From: Remi Gacogne Date: Wed, 22 Feb 2023 10:24:17 +0000 (+0100) Subject: builder-dispatch: Refactoring to get provenance for all targets X-Git-Tag: rec-5.0.0-alpha1~145^2~5 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=cc6bf85ff036523c1b8a057393ed5293c1a44886;p=thirdparty%2Fpdns.git builder-dispatch: Refactoring to get provenance for all targets Also include the list of installed packages during our package builds --- diff --git a/.github/workflows/builder-dispatch.yml b/.github/workflows/builder-dispatch.yml index 538e4e3511..9001c2c76c 100644 --- a/.github/workflows/builder-dispatch.yml +++ b/.github/workflows/builder-dispatch.yml @@ -61,7 +61,16 @@ jobs: os: ${{fromJson(needs.prepare.outputs.oslist)}} fail-fast: false outputs: - hashes: ${{ steps.hash.outputs.hashes }} + version: ${{ steps.getversion.outputs.version }} + pkghashes-el-7: ${{ steps.pkghashes.outputs.pkghashes-el-7 }} + pkghashes-el-8: ${{ steps.pkghashes.outputs.pkghashes-el-8 }} + pkghashes-el-9: ${{ steps.pkghashes.outputs.pkghashes-el-9 }} + pkghashes-debian-buster: ${{ steps.pkghashes.outputs.pkghashes-debian-buster }} + pkghashes-debian-bullseye: ${{ steps.pkghashes.outputs.pkghashes-debian-bullseye }} + pkghashes-ubuntu-bionic: ${{ steps.pkghashes.outputs.pkghashes-ubuntu-bionic }} + pkghashes-ubuntu-focal: ${{ steps.pkghashes.outputs.pkghashes-ubuntu-focal }} + pkghashes-ubuntu-jammy: ${{ steps.pkghashes.outputs.pkghashes-ubuntu-jammy }} + srchashes: ${{ steps.srchashes.outputs.srchashes }} steps: - uses: actions/checkout@v3 with: @@ -79,11 +88,22 @@ jobs: name: ${{ github.event.inputs.product }}-${{ matrix.os }}-${{ steps.getversion.outputs.version }} path: built_pkgs/ retention-days: 7 - - name: Generate hashes for provenance + - name: Extract packages from the tarball + # so we get provenance for individual packages (and the JSON package manifests from the builder) + id: extract + run: | + mkdir -m 700 -p ./packages/ + tar xvf ./built_pkgs/*/*/${{ github.event.inputs.product }}-${{ steps.getversion.outputs.version }}-${{ matrix.os }}.tar.bz2 -C ./packages/ --transform='s/.*\///' + - name: Generate package hashes for provenance + shell: bash + id: pkghashes + run: | + echo "pkghashes-${{ matrix.os }}=$(sha256sum ./packages/*.rpm ./packages/*.deb ./packages/*.json | base64 -w0)" >> $GITHUB_OUTPUT + - name: Generate source hash for provenance shell: bash - id: hash + id: srchashes run: | - echo "hashes=$(sha256sum ./built_pkgs/*/*/* | base64 -w0)" >> $GITHUB_OUTPUT + echo "srchashes=$(sha256sum ./built_pkgs/*/*/${{ github.event.inputs.product }}-${{ steps.getversion.outputs.version }}.tar.bz2 ./packages/*.json | base64 -w0)" >> $GITHUB_OUTPUT - name: Upload packages to downloads.powerdns.com env: SSHKEY: ${{ secrets.DOWNLOADS_AUTOBUILT_SECRET }} @@ -98,14 +118,31 @@ jobs: echo "$HOSTKEY" > ~/.ssh/known_hosts rsync -4rlptD built_pkgs/* "$RSYNCTARGET" - provenance: + provenance-pkgs: + needs: [prepare, build] + name: Generate provenance for ${{ github.event.inputs.product }} (${{ github.event.inputs.ref }}) for ${{ matrix.os }} + strategy: + matrix: + os: ${{fromJson(needs.prepare.outputs.oslist)}} + permissions: + actions: read # To read the workflow path. + id-token: write # To sign the