Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

blog: post for Build-Your-Own-Builder on GHA #929

Merged
merged 36 commits into from
Aug 25, 2023
Merged

blog: post for Build-Your-Own-Builder on GHA #929

merged 36 commits into from
Aug 25, 2023

Conversation

laurentsimon
Copy link
Contributor

@laurentsimon laurentsimon commented Jul 24, 2023 •
edited
Loading

Adds a guest blog post for Build-Your-Own-Builder on GHA.
ETA 14 Aug 2023. (May change if needed)

Images needed for the post:
action-release

action-reusable
byob drawio

resize-maven

Notes: a few TODOs in the text.

cc @aalmiray, @AdamKorcz, @steiza, @feelepxyz, @asraa @ianlewis @loosebazooka

@netlify
Copy link

netlify bot commented Jul 24, 2023 •
edited
Loading

✅ Deploy Preview for slsa ready!

Name Link
🔨 Latest commit 5554f3b
🔍 Latest deploy log https://app.netlify.com/sites/slsa/deploys/64dfbd982a2a4e00085dd93b
😎 Deploy Preview https://deploy-preview-929--slsa.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

@laurentsimon laurentsimon changed the title docs: blog post for Build-Your-Own-Builder on GHA content: blog post for Build-Your-Own-Builder on GHA Jul 25, 2023
MarkLodato
MarkLodato reviewed Jul 25, 2023
View reviewed changes
docs/_posts/2023-08-07-bring-your-own-builder-github.md Outdated Show resolved Hide resolved
docs/_posts/2023-08-07-bring-your-own-builder-github.md Outdated Show resolved Hide resolved
docs/_posts/2023-08-07-bring-your-own-builder-github.md Outdated Show resolved Hide resolved
docs/_posts/2023-08-07-bring-your-own-builder-github.md Outdated Show resolved Hide resolved
docs/_posts/2023-08-07-bring-your-own-builder-github.md Outdated Show resolved Hide resolved
docs/_posts/2023-08-07-bring-your-own-builder-github.md Outdated Show resolved Hide resolved
docs/_posts/2023-08-07-bring-your-own-builder-github.md Outdated Show resolved Hide resolved
docs/_posts/2023-08-07-bring-your-own-builder-github.md Outdated Show resolved Hide resolved
docs/_posts/2023-08-07-bring-your-own-builder-github.md Outdated Show resolved Hide resolved
docs/_posts/2023-08-07-bring-your-own-builder-github.md Outdated Show resolved Hide resolved
@MarkLodato MarkLodato changed the title content: blog post for Build-Your-Own-Builder on GHA blog: post for Build-Your-Own-Builder on GHA Jul 25, 2023
@laurentsimon
Copy link
Contributor Author

Can someone advise on showing $ signs correctly in the snippet (They don't show when viewing the webpage preview)?

@laurentsimon
Copy link
Contributor Author

@MarkLodato can you take a second look to see if your comments are addressed?

@laurentsimon
Copy link
Contributor Author

Looking for a second round of reviews. Thanks everyone

@inferno-chromium inferno-chromium requested a review from a team August 1, 2023 18:29
@inferno-chromium
Copy link
Contributor

Can someone from @slsa-framework/slsa-steering-committee please take a look at this. Thanks!

MarkLodato
MarkLodato approved these changes Aug 1, 2023
View reviewed changes
Copy link
Member

@MarkLodato MarkLodato left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

trishankatdatadog
trishankatdatadog reviewed Aug 1, 2023
View reviewed changes
Copy link
Member

@trishankatdatadog trishankatdatadog left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the blog post! Great idea, but needs a bit more explication of what the problems are, why the solution addresses them, and what this all means for the everyday user. Thanks again!

docs/_posts/2023-08-07-bring-your-own-builder-github.md Outdated Show resolved Hide resolved
docs/_posts/2023-08-07-bring-your-own-builder-github.md Outdated Show resolved Hide resolved
docs/_posts/2023-08-07-bring-your-own-builder-github.md Outdated Show resolved Hide resolved
docs/_posts/2023-08-07-bring-your-own-builder-github.md Outdated Show resolved Hide resolved
AdamKorcz
AdamKorcz suggested changes Aug 1, 2023
View reviewed changes
docs/_posts/2023-08-07-bring-your-own-builder-github.md Outdated Show resolved Hide resolved
docs/_posts/2023-08-07-bring-your-own-builder-github.md Outdated Show resolved Hide resolved
docs/_posts/2023-08-07-bring-your-own-builder-github.md Outdated

SLSA now provides and maintains official builders for [Go](2022-06-20-slsa-github-workflows.md), [Node.js](2023-05-11-bringing-improved-supply-chain-security-to-the-nodejs-ecosystem.md) and [Container](2023-06-13-slsa-github-worfklows-container-based.md) based projects. But what if you don't use any of these languages or use custom tooling that isn't supported by the official builders?

To empower the community to create their own provenance builders and leverage the secure architecture of the official SLSA builders we are releasing the ["Build Your Own Builder" (BYOB) framework](https://github.com/slsa-framework/slsa-github-generator/tree/main#build-your-own-builder) for GitHub Actions. This makes it easy to take an existing GitHub Action (e.g. [JReleaser](https://jreleaser.org/)) and make it produce [SLSA Build Level 3 provenance](/spec/v1.0/requirements#provenance-generation).
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggestion: Have a more direct answer to the question in the previous sentence/paragraph.

Copy link

@AdamKorcz AdamKorcz Aug 1, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It could for example be:

change

"To empower the community to create their own provenance builders and leverage the secure architecture of the official SLSA builders we are releasing the "Build Your Own Builder" (BYOB) framework for GitHub Actions."

to

"Today we release "Build Your Own Builder" (BYOB) framework for GitHub Actions which will empower the community to create their own provenance builders and leverage the secure architecture of the official SLSA builders."

or a bit more casual:

"Enter the "Build Your Own Builder" (BYOB) framework which will empower the community to create their own provenance builders and leverage the secure architecture of the official SLSA builders."

@laurentsimon
Copy link
Contributor Author

Please don't merge. I'll merge once we're ready (release cut, etc). Thanks

trishankatdatadog
trishankatdatadog approved these changes Aug 2, 2023
View reviewed changes
Copy link
Member

@trishankatdatadog trishankatdatadog left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM in the interest of unblocking

@trishankatdatadog
Copy link
Member

LGTM in the interest of unblocking

Bah, it didn't let me finish. I still think the threat model is unclear, but I think as long as readers get the idea that, "Hey, I really should use BYOB instead of my own stuff due to some apparently complicated details pertaining security", then that's good enough. Thanks for all of your hard work!

lehors
lehors approved these changes Aug 14, 2023
View reviewed changes
Copy link
Member

@lehors lehors left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewing this made me wonder about some meta questions about how this work is positioned with regard to the OpenSSF governance structure but I think this is a good post and I applaud the effort to make it easier for people to support SLSA.

docs/_posts/2023-08-21-bring-your-own-builder-github.md Outdated Show resolved Hide resolved
docs/_posts/2023-08-21-bring-your-own-builder-github.md Outdated

SLSA already provides and maintains official builders for [Go](2022-06-20-slsa-github-workflows.md), [Node.js](2023-05-11-bringing-improved-supply-chain-security-to-the-nodejs-ecosystem.md) and [Container](2023-06-13-slsa-github-worfklows-container-based.md) based projects. But what if you don't use any of these languages or use custom tooling that isn't supported by the official builders?

