Skip to content

Commit cc98f27

Browse files
laurentsimonlaurentsimon
committedApr 12, 2022
updates
1 parent 1225eaf commit cc98f27

File tree

5 files changed

+3349
-66
lines changed

5 files changed

+3349
-66
lines changed
 

‎.github/workflows/slsa3-builder.yml

+12-18
Original file line numberDiff line numberDiff line change
@@ -135,9 +135,11 @@ jobs:
135135
needs: [builder]
136136
env:
137137
UNTRUSTED_ARGS: "${{ inputs.args }}"
138+
UNTRUSTED_ENVS: "${{ inputs.envs }}"
138139
BUILDER_HASH: "${{ needs.builder.outputs.builder-sha256 }}"
139140
outputs:
140141
command: ${{ steps.build-dry.outputs.command }}
142+
envs: ${{ steps.build-dry.outputs.envs }}
141143

142144
steps:
143145
- name: Checkout the repository
@@ -176,9 +178,9 @@ jobs:
176178
177179
# TODO: verify hash
178180
echo "running the builder $BUILDER_BINARY with hash $BUILDER_HASH"
179-
echo ./"$BUILDER_BINARY" $UNTRUSTED_ARGS --dry-run
180-
./"$BUILDER_BINARY" $UNTRUSTED_ARGS --dry-run
181-
echo "::set-output name=command::this is a command!"
181+
echo ./"$BUILDER_BINARY" --dry-run --args "$UNTRUSTED_ARGS" --envs "$UNTRUSTED_ENVS"
182+
# Note: this will print command and envs.
183+
./"$BUILDER_BINARY" --dry-run --args "$UNTRUSTED_ARGS" --envs "$UNTRUSTED_ENVS"
182184
183185
###################################################################
184186
# #
@@ -276,13 +278,11 @@ jobs:
276278
env:
277279
UNTRUSTED_IMAGE: "${{ needs.build-release.outputs.image }}"
278280
UNTRUSTED_COMMAND: "${{ needs.build-dry.outputs.command }}"
281+
UNTRUSTED_ENVS: "${{ needs.build-dry.outputs.envs }}"
279282
UNTRUSTED_PASSWORD: "${{ secrets.password }}"
280283
UNTRUSTED_USERNAME: "${{ inputs.username }}"
281284

