debug: generic as byob

Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
Signed-off-by: Ramon Petgrave <32398091+ramonpetgrave64@users.noreply.github.com>

.github/workflows/builder_generic_slsa3.yml

@@ -29,6 +29,11 @@ on:
         required: false
         type: string
 
+      provenance-name:
+        description: The artifact name of the signed provenance. The file must have the intoto.jsonl extension. Defaults to <filename>.intoto.jsonl for single artifact or multiple.intoto.jsonl for multiple artifacts.
+        required: false
+        type: string
+
       rekor-log-public:
         description: "Allow publication of your repository name on the public Rekor log"
         required: false

.github/workflows/debug.generic-generator.yml

@@ -45,21 +45,21 @@ jobs:
           # sha256sum artifact1 artifact2 ... | base64 -w0
           echo "hashes=$(sha256sum artifact1 artifact2 | base64 -w0)" >> "$GITHUB_OUTPUT"
 
-      - name: Upload artifact1
-        uses: actions/upload-artifact@v4
-        with:
-          name: artifact1
-          path: artifact1
-          if-no-files-found: error
-          retention-days: 5
+      # - name: Upload artifact1
+      #   uses: actions/upload-artifact@v4
+      #   with:
+      #     name: artifact1
+      #     path: artifact1
+      #     if-no-files-found: error
+      #     retention-days: 5
 
-      - name: Upload artifact2
-        uses: actions/upload-artifact@v4
-        with:
-          name: artifact2
-          path: artifact2
-          if-no-files-found: error
-          retention-days: 5
+      # - name: Upload artifact2
+      #   uses: actions/upload-artifact@v4
+      #   with:
+      #     name: artifact2
+      #     path: artifact2
+      #     if-no-files-found: error
+      #     retention-days: 5
 
   provenance:
     needs: build
@@ -101,3 +101,11 @@ jobs:
             --provenance-path build.intoto.jsonl \
             --source-uri github.com/slsa-framework/slsa-github-generator \
             --print-provenance
+
+  provenance2:
+    needs: build
+    uses: ./.github/workflows/builder_generic_slsa3.yml
+    with:
+      base64-subjects: "${{ needs.build.outputs.hashes }}"
+      provenance-name: build.intoto.jsonl
+      rekor-log-public: true

internal/builders/generic_generator/action.yml

@@ -0,0 +1,59 @@
+# Copyright 2023 SLSA Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: SLSA3 Generic Generator internal wrapper
+description: SLSA3 Generic Generator internal wrapper
+
+inputs:
+  slsa-workflow-inputs:
+    description: "All the inputs formatted as a JSON map"
+    required: true
+
+  slsa-layout-file:
+    description: "Location to store the layout content"
+    required: true
+
+  # Unused secret inputs.
+  slsa-workflow-secret1: {}
+  slsa-workflow-secret2: {}
+  slsa-workflow-secret3: {}
+  slsa-workflow-secret4: {}
+  slsa-workflow-secret5: {}
+  slsa-workflow-secret6: {}
+  slsa-workflow-secret7: {}
+  slsa-workflow-secret8: {}
+  slsa-workflow-secret9: {}
+  slsa-workflow-secret10: {}
+  slsa-workflow-secret11: {}
+  slsa-workflow-secret12: {}
+  slsa-workflow-secret13: {}
+  slsa-workflow-secret14: {}
+  slsa-workflow-secret15: {}
+
+runs:
+  using: "composite"
+  steps:
+    - id: layout
+      shell: bash
+      env:
+        BASE64_SUBJECTS: ${{ fromJson(inputs.slsa-workflow-inputs).base64-subjects }}
+        BASE64_SUBJECTS_FILE: ${{ fromJson(inputs.slsa-workflow-inputs).base64-subjects-file }}
+        PROVENANCE_NAME: ${{ fromJson(inputs.slsa-workflow-inputs).provenance-name }}
+        OUTPUT_FILE: ${{ inputs.slsa-layout-file }}
+      run: |
+        go run . \
+          --base64-subjects $BASE64_SUBJECTS \
+          --base64-subjects-file $BASE64_SUBJECTS_FILE \
+          --provenance-name $PROVENANCE_NAME \
+          --output-file $OUTPUT_FILE

internal/builders/generic_generator/main.go

@@ -0,0 +1,100 @@
+package main
+
+import (
+	"encoding/base64"
+	"encoding/json"
+	"flag"
+	"log"
+	"os"
+	"strings"
+)
+
+type SLSALayout struct {
+	Version      int            `json:"version"`
+	Attestations []*Attestation `json:"attestations"`
+}
+type Attestation struct {
+	Name     string     `json:"name"`
+	Subjects []*Subject `json:"subjects"`
+}
+
+type Subject struct {
+	Name   string            `json:"name"`
+	Digest map[string]string `json:"digest"`
+}
+
+func main() {
+	base64Subjects := flag.String("base64-subjects", "", "a base64-encoded list of subjects")
+	base64SubjectsFile := flag.String("base64-subjects-file", "", "file with a base64-encoded list of subjects")
+	provenanceName := flag.String("provenance-name", "", "name of the provenance")
+	outputFile := flag.String("output-file", "", "outfile to write the SLSA layout to")
+	flag.Parse()
+
+	var base64Content string
+	if *base64Subjects != "" {
+		base64Content = *base64Subjects
+	} else if *base64SubjectsFile != "" {
+		base64ContentBytes, err := os.ReadFile(*base64SubjectsFile)
+		if err != nil {
+			log.Fatalf("failed to read file %s: %v", *base64SubjectsFile, err)
+		}
+		base64Content = string(base64ContentBytes)
+	} else {
+		log.Fatal("either --base64-subjects or --base64-subjects-file must be set")
+	}
+
+	decodedContent, err := base64.StdEncoding.DecodeString(base64Content)
+	if err != nil {
+		log.Fatalf("failed to decode base64 the content. Did you base64-encode?: %v", err)
+	}
+
+	attestation := Attestation{
+		Name: strings.TrimSuffix(*provenanceName, ".intoto.jsonl"),
+	}
+	layout := SLSALayout{
+		Version:      1,
+		Attestations: []*Attestation{&attestation},
+	}
+
+	lines := strings.Split(string(decodedContent), "\n")
+	for _, line := range lines {
+		if len(line) == 0 {
+			continue
+		}
+		parts := strings.SplitN(line, " ", 2)
+		if len(parts) != 2 {
+			log.Fatalf("invalid line, should be `<artifact digest> <artifact name>`: %s", line)
+		}
+		artifactDigest := parts[0]
+		artifactName := parts[1]
+
+		subject := &Subject{
+			Name: artifactName,
+			Digest: map[string]string{
+				"sha256": artifactDigest,
+			},
+		}
+
+		attestation.Subjects = append(attestation.Subjects, subject)
+	}
+	if len(attestation.Subjects) == 0 {
+		log.Fatal("no subjects found")
+	}
+
+	layoutBytes, err := json.Marshal(layout)
+	if err != nil {
+		log.Fatalf("failed to marshal layout: %v", err)
+	}
+
+	f, err := os.Create(*outputFile)
+	if err != nil {
+		log.Fatalf("failed to create file %s: %v", *outputFile, err)
+	}
+	defer f.Close()
+
+	_, err = f.Write(layoutBytes)
+	if err != nil {
+		log.Fatalf("failed to write layout to file: %v", err)
+	}
+	return
+}