Skip to content
This repository was archived by the owner on Apr 21, 2025. It is now read-only.

[WIP] Test Witness for build attestations#135

Draft
colek42 wants to merge 12 commits into
HewlettPackard:victor/slsafrom
testifysec:cole/witness
Draft

[WIP] Test Witness for build attestations#135
colek42 wants to merge 12 commits into
HewlettPackard:victor/slsafrom
testifysec:cole/witness

Conversation

@colek42
Copy link
Copy Markdown

@colek42 colek42 commented Apr 7, 2023

Pull request check list

  • Proper tests/regressions included?
  • Documentation updated?

Affected functionality

Description of change

Which issue this pull requests fixes

@colek42 colek42 changed the title [WIP[ Test Witness for build attestations [WIP] Test Witness for build attestations Apr 7, 2023
@colek42
Copy link
Copy Markdown
Author

colek42 commented Apr 7, 2023

Working test run is viewable here: https://github.com/testifysec/galadriel/actions/runs/4636814805

github-advanced-security[bot]
github-advanced-security AI found potential problems Apr 7, 2023
View reviewed changes
Comment thread .github/workflows/release.yml Outdated
- name: Run GoReleaser
id: run-goreleaser
uses: goreleaser/goreleaser-action@8f67e590f2d095516493f017008adc464e63adb1 # v4.1.0
uses: testifysec/witness-run-action@main

Check warning

Code scanning / Scorecard

Pinned-Dependencies

score is 5: third-party GitHubAction not pinned by hash Click Remediation section below to solve this issue
github-advanced-security[bot]
github-advanced-security AI found potential problems Apr 7, 2023
View reviewed changes
Comment thread .github/workflows/release.yml Outdated
distribution: goreleaser
version: latest
args: release --rm-dist
uses: testifysec/witness-run-action@main

Check warning

Code scanning / Scorecard

Pinned-Dependencies

score is 5: third-party GitHubAction not pinned by hash Click Remediation section below to solve this issue
github-advanced-security[bot]
github-advanced-security AI found potential problems Apr 10, 2023
View reviewed changes
Comment thread .github/workflows/release.yml Outdated
distribution: goreleaser
version: latest
args: release --rm-dist
uses: testifysec/witness-run-action@main

Check warning

Code scanning / Scorecard

Pinned-Dependencies

score is 5: third-party GitHubAction not pinned by hash Click Remediation section below to solve this issue
github-advanced-security[bot]
github-advanced-security AI found potential problems Apr 14, 2023
View reviewed changes
Comment thread .github/workflows/trivy.yml Outdated
sudo apt-get install trivy -y

- name: Run Trivy vulnerability scanner with Witness
uses: testifysec/witness-run-action@main

Check warning

Code scanning / Scorecard

Pinned-Dependencies

score is 5: third-party GitHubAction not pinned by hash Click Remediation section below to solve this issue
github-advanced-security[bot]
github-advanced-security AI found potential problems Apr 14, 2023
View reviewed changes
Comment thread .github/workflows/release.yml Outdated
run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin

- name: Build Server
uses: testifysec/witness-run-action@main

Check warning

Code scanning / Scorecard

Pinned-Dependencies

score is 5: third-party GitHubAction not pinned by hash Click Remediation section below to solve this issue
Comment thread .github/workflows/release.yml Outdated
command: ko build --tarball server.tar --tags=ghcr.io/${{ github.repository }}:${{ github.sha }} --platform=all --sbom-dir . ./cmd/server

- name: Build Harvestor
uses: testifysec/witness-run-action@main

Check warning

Code scanning / Scorecard

Pinned-Dependencies

score is 5: third-party GitHubAction not pinned by hash Click Remediation section below to solve this issue
Comment thread .github/workflows/release.yml

- name: Install KO
run: go install github.com/google/ko/cmd/ko@latest

Check warning

Code scanning / Scorecard

Pinned-Dependencies

score is 5: goCommand not pinned by hash Click Remediation section below to solve this issue
github-advanced-security[bot]
github-advanced-security AI found potential problems Apr 14, 2023
View reviewed changes
Comment thread .github/workflows/release.yml
# command: goreleaser release --clean --snapshot

- name: Setup KO
uses: imjasonh/setup-ko@v0.6

Check warning

Code scanning / Scorecard

Pinned-Dependencies

score is 5: third-party GitHubAction not pinned by hash Click Remediation section below to solve this issue
Comment thread .github/workflows/release.yml Outdated
uses: imjasonh/setup-ko@v0.6