282285
steps:
283-
- name: Checkout the repository
284-
uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # v2.3.4
285-
286286
- name: Generate predicate
287287
id: gen-predicate
288288
env:
@@ -292,23 +292,17 @@ jobs:
292292
293293
echo "image is: $UNTRUSTED_IMAGE"
294294
295-
echo "TODO: generate provenance dynamically"
296-
echo "command: $UNTRUSTED_COMMAND"
297-
298295
#TODO: generate PROJECT dynamically using the URL
299296
# testing. Use a local file containing provenance.
300297
IMAGE_SHA256=$(echo $UNTRUSTED_IMAGE | cut -d "@" -f2 | cut -d ":" -f2)
301-
IMAGE_PROVENANCE="predicate-sha256-$IMAGE_SHA256.json"
298+
IMAGE_NAME=$(echo $UNTRUSTED_IMAGE | cut -d "@" -f1)
299+
302300
303-
echo "provenance is: $IMAGE_PROVENANCE"
304-
305-
export DATA="ewogICJidWlsZGVyIjogewogICAgImlkIjogImh0dHBzOi8vZ2l0aHViLmNvbS9zbHNhLWZyYW1ld29yay9zbHNhLWdpdGh1Yi1nZW5lcmF0b3ItZ28vLmdpdGh1Yi93b3JrZmxvd3MvYnVpbGRlci55bWxAcmVmcy9oZWFkcy9tYWluIgogIH0sCiAgImJ1aWxkVHlwZSI6ICJodHRwczovL2dpdGh1Yi5jb20vc2xzYS1mcmFtZXdvcmsvc2xzYS1naXRodWItZ2VuZXJhdG9yLWdvQHYxIiwKICAiaW52b2NhdGlvbiI6IHsKICAgICJjb25maWdTb3VyY2UiOiB7CiAgICAgICJ1cmkiOiAiZ2l0K2h0dHBzOi8vZ2l0aHViLmNvbWxhdXJlbnRzaW1vbi9zbHNhLW9uLWdpdGh1Yi10ZXN0QHJlZnMvaGVhZHMvbWFpbi5naXQiLAogICAgICAiZGlnZXN0IjogewogICAgICAgICJzaGExIjogImQzZmQ5NDgyZTY4ZDI3NmU2OWMwYThiM2Y3ZWFhYmIzYjllNTY2OTUiCiAgICAgIH0sCiAgICAgICJlbnRyeVBvaW50IjogIlNMU0EgUmVsZWFzZSIKICAgIH0sCiAgICAicGFyYW1ldGVycyI6IHsKICAgICAgInZlcnNpb24iOiAxLAogICAgICAicmVmX3R5cGUiOiAiYnJhbmNoIiwKICAgICAgInJlZiI6ICJyZWZzL2hlYWRzL21haW4iLAogICAgICAiYmFzZV9yZWYiOiAiIiwKICAgICAgImhlYWRfcmVmIjogIiIsCiAgICAgICJhY3RvciI6ICJsYXVyZW50c2ltb24iLAogICAgICAic2hhMSI6ICJkM2ZkOTQ4MmU2OGQyNzZlNjljMGE4YjNmN2VhYWJiM2I5ZTU2Njk1IgogICAgfSwKICAgICJlbnZpcm9ubWVudCI6IHsKICAgICAgImFyY2giOiAiYW1kNjQiLAogICAgICAiZ2l0aHViX2V2ZW50X25hbWUiOiAid29ya2Zsb3dfZGlzcGF0Y2giLAogICAgICAiZ2l0aHViX3J1bl9hdHRlbXB0IjogIjEiLAogICAgICAiZ2l0aHViX3J1bl9pZCI6ICIyMDkwODQxMjYzIiwKICAgICAgImdpdGh1Yl9ydW5fbnVtYmVyIjogIjE4IiwKICAgICAgIm9zIjogInVidW50dSIKICAgIH0KICB9LAogICJidWlsZENvbmZpZyI6IHsKICAgICJ2ZXJzaW9uIjogMSwKICAgICJzdGVwcyI6IFsKICAgICAgewogICAgICAgICJjb21tYW5kIjogWwogICAgICAgICAgIi9vcHQvaG9zdGVkdG9vbGNhY2hlL2dvLzEuMTcuOC94NjQvYmluL2dvIiwKICAgICAgICAgICJidWlsZCIsCiAgICAgICAgICAiLW1vZD12ZW5kb3IiLAogICAgICAgICAgIi10cmltcGF0aCIsCiAgICAgICAgICAiLXRhZ3M9bmV0Z28iLAogICAgICAgICAgIi1vIiwKICAgICAgICAgICJiaW5hcnktbGludXgtYW1kNjQiCiAgICAgICAgXSwKICAgICAgICAiZW52IjogWwogICAgICAgICAgIkdPT1M9bGludXgiLAogICAgICAgICAgIkdPQVJDSD1hbWQ2NCIsCiAgICAgICAgICAiR08xMTFNT0RVTEU9b24iLAogICAgICAgICAgIkNHT19FTkFCTEVEPTAiCiAgICAgICAgXQogICAgICB9CiAgICBdCiAgfSwKICAibWF0ZXJpYWxzIjogWwogICAgewogICAgICAidXJpIjogImdpdCtsYXVyZW50c2ltb24vc2xzYS1vbi1naXRodWItdGVzdC5naXQiLAogICAgICAiZGlnZXN0IjogewogICAgICAgICJzaGExIjogImQzZmQ5NDgyZTY4ZDI3NmU2OWMwYThiM2Y3ZWFhYmIzYjllNTY2OTUiCiAgICAgIH0KICAgIH0KICBdCn0="
306-
#echo "TODO: upload artifact"
307-
UNTRUSTED_PROVENANCE_DATA=$(echo -n "$DATA" | base64 -d)
308-
echo -n "$UNTRUSTED_PROVENANCE_DATA" > "$IMAGE_PROVENANCE"
309-
310-
echo "::set-output name=filename::$IMAGE_PROVENANCE"
311301
echo "::set-output name=image::$UNTRUSTED_IMAGE"
302+
303+
./"$BUILDER_BINARY" predicate --artifact-name "$IMAGE_NAME" \
304+
--digest "$IMAGE_SHA256" --command "$UNTRUSTED_COMMAND" \
305+
--env "$UNTRUSTED_ENVS"
312306
313307
# Note: here we need packages permissions
314308
# TODO: here we may use each ecosystem's login action instead,