provenance. + contents: write # To be able to upload assets as release artifacts + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.4.0 + with: + base64-subjects: "${{ needs.build.outputs[format('pkghashes-{0}', matrix.os)] }}" + upload-assets: false + provenance-name: "${{ github.event.inputs.product }}-${{ needs.build.outputs.version }}-${{ matrix.os}}.intoto.jsonl" + + provenance-src: needs: build - name: Generate build provenance + name: Generate provenance for ${{ github.event.inputs.product }} (${{ github.event.inputs.ref }}) source tarball permissions: actions: read # To read the workflow path. id-token: write # To sign the provenance. contents: write # To be able to upload assets as release artifacts uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.4.0 with: - base64-subjects: "${{ needs.build.outputs.hashes }}" + base64-subjects: "${{ needs.build.outputs.srchashes }}" upload-assets: false + provenance-name: "${{ github.event.inputs.product }}-${{ needs.build.outputs.version }}-src.intoto.jsonl" diff --git a/builder-support/dockerfiles/Dockerfile.debbuild b/builder-support/dockerfiles/Dockerfile.debbuild index 5b350d666a..46b315d74b 100644 --- a/builder-support/dockerfiles/Dockerfile.debbuild +++ b/builder-support/dockerfiles/Dockerfile.debbuild @@ -20,3 +20,7 @@ RUN builder/helpers/build-debs.sh dnsdist-${BUILDER_VERSION} RUN mv dnsdist*.deb /dist; mv dnsdist*.ddeb /dist || true @ENDIF + +# Generate provenance +RUN apt-get install -y python-apt || apt-get install -y python3-apt +@EVAL RUN python2 builder/helpers/generate-deb-provenance.py /dist/packages-${BUILDER_TARGET}.json || python3 builder/helpers/generate-deb-provenance.py /dist/packages-${BUILDER_TARGET}.json diff --git a/builder-support/dockerfiles/Dockerfile.rpmbuild b/builder-support/dockerfiles/Dockerfile.rpmbuild index b21923a435..6ba2911557 100644 --- a/builder-support/dockerfiles/Dockerfile.rpmbuild +++ b/builder-support/dockerfiles/Dockerfile.rpmbuild @@ -1,7 +1,11 @@ FROM dist-base as package-builder -RUN touch /var/lib/rpm/* && \ - yum upgrade -y && \ - yum install -y rpm-build rpmdevtools python3 "@Development Tools" +RUN touch /var/lib/rpm/* && if $(grep -q 'release 7' /etc/redhat-release); then \ + yum upgrade -y && \ + yum install -y rpm-build rpmdevtools python2 python3 "@Development Tools"; \ + else \ + yum upgrade -y && \ + yum install -y rpm-build rpmdevtools python3 "@Development Tools"; \ + fi RUN mkdir /dist /pdns WORKDIR /pdns @@ -54,6 +58,14 @@ RUN touch /var/lib/rpm/* && if $(grep -q 'release 7' /etc/redhat-release); then fi @ENDIF +# Generate provenance +@IF [ ${BUILDER_TARGET} = el-7 ] +@EVAL RUN python builder/helpers/generate-yum-provenance.py /dist/packages-${BUILDER_TARGET}.json || python3 builder/helpers/generate-yum-provenance.py /dist/packages-${BUILDER_TARGET}.json +@ENDIF +@IF [ ${BUILDER_TARGET} != el-7 ] +@EVAL RUN python builder/helpers/generate-dnf-provenance.py /dist/packages-${BUILDER_TARGET}.json || python3 builder/helpers/generate-dnf-provenance.py /dist/packages-${BUILDER_TARGET}.json +@ENDIF + # mv across layers with overlay2 is buggy in some kernel versions (results in empty dirs) # See: https://github.com/moby/moby/issues/33733 #RUN mv /root/rpmbuild/RPMS/* /dist/