- name: Build Server
uses: testifysec/witness-run-action@v0.1.1

Check warning

Code scanning / Scorecard

Pinned-Dependencies

score is 5: third-party GitHubAction not pinned by hash Click Remediation section below to solve this issue
Comment thread .github/workflows/release.yml Outdated
- name: Generate subject
id: hash
- name: Build Harvestor
uses: testifysec/witness-run-action@v0.1.1

Check warning

Code scanning / Scorecard

Pinned-Dependencies

score is 5: third-party GitHubAction not pinned by hash Click Remediation section below to solve this issue
github-advanced-security[bot]
github-advanced-security AI found potential problems Apr 14, 2023
View reviewed changes
Comment thread .github/workflows/release.yml
# command: goreleaser release --clean --snapshot

- name: Setup KO
uses: imjasonh/setup-ko@v0.6

Check warning

Code scanning / Scorecard

Pinned-Dependencies

score is 5: third-party GitHubAction not pinned by hash Click Remediation section below to solve this issue
github-advanced-security[bot]
github-advanced-security AI found potential problems Apr 14, 2023
View reviewed changes
Comment thread .github/workflows/release.yml
# command: goreleaser release --clean --snapshot

- name: Setup KO
uses: imjasonh/setup-ko@v0.6

Check warning

Code scanning / Scorecard

Pinned-Dependencies

score is 5: third-party GitHubAction not pinned by hash Click Remediation section below to solve this issue
github-advanced-security[bot]
github-advanced-security AI found potential problems Apr 14, 2023
View reviewed changes
Comment thread .github/workflows/release.yml Outdated
- name: Generate subject
id: hash
- name: Build Harvestor
uses: testifysec/witness-run-action@v0.1.1

Check warning

Code scanning / Scorecard

Pinned-Dependencies

score is 5: third-party GitHubAction not pinned by hash Click Remediation section below to solve this issue
github-advanced-security[bot]
github-advanced-security AI found potential problems Apr 14, 2023
View reviewed changes
Comment thread .github/workflows/release.yml
command: goreleaser release --clean --snapshot

- name: Setup KO
uses: imjasonh/setup-ko@v0.6

Check warning

Code scanning / Scorecard

Pinned-Dependencies

score is 5: third-party GitHubAction not pinned by hash Click Remediation section below to solve this issue
github-advanced-security[bot]
github-advanced-security AI found potential problems Apr 14, 2023
View reviewed changes
Comment thread .github/workflows/trivy.yml Outdated
sudo apt-get install trivy -y

- name: Run Trivy vulnerability scanner with Witness
uses: testifysec/witness-run-action@v0.1.1

Check warning

Code scanning / Scorecard

Pinned-Dependencies

score is 5: third-party GitHubAction not pinned by hash Click Remediation section below to solve this issue
github-advanced-security[bot]
github-advanced-security AI found potential problems Apr 14, 2023
View reviewed changes
Comment thread .github/workflows/release.yml Outdated
echo "${AUTH_TOKEN}" | ko login ghcr.io --username dummy --password-stdin

- name: Build Server
uses: testifysec/witness-run-action@fix-output

Check warning

Code scanning / Scorecard

Pinned-Dependencies

score is 5: third-party GitHubAction not pinned by hash Click Remediation section below to solve this issue
github-advanced-security[bot]
github-advanced-security AI found potential problems Apr 18, 2023
View reviewed changes
Comment thread .witness/policy.key Outdated
@@ -0,0 +1,28 @@
-----BEGIN PRIVATE KEY-----

Check failure

Code scanning / Trivy

Asymmetric Private Key

Artifact: .witness/policy.key Type: Secret Asymmetric Private Key Severity: HIGH Match: -----BEGIN PRIVATE KEY-----*******************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************-----END PRIVATE KEY
github-advanced-security[bot]
github-advanced-security AI found potential problems Apr 18, 2023
View reviewed changes
Comment thread .witness/policy.key Outdated
@@ -0,0 +1,28 @@
-----BEGIN PRIVATE KEY-----

Check failure

Code scanning / Trivy

Asymmetric Private Key

Artifact: .witness/policy.key Type: Secret Asymmetric Private Key Severity: HIGH Match: -----BEGIN PRIVATE KEY-----*******************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************-----END PRIVATE KEY
github-advanced-security[bot]
github-advanced-security AI found potential problems Apr 18, 2023
View reviewed changes
Comment thread .witness/policy.key Outdated
@@ -0,0 +1,28 @@
-----BEGIN PRIVATE KEY-----