‎go.mod

+205-4
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,208 @@
1-
module laurentsimon/slsa-github-generator-ko/builder
1+
module github.com/laurentsimon/slsa-github-generator-ko/builder
22

3-
go 1.18
3+
go 1.17
44

5-
require github.com/pborman/uuid v1.2.1
5+
require (
6+
github.com/in-toto/in-toto-golang v0.3.4-0.20211211042327-af1f9fb822bf
7+
github.com/sigstore/cosign v1.7.2
8+
github.com/sigstore/sigstore v1.2.1-0.20220401110139-0e610e39782f
9+
)
610

7-
require github.com/google/uuid v1.0.0 // indirect
11+
require (
12+
cloud.google.com/go v0.100.2 // indirect
13+
cloud.google.com/go/compute v1.5.0 // indirect
14+
cloud.google.com/go/iam v0.3.0 // indirect
15+
cloud.google.com/go/kms v1.4.0 // indirect
16+
cloud.google.com/go/storage v1.22.0 // indirect
17+
github.com/Azure/azure-sdk-for-go v63.0.0+incompatible // indirect
18+
github.com/Azure/go-autorest/autorest v0.11.25 // indirect
19+
github.com/Azure/go-autorest/autorest/adal v0.9.18 // indirect
20+
github.com/Azure/go-autorest/autorest/azure/auth v0.5.11 // indirect
21+
github.com/Azure/go-autorest/autorest/azure/cli v0.4.5 // indirect
22+
github.com/Azure/go-autorest/autorest/date v0.3.0 // indirect
23+
github.com/Azure/go-autorest/autorest/to v0.4.0 // indirect
24+
github.com/Azure/go-autorest/autorest/validation v0.3.1 // indirect
25+
github.com/Azure/go-autorest/logger v0.2.1 // indirect
26+
github.com/Azure/go-autorest/tracing v0.6.0 // indirect
27+
github.com/PaesslerAG/gval v1.0.0 // indirect
28+
github.com/PaesslerAG/jsonpath v0.1.1 // indirect
29+
github.com/PuerkitoBio/purell v1.1.1 // indirect
30+
github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 // indirect
31+
github.com/ReneKroon/ttlcache/v2 v2.11.0 // indirect
32+
github.com/armon/go-metrics v0.3.10 // indirect
33+
github.com/armon/go-radix v1.0.0 // indirect
34+
github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d // indirect
35+
github.com/aws/aws-sdk-go v1.43.30 // indirect
36+
github.com/aws/aws-sdk-go-v2 v1.14.0 // indirect
37+
github.com/aws/aws-sdk-go-v2/config v1.14.0 // indirect
38+
github.com/aws/aws-sdk-go-v2/credentials v1.9.0 // indirect
39+
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.11.0 // indirect
40+
github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.5 // indirect
41+
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.3.0 // indirect
42+
github.com/aws/aws-sdk-go-v2/internal/ini v1.3.6 // indirect
43+
github.com/aws/aws-sdk-go-v2/service/ecr v1.15.0 // indirect
44+
github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.12.0 // indirect
45+
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.8.0 // indirect
46+
github.com/aws/aws-sdk-go-v2/service/sso v1.10.0 // indirect
47+
github.com/aws/aws-sdk-go-v2/service/sts v1.15.0 // indirect
48+
github.com/aws/smithy-go v1.11.0 // indirect
49+
github.com/awslabs/amazon-ecr-credential-helper/ecr-login v0.0.0-20220228164355-396b2034c795 // indirect
50+
github.com/beorn7/perks v1.0.1 // indirect
51+
github.com/blang/semver v3.5.1+incompatible // indirect
52+
