From ea654f2aaf6c55767df5fb8585f2d35605bb4e96 Mon Sep 17 00:00:00 2001 From: Rouel Joseph Soberano Date: Mon, 22 Jan 2024 17:44:57 -0800 Subject: [PATCH] build: adding provenance generation to release-please workflow --- .github/actions/build/action.yml | 10 ++++++++++ .github/workflows/release-please.yml | 19 +++++++++++++++++++ PROVENANCE.md | 28 ++++++++++++++++++++++++++++ README.md | 4 ++++ 4 files changed, 61 insertions(+) create mode 100644 PROVENANCE.md diff --git a/.github/actions/build/action.yml b/.github/actions/build/action.yml index 5cf127c1..33e5280d 100644 --- a/.github/actions/build/action.yml +++ b/.github/actions/build/action.yml @@ -1,5 +1,9 @@ name: Build distribution files description: 'Build distribution files' +outputs: + package-hashes: + description: "base64-encoded sha256 hashes of distribution files" + value: ${{ steps.package-hashes.outputs.package-hashes }} runs: using: composite @@ -7,3 +11,9 @@ runs: - name: Build distribution files shell: bash run: poetry build + - name: Hash build files for provenance + id: package-hashes + shell: bash + working-directory: ./dist + run: | + echo "package-hashes=$(sha256sum * | base64 -w0)" >> "$GITHUB_OUTPUT" \ No newline at end of file diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index e081bc8d..05342c1e 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -7,6 +7,10 @@ on: jobs: release-package: runs-on: ubuntu-latest + outputs: + release-created: ${{ steps.release.outputs.release_created }} + upload-tag-name: ${{ steps.release.outputs.tag_name }} + package-hashes: ${{ steps.build.outputs.package-hashes}} permissions: id-token: write # Needed if using OIDC to get release secrets. contents: write # Contents and pull-requests are for release-please to make releases. @@ -41,6 +45,7 @@ jobs: ssm_parameter_pairs: '/production/common/releasing/pypi/token = PYPI_AUTH_TOKEN' - uses: ./.github/actions/build + id: build if: ${{ steps.release.outputs.releases_created }} - uses: ./.github/actions/build-docs @@ -51,3 +56,17 @@ jobs: with: token: ${{env.PYPI_AUTH_TOKEN}} dry_run: false + + release-provenance: + needs: [ 'release-package' ] + if: ${{ needs.release-package.outputs.release-created }} + runs-on: ubuntu-latest + permissions: + actions: read + id-token: write + contents: write + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.7.0 + with: + base64-subjects: "${{ needs.release-package.outputs.package-hashes }}" + upload-assets: true + upload-tag-name: ${{ needs.release-package.outputs.upload-tag-name }} diff --git a/PROVENANCE.md b/PROVENANCE.md new file mode 100644 index 00000000..f14396bc --- /dev/null +++ b/PROVENANCE.md @@ -0,0 +1,28 @@ +## Verifying SDK build provenance with the SLSA framework + +LaunchDarkly uses the [SLSA framework](https://slsa.dev/spec/v1.0/about) (Supply-chain Levels for Software Artifacts) to help developers make their supply chain more secure by ensuring the authenticity and build integrity of our published SDK packages. + +As part of [SLSA requirements for level 3 compliance](https://slsa.dev/spec/v1.0/requirements), LaunchDarkly publishes provenance about our SDK package builds using [GitHub's generic SLSA3 provenance generator](https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/generic/README.md#generation-of-slsa3-provenance-for-arbitrary-projects) for distribution alongside our packages. These attestations are available for download from the GitHub release page for the release version under Assets > `multiple-provenance.intoto.jsonl`. + +To verify SLSA provenance attestations, we recommend using [slsa-verifier](https://github.com/slsa-framework/slsa-verifier). Example usage for verifying SDK packages is included below: + +``` +# Download packages from PyPi +$ pip download --only-binary=:all: launchdarkly-server-sdk + +# Download provenance from Github release +$ curl --location -O \ + https://github.com/launchdarkly/python-server-sdk/releases/download/VERSION/multiple.intoto.jsonl + +# Run slsa-verifier to verify provenance against package artifacts +$ slsa-verifier verify-artifact \ +--provenance-path multiple-provenance.intoto.jsonl \ +--source-uri github.com/launchdarkly/launchdarkly-server-sdk \ +launchdarkly_server_sdk-VERSION-py3-none-any.whl + +TBD OUTPUT +``` + +Alternatively, to verify the provenance manually, the SLSA framework specifies [recommendations for verifying build artifacts](https://slsa.dev/spec/v1.0/verifying-artifacts) in their documentation. + +**Note:** These instructions do not apply when building our SDKs from source. diff --git a/README.md b/README.md index d659e85f..c70e6889 100644 --- a/README.md +++ b/README.md @@ -34,6 +34,10 @@ We run integration tests for all our SDKs using a centralized test harness. This We encourage pull requests and other contributions from the community. Check out our [contributing guidelines](CONTRIBUTING.md) for instructions on how to contribute to this SDK. +## Verifying SDK build provenance with the SLSA framework + +LaunchDarkly uses the [SLSA framework](https://slsa.dev/spec/v1.0/about) (Supply-chain Levels for Software Artifacts) to help developers make their supply chain more secure by ensuring the authenticity and build integrity of our published SDK packages. To learn more, see the [provenance guide](PROVENANCE.md). + ## About LaunchDarkly * LaunchDarkly is a continuous delivery platform that provides feature flags as a service and allows developers to iterate quickly and safely. We allow you to easily flag your features and manage them from the LaunchDarkly dashboard. With LaunchDarkly, you can: