication to express the same image using the various tags.

To be discussed:

• How to make he provenance action aware of the released docker images during a Github release?
• Will there be a provenance file per registry or per tag or one for all the registries?
• …

[marcofranssen]

some steps to retrieve the digest (only works after pushing the images to the registry

docker inspect ghcr.io/philips-labs/slsa-provenance:v0.2.0 --format '{{ index .RepoDigests 0 }}'

Now the provenance job can use this digest to filter the images based on digest. Unfortunately it is not possible to pull all tags by digest, so as a best effort so far I managed to pull all images from a repo and then inspect the digest.

docker pull ghcr.io/philips-labs/slsa-provenance -a
docker pull philipssoftware/slsa-provenance -a
docker inspect ghcr.io/philips-labs/slsa-provenance@sha256:somedigest

[marcofranssen]

See here the current progress of the feature

https://github.com/philips-labs/slsa-provenance-action/runs/4118652943?check_suite_focus=true#step:3:175

[marcofranssen]

Tried following API's to see if we can somehow fetch the related tags for a digest directly from the api

• https://ghcr.io/v2/philips-labs/slsa-provenance/manifests/sha256%3A47076d89b7d58102de03eddc732f8715c7a1f264625b752e25f2571b2fd4d64f

  {
          "schemaVersion": 2,
          "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
          "config": {
             "mediaType": "application/vnd.docker.container.image.v1+json",
             "size": 4113,
             "digest": "sha256:18fd6a96718f88e2c70f5fb0b3f901b7b908e13d8f9cfde5d3b0fca79448a918"
          },
          "layers": [
             {
                "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
                "size": 803814,
                "digest": "sha256:e8614d09b7bebabd9d8a450f44e88a8807c98a438a2ddd63146865286b132d1b"
             },
             {
                "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
                "size": 7975415,
                "digest": "sha256:c6f4d1a13b699c8490910fd4fd6c7056b90fd0da3077e4f29b4bd27bf0bae6cd"
             },
             {
                "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
                "size": 130266,
                "digest": "sha256:f453ef12a4d0b251a0c31cadebacd6ceeededb40fd7d2d4f8344f4cd331b1bcc"
             },
             {
                "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
                "size": 3888472,
                "digest": "sha256:9619f8218529f5a1ef16a9ad23ab079f712c3d65935c5f42a33940226cc3f434"
             }
          ]
       }
  

• https://ghcr.io/v2/philips-labs/slsa-provenance/tags/list

  {\"name\":\"philips-labs/slsa-provenance\",\"tags\":[\"v0.2.0-rc3\",\"f8d40849521945d99ace0ad97b1ed3f932d899b0\",\"v0.2.0\",\"96ebd0a2d2be7c191399e9dc52575fc315ac0126\",\"v0.2.1\",\"f471992de16e6c31403e040d6fda5dc2f3431861\",\"v0.2.2\",\"4ce660b288bf0ec565c98d6f4e0a581b211cce69\",\"9409d92857288212b90af0c1b27a3eb4617fae60\",\"v0.2.3-alpha\",\"b0d0e2e65f16d13c7bba83676d5022e948f958f7\"]}
  

[justincormack]

Unfortunately OCI has not released standard APIs for digests. Some registries have non standardised ones.

Docker push cannot currently give you digests before pushing but other tools, eg Buildkit based tools can do this.

We (Docker) are looking to make improvements in these areas, and would love feedback on our public roadmap https://github.com/docker/roadmap/issues about the areas we could help with.

[marcofranssen]

@justincormack thanks for clarifying. I am able to get the digest image tags, but only by first pulling all tags from a given repo.

docker pull philipssoftware/slsa-provenance -a
docker inspect ghcr.io/philips-labs/slsa-provenance@sha256:somedigest

The problem with that approach is that this will get slower and more resource intensive the more releases we make.

See here the POC on trying to build this into this action. https://github.com/philips-labs/slsa-provenance-action/compare/container-provenance

We are using a dedicated job with a clean runner to create provenance at this time, this is the reason why I need to pull the images.

Some workarounds could be:

• to also provide the tags and repositories to the provenance action but that makes the UX of the action just worse.
• generate the provenance for the images within the release job because there we already have the images and digests just after we pushed them to the registry.

Really surprised none of the registries have the capability to fetch all tags for a given digest as this seems to be a very trivial thing that support dozen of use cases.

Any thoughts on where to bring this up? Maybe this should become part of the OCI spec.