util: verify provenance #2110
Merged
util: verify provenance #2110
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
mkulke
force-pushed
the
mkulke/add-verify-provenance-helper
branch
2 times, most recently
from
6475f94 to
da4d86c
Compare
stevenhorsman
approved these changes
Oct 11, 2024
There was a problem hiding this comment.
Looks great. I've tried positive and negative cases locally with and without the -g mode and it seems to work in them. Great job @mkulke!
bpradipt
reviewed
Oct 14, 2024
This is prep-work to consume binaries with attestation from
guest-components. The tool asserts that the OCI image has been built on
the specified's repo with a push on a main branch and the specified
digest matches the git sha of the source code and workflow.
```bash
$ cd src/cloud-api-adaptor
$ ./hack/verify-provenance.sh \
-a ghcr.io/...@sha256:1234 \
-r confidential-containers/guest-components \
-d d8da69072424e496486dfb5421a26f16ff2a7abf
Verification passed
```
Signed-off-by: Magnus Kulke <[email protected]>
mkulke
force-pushed
the
mkulke/add-verify-provenance-helper
branch
from
da4d86c to
d399589
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is prep-work to consume binaries with attestation from guest-components (#2074) The tool asserts that the OCI image has been built on the specified repo with a push on the main branch and the specified digest matches the git sha of the source code and of the workflow.
Note: such a verification is only solid when performed for an oci image w/ digest, since the tags are mutable. we want to resolve a tag to a digest uri and then verify and pull that digest uri. (oras resolve image:tag)
$ cd src/cloud-api-adaptor $ ./hack/verify-provenance.sh \ -a ghcr.io/confidential-containers/guest-components/api-server-rest@sha256:0d2f600490caddb024c4e1e4c9d512c38a0d38e20131dd74702e6dfa4c6890b1 \ -r confidential-containers/guest-components \ -d d8da69072424e496486dfb5421a26f16ff2a7abf Verification passed