Check failure

Code scanning / Trivy

Asymmetric Private Key

Artifact: .witness/policy.key Type: Secret Asymmetric Private Key Severity: HIGH Match: -----BEGIN PRIVATE KEY-----*******************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************-----END PRIVATE KEY
github-advanced-security[bot]
github-advanced-security AI found potential problems Apr 18, 2023
View reviewed changes
Comment thread .witness/policy.key Outdated
@@ -0,0 +1,28 @@
-----BEGIN PRIVATE KEY-----

Check failure

Code scanning / Trivy

Asymmetric Private Key

Artifact: .witness/policy.key Type: Secret Asymmetric Private Key Severity: HIGH Match: -----BEGIN PRIVATE KEY-----*******************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************-----END PRIVATE KEY
github-advanced-security[bot]
github-advanced-security AI found potential problems Apr 18, 2023
View reviewed changes
Comment thread .witness/policy.key Outdated
@@ -0,0 +1,28 @@
-----BEGIN PRIVATE KEY-----

Check failure

Code scanning / Trivy

Asymmetric Private Key

Artifact: .witness/policy.key Type: Secret Asymmetric Private Key Severity: HIGH Match: -----BEGIN PRIVATE KEY-----*******************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************-----END PRIVATE KEY
dependabot Bot and others added 5 commits April 18, 2023 03:46
@dependabot @cole-rgb
Bump golangci/golangci-lint-action from 3.2.0 to 3.3.1
504286d 
Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) from 3.2.0 to 3.3.1.
- [Release notes](https://github.com/golangci/golangci-lint-action/releases)
- [Commits](golangci/golangci-lint-action@537aa19...0ad9a09)

---
updated-dependencies:
- dependency-name: golangci/golangci-lint-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@Victorblsilveira @cole-rgb
feat: Introduzing Github workflow to automate build process generating
83b6cbc 
provenance artifact with signature and sboms

Signed-off-by: Victor Vieira Barros Leal da Silveira <victorblsilveira@gmail.com>
@Victorblsilveira @cole-rgb
feat: Updating demo dependencies
407de97
@Victorblsilveira @cole-rgb
feat: Updating go.sum
ae1cb49
@dependabot @cole-rgb
Bump golangci/golangci-lint-action from 3.3.1 to 3.4.0
b0d9bb6 
Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) from 3.3.1 to 3.4.0.
- [Release notes](https://github.com/golangci/golangci-lint-action/releases)
- [Commits](golangci/golangci-lint-action@0ad9a09...08e2f20)

---
updated-dependencies:
- dependency-name: golangci/golangci-lint-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@colek42 colek42 force-pushed the cole/witness branch 2 times, most recently from 1b04d08 to 69d694c Compare April 18, 2023 08:54
cole-rgb and others added 2 commits April 19, 2023 13:50
@cole-rgb
test
94fa2ec
@colek42
Update scorecards.yml
cad3d3d 
Signed-off-by: Cole Kennedy <colek42@gmail.com>
@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud Bot commented Apr 25, 2023

Kudos, SonarCloud Quality Gate passed!    Quality Gate passed

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 0 Code Smells

No Coverage information No Coverage information
No Duplication information No Duplication information

colek42 added 2 commits August 25, 2023 13:25
@colek42
Update release.yml
5c88d16 
Signed-off-by: Cole Kennedy <colek42@gmail.com>
@colek42
Update release.yml
4314ab9 
Signed-off-by: Cole Kennedy <colek42@gmail.com>
@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud Bot commented Aug 26, 2023

Kudos, SonarCloud Quality Gate passed!    Quality Gate passed

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 0 Code Smells

No Coverage information No Coverage information
No Duplication information No Duplication information

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@wibarre wibarre Awaiting requested review from wibarre wibarre will be requested when the pull request is marked ready for review wibarre is a code owner

@mchurichi mchurichi Awaiting requested review from mchurichi mchurichi will be requested when the pull request is marked ready for review mchurichi is a code owner

@jufantozzi jufantozzi Awaiting requested review from jufantozzi jufantozzi will be requested when the pull request is marked ready for review jufantozzi is a code owner

@maxlambrecht maxlambrecht Awaiting requested review from maxlambrecht maxlambrecht will be requested when the pull request is marked ready for review maxlambrecht is a code owner

@mgbcaio mgbcaio Awaiting requested review from mgbcaio mgbcaio will be requested when the pull request is marked ready for review mgbcaio is a code owner

@Victorblsilveira Victorblsilveira Awaiting requested review from Victorblsilveira Victorblsilveira will be requested when the pull request is marked ready for review Victorblsilveira is a code owner

Assignees

@colek42 colek42

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@colek42 @github-advanced-security @Victorblsilveira @cole-rgb