Add simple test for Maven builder

.github/workflows/e2e.maven.workflow_dispatch.main.default.slsa3.yml

@@ -0,0 +1,49 @@
+name: Maven e2e test - simple
+on:
+  schedule:
+    - cron: "0 6 * * *"
+  workflow_dispatch:
+
+permissions: read-all
+
+env:
+  GH_TOKEN: ${{ github.token }}
+
+jobs:
+  bootstrap:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      - run: mv e2e/maven/pom.xml ./ && cp -r e2e/maven/src ./ && rm -r e2e/maven/src
+  build:
+    #runs-on: ubuntu-latest
+    permissions:
+      id-token: write # For signing.
+      contents: read # For repo checkout of private repos.
+      actions: read # For getting workflow run on private repos.
+    uses: slsa-framework/slsa-github-generator/.github/workflows/builder_maven_slsa3.yml@main
+  verify:
+    runs-on: ubuntu-latest
+    needs: [build]
+    steps:
+      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-folder@main
+        with:
+          name: "${{ needs.build.outputs.provenance-download-name }}"
+          sha256: "${{ needs.build.outputs.provenance-download-sha256 }}"
+          path: slsa-attestations
+      - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-folder@main
+        with:
+          name: target
+          sha256: "${{ needs.build.outputs.target-download-sha256 }}"
+          path: ./
+      - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
+        with:
+          go-version: "1.18"
+      - env:
+          BINARY: ./target/test-java-project-0.1.19.jar
+          PROVENANCE: "slsa-attestations/${{ needs.build.outputs.provenance-download-name }}/test-java-project-0.1.19.jar.build.slsa"
+          BUILDER_TAG: "v2.0.0"
+        run: ./.github/workflows/scripts/e2e.maven.default.verify.sh

.github/workflows/scripts/e2e-utils.sh

@@ -433,7 +433,7 @@ _e2e_verify_query() {
     local expected="$2"
     local query="$3"
     name=$(echo -n "${attestation}" | jq -c -r "${query}")
-    e2e_assert_eq "${name}" "${expected}" "${query} should be ${expected}"
+    e2e_assert_eq "${name}" "${expected}" "${query} should be ${expected} but was ${name}"
 }
 
 # Returns the first 2 asset in a release.

.github/workflows/scripts/e2e-verify.common.sh

@@ -340,6 +340,11 @@ verify_provenance_authenticity() {
     if [[ "$tag" == "HEAD" ]] || version_ge "$tag" "v1.3"; then
         echo "  **** Default parameters (annotated tags) *****"
 
+        echo "1: ${artifactAndbuilderMinArgs[@]}"
+        echo "2: ${provenanceArg[@]}"
+        echo "3: ${packageArg[@]}"
+        echo "4: ${sourceArg[@]}"
+        echo "5: github.com/$GITHUB_REPOSITORY"
         $verifierCmd "${artifactAndbuilderMinArgs[@]}" "${provenanceArg[@]}" "${packageArg[@]}" "${sourceArg[@]}" "github.com/$GITHUB_REPOSITORY"
         e2e_assert_eq "$?" "0" "not main default parameters (annotated_tags)"
     elif [[ -z "$annotated_tags" ]]; then

.github/workflows/scripts/e2e.delegator.default.verify.sh

@@ -39,6 +39,10 @@ echo "DEBUG: file is $THIS_FILE"
 
 export SLSA_VERIFIER_TESTING="true"
 
+echo "finding..................."
+find . -name *.build.slsa
+find . -name "*.jar"
+
 # Verify provenance authenticity.
 # TODO(233): Update to v1.8.0 tag.
 e2e_run_verifier_all_releases "HEAD"

.github/workflows/scripts/e2e.maven.default.verify.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+
+# shellcheck source=/dev/null
+source "./.github/workflows/scripts/e2e-verify.common.sh"
+
+RUNNER_DEBUG=${RUNNER_DEBUG:-}
+if [[ -n "${RUNNER_DEBUG}" ]]; then
+    set -x
+fi
+
+go env -w GOFLAGS=-mod=mod
+
+verify_provenance_content() {
+    e2e_verify_predicate_subject_name "${ATTESTATION}" "test-java-project-0.1.19.jar"
+    e2e_verify_predicate_v1_runDetails_builder_id "${ATTESTATION}" "https://github.com/slsa-framework/slsa-github-generator/.github/workflows/builder_maven_slsa3.yml@refs/heads/main"
+    e2e_verify_predicate_v1_buildDefinition_buildType "${ATTESTATION}" "https://github.com/slsa-framework/slsa-github-generator/delegator-generic@v0"
+}
+
+THIS_FILE=$(e2e_this_file)
+BRANCH=$(echo "$THIS_FILE" | cut -d '.' -f4)
+echo "branch is $BRANCH"
+echo "GITHUB_REF_NAME: $GITHUB_REF_NAME"
+echo "GITHUB_REF_TYPE: $GITHUB_REF_TYPE"
+echo "GITHUB_REF: $GITHUB_REF"
+echo "DEBUG: file is $THIS_FILE"
+echo "PROVENANCE is: ${PROVENANCE}"
+
+ATTESTATION=$(jq -r '.dsseEnvelope.payload' "${PROVENANCE}" | base64 -d)
+export ATTESTATION
+
+export SLSA_VERIFIER_TESTING="true"
+
+# Verify provenance content.
+echo "verify_provenance_content:"
+verify_provenance_content

