mirror of
https://github.com/hashicorp/packer.git
synced 2026-09-19 06:21:41 -04:00
Tanmay Jain
014f8d1bbe
* feat(provenance): add SLSA provenance and attestation signing libraries Add internal/provenance for deriving in-toto subjects from Packer artifacts, building SLSA Provenance v1 predicates, wrapping in-toto statements, and best-effort git/CI source detection. Add internal/attestation for DSSE envelope handling and a pluggable Signer/Verifier backend supporting key (local PEM), kms (aws/gcp/ azure/hashivault), and keyless (Sigstore Fulcio) modes, plus Sigstore bundle handling and DSSE/policy verification. Add the supporting module dependencies in go.mod/go.sum. * feat(provenance): add provenance post-processor Add the opt-in "provenance" post-processor that runs after a build, derives subjects from the artifact, emits DSSE-wrapped SLSA provenance (and optional SBOM) attestations, signs them via the configured signing backend, and writes sidecar files (including *.sigstore.json bundles in keyless mode). Register it in the core post-processor set. The provenance enable flag is a tri-state so an unset value stays enabled through HCL2 decoding instead of being silently disabled. * feat(provenance): add verify-attestation command Add "packer verify-attestation" to verify signed DSSE attestations against key, KMS, and keyless policy inputs, including optional Sigstore bundle checks for Rekor and timestamp evidence. Register the command in the CLI. * docs(provenance): add reference CI workflows and changelog Add reference GitHub Actions workflows under examples/ci for SLSA L2 keyless signing and L3-compatible delegated signing * fix: lint and tests * Added docs for Provenance PostProcessor
94 lines
3.3 KiB
YAML
94 lines
3.3