github.com/cenkalti/backoff/v3 v3.2.2 // indirect
53+
github.com/cespare/xxhash/v2 v2.1.2 // indirect
54+
github.com/chrismellard/docker-credential-acr-env v0.0.0-20220119192733-fe33c00cee21 // indirect
55+
github.com/common-nighthawk/go-figure v0.0.0-20210622060536-734e95fb86be // indirect
56+
github.com/containerd/stargz-snapshotter/estargz v0.10.1 // indirect
57+
github.com/coreos/go-oidc/v3 v3.1.0 // indirect
58+
github.com/cyberphone/json-canonicalization v0.0.0-20210823021906-dc406ceaf94b // indirect
59+
github.com/davecgh/go-spew v1.1.1 // indirect
60+
github.com/dimchansky/utfbom v1.1.1 // indirect
61+
github.com/docker/cli v20.10.12+incompatible // indirect
62+
github.com/docker/distribution v2.8.0+incompatible // indirect
63+
github.com/docker/docker v20.10.12+incompatible // indirect
64+
github.com/docker/docker-credential-helpers v0.6.4 // indirect
65+
github.com/fatih/color v1.13.0 // indirect
66+
github.com/fsnotify/fsnotify v1.5.1 // indirect
67+
github.com/ghodss/yaml v1.0.0 // indirect
68+
github.com/go-chi/chi v4.1.2+incompatible // indirect
69+
github.com/go-logr/logr v1.2.2 // indirect
70+
github.com/go-openapi/analysis v0.21.2 // indirect
71+
github.com/go-openapi/errors v0.20.2 // indirect
72+
github.com/go-openapi/jsonpointer v0.19.5 // indirect
73+
github.com/go-openapi/jsonreference v0.19.6 // indirect
74+
github.com/go-openapi/loads v0.21.1 // indirect
75+
github.com/go-openapi/runtime v0.23.3 // indirect
76+
github.com/go-openapi/spec v0.20.4 // indirect
77+
github.com/go-openapi/strfmt v0.21.2 // indirect
78+
github.com/go-openapi/swag v0.21.1 // indirect
79+
github.com/go-openapi/validate v0.21.0 // indirect
80+
github.com/go-playground/locales v0.14.0 // indirect
81+
github.com/go-playground/universal-translator v0.18.0 // indirect
82+
github.com/go-playground/validator/v10 v10.10.0 // indirect
83+
github.com/go-stack/stack v1.8.1 // indirect
84+
github.com/gogo/protobuf v1.3.2 // indirect
85+
github.com/golang-jwt/jwt/v4 v4.3.0 // indirect
86+
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
87+
github.com/golang/protobuf v1.5.2 // indirect
88+
github.com/golang/snappy v0.0.4 // indirect
89+
github.com/google/go-cmp v0.5.7 // indirect
90+
github.com/google/go-containerregistry v0.8.1-0.20220209165246-a44adc326839 // indirect
91+
github.com/google/go-github/v42 v42.0.0 // indirect
92+
github.com/google/go-querystring v1.1.0 // indirect
93+
github.com/google/gofuzz v1.2.0 // indirect
94+
github.com/google/trillian v1.4.0 // indirect
95+
github.com/googleapis/gax-go/v2 v2.2.0 // indirect
96+
github.com/googleapis/gnostic v0.5.5 // indirect
97+
github.com/googleapis/go-type-adapters v1.0.0 // indirect
98+
github.com/hashicorp/errwrap v1.1.0 // indirect
99+
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
100+
github.com/hashicorp/go-hclog v1.2.0 // indirect
101+
github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
102+
github.com/hashicorp/go-multierror v1.1.1 // indirect
103+
github.com/hashicorp/go-plugin v1.4.3 // indirect
104+
github.com/hashicorp/go-retryablehttp v0.7.0 // indirect
105+
github.com/hashicorp/go-rootcerts v1.0.2 // indirect
106+
github.com/hashicorp/go-secure-stdlib/mlock v0.1.2 // indirect
107+
github.com/hashicorp/go-secure-stdlib/parseutil v0.1.3 // indirect
108+
github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
109+
github.com/hashicorp/go-sockaddr v1.0.2 // indirect
110+
github.com/hashicorp/go-uuid v1.0.3 // indirect
111+
github.com/hashicorp/go-version v1.4.0 // indirect
112+
github.com/hashicorp/golang-lru v0.5.4 // indirect
113+
github.com/hashicorp/hcl v1.0.0 // indirect
114+
github.com/hashicorp/vault/api v1.5.0 // indirect
115+
github.com/hashicorp/vault/sdk v0.4.1 // indirect
116+
github.com/hashicorp/yamux v0.0.0-20211028200310-0bc27b27de87 // indirect
117+
github.com/imdario/mergo v0.3.12 // indirect
118+
github.com/jedisct1/go-minisign v0.0.0-20210703085342-c1f07ee84431 // indirect
119+
github.com/jmespath/go-jmespath v0.4.0 // indirect
120+
github.com/josharian/intern v1.0.0 // indirect
121+
github.com/json-iterator/go v1.1.12 // indirect
122+
github.com/klauspost/compress v1.14.2 // indirect
123+
github.com/leodido/go-urn v1.2.1 // indirect
124+
github.com/letsencrypt/boulder v0.0.0-20220331220046-b23ab962616e // indirect
125+
github.com/magiconair/properties v1.8.5 // indirect
126+
github.com/mailru/easyjson v0.7.7 // indirect
127+
github.com/mattn/go-colorable v0.1.12 // indirect
128+
github.com/mattn/go-isatty v0.0.14 // indirect
129+
github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 // indirect
130+
github.com/mitchellh/copystructure v1.2.0 // indirect
131+
github.com/mitchellh/go-homedir v1.1.0 // indirect
132+
github.com/mitchellh/go-testing-interface v1.14.1 // indirect
133+
github.com/mitchellh/mapstructure v1.4.3 // indirect
134+
github.com/mitchellh/reflectwalk v1.0.2 // indirect
135+
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
136+
github.com/modern-go/reflect2 v1.0.2 // indirect
137+
github.com/oklog/run v1.1.0 // indirect
138+
github.com/oklog/ulid v1.3.1 // indirect
139+
github.com/opencontainers/go-digest v1.0.0 // indirect
140+
github.com/opencontainers/image-spec v1.0.3-0.20220114050600-8b9d41f48198 // indirect
141+
github.com/opentracing/opentracing-go v1.2.0 // indirect
142+
github.com/pelletier/go-toml v1.9.4 // indirect
143+
github.com/pierrec/lz4 v2.6.1+incompatible // indirect
144+
github.com/pkg/errors v0.9.1 // indirect
145+
github.com/prometheus/client_golang v1.12.1 // indirect
146+
github.com/prometheus/client_model v0.2.0 // indirect
147+
github.com/prometheus/common v0.32.1 // indirect
148+
github.com/prometheus/procfs v0.7.3 // indirect
149+
github.com/ryanuber/go-glob v1.0.0 // indirect
150+
github.com/sassoftware/relic v0.0.0-20210427151427-dfb082b79b74 // indirect
151+
github.com/secure-systems-lab/go-securesystemslib v0.3.1 // indirect
152+
github.com/segmentio/ksuid v1.0.4 // indirect
153+
github.com/shibumi/go-pathspec v1.3.0 // indirect
154+
github.com/sigstore/fulcio v0.1.2-0.20220114150912-86a2036f9bc7 // indirect
155+
