Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add functionality to output the UUID for log lookup purposes #3744

Closed
wants to merge 10 commits into from
Closed

Add functionality to output the UUID for log lookup purposes #3744

Show file tree
Hide file tree
Changes from 8 commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
930ed59
Add functionality to output the UUID for log lookup purposes
daoauth Jul 23, 2024
5d19df0
fix output name and update README.md
daoauth Jul 23, 2024
3473314
update description
daoauth Jul 23, 2024
d440ec9
reformat workflow outputs table
daoauth Jul 24, 2024
83b4cea
fix uuid length
daoauth Jul 24, 2024
4853ba0
fix markdown format
daoauth Jul 24, 2024
bf7ef05
Merge branch 'main' into main
daoauth Jul 26, 2024
d9a57c9
update CHANGELOG.md
daoauth Jul 30, 2024
6601053
update CHANGELOG.md
daoauth Jul 31, 2024
c81f799
Update CHANGELOG.md
daoauth Aug 1, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion .github/workflows/generator_generic_slsa3.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,6 +97,9 @@ on:
provenance-name:
description: "The artifact name of the signed provenance. (A file with the intoto.jsonl extension)."
value: ${{ jobs.generator.outputs.provenance-name }}
provenance-rekor-uuid:
description: "The Rekor UUID is a unique identifier that can be used to search for and view specific log entry details on the Rekor Search UI."
value: ${{ jobs.generator.outputs.uuid }}
# Note: we use this output because there is no buildt-in `outcome` and `result` is always `success`
# if `continue-on-error` is set to `true`.
outcome:
Expand Down Expand Up @@ -145,6 +148,7 @@ jobs:
outcome: ${{ steps.final.outputs.outcome }}
provenance-sha256: ${{ steps.sign-prov.outputs.provenance-sha256 }}
provenance-name: ${{ steps.sign-prov.outputs.provenance-name }}
uuid: ${{ steps.sign-prov.outputs.uuid }}
subject-artifact-name: ${{ steps.metadata.outputs.artifact_name }}
runs-on: ubuntu-latest
needs: [detect-env]
Expand Down Expand Up @@ -234,7 +238,10 @@ jobs:
# number of subjects based on in-toto attestation bundle file naming conventions.
# See: https://github.com/in-toto/attestation/blob/main/spec/bundle.md#file-naming-convention
# NOTE: The attest commmand outputs the provenance-name and provenance-sha256
"$GITHUB_WORKSPACE/$BUILDER_BINARY" attest --subjects-filename "${SUBJECTS_FILENAME}" -g "$untrusted_prov_name"
output=$("$GITHUB_WORKSPACE/$BUILDER_BINARY" attest --subjects-filename "${SUBJECTS_FILENAME}" -g "$untrusted_prov_name")
echo "$output"
uuid=$(echo "$output" | grep -oP 'UUID \K[0-9a-f]{80}')
Copy link
Collaborator

@ramonpetgrave64 ramonpetgrave64 Jul 26, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nonblocker: it seems the rekor UUID is meant to be 64 hex digits, not 80.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The length of the UUID generated in "create and sign provenance" is 80.

https://search.sigstore.dev/?uuid=24296fb24b8ad77a037b175b6a98db3d318ae8d94428f5be89eb07c8a6b70b58b54bdd32c7b15fb6

https://docs.sigstore.dev/logging/sharding/#identifier-definitions-entryid-uuid-logid-log-index

So, I think the UUID used as a search parameter in sigstore is actually an entry ID.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The additional prefix digits are for distinguishing which log "shard" hosts the content.

echo "uuid=$uuid" >> $GITHUB_OUTPUT
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Lint errors: please run make actionlint and make lint


- name: Upload the signed provenance
id: upload-prov
Expand Down
6 changes: 6 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

- [Unreleased](#unreleased)
- [Unreleased: Vars context recorded in provenance](#unreleased-vars-context-recorded-in-provenance)
- [Unreleased: Provenance Rekor UUID Output](#unreleased-provenance-rekor-uuid-output)
- [v2.0.0](#v200)
- [v2.0.0: Breaking Change: upload-artifact and download-artifact](#v200-breaking-change-upload-artifact-and-download-artifact)
- [v2.0.0: Breaking Change: attestation-name Workflow Input and Output](#v200-breaking-change-attestation-name-workflow-input-and-output)
Expand Down Expand Up @@ -112,6 +113,11 @@ duplication."
container generators. The `vars` context cannot affect the build in the Go
builder so it is not recorded.

### Unreleased: Provenance Rekor UUID Output

- **Added**: The workflow now includes the output of `provenance-rekor-uuid` for log lookup purposes.
This enhancement ensures that each build and deployment can be traced and audited using a unique identifier.
daoauth marked this conversation as resolved.
Show resolved Hide resolved

## v2.0.0

### v2.0.0: Breaking Change: upload-artifact and download-artifact
Expand Down
11 changes: 5 additions & 6 deletions internal/builders/generic/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -272,12 +272,11 @@ The [generic workflow](https://github.com/slsa-framework/slsa-github-generator/b

### Workflow Outputs

The [generic workflow](https://github.com/slsa-framework/slsa-github-generator/blob/main/.github/workflows/generator_generic_slsa3.yml) produces the following outputs:

| Name | Description |
| ----------------- | ----------------------------------------------------------------------------------------------- |
| `provenance-name` | The artifact name of the signed provenance. |
| `outcome` | If `continue-on-error` is `true`, will contain the outcome of the run (`success` or `failure`). |
| Name | Description |
| ----------------------- | -------------------------------------------------------------------------------------------------------------------------------- |
| `provenance-name` | The artifact name of the signed provenance. |
| `provenance-rekor-uuid` | The Rekor UUID is a unique identifier that can be used to search for and view specific log entry details on the Rekor Search UI. |
| `outcome` | If `continue-on-error` is `true`, will contain the outcome of the run (`success` or `failure`). |

### Provenance Format

Expand Down