Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Haskell provenance #595

Merged
merged 5 commits into from
Jul 20, 2022
Merged

Haskell provenance #595

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
0e6b918
Add provenance for Haskell.
mihaimaruseac Jul 20, 2022
41c4dc1
Fix off-by-one counting errors
mihaimaruseac Jul 20, 2022
b23adc6
Remove trailing whitespace
mihaimaruseac Jul 20, 2022
7cf2791
Remove the build id step as it is not needed
mihaimaruseac Jul 20, 2022
887e626
Update README.md
laurentsimon Jul 20, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
85 changes: 77 additions & 8 deletions internal/builders/generic/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,7 @@ project simply generates provenance as a separate step in an existing workflow.
- [Provenance for Bazel](#provenance-for-bazel)
- [Provenance for Java](#provenance-for-java)
- [Provenance for Rust](#provenance-for-rust)
- [Provenance for Haskell](#provenance-for-haskell)

---

Expand Down Expand Up @@ -351,7 +352,7 @@ jobs:
### Provenance for Bazel

If you use [Bazel](https://bazel.build/) to generate your artifacts, you can
easily generate SLSA3 provenance by updating your existing workflow with the 4
easily generate SLSA3 provenance by updating your existing workflow with the 5
steps indicated in the workflow below:

```yaml
Expand Down Expand Up @@ -462,7 +463,7 @@ jobs:
run: |
# Your normal build workflow targets here
mvn clean package

# ======================================================
#
# Step 3: Save the location of the maven output files
Expand All @@ -484,7 +485,7 @@ jobs:
id: hash
run: |
echo "::set-output name=hashes::$(sha256sum ${{ steps.build.outputs.artifact_pattern }} | base64 -w0)"

- name: Upload build artifacts
uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # tag=v3.1.0
with:
Expand Down Expand Up @@ -541,7 +542,7 @@ jobs:

# ========================================================
#
# Step 4: Add a step to generate the provenance subjects
# Step 3: Add a step to generate the provenance subjects
# as shown below. Update the sha256 sum arguments
# to include all binaries that you generate
# provenance for.
Expand All @@ -553,7 +554,7 @@ jobs:
id: hash
run: |
echo "::set-output name=hashes::$(sha256sum ./build/libs/* | base64 -w0)"

- name: Upload build artifacts
uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # tag=v3.1.0
with:
Expand All @@ -563,7 +564,7 @@ jobs:

# =========================================================
#
# Step 5: Call the generic workflow to generate provenance
# Step 4: Call the generic workflow to generate provenance
# by declaring the job below.
#
# =========================================================
Expand Down Expand Up @@ -616,7 +617,7 @@ jobs:

# ========================================================
#
# Step 4: Add a step to generate the provenance subjects
# Step 3: Add a step to generate the provenance subjects
# as shown below. Update the sha256 sum arguments
# to include all binaries that you generate
# provenance for.
Expand All @@ -631,7 +632,75 @@ jobs:

# =========================================================
#
# Step 5: Call the generic workflow to generate provenance
# Step 4: Call the generic workflow to generate provenance
# by declaring the job below.
#
# =========================================================
provenance:
needs: [build]
permissions:
actions: read # To read the workflow path.
id-token: write # To sign the provenance.
contents: write # To add assets to a release.
uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
with:
base64-subjects: "${{ needs.build.outputs.hashes }}"
upload-assets: true # Optional: Upload to a new release
```

### Provenance for Haskell

If you use [Haskell](https://www.haskell.org/) (either via
[`cabal`](https://www.haskell.org/cabal/) or
[`stack`](https://docs.haskellstack.org/en/stable/README/)) to generate your
artifacts, you can easily generate SLSA3 provenance by updating your existing
workflow with the steps indicated in the workflow below.

```yaml
jobs:
build:
# ==================================================
#
# Step 1: Declare an `outputs` for the hashes to be
# used during the provenance steps.
#
# ==================================================
outputs:
hashes: ${{ steps.hash.outputs.hashes }}

[...]

steps:
[...]
- name: Build using Haskell
run: |
# Your normal build workflow targets here.
cabal build # or stack build

# Copy the binary to the root directory for easier reference
# For Cabal, use the following command
cp $(cabal list-bin .) .
# For Stack, use the following command instead
# cp $(stack path --local-install-root)/bin/target_binary .

# ========================================================
#
# Step 2: Add a step to generate the provenance subjects
# as shown below. Update the sha256 sum arguments
# to include all binaries that you generate
# provenance for.
#
# ========================================================
- name: Generate subject
id: hash
run: |
set -euo pipefail

echo "::set-output name=hashes::$(sha256sum target_binary | base64 -w0)"

# =========================================================
#
# Step 3: Call the generic workflow to generate provenance
# by declaring the job below.
#
# =========================================================
Expand Down