github.com/sigstore/rekor v0.4.1-0.20220114213500-23f583409af3 // indirect
156+
github.com/sirupsen/logrus v1.8.1 // indirect
157+
github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 // indirect
158+
github.com/spf13/afero v1.8.0 // indirect
159+
github.com/spf13/cast v1.4.1 // indirect
160+
github.com/spf13/cobra v1.4.0 // indirect
161+
github.com/spf13/jwalterweatherman v1.1.0 // indirect
162+
github.com/spf13/pflag v1.0.5 // indirect
163+
github.com/spf13/viper v1.10.1 // indirect
164+
github.com/spiffe/go-spiffe/v2 v2.0.0 // indirect
165+
github.com/subosito/gotenv v1.2.0 // indirect
166+
github.com/syndtr/goleveldb v1.0.1-0.20210819022825-2ae1ddf74ef7 // indirect
167+
github.com/tent/canonical-json-go v0.0.0-20130607151641-96e4ba3a7613 // indirect
168+
github.com/theupdateframework/go-tuf v0.0.0-20220211205608-f0c3294f63b9 // indirect
169+
github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 // indirect
170+
github.com/vbatts/tar-split v0.11.2 // indirect
171+
github.com/xanzy/go-gitlab v0.62.0 // indirect
172+
github.com/zeebo/errs v1.2.2 // indirect
173+
go.mongodb.org/mongo-driver v1.8.3 // indirect
174+
go.opencensus.io v0.23.0 // indirect
175+
go.uber.org/atomic v1.9.0 // indirect
176+
go.uber.org/multierr v1.7.0 // indirect
177+
go.uber.org/zap v1.21.0 // indirect
178+
golang.org/x/crypto v0.0.0-20220214200702-86341886e292 // indirect
179+
golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3 // indirect
180+
golang.org/x/net v0.0.0-20220325170049-de3da57026de // indirect
181+
golang.org/x/oauth2 v0.0.0-20220309155454-6242fa91716a // indirect
182+
golang.org/x/sync v0.0.0-20210220032951-036812b2e83c // indirect
183+
golang.org/x/sys v0.0.0-20220328115105-d36c6a25d886 // indirect
184+
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211 // indirect
185+
golang.org/x/text v0.3.7 // indirect
186+
golang.org/x/time v0.0.0-20220224211638-0e9765cccd65 // indirect
187+
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
188+
google.golang.org/api v0.74.0 // indirect
189+
google.golang.org/genproto v0.0.0-20220405205423-9d709892a2bf // indirect
190+
google.golang.org/grpc v1.45.0 // indirect
191+
google.golang.org/protobuf v1.28.0 // indirect
192+
gopkg.in/inf.v0 v0.9.1 // indirect
193+
gopkg.in/ini.v1 v1.66.2 // indirect
194+
gopkg.in/square/go-jose.v2 v2.6.0 // indirect
195+
gopkg.in/yaml.v2 v2.4.0 // indirect
196+
gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b // indirect
197+
k8s.io/api v0.23.5 // indirect
198+
k8s.io/apimachinery v0.23.5 // indirect
199+
k8s.io/client-go v0.23.5 // indirect
200+
k8s.io/klog/v2 v2.60.1-0.20220317184644-43cc75f9ae89 // indirect
201+
k8s.io/kube-openapi v0.0.0-20220124234850-424119656bbf // indirect
202+
k8s.io/utils v0.0.0-20220210201930-3a6ce19ff2f9 // indirect
203+
knative.dev/pkg v0.0.0-20220325200448-1f7514acd0c2 // indirect
204+
sigs.k8s.io/json v0.0.0-20211208200746-9f7c6b3444d2 // indirect
205+
sigs.k8s.io/release-utils v0.6.0 // indirect
206+
sigs.k8s.io/structured-merge-diff/v4 v4.2.1 // indirect
207+
sigs.k8s.io/yaml v1.3.0 // indirect
208+
)