e2e/maven/pom.xml

@@ -0,0 +1,163 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
+   <modelVersion>4.0.0</modelVersion>
+   <groupId>io.github.adamkorcz</groupId>
+   <artifactId>test-java-project</artifactId>
+   <version>0.1.19</version>
+   <packaging>jar</packaging>
+   <name>Adams test java project</name>
+   <description>A test java project.</description>
+   <url>https://github.com/AdamKorcz/test-java-project</url>
+   <properties>
+      <maven.compiler.source>1.8</maven.compiler.source>
+      <maven.compiler.target>1.8</maven.compiler.target>
+   </properties>
+   <distributionManagement>
+      <snapshotRepository>
+         <id>ossrh</id>
+         <url>https://s01.oss.sonatype.org/content/repositories/snapshots</url>
+      </snapshotRepository>
+      <repository>
+         <id>ossrh</id>
+         <url>https://s01.oss.sonatype.org/service/local/staging/deploy/maven2/</url>
+      </repository>
+   </distributionManagement>
+   <licenses>
+      <license>
+         <name>MIT License</name>
+         <url>http://www.opensource.org/licenses/mit-license.php</url>
+      </license>
+   </licenses>
+   <developers>
+      <developer>
+         <name>Adam K</name>
+         <email>[email protected]</email>
+         <organization>Ada Logics</organization>
+         <organizationUrl>http://www.adalogics.com</organizationUrl>
+      </developer>
+   </developers>
+   <scm>
+      <connection>scm:git:git://github.com/adamkorcz/test-java-project.git</connection>
+      <developerConnection>scm:git:ssh://github.com:simpligility/test-java-project.git</developerConnection>
+      <url>http://github.com/adamkorcz/test-java-project/tree/main</url>
+   </scm>
+   <build>
+      <plugins>
+         <plugin>
+            <groupId>org.apache.maven.plugins</groupId>
+            <artifactId>maven-source-plugin</artifactId>
+            <version>2.2.1</version>
+            <executions>
+               <execution>
+                  <id>attach-sources</id>
+                  <phase>package</phase>
+                  <goals>
+                     <goal>jar-no-fork</goal>
+                  </goals>
+               </execution>
+            </executions>
+         </plugin>
+         <plugin>
+            <groupId>org.apache.maven.plugins</groupId>
+            <artifactId>maven-javadoc-plugin</artifactId>
+            <version>2.9.1</version>
+            <configuration>
+               <javadocExecutable>${java.home}/bin/javadoc</javadocExecutable>
+            </configuration>
+            <executions>
+               <execution>
+                  <id>attach-javadocs</id>
+                  <goals>
+                     <goal>jar</goal>
+                  </goals>
+               </execution>
+            </executions>
+         </plugin>
+         <plugin>
+            <groupId>org.apache.maven.plugins</groupId>
+            <artifactId>maven-shade-plugin</artifactId>
+            <version>3.2.4</version>
+            <executions>
+               <execution>
+                  <phase>package</phase>
+                  <goals>
+                     <goal>shade</goal>
+                  </goals>
+                  <configuration>
+                     <transformers>
+                        <transformer implementation="org.apache.maven.plugins.shade.resource.ManifestResourceTransformer">
+                           <mainClass>hello.HelloWorld</mainClass>
+                        </transformer>
+                     </transformers>
+                  </configuration>
+               </execution>
+            </executions>
+         </plugin>
+         <plugin>
+            <groupId>org.sonatype.plugins</groupId>
+            <artifactId>nexus-staging-maven-plugin</artifactId>
+            <version>1.6.7</version>
+            <extensions>true</extensions>
+            <configuration>
+               <serverId>ossrh</serverId>
+               <nexusUrl>https://s01.oss.sonatype.org/</nexusUrl>
+               <autoReleaseAfterClose>false</autoReleaseAfterClose>
+            </configuration>
+         </plugin>
+         <plugin>
+            <groupId>org.apache.maven.plugins</groupId>
+            <artifactId>maven-gpg-plugin</artifactId>
+            <version>3.1.0</version>
+            <executions>
+               <execution>
+                  <id>sign-artifacts</id>
+                  <phase>verify</phase>
+                  <goals>
+                     <goal>sign</goal>
+                  </goals>
+               </execution>
+            </executions>
+            <configuration>
+               <gpgArguments>
+                  <argument>--pinentry-mode</argument>
+                  <argument>loopback</argument>
+               </gpgArguments>
+            </configuration>
+         </plugin>
+         <plugin>
+            <groupId>org.apache.maven.plugins</groupId>
+            <artifactId>maven-deploy-plugin</artifactId>
+            <version>3.1.1</version>
+            <executions>
+              <execution>
+                  <id>deploy-file</id>
+                  <phase>deploy</phase>
+                  <goals>
+                      <goal>deploy-file</goal>
+                  </goals>
+                  <configuration>
+                      <file>textfile.txt</file>
+                      <url>https://s01.oss.sonatype.org/</url>
+                      <repositoryId>io.github.adamkorcz</repositoryId>
+                  </configuration>
+              </execution>
+          </executions>
+         </plugin>         
+         <plugin>
+             <groupId>io.github.slsa-framework.slsa-github-generator</groupId>
+             <artifactId>hash-maven-plugin</artifactId>
+             <version>0.0.1</version>
+             <executions>
+                 <execution>
+                     <goals>
+                         <goal>hash-jarfile</goal>
+                     </goals>
+                 </execution>
+             </executions>
+             <configuration>
+                 <outputJsonPath>${SLSA_OUTPUTS_ARTIFACTS_FILE}</outputJsonPath>
+             </configuration>
+         </plugin>
+      </plugins>
+   </build>
+</project>

e2e/maven/src/main/java/hello/Greeter.java

@@ -0,0 +1,7 @@
+package hello;
+
+public class Greeter {
+  public String sayHello() {
+    return "Hello world!";
+  }
+}

e2e/maven/src/main/java/hello/HelloWorld.java

@@ -0,0 +1,8 @@
+package hello;
+
+public class HelloWorld {
+  public static void main(String[] args) {
+    Greeter greeter = new Greeter();
+    System.out.println(greeter.sayHello());
+  }
+}