Skip to content

Commit 7701105

Browse files
wraithgarwlynch
wraithgar
and
wlynch
authored
feat: Add GitLab CI provenance (#6375) (#6526)
This is a first pass at provenance generation for GitLab CI. This is based loosely off of existing GitLab provenance documents: https://about.gitlab.com/blog/2022/11/30/achieve-slsa-level-2-compliance-with-gitlab/ https://gist.github.com/wlynch/c7fd8f53adc77d3c0ec82356e4d43cb5 Co-authored-by: Billy Lynch <1844673+wlynch@users.noreply.github.com>
1 parent 03aaa78 commit 7701105

File tree

3 files changed

+434
-62
lines changed

3 files changed

+434
-62
lines changed

‎workspaces/libnpmpublish/lib/provenance.js

+184-49
Original file line numberDiff line numberDiff line change
@@ -1,69 +1,204 @@
11
const { sigstore } = require('sigstore')
22
const { readFile } = require('fs/promises')
3+
const ci = require('ci-info')
4+
const { env } = process
35

46
const INTOTO_PAYLOAD_TYPE = 'application/vnd.in-toto+json'
57
const INTOTO_STATEMENT_TYPE = 'https://in-toto.io/Statement/v0.1'
68
const SLSA_PREDICATE_TYPE = 'https://slsa.dev/provenance/v0.2'
79

8-
const BUILDER_ID = 'https://github.com/actions/runner'
9-
const BUILD_TYPE_PREFIX = 'https://github.com/npm/cli/gha'
10-
const BUILD_TYPE_VERSION = 'v2'
10+
const GITHUB_BUILDER_ID = 'https://github.com/actions/runner'
11+
const GITHUB_BUILD_TYPE_PREFIX = 'https://github.com/npm/cli/gha'
12+
const GITHUB_BUILD_TYPE_VERSION = 'v2'
13+
14+
const GITLAB_BUILD_TYPE_PREFIX = 'https://github.com/npm/cli/gitlab'
15+
const GITLAB_BUILD_TYPE_VERSION = 'v0alpha1'
1116

