Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

docs: Add changelog entry for registry-username secret #1648

Merged
merged 5 commits into from
Feb 16, 2023
Merged

docs: Add changelog entry for registry-username secret #1648

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
73678f2
Add changelog entry for registry-username secret
Feb 15, 2023
357be2b
fix version
Feb 15, 2023
4801e36
Merge branch 'main' into registry-username-changelog
asraa Feb 15, 2023
adc24d1
Merge branch 'main' into registry-username-changelog
Feb 16, 2023
baefa71
Merge remote-tracking branch 'origin/registry-username-changelog' int…
Feb 16, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,6 +86,7 @@
#### New Features

- A new boolean [`continue-on-error`](https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/container/README.md#workflow-inputs) input was added which, when set to `true`, prevents the workflow from failing when a step fails. If set to true, the result of the reusable workflow will be return in the [`outcome`](https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/container/README.md#workflow-outputs) output.
- A new [`repository-username`](https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/container/README.md#workflow-inputs) secret input was added to allow users to pass their repository username that is stored in a [Github Actions encrypted secret](https://docs.github.com/en/actions/security-guides/encrypted-secrets).
Copy link
Collaborator

@laurentsimon laurentsimon Feb 15, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this will make the workflow fail if the username has low entropy, because GH scanning will find it in other strings like our hashes. Can we be more prescriptive about which option to use? For example, can we say that the secret option should only be used with high-entropy secrets and give an example of cloud providers where it's suitable? I think someone had mentioned the AWS username have high entropy.

In the case where username should not be a secret but users still want to avoid commiting it to the source code of the repo, we should tell users to use https://github.blog/2023-01-10-introducing-required-workflows-and-configuration-variables-to-github-actions/

Wdut?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks. That's a good call. I'll add a note about it here and more details in the docs on workflow inputs that it links to.

I assume the entropy issue is not that GitHub checks the entropy but just that something with low entropy will match hashes etc. more often?

Copy link
Collaborator

@laurentsimon laurentsimon Feb 15, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Correct, that's my understanding as well.

- Support was added for authenticating with [Google Artifact Registry](https://cloud.google.com/artifact-registry) and [Google Container Registry](https://cloud.google.com/container-registry) using [Workload Identity Federation](https://cloud.google.com/iam/docs/workload-identity-federation). Users can use this new feature by using the [`gcp-workload-identity-provider` and `gcp-service-account` inputs](https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/container/README.md#workflow-inputs)

## Changelog since v1.4.0
Expand Down