-
Notifications
You must be signed in to change notification settings - Fork 18
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Allow injection of extra materials via files #72
Conversation
e4dc66a
to
d4783cb
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for your contribution.
This looks great. Could you elaborate a bit on the usecase and where such provenance file would originate from.
Maybe add a reference to slsa or maybe we can clarify a bit in the README.md.
We are also still learning on slsa and the provenance…
E.g. how would this work with docker images? We also have an open issue to work on docker image provenance support #73
To build PowerDNS packages we use pdns-builder, which is used a git sub-module. pdns-builder takes some templates and generates a Dockerfile that has all the instructions to build the RPM or Debian package, which is SLSA specifies that the URL of materials is a "ResourceURI" and that is RECOMMENDED to be a "package url" and has some examples on how these urls can look. Being able to add this package information to the SLSA material provenance would allow anyone to create a replica of the build environment and reproduce the package. It also proves/tells us what versions of dependencies we linked against.
SLSA has the "Dependencies complete" requirement. It is described as
For us, the initial state is the docker base-image we pulled (e.g. debian:buster) and the service-provided artifacts are the packages that installed as part of the build-process (via e.g.
So are we :).
This might not work for actually generated docker images. This is about the docker images used as a base for the builds (which, combined with the exact installed packages should lead to something that would allow for a reproducible build). P.S. I did notice I didn't update the action.yaml to allow this option to be set, I'll add a separate commit for that. |
Thanks for clarifying. Now it starts to make more sense to me. Would it be possible to add a small usage example here in the README.md. https://github.com/philips-labs/slsa-provenance-action/blob/main/README.md?plain=1#L188 That would be very beneficial for other consumers of the action. |
Done!
Done! |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This change looks good to me (as one of the SLSA authors).
Some build systems could create files that contain materials used during the build (like docker images, operating system packages etc.). These files would contain a JSON array with Items. When set on the command-line flag `-extra_materials`, slsa-provenance will read and parse these files and add the found materials to the statement. Signed-off-by: Pieter Lexis <pieter.lexis@powerdns.com>
Signed-off-by: Pieter Lexis <pieter.lexis@powerdns.com>
Signed-off-by: Pieter Lexis <pieter.lexis@powerdns.com>
Signed-off-by: Pieter Lexis <pieter.lexis@powerdns.com>
Signed-off-by: Pieter Lexis <pieter.lexis@powerdns.com>
Signed-off-by: Pieter Lexis <pieter.lexis@powerdns.com>
Signed-off-by: Pieter Lexis <pieter.lexis@powerdns.com>
ed05ad7
to
bc88d4e
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks a lot for your contribution @pieterlexis.
Some build systems could create files that contain materials used during
the build (like docker images, operating system packages etc.). These
files would contain a JSON array with Items. When set on the
command-line flag
-extra_materials
, slsa-provenance will read andparse these files and add the found materials to the statement.