1217
const generateProvenance = async (subject, opts) => {
13-
const { env } = process
14-
/* istanbul ignore next - not covering missing env var case */
15-
const [workflowPath] = (env.GITHUB_WORKFLOW_REF || '')
16-
.replace(env.GITHUB_REPOSITORY + '/', '')
17-
.split('@')
18-
const payload = {
19-
_type: INTOTO_STATEMENT_TYPE,
20-
subject,
21-
predicateType: SLSA_PREDICATE_TYPE,
22-
predicate: {
23-
buildType: `${BUILD_TYPE_PREFIX}/${BUILD_TYPE_VERSION}`,
24-
builder: { id: BUILDER_ID },
25-
invocation: {
26-
configSource: {
27-
uri: `git+${env.GITHUB_SERVER_URL}/${env.GITHUB_REPOSITORY}@${env.GITHUB_REF}`,
28-
digest: {
29-
sha1: env.GITHUB_SHA,
18+
let payload
19+
if (ci.GITHUB_ACTIONS) {
20+
/* istanbul ignore next - not covering missing env var case */
21+
const [workflowPath] = (env.GITHUB_WORKFLOW_REF || '')
22+
.replace(env.GITHUB_REPOSITORY + '/', '')
23+
.split('@')
24+
payload = {
25+
_type: INTOTO_STATEMENT_TYPE,
26+
subject,
27+
predicateType: SLSA_PREDICATE_TYPE,
28+
predicate: {
29+
buildType: `${GITHUB_BUILD_TYPE_PREFIX}/${GITHUB_BUILD_TYPE_VERSION}`,
30+
builder: { id: GITHUB_BUILDER_ID },
31+
invocation: {
32+
configSource: {
33+
uri: `git+${env.GITHUB_SERVER_URL}/${env.GITHUB_REPOSITORY}@${env.GITHUB_REF}`,
34+
digest: {
35+
sha1: env.GITHUB_SHA,
36+
},
37+
entryPoint: workflowPath,
38+
},
39+
parameters: {},
40+
environment: {
41+
GITHUB_EVENT_NAME: env.GITHUB_EVENT_NAME,
42+
GITHUB_REF: env.GITHUB_REF,
43+
GITHUB_REPOSITORY: env.GITHUB_REPOSITORY,
44+
GITHUB_REPOSITORY_ID: env.GITHUB_REPOSITORY_ID,
45+
GITHUB_REPOSITORY_OWNER_ID: env.GITHUB_REPOSITORY_OWNER_ID,
46+
GITHUB_RUN_ATTEMPT: env.GITHUB_RUN_ATTEMPT,
47+
GITHUB_RUN_ID: env.GITHUB_RUN_ID,
48+
GITHUB_SHA: env.GITHUB_SHA,
49+
GITHUB_WORKFLOW_REF: env.GITHUB_WORKFLOW_REF,
50+
GITHUB_WORKFLOW_SHA: env.GITHUB_WORKFLOW_SHA,
3051
},
31-
entryPoint: workflowPath,
3252
},
33-
parameters: {},
34-
environment: {
35-
GITHUB_EVENT_NAME: env.GITHUB_EVENT_NAME,
36-
GITHUB_REF: env.GITHUB_REF,
37-
GITHUB_REPOSITORY: env.GITHUB_REPOSITORY,
38-
GITHUB_REPOSITORY_ID: env.GITHUB_REPOSITORY_ID,
39-
GITHUB_REPOSITORY_OWNER_ID: env.GITHUB_REPOSITORY_OWNER_ID,
40-
GITHUB_RUN_ATTEMPT: env.GITHUB_RUN_ATTEMPT,
41-
GITHUB_RUN_ID: env.GITHUB_RUN_ID,
42-
GITHUB_SHA: env.GITHUB_SHA,
43-
GITHUB_WORKFLOW_REF: env.GITHUB_WORKFLOW_REF,
44-
GITHUB_WORKFLOW_SHA: env.GITHUB_WORKFLOW_SHA,
53+
metadata: {
54+
buildInvocationId: `${env.GITHUB_RUN_ID}-${env.GITHUB_RUN_ATTEMPT}`,
55+
completeness: {
56+
parameters: false,
57+
environment: false,
58+
materials: false,
59+
},
60+
reproducible: false,
4561
},
62+
materials: [
63+
{
64+
uri: `git+${env.GITHUB_SERVER_URL}/${env.GITHUB_REPOSITORY}@${env.GITHUB_REF}`,
65+
digest: {
66+
sha1: env.GITHUB_SHA,
67+
},
68+
},
69+
],
4670
},
47-
metadata: {
48-
buildInvocationId: `${env.GITHUB_RUN_ID}-${env.GITHUB_RUN_ATTEMPT}`,
49-
completeness: {
50-
parameters: false,
51-
environment: false,
52-
materials: false,
71+
}
72+
}
73+
if (ci.GITLAB) {
74+
payload = {
75+
_type: INTOTO_STATEMENT_TYPE,
76+
subject,
77+
predicateType: SLSA_PREDICATE_TYPE,
78+
predicate: {
79+
buildType: `${GITLAB_BUILD_TYPE_PREFIX}/${GITLAB_BUILD_TYPE_VERSION}`,
80+
builder: { id: `${env.CI_PROJECT_URL}/-/runners/${env.CI_RUNNER_ID}` },
81+
invocation: {
82+
configSource: {
83+
uri: `git+${env.CI_PROJECT_URL}`,
84+
digest: {
85+
sha1: env.CI_COMMIT_SHA,
86+
},
87+
entryPoint: env.CI_JOB_NAME,
88+
},
89+
parameters: {
90+
CI: env.CI,
91+
CI_API_GRAPHQL_URL: env.CI_API_GRAPHQL_URL,
92+
CI_API_V4_URL: env.CI_API_V4_URL,
93+
CI_BUILD_BEFORE_SHA: env.CI_BUILD_BEFORE_SHA,
94+
CI_BUILD_ID: env.CI_BUILD_ID,
95+
CI_BUILD_NAME: env.CI_BUILD_NAME,
96+
CI_BUILD_REF: env.CI_BUILD_REF,
97+
CI_BUILD_REF_NAME: env.CI_BUILD_REF_NAME,
98+
CI_BUILD_REF_SLUG: env.CI_BUILD_REF_SLUG,
99+
CI_BUILD_STAGE: env.CI_BUILD_STAGE,
100+
CI_COMMIT_BEFORE_SHA: env.CI_COMMIT_BEFORE_SHA,
101+
CI_COMMIT_BRANCH: env.CI_COMMIT_BRANCH,
102+
CI_COMMIT_REF_NAME: env.CI_COMMIT_REF_NAME,
103+
CI_COMMIT_REF_PROTECTED: env.CI_COMMIT_REF_PROTECTED,
104+
CI_COMMIT_REF_SLUG: env.CI_COMMIT_REF_SLUG,
105+
CI_COMMIT_SHA: env.CI_COMMIT_SHA,
106+
CI_COMMIT_SHORT_SHA: env.CI_COMMIT_SHORT_SHA,
107+
CI_COMMIT_TIMESTAMP: env.CI_COMMIT_TIMESTAMP,
108+
CI_COMMIT_TITLE: env.CI_COMMIT_TITLE,
109+
CI_CONFIG_PATH: env.CI_CONFIG_PATH,
110+
CI_DEFAULT_BRANCH: env.CI_DEFAULT_BRANCH,
111+
CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX:
112+
env.CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX,
113+
CI_DEPENDENCY_PROXY_GROUP_IMAGE_PREFIX: env.CI_DEPENDENCY_PROXY_GROUP_IMAGE_PREFIX,
114+
CI_DEPENDENCY_PROXY_SERVER: env.CI_DEPENDENCY_PROXY_SERVER,
115+
CI_DEPENDENCY_PROXY_USER: env.CI_DEPENDENCY_PROXY_USER,
116+
CI_JOB_ID: env.CI_JOB_ID,
117+
CI_JOB_NAME: env.CI_JOB_NAME,
118+
CI_JOB_NAME_SLUG: env.CI_JOB_NAME_SLUG,
119+
CI_JOB_STAGE: env.CI_JOB_STAGE,
120+
CI_JOB_STARTED_AT: env.CI_JOB_STARTED_AT,
121+
CI_JOB_URL: env.CI_JOB_URL,
122+
CI_NODE_TOTAL: env.CI_NODE_TOTAL,
123+
CI_PAGES_DOMAIN: env.CI_PAGES_DOMAIN,
124+
CI_PAGES_URL: env.CI_PAGES_URL,
125+
CI_PIPELINE_CREATED_AT: env.CI_PIPELINE_CREATED_AT,
126+
CI_PIPELINE_ID: env.CI_PIPELINE_ID,
127+
CI_PIPELINE_IID: env.CI_PIPELINE_IID,
128+
CI_PIPELINE_SOURCE: env.CI_PIPELINE_SOURCE,
129+
CI_PIPELINE_URL: env.CI_PIPELINE_URL,
130+
CI_PROJECT_CLASSIFICATION_LABEL: env.CI_PROJECT_CLASSIFICATION_LABEL,
131+
CI_PROJECT_DESCRIPTION: env.CI_PROJECT_DESCRIPTION,
132+
CI_PROJECT_ID: env.CI_PROJECT_ID,
133+
CI_PROJECT_NAME: env.CI_PROJECT_NAME,
134+
CI_PROJECT_NAMESPACE: env.CI_PROJECT_NAMESPACE,
135+
CI_PROJECT_NAMESPACE_ID: env.CI_PROJECT_NAMESPACE_ID,
136+
CI_PROJECT_PATH: env.CI_PROJECT_PATH,
137+
CI_PROJECT_PATH_SLUG: env.CI_PROJECT_PATH_SLUG,
138+
CI_PROJECT_REPOSITORY_LANGUAGES: env.CI_PROJECT_REPOSITORY_LANGUAGES,
139+
CI_PROJECT_ROOT_NAMESPACE: env.CI_PROJECT_ROOT_NAMESPACE,
140+
CI_PROJECT_TITLE: env.CI_PROJECT_TITLE,
141+
CI_PROJECT_URL: env.CI_PROJECT_URL,
142+
CI_PROJECT_VISIBILITY: env.CI_PROJECT_VISIBILITY,
143+
CI_REGISTRY: env.CI_REGISTRY,
144+
CI_REGISTRY_IMAGE: env.CI_REGISTRY_IMAGE,
145+
CI_REGISTRY_USER: env.CI_REGISTRY_USER,
146+
CI_RUNNER_DESCRIPTION: env.CI_RUNNER_DESCRIPTION,
147+
CI_RUNNER_ID: env.CI_RUNNER_ID,
148+
CI_RUNNER_TAGS: env.CI_RUNNER_TAGS,
149+
CI_SERVER_HOST: env.CI_SERVER_HOST,
150+
CI_SERVER_NAME: env.CI_SERVER_NAME,
151+
CI_SERVER_PORT: env.CI_SERVER_PORT,
152+
CI_SERVER_PROTOCOL: env.CI_SERVER_PROTOCOL,
153+
CI_SERVER_REVISION: env.CI_SERVER_REVISION,
154+
CI_SERVER_SHELL_SSH_HOST: env.CI_SERVER_SHELL_SSH_HOST,
155+
CI_SERVER_SHELL_SSH_PORT: env.CI_SERVER_SHELL_SSH_PORT,
156+
CI_SERVER_URL: env.CI_SERVER_URL,
157+
CI_SERVER_VERSION: env.CI_SERVER_VERSION,
158+
CI_SERVER_VERSION_MAJOR: env.CI_SERVER_VERSION_MAJOR,
159+
CI_SERVER_VERSION_MINOR: env.CI_SERVER_VERSION_MINOR,
160+
CI_SERVER_VERSION_PATCH: env.CI_SERVER_VERSION_PATCH,
161+
CI_TEMPLATE_REGISTRY_HOST: env.CI_TEMPLATE_REGISTRY_HOST,
162+
GITLAB_CI: env.GITLAB_CI,
163+
GITLAB_FEATURES: env.GITLAB_FEATURES,
164+
GITLAB_USER_ID: env.GITLAB_USER_ID,
165+
GITLAB_USER_LOGIN: env.GITLAB_USER_LOGIN,
166+
RUNNER_GENERATE_ARTIFACTS_METADATA: env.RUNNER_GENERATE_ARTIFACTS_METADATA,
167+
},
168+
environment: {
169+
name: env.CI_RUNNER_DESCRIPTION,
170+
architecture: env.CI_RUNNER_EXECUTABLE_ARCH,
171+
server: env.CI_SERVER_URL,
172+
project: env.CI_PROJECT_PATH,
173+
job: {
174+
id: env.CI_JOB_ID,
175+
},
176+
pipeline: {
177+
id: env.CI_PIPELINE_ID,
178+
ref: env.CI_CONFIG_PATH,
179+
},
180+
},
53181
},
54-
reproducible: false,
55-
},
56-
materials: [
57-
{
58-
uri: `git+${env.GITHUB_SERVER_URL}/${env.GITHUB_REPOSITORY}@${env.GITHUB_REF}`,
59-
digest: {
60-
sha1: env.GITHUB_SHA,
182+
metadata: {
183+
buildInvocationId: `${env.CI_JOB_URL}`,
184+
completeness: {
185+
parameters: true,
186+
environment: true,
187+
materials: false,
61188
},
189+
reproducible: false,
62190
},
63-
],
64-
},
191+
materials: [
192+
{
193+
uri: `git+${env.CI_PROJECT_URL}`,
194+
digest: {
195+
sha1: env.CI_COMMIT_SHA,
196+
},
197+
},
198+
],
199+
},
200+
}
65201
}
66-
67202
return sigstore.attest(Buffer.from(JSON.stringify(payload)), INTOTO_PAYLOAD_TYPE, opts)
68203
}
69204

‎workspaces/libnpmpublish/lib/publish.js

+21-13
Original file line numberDiff line numberDiff line change
@@ -166,7 +166,7 @@ const buildMetadata = async (registry, manifest, tarballData, spec, opts) => {
166166
provenanceBundle = await generateProvenance([subject], opts)
167167

168168
/* eslint-disable-next-line max-len */
169-
log.notice('publish', 'Signed provenance statement with source and build information from GitHub Actions')
169+
log.notice('publish', `Signed provenance statement with source and build information from ${ciInfo.name}`)
170170

171171
const tlogEntry = provenanceBundle?.verificationMaterial?.tlogEntries[0]
172172
/* istanbul ignore else */
@@ -242,19 +242,27 @@ const patchMetadata = (current, newData) => {
242242

243243
// Check that all the prereqs are met for provenance generation
244244
const ensureProvenanceGeneration = async (registry, spec, opts) => {
245-
// Ensure that we're running in GHA, currently the only supported build environment
246-
if (ciInfo.name !== 'GitHub Actions') {
247-
throw Object.assign(
248-
new Error('Automatic provenance generation not supported outside of GitHub Actions'),
249-
{ code: 'EUSAGE' }
250-
)
251-
}
252-
253-
// Ensure that the GHA OIDC token is available
254-
if (!process.env.ACTIONS_ID_TOKEN_REQUEST_URL) {
245+
if (ciInfo.GITHUB_ACTIONS) {
246+
// Ensure that the GHA OIDC token is available
247+
if (!process.env.ACTIONS_ID_TOKEN_REQUEST_URL) {
248+
throw Object.assign(
249+
/* eslint-disable-next-line max-len */
250+
new Error('Provenance generation in GitHub Actions requires "write" access to the "id-token" permission'),
251+
{ code: 'EUSAGE' }
252+
)
253+
}
254+
} else if (ciInfo.GITLAB) {
255+
// Ensure that the Sigstore OIDC token is available
256+
if (!process.env.SIGSTORE_ID_TOKEN) {
257+
throw Object.assign(
258+
/* eslint-disable-next-line max-len */
259+
new Error('Provenance generation in GitLab CI requires "SIGSTORE_ID_TOKEN" with "sigstore" audience to be present in "id_tokens". For more info see:\nhttps://docs.gitlab.com/ee/ci/secrets/id_token_authentication.html'),
260+
{ code: 'EUSAGE' }
261+
)
262+
}
263+
} else {
255264
throw Object.assign(
256-
/* eslint-disable-next-line max-len */
257-
new Error('Provenance generation in GitHub Actions requires "write" access to the "id-token" permission'),
265+
new Error('Automatic provenance generation not supported for provider: ' + ciInfo.name),
258266
{ code: 'EUSAGE' }
259267
)
260268
}

0 commit comments

Comments
 (0)