To empower the community to create their own provenance builders and leverage the secure architecture of the official SLSA builders we are releasing the ["Build Your Own Builder" (BYOB) framework](https://github.com/slsa-framework/slsa-github-generator/tree/main#build-your-own-builder) for GitHub Actions. This makes it easy to take an existing GitHub Action (e.g. [JReleaser](https://jreleaser.org/)) and make it produce [SLSA Build Level 3 provenance](/spec/v1.0/requirements#provenance-generation).
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Who decides what's an "official SLSA builder"? And who's "we"?
Sorry again for bugging everybody with process and governance questions... :-)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

good question. Till now we've been calling them "official" because their code lives under the slsa-framework org... Happy to re-phrase if you have a suggestion

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FWIW I don't think we've specifically used the word "official" to describe them in our blog posts or documentation so we could technically drop it.

We have used "SLSA Tooling SIG" and "SLSA Tooling working group" in our past blog posts to describe "us". I think that might be the best way to go instead of just saying "SLSA".
See:

The SLSA Tooling SIG is listed on the community page: https://slsa.dev/community

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The problem is that SIGs aren't meant to be primarily about producing code, Projects are:
https://github.com/ossf/tac/blob/main/organizational-structure-overview.md
So, we should move from SLSA Tooling SIG to SLSA Tooling Project and get it listed on the TAC page:
https://github.com/ossf/tac/blob/main/README.md

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fine with me. I'll update to "SLSA Tooling Project". Can you make the change to the TAC's README?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I suppose the TAC page update would include the reporting WG.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is also just a side note, but it seems strange that SLSA wouldn't be mentioned anywhere on the TAC page if it is indeed owned by OpenSSF

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok, so I think what we should do is to get a page for the project in the SCI WG repo that is linked from its README. I don't think it's worth creating a whole new repo for that since it would merely contained a README. That page can just explain what the project is about and point to the different tools already available and any other info that is relevant.
Then we can get it also listed on and linked from the TAC page.
I'm happy to help with all of that.

I agree it's unfortunate that SLSA doesn't appear on the TAC page at all. This is because it's a SIG and currently SIGs are not listed... I think it'd be worth adding but that requires the WGs to play along and submit changes to reflect changes in their WGs.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FYI, I just submitted a PR to give the Tooling project a home page and official standing in the openssf governance structure: ossf/wg-supply-chain-integrity#72

ianlewis
ianlewis reviewed Aug 15, 2023
View reviewed changes
docs/_posts/2023-08-21-bring-your-own-builder-github.md Outdated Show resolved Hide resolved
docs/_posts/2023-08-21-bring-your-own-builder-github.md Outdated Show resolved Hide resolved
docs/_posts/2023-08-21-bring-your-own-builder-github.md Outdated Show resolved Hide resolved
docs/_posts/2023-08-21-bring-your-own-builder-github.md Outdated Show resolved Hide resolved
docs/_posts/2023-08-21-bring-your-own-builder-github.md Outdated

SLSA already provides and maintains official builders for [Go](2022-06-20-slsa-github-workflows.md), [Node.js](2023-05-11-bringing-improved-supply-chain-security-to-the-nodejs-ecosystem.md) and [Container](2023-06-13-slsa-github-worfklows-container-based.md) based projects. But what if you don't use any of these languages or use custom tooling that isn't supported by the official builders?

To empower the community to create their own provenance builders and leverage the secure architecture of the official SLSA builders we are releasing the ["Build Your Own Builder" (BYOB) framework](https://github.com/slsa-framework/slsa-github-generator/tree/main#build-your-own-builder) for GitHub Actions. This makes it easy to take an existing GitHub Action (e.g. [JReleaser](https://jreleaser.org/)) and make it produce [SLSA Build Level 3 provenance](/spec/v1.0/requirements#provenance-generation).
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we make the release status clear and say that BYOB is being released in beta?