‎go.sum

+3,024-3
Large diffs are not rendered by default.

‎main.go

+21-16
Original file line numberDiff line numberDiff line change
@@ -15,18 +15,19 @@
1515
package main
1616

1717
import (
18+
"errors"
1819
"flag"
1920
"fmt"
21+
"io/ioutil"
2022
"os"
21-
"os/exec"
2223

2324
"github.com/laurentsimon/slsa-github-generator-ko/builder/pkg"
2425
)
2526

2627
func usage(p string) {
2728
panic(fmt.Sprintf(`Usage:
2829
%s build [--dry] --env $ENV
29-
%s predicate --binary-name $NAME --digest $DIGEST --command $COMMAND --env $ENV`, p, p))
30+
%s predicate --artifact-name $NAME --digest $DIGEST --command $COMMAND --env $ENV`, p, p))
3031
}
3132

3233
func check(e error) {
@@ -38,15 +39,16 @@ func check(e error) {
3839
func main() {
3940
// Build command.
4041
buildCmd := flag.NewFlagSet("build", flag.ExitOnError)
41-
buildDry := buildCmd.Bool("dry", false, "dry run of the build without invoking compiler")
42-
buildEnv := buildCmd.String("env", "", "env variables used to compile the binary")
42+
buildDry := buildCmd.Bool("dry", false, "dry run of the build without invoking ko")
43+
buildEnv := buildCmd.String("env", "", "env variables for ko")
44+
buildArgs := buildCmd.String("args", "", "arguments for ko")
4345

4446
// Predicate command.
4547
predicateCmd := flag.NewFlagSet("predicate", flag.ExitOnError)
46-
predicateName := predicateCmd.String("binary-name", "", "untrusted binary name of the artifact built")
47-
predicateDigest := predicateCmd.String("digest", "", "sha256 digest of the untrusted binary")
48-
predicateCommand := predicateCmd.String("command", "", "command used to compile the binary")
49-
// predicateEnv := predicateCmd.String("env", "", "env variables used to compile the binary")
48+
predicateName := predicateCmd.String("artifact-name", "", "untrusted artifact name")
49+
predicateDigest := predicateCmd.String("digest", "", "sha256 digest of the artifact")
50+
predicateCommand := predicateCmd.String("command", "", "command used to generate the artifact")
51+
predicateEnv := predicateCmd.String("env", "", "env variables used to generate the artifact")
5052

5153
// Expect a sub-command.
5254
if len(os.Args) < 2 {
@@ -56,15 +58,18 @@ func main() {
5658
switch os.Args[1] {
5759
case buildCmd.Name():
5860
buildCmd.Parse(os.Args[2:])
59-
if len(buildCmd.Args()) < 1 {
60-
usage(os.Args[0])
61-
}
6261

63-
ko, err := exec.LookPath("ko")
64-
check(err)
62+
// TODO: update
63+
// ko, err := exec.LookPath("ko")
64+
// check(err)
65+
ko := "~/go/bin/ko"
6566

6667
kobuild := pkg.KoBuildNew(ko)
6768

69+
// Set arguments.
70+
err := kobuild.SetArgs(*buildArgs)
71+
check(err)
72+
6873
// Set env variables encoded as arguments.
6974
err = kobuild.SetArgEnvVariables(*buildEnv)
7075
check(err)
@@ -79,7 +84,7 @@ func main() {
7984
usage(os.Args[0])
8085
}
8186

82-
/*githubContext, ok := os.LookupEnv("GITHUB_CONTEXT")
87+
githubContext, ok := os.LookupEnv("GITHUB_CONTEXT")
8388
if !ok {
8489
panic(errors.New("environment variable GITHUB_CONTEXT not present"))
8590
}
@@ -92,8 +97,8 @@ func main() {
9297
err = ioutil.WriteFile(filename, attBytes, 0600)
9398
check(err)
9499

95-
fmt.Printf("::set-output name=signed-predicate-name::%s\n", filename)
96-
*/
100+
fmt.Printf("::set-output name=predicate::%s\n", filename)
101+
97102
default:
98103
fmt.Println("expected 'build' or 'predicate' subcommands")
99104
os.Exit(1)

‎pkg/build.go

+87-25
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,8 @@
1515
package pkg
1616

1717
import (
18+
"encoding/base64"
19+
"encoding/json"
1820
"errors"
1921
"fmt"
2022
"strings"
@@ -29,43 +31,103 @@ var (
2931
errorEmptyFilename = errors.New("filename is not set")
3032
)
3133

32-
// See `go build help`.
33-
// `-asmflags`, `-n`, `-mod`, `-installsuffix`, `-modfile`,
34-
// `-workfile`, `-overlay`, `-pkgdir`, `-toolexec`, `-o`,
35-
// `-modcacherw`, `-work` not supported for now.
36-
37-
var allowedBuildArgs = map[string]bool{
38-
"-a": true, "-race": true, "-msan": true, "-asan": true,
39-
"-v": true, "-x": true, "-buildinfo": true,
40-
"-buildmode": true, "-buildvcs": true, "-compiler": true,
41-
"-gccgoflags": true, "-gcflags": true,
42-
"-ldflags": true, "-linkshared": true,
43-
"-tags": true, "-trimpath": true,
44-
}
45-
46-
var allowedEnvVariablePrefix = map[string]bool{
47-
"GO": true, "CGO_": true, "KO_": true,
48-
"KIND_": true,
49-
}
50-
5134
type KoBuild struct {
52-
ko string
53-
argEnv map[string]string
35+
ko string
36+
args []string
37+
envs map[string]string
5438
}
5539

5640
func KoBuildNew(ko string) *KoBuild {
5741
c := KoBuild{
58-
ko: ko,
59-
argEnv: make(map[string]string),
42+
ko: ko,
43+
envs: make(map[string]string),
44+
args: make([]string, 0),
6045
}
6146

6247
return &c
6348
}
6449

6550
func (b *KoBuild) Run(dry bool) error {
51+
fmt.Println("Run")
52+
53+
command, err := b.generateCommandArgs()
54+
if err != nil {
55+
return err
56+
}
57+
58+
// A dry run prints the information that is "trusted", before
59+
// the compiler is invoked.
60+
if dry {
61+
// Share the arguments.
62+
command, err := marshallList(command)
63+
if err != nil {
64+
return err
65+
}
66+
fmt.Printf("::set-output name=command::%s\n", command)
67+
68+
// Share the env variables.
69+
env, err := b.generateCommandEnvVariables()
70+
if err != nil {
71+
return err
72+
}
73+
envs, err := marshallList(env)
74+
if err != nil {
75+
return err
76+
}
77+
fmt.Printf("::set-output name=envs::%s\n", envs)
78+
return nil
79+
}
80+
return nil
81+
}
82+
83+
func (b *KoBuild) SetArgs(args string) error {
84+
if args == "" {
85+
return nil
86+
}
87+
88+
for _, arg := range strings.Split(args, " ") {
89+
arg = strings.Trim(arg, " ")
90+
91+
fmt.Printf("arg: %s\n", arg)
92+
b.args = append(b.args, arg)
93+
94+
}
6695
return nil
6796
}
6897

98+
func (b *KoBuild) generateCommandEnvVariables() ([]string, error) {
99+
var env []string
100+
101+
// Set env variables from config file.
102+
for k, v := range b.envs {
103+
env = append(env, fmt.Sprintf("%s=%s", k, v))
104+
}
105+
106+
return env, nil
107+
}
108+
109+
func marshallList(args []string) (string, error) {
110+
jsonData, err := json.Marshal(args)
111+
if err != nil {
112+
return "", fmt.Errorf("json.Marshal: %w", err)
113+
}
114+
115+
encoded := base64.StdEncoding.EncodeToString(jsonData)
116+
if err != nil {
117+
return "", fmt.Errorf("base64.StdEncoding.DecodeString: %w", err)
118+
}
119+
return encoded, nil
120+
}
121+
122+
func (b *KoBuild) generateCommandArgs() ([]string, error) {
123+
flags := []string{b.ko, "publish"}
124+
125+
for _, v := range b.args {
126+
flags = append(flags, v)
127+
}
128+
return flags, nil
129+
}
130+
69131
func (b *KoBuild) SetArgEnvVariables(envs string) error {
70132
if envs == "" {
71133
return nil
@@ -74,15 +136,15 @@ func (b *KoBuild) SetArgEnvVariables(envs string) error {
74136
for _, e := range strings.Split(envs, ",") {
75137
s := strings.Trim(e, " ")
76138

77-
sp := strings.Split(s, ":")
139+
sp := strings.Split(s, "=")
78140
if len(sp) != 2 {
79141
return fmt.Errorf("%w: %s", errorInvalidEnvArgument, s)
80142
}
81143
name := strings.Trim(sp[0], " ")
82144
value := strings.Trim(sp[1], " ")
83145

84146
fmt.Printf("arg env: %s:%s\n", name, value)
85-
b.argEnv[name] = value
147+
b.envs[name] = value
86148

87149
}
88150
return nil

0 commit comments

Comments
 (0)
Please sign in to comment.