SLSA Verification failed with `--source-tag` at v1.4.3

[suzuki-shunsuke]

SLSA Verification failed with --source-tag.

https://github.com/google/osv-scanner/releases/tag/v1.4.3

$ slsa-verifier verify-artifact --provenance-path multiple.intoto.jsonl osv-scanner_1.4.3_darwin_arm64 --source-uri=github.com/google/osv-scanner --source-tag v1.4.3
Verified signature against tlog entry index 46958093 at URL: https://rekor.sigstore.dev/api/v1/log/entries/24296fb24b8ad77a578bd1cfcad81368e4524e0ed934b939d91026a9b41ee64e53177ba71dee1b2d
Verifying artifact osv-scanner_1.4.3_darwin_arm64: FAILED: expected tag 'refs/tags/v1.4.3', got '': tag used to generate the binary does not match provenance

FAILED: SLSA verification failed: expected tag 'refs/tags/v1.4.3', got '': tag used to generate the binary does not match provenance

How to reproduce

Download multiple.intoto.jsonl and asset from GitHub Releases.

curl -LqO https://github.com/google/osv-scanner/releases/download/v1.4.3/multiple.intoto.jsonl
curl -LqO https://github.com/google/osv-scanner/releases/download/v1.4.3/osv-scanner_1.4.3_darwin_arm64

Install slsa-verifier.

$ slsa-verifier version
  ____    _       ____       _             __     __  _____   ____    ___   _____   ___   _____   ____
 / ___|  | |     / ___|     / \            \ \   / / | ____| |  _ \  |_ _| |  ___| |_ _| | ____| |  _ \
 \___ \  | |     \___ \    / _ \    _____   \ \ / /  |  _|   | |_) |  | |  | |_     | |  |  _|   | |_) |
  ___) | | |___   ___) |  / ___ \  |_____|   \ V /   | |___  |  _ <   | |  |  _|    | |  | |___  |  _ <
 |____/  |_____| |____/  /_/   \_\            \_/    |_____| |_| \_\ |___| |_|     |___| |_____| |_| \_\
slsa-verifier: Verify SLSA provenance for Github Actions

GitVersion:    2.0.3
GitCommit:     38829fa7d9491108bc3a86a6160fb2d53ddc3506
GitTreeState:  clean
BuildDate:     2023-03-11T03:02:01
GoVersion:     go1.18.10
Compiler:      gc
Platform:      darwin/arm64

Without --source-tag, slsa-verifier succeeded.

$ slsa-verifier verify-artifact --provenance-path multiple.intoto.jsonl osv-scanner_1.4.3_darwin_arm64 --source-uri=github.com/google/osv-scanner 
Verified signature against tlog entry index 46958093 at URL: https://rekor.sigstore.dev/api/v1/log/entries/24296fb24b8ad77a578bd1cfcad81368e4524e0ed934b939d91026a9b41ee64e53177ba71dee1b2d
Verified build using builder https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@refs/tags/v1.9.0 at commit 6316373e47d7e3e4b4fd3630c4bbc10987738de6
Verifying artifact osv-scanner_1.4.3_darwin_arm64: PASSED

PASSED: Verified SLSA provenance

However, slsa-verifier failed with --source-tag

$ slsa-verifier verify-artifact --provenance-path multiple.intoto.jsonl osv-scanner_1.4.3_darwin_arm64 --source-uri=github.com/google/osv-scanner --source-tag v1.4.3
Verified signature against tlog entry index 46958093 at URL: https://rekor.sigstore.dev/api/v1/log/entries/24296fb24b8ad77a578bd1cfcad81368e4524e0ed934b939d91026a9b41ee64e53177ba71dee1b2d
Verifying artifact osv-scanner_1.4.3_darwin_arm64: FAILED: expected tag 'refs/tags/v1.4.3', got '': tag used to generate the binary does not match provenance

FAILED: SLSA verification failed: expected tag 'refs/tags/v1.4.3', got '': tag used to generate the binary does not match provenance

Cause

• Update release pipeline #602

cf948ee

The event of .github/workflows/goreleaser.yml was changed from push event to workflow_dispatch event.
But to verify SLSA Provenance with --source-tag, the workflow must be triggered by push event.

[suzuki-shunsuke]

I opened a pull request to revert #602 .

• Revert "Update release pipeline (#602)" #633

[another-rex]

This is an intentional change, because we want to run the pipeline before the tag is introduced, as the tag is a Go library release, and can't change once added (e.g. needed in the event of the pipeline failing).

The issue is a limitation with the SLSA reusable workflow slsa-framework/slsa-github-generator#1947, and we do need to fix this (possibly by manually calling the slsa github action?).

I'll leave this issue open to track this until we can workaround the tagging limitation.

[suzuki-shunsuke]

I see. Thank you for your explanation.
One of the workarounds is creating two workflows with workflow_dispatch and push.

• workflow_dispatch
  • Test
  • Push a tag and trigger push event
    • To trigger a new workflow run, either personal access token or GitHub App must be used instead of GitHub Actions token
      • https://docs.github.com/en/actions/security-guides/automatic-token-authentication#using-the-github_token-in-a-workflow
• push
  • Release
  • We can prevent tags from being pushed from localhost by checking github.actor

[another-rex]

Good idea! I'll try to implement that before the next release (currently scheduled every 3 weeks (the release this week is a special case)).

[another-rex]

Hmm I spent a bit of time looking into this today, and it looks like it'll be harder to do than I expected.

The PAT requirement means whoever the PAT owner is can still manually push tags to release (since github.actor will be their username for both cases), and is another secret to maintain and refresh.

[suzuki-shunsuke]

How about creating GitHub Access tokens from GitHub App by https://github.com/tibdex/github-app-token or https://github.com/actions/create-github-app-token ?

[another-rex]

That requires registering a org level github app which we also want to avoid. I think we'll move back to a manual release process for now to unblock this until slsa-framework/slsa-github-generator#1947 can be resolved.

[suzuki-shunsuke]

I see.

I think we'll move back to a manual release process for now to unblock this

Should I reopen #633 ?

[another-rex]

No need, I made #681 with some changes to allow us to manually trigger a workflow which runs through the pre release checks, before manually pushing the tag to trigger the actual release.

[suzuki-shunsuke]

Got it. Thank you!