Comments (5)
As of slsa-framework/slsa-github-generator-go#16 we capture the runner's Image details (GitHub tag) in the materials.
@laurentsimon proposed (slsa-framework/slsa-github-generator-go#16 (comment)) that we improve this by including the SHA (as tags are not immutable).
from slsa-github-generator.
Unfortunately the virtual-environment itself does not seem to include the SHA of the commit the tag references, but it's highly desirable to include this in order to list fully traceable information about the images in the provenance (tags can be replaced, after all).
One option is to query the ref the tag currently points to at provenance generation time with a programmatic equivalent to:
gh api -H "Accept: application/vnd.github.v3+json" /repos/actions/virtual-environments/git/matching-refs/tags/$ImageOS/$ImageVersion
However, what we really want is the SHA at the time the image was built. Unless anyone has any smarter ideas, I think I'll file a feature request against actions/virtual-environments to include the SHA commit hash matching the tag into the environment or the /imagegeneration/imagedata.json file.
from slsa-github-generator.
Unfortunately the virtual-environment itself does not seem to include the SHA of the commit the tag references, but it's highly desirable to include this in order to list fully traceable information about the images in the provenance (tags can be replaced, after all).
One option is to query the ref the tag currently points to at provenance generation time with a programmatic equivalent to:
gh api -H "Accept: application/vnd.github.v3+json" /repos/actions/virtual-environments/git/matching-refs/tags/$ImageOS/$ImageVersion
However, what we really want is the SHA at the time the image was built. Unless anyone has any smarter ideas, I think I'll file a feature request against actions/virtual-environments to include the SHA commit hash matching the tag into the environment or the /imagegeneration/imagedata.json file.
+1 on asking them to add it.
How about: gh api repos/$REPO/git/ref/tags/ubuntu20/20220425.1 | jq -r '.object.sha'
?
from slsa-github-generator.
+1 on asking them to add it.
The actions/virtual-environments repository has fairly rigid issue templates so I started a discussion instead: actions/runner-images#5483
from slsa-github-generator.
I'm curious: are we certain that the virtual runner used in the provenance generation VM is the same as the one used by the actual build?
Similarly: If we want to report the compiler hash used during compilation, we may also need to validate they are the same in the build VM and the dry run VM. Or we move to container image, maybe something like https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#example-running-a-job-within-a-container?
from slsa-github-generator.
Related Issues (20)
- [e2e]: nodejs push branch1 default slsa3 HOT 1
- [e2e]: nodejs push branch1 default slsa3 HOT 1
- [e2e]: generic push main upload-tag-name slsa3 HOT 1
- [e2e]: generic release main default slsa3 HOT 1
- [e2e]: go schedule main config-noldflags slsa3 HOT 1
- [e2e]: delegator-lowperms release main default slsa3 HOT 1
- [e2e]: nodejs push branch1 default slsa3 HOT 1
- [e2e]: container-based schedule main default slsa3 HOT 1
- [e2e]: delegator-generic push main default slsa3 HOT 1
- [e2e]: container workflow_dispatch branch1 default slsa3 HOT 1
- [feature] Custom GITHUB_TOKEN for go `upload-assets` HOT 1
- [e2e]: generic tag main goreleaser-assets-multi-subjects slsa3 HOT 2
- [bug][CI] DCO app is down HOT 2
- Renovate lockfile maintenance
- [e2e]: go release main config-ldflags-noassets slsa3 HOT 1
- [e2e]: generic tag main assets slsa3 HOT 1
- [e2e]: nodejs push main node18 slsa3 HOT 1
- [e2e]: go workflow_dispatch branch1 config-ldflags slsa3 HOT 1
- [e2e]: go schedule main config-noldflags slsa3 HOT 1
- [e2e]: container-based tag main default slsa3 HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from slsa-github-generator.