New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: Support for GCB verification #202

Merged

laurentsimon merged 22 commits into slsa-framework:main from laurentsimon:feat/gcbverif

Aug 24, 2022

Contributor

laurentsimon commented Aug 9, 2022 •

edited

Loading

This PR depends on #147 which should be merged.

Please verify the GCB public keys in this PR, using steps in verifiers/internal/gcb/keys/README.md.

This PR adds support for verification of GCB provenance. Some TODOS:

Unit tests. Follow-up PRs will be needed
This only works for containers today, but does not support provenance available next to the registry. (current limitation of GCB).

In a follow-up PR: #221

laurentsimon marked this pull request as draft

August 9, 2022 22:47

laurentsimon changed the title ~~Support for GCB verification~~ [DRAFT] Support for GCB verification

laurentsimon commented

View reviewed changes

verifiers/internal/gcb/provenance.go Outdated Show resolved Hide resolved

laurentsimon commented

View reviewed changes

verifiers/internal/gcb/provenance.go Outdated Show resolved Hide resolved

laurentsimon force-pushed the feat/gcbverif branch from e21f485 to 3f03ce3 Compare

August 15, 2022 23:35

laurentsimon changed the title ~~[DRAFT] Support for GCB verification~~ feat: Support for GCB verification

laurentsimon marked this pull request as ready for review

August 16, 2022 22:19

laurentsimon requested review from ianlewis and asraa

August 16, 2022 22:19

laurentsimon force-pushed the feat/gcbverif branch from 985aa8c to 47ff8a8 Compare

August 16, 2022 22:22

asraa reviewed

View reviewed changes

Contributor

asraa left a comment

Thanks for starting this! Some comments. Overall, implementation of the provenance looks fine to me.

verifiers/internal/gcb/keys/keys.go Outdated Show resolved Hide resolved

verifiers/internal/gcb/keys/keys.go Outdated Show resolved Hide resolved

verifiers/internal/gcb/provenance.go Outdated Show resolved Hide resolved

verifiers/internal/gcb/provenance.go Outdated Show resolved Hide resolved

verifiers/internal/gcb/provenance.go Show resolved Hide resolved

verifiers/internal/gcb/verifier.go Show resolved Hide resolved

verifiers/internal/gcb/verifier.go Show resolved Hide resolved

verifiers/internal/gcb/verifier.go Outdated Show resolved Hide resolved

verifiers/internal/gcb/testdata/gcloud-container-invalid-slsaheader.json Show resolved Hide resolved

verifiers/internal/gcb/provenance.go Outdated Show resolved Hide resolved

laurentsimon commented

View reviewed changes

verifiers/internal/gcb/keys/keys.go Outdated Show resolved Hide resolved

laurentsimon commented

View reviewed changes

verifiers/internal/gcb/keys/list Outdated Show resolved Hide resolved

laurentsimon commented

View reviewed changes

verifiers/internal/gcb/provenance.go Outdated Show resolved Hide resolved

laurentsimon force-pushed the feat/gcbverif branch from 47ff8a8 to d2b921e Compare

August 18, 2022 15:09

Contributor Author

laurentsimon commented Aug 18, 2022

Added more tests, ready for review!

ianlewis reviewed

View reviewed changes

main_test.go Outdated Show resolved Hide resolved

main_test.go Outdated Show resolved Hide resolved

main_test.go Outdated Show resolved Hide resolved

verifiers/internal/gcb/keys/keys.go Outdated Show resolved Hide resolved

verifiers/internal/gcb/keys/keys.go Outdated Show resolved Hide resolved

verifiers/internal/gcb/provenance.go Outdated Show resolved Hide resolved

verifiers/internal/gcb/provenance.go Outdated Show resolved Hide resolved

verifiers/internal/gcb/provenance.go Outdated Show resolved Hide resolved

verifiers/internal/gcb/provenance.go Outdated Show resolved Hide resolved

verifiers/internal/gcb/testdata/gcloud-container-invalid-slsaheader.json Show resolved Hide resolved

asraa and others added 13 commits

August 23, 2022 20:49


          add testing folder

388626a

Signed-off-by: Asra Ali <asraa@google.com>


          add tests

c6924f1

Signed-off-by: Asra Ali <asraa@google.com>


          update

56b1c36


          updated comments

ece5c74

Signed-off-by: Asra Ali <asraa@google.com>


          update

25d04d8


          update

8ecd05e


          update

b06cda6


          update

f5e62c1


          update

0b327d8


          update

2b7c82d


          update

2174f5f


          draft

cd42eb1


          update

fcbd07b

laurentsimon added 5 commits

August 23, 2022 20:49


          update

e61a35f


          update

22376c1


          update

da715b8


          update

3e76571


          update

b120989

laurentsimon force-pushed the feat/gcbverif branch from 523ffe3 to b120989 Compare

August 23, 2022 20:50

laurentsimon added 4 commits

August 23, 2022 20:57


          update

473c094


          update

21b2eca


          update

17656d6


          update

d6f11e7

asraa approved these changes

View reviewed changes

laurentsimon merged commit 3b5c68f into slsa-framework:main

laurentsimon mentioned this pull request

Improve GCB verification #221

Open

23 tasks

ramonpetgrave64 pushed a commit to ramonpetgrave64/slsa-verifier that referenced this pull request


          Fix formatting in language agnostic instructions (slsa-framework#202)

a0150d3

The markdown table should have just one row. However, the example is
formatted in such a way that it gets 3 rows. This is just minor cleanup,
with no functional change.

Co-authored-by: Ian Lewis <ianlewis@google.com>

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet