mirror of
https://github.com/hashicorp/packer.git
synced 2026-09-21 07:21:40 -04:00
Tanmay Jain
014f8d1bbe
* feat(provenance): add SLSA provenance and attestation signing libraries Add internal/provenance for deriving in-toto subjects from Packer artifacts, building SLSA Provenance v1 predicates, wrapping in-toto statements, and best-effort git/CI source detection. Add internal/attestation for DSSE envelope handling and a pluggable Signer/Verifier backend supporting key (local PEM), kms (aws/gcp/ azure/hashivault), and keyless (Sigstore Fulcio) modes, plus Sigstore bundle handling and DSSE/policy verification. Add the supporting module dependencies in go.mod/go.sum. * feat(provenance): add provenance post-processor Add the opt-in "provenance" post-processor that runs after a build, derives subjects from the artifact, emits DSSE-wrapped SLSA provenance (and optional SBOM) attestations, signs them via the configured signing backend, and writes sidecar files (including *.sigstore.json bundles in keyless mode). Register it in the core post-processor set. The provenance enable flag is a tri-state so an unset value stays enabled through HCL2 decoding instead of being silently disabled. * feat(provenance): add verify-attestation command Add "packer verify-attestation" to verify signed DSSE attestations against key, KMS, and keyless policy inputs, including optional Sigstore bundle checks for Rekor and timestamp evidence. Register the command in the CLI. * docs(provenance): add reference CI workflows and changelog Add reference GitHub Actions workflows under examples/ci for SLSA L2 keyless signing and L3-compatible delegated signing * fix: lint and tests * Added docs for Provenance PostProcessor
90 lines
7.3 KiB
Go
90 lines
7.3 KiB
Go
// Code generated by "packer-sdc mapstructure-to-hcl2"; DO NOT EDIT.
|
|
|
|
package provenance
|
|
|
|
import (
|
|
"github.com/hashicorp/hcl/v2/hcldec"
|
|
"github.com/zclconf/go-cty/cty"
|
|
)
|
|
|
|
// FlatConfig is an auto-generated flat version of Config.
|
|
// Where the contents of a field with a `mapstructure:,squash` tag are bubbled up.
|
|
type FlatConfig struct {
|
|
PackerBuildName *string `mapstructure:"packer_build_name" cty:"packer_build_name" hcl:"packer_build_name"`
|
|
PackerBuilderType *string `mapstructure:"packer_builder_type" cty:"packer_builder_type" hcl:"packer_builder_type"`
|
|
PackerCoreVersion *string `mapstructure:"packer_core_version" cty:"packer_core_version" hcl:"packer_core_version"`
|
|
PackerDebug *bool `mapstructure:"packer_debug" cty:"packer_debug" hcl:"packer_debug"`
|
|
PackerForce *bool `mapstructure:"packer_force" cty:"packer_force" hcl:"packer_force"`
|
|
PackerOnError *string `mapstructure:"packer_on_error" cty:"packer_on_error" hcl:"packer_on_error"`
|
|
PackerUserVars map[string]string `mapstructure:"packer_user_variables" cty:"packer_user_variables" hcl:"packer_user_variables"`
|
|
PackerSensitiveVars []string `mapstructure:"packer_sensitive_variables" cty:"packer_sensitive_variables" hcl:"packer_sensitive_variables"`
|
|
Provenance *bool `mapstructure:"provenance" cty:"provenance" hcl:"provenance"`
|
|
BuildType *string `mapstructure:"build_type" cty:"build_type" hcl:"build_type"`
|
|
OutputDir *string `mapstructure:"output_dir" cty:"output_dir" hcl:"output_dir"`
|
|
TemplatePath *string `mapstructure:"template" cty:"template" hcl:"template"`
|
|
OnlyBuilds []string `mapstructure:"only_builds" cty:"only_builds" hcl:"only_builds"`
|
|
UserVariables map[string]string `mapstructure:"user_variables" cty:"user_variables" hcl:"user_variables"`
|
|
SourceURI *string `mapstructure:"source_uri" cty:"source_uri" hcl:"source_uri"`
|
|
SBOM *bool `mapstructure:"sbom" cty:"sbom" hcl:"sbom"`
|
|
SBOMFormat *string `mapstructure:"sbom_format" cty:"sbom_format" hcl:"sbom_format"`
|
|
SBOMScanPath *string `mapstructure:"sbom_scan_path" cty:"sbom_scan_path" hcl:"sbom_scan_path"`
|
|
SBOMScope *string `mapstructure:"sbom_scope" cty:"sbom_scope" hcl:"sbom_scope"`
|
|
SBOMExclude []string `mapstructure:"sbom_exclude" cty:"sbom_exclude" hcl:"sbom_exclude"`
|
|
SigningMode *string `mapstructure:"signing_mode" cty:"signing_mode" hcl:"signing_mode"`
|
|
Signer *string `mapstructure:"signer" cty:"signer" hcl:"signer"`
|
|
Key *string `mapstructure:"key" cty:"key" hcl:"key"`
|
|
Verifier *string `mapstructure:"verifier" cty:"verifier" hcl:"verifier"`
|
|
FulcioURL *string `mapstructure:"fulcio_url" cty:"fulcio_url" hcl:"fulcio_url"`
|
|
RekorURL *string `mapstructure:"rekor_url" cty:"rekor_url" hcl:"rekor_url"`
|
|
UploadTlog *bool `mapstructure:"upload_tlog" cty:"upload_tlog" hcl:"upload_tlog"`
|
|
TrustedRootPath *string `mapstructure:"trusted_root_path" cty:"trusted_root_path" hcl:"trusted_root_path"`
|
|
KeylessIdentity *string `mapstructure:"keyless_identity" cty:"keyless_identity" hcl:"keyless_identity"`
|
|
KeylessOIDCIssuer *string `mapstructure:"keyless_oidc_issuer" cty:"keyless_oidc_issuer" hcl:"keyless_oidc_issuer"`
|
|
}
|
|
|
|
// FlatMapstructure returns a new FlatConfig.