laurentsimon and others added 25 commits August 18, 2023 18:39
@laurentsimon
update
38f1c48 
Signed-off-by: laurentsimon <[email protected]>
@laurentsimon
explain BYOB benefits
5794e69 
Signed-off-by: laurentsimon <[email protected]>
@laurentsimon
update
ae30e01 
Signed-off-by: laurentsimon <[email protected]>
@laurentsimon
update
6571787 
Signed-off-by: laurentsimon <[email protected]>
@laurentsimon
update
ccf5260 
Signed-off-by: laurentsimon <[email protected]>
@laurentsimon
update
f4d7756 
Signed-off-by: laurentsimon <[email protected]>
@laurentsimon
update
3f6a1ad 
Signed-off-by: laurentsimon <[email protected]>
@laurentsimon @feelepxyz
Update docs/_posts/2023-08-07-bring-your-own-builder-github.md
ca0e08e 
Co-authored-by: Philip Harrison <[email protected]>
Signed-off-by: laurentsimon <[email protected]>
@laurentsimon @feelepxyz
Update docs/_posts/2023-08-07-bring-your-own-builder-github.md
a8ce2c8 
Co-authored-by: Philip Harrison <[email protected]>
Signed-off-by: laurentsimon <[email protected]>
@laurentsimon @feelepxyz
Update docs/_posts/2023-08-07-bring-your-own-builder-github.md
5004587 
Co-authored-by: Philip Harrison <[email protected]>
Signed-off-by: laurentsimon <[email protected]>
@laurentsimon @feelepxyz
Update docs/_posts/2023-08-07-bring-your-own-builder-github.md
5020a21 
Co-authored-by: Philip Harrison <[email protected]>
Signed-off-by: laurentsimon <[email protected]>
@laurentsimon
Fix dollar sign
8968614 
Signed-off-by: laurentsimon <[email protected]>
@laurentsimon
Fix dollar sign
04f90f8 
Signed-off-by: laurentsimon <[email protected]>
@laurentsimon
Remove slsa.dev from links
9ab12f9 
Signed-off-by: laurentsimon <[email protected]>
@laurentsimon
Remove 'you'
63d12b8 
Signed-off-by: laurentsimon <[email protected]>
@laurentsimon
Add moew diagrams
9b1f941 
Signed-off-by: laurentsimon <[email protected]>
@laurentsimon
Update diagram
6caa51b 
Signed-off-by: laurentsimon <[email protected]>
@laurentsimon
update
a3bd881 
Signed-off-by: laurentsimon <[email protected]>
@laurentsimon
update
09208c8 
Signed-off-by: laurentsimon <[email protected]>
@laurentsimon
update
1866e0b 
Signed-off-by: laurentsimon <[email protected]>
@laurentsimon
Explain verification
357c8da 
Signed-off-by: laurentsimon <[email protected]>
@laurentsimon
update
f5dc3f1 
Signed-off-by: laurentsimon <[email protected]>
@laurentsimon
push release date
61ce857 
Signed-off-by: laurentsimon <[email protected]>
@laurentsimon
push date
56177b6 
Signed-off-by: laurentsimon <[email protected]>
@laurentsimon
pushing date by 1 week
b1c195c 
Signed-off-by: laurentsimon <[email protected]>
@laurentsimon
resize image
5554f3b 
Signed-off-by: laurentsimon <[email protected]>
@travi travi mentioned this pull request Aug 18, 2023
Open
joshuagl
joshuagl approved these changes Aug 24, 2023
View reviewed changes
Copy link
Member

@joshuagl joshuagl left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Really nice work on BYOB and implementations for Java. 👏

@laurentsimon laurentsimon merged commit d932416 into slsa-framework:main Aug 25, 2023
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@olivekl olivekl olivekl left review comments

@AdamKorcz AdamKorcz AdamKorcz requested changes

@lehors lehors lehors approved these changes

@DavidKorczynski DavidKorczynski DavidKorczynski left review comments

@ianlewis ianlewis ianlewis left review comments

@feelepxyz feelepxyz feelepxyz left review comments

@trishankatdatadog trishankatdatadog trishankatdatadog approved these changes

@joshuagl joshuagl joshuagl approved these changes

@MarkLodato MarkLodato MarkLodato approved these changes

@mlieberman85 mlieberman85 Awaiting requested review from mlieberman85

Assignees
No one assigned
Labels
None yet
Projects
Issue triage
Status: ✅ Done
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.