|
|
// FlatConfig is an auto-generated flat version of Config.
|
|
// Where the contents a fields with a `mapstructure:,squash` tag are bubbled up.
|
|
func (*Config) FlatMapstructure() interface{ HCL2Spec() map[string]hcldec.Spec } {
|
|
return new(FlatConfig)
|
|
}
|
|
|
|
// HCL2Spec returns the hcl spec of a Config.
|
|
// This spec is used by HCL to read the fields of Config.
|
|
// The decoded values from this spec will then be applied to a FlatConfig.
|
|
func (*FlatConfig) HCL2Spec() map[string]hcldec.Spec {
|
|
s := map[string]hcldec.Spec{
|
|
"packer_build_name": &hcldec.AttrSpec{Name: "packer_build_name", Type: cty.String, Required: false},
|
|
"packer_builder_type": &hcldec.AttrSpec{Name: "packer_builder_type", Type: cty.String, Required: false},
|
|
"packer_core_version": &hcldec.AttrSpec{Name: "packer_core_version", Type: cty.String, Required: false},
|
|
"packer_debug": &hcldec.AttrSpec{Name: "packer_debug", Type: cty.Bool, Required: false},
|
|
"packer_force": &hcldec.AttrSpec{Name: "packer_force", Type: cty.Bool, Required: false},
|
|
"packer_on_error": &hcldec.AttrSpec{Name: "packer_on_error", Type: cty.String, Required: false},
|
|
"packer_user_variables": &hcldec.AttrSpec{Name: "packer_user_variables", Type: cty.Map(cty.String), Required: false},
|
|
"packer_sensitive_variables": &hcldec.AttrSpec{Name: "packer_sensitive_variables", Type: cty.List(cty.String), Required: false},
|
|
"provenance": &hcldec.AttrSpec{Name: "provenance", Type: cty.Bool, Required: false},
|
|
"build_type": &hcldec.AttrSpec{Name: "build_type", Type: cty.String, Required: false},
|
|
"output_dir": &hcldec.AttrSpec{Name: "output_dir", Type: cty.String, Required: false},
|
|
"template": &hcldec.AttrSpec{Name: "template", Type: cty.String, Required: false},
|
|
"only_builds": &hcldec.AttrSpec{Name: "only_builds", Type: cty.List(cty.String), Required: false},
|
|
"user_variables": &hcldec.AttrSpec{Name: "user_variables", Type: cty.Map(cty.String), Required: false},
|
|
"source_uri": &hcldec.AttrSpec{Name: "source_uri", Type: cty.String, Required: false},
|
|
"sbom": &hcldec.AttrSpec{Name: "sbom", Type: cty.Bool, Required: false},
|
|
"sbom_format": &hcldec.AttrSpec{Name: "sbom_format", Type: cty.String, Required: false},
|
|
"sbom_scan_path": &hcldec.AttrSpec{Name: "sbom_scan_path", Type: cty.String, Required: false},
|
|
"sbom_scope": &hcldec.AttrSpec{Name: "sbom_scope", Type: cty.String, Required: false},
|
|
"sbom_exclude": &hcldec.AttrSpec{Name: "sbom_exclude", Type: cty.List(cty.String), Required: false},
|
|
"signing_mode": &hcldec.AttrSpec{Name: "signing_mode", Type: cty.String, Required: false},
|
|
"signer": &hcldec.AttrSpec{Name: "signer", Type: cty.String, Required: false},
|
|
"key": &hcldec.AttrSpec{Name: "key", Type: cty.String, Required: false},
|
|
"verifier": &hcldec.AttrSpec{Name: "verifier", Type: cty.String, Required: false},
|
|
"fulcio_url": &hcldec.AttrSpec{Name: "fulcio_url", Type: cty.String, Required: false},
|
|
"rekor_url": &hcldec.AttrSpec{Name: "rekor_url", Type: cty.String, Required: false},
|
|
"upload_tlog": &hcldec.AttrSpec{Name: "upload_tlog", Type: cty.Bool, Required: false},
|
|
"trusted_root_path": &hcldec.AttrSpec{Name: "trusted_root_path", Type: cty.String, Required: false},
|
|
"keyless_identity": &hcldec.AttrSpec{Name: "keyless_identity", Type: cty.String, Required: false},
|
|
"keyless_oidc_issuer": &hcldec.AttrSpec{Name: "keyless_oidc_issuer", Type: cty.String, Required: false},
|
|
}
|
|
return s
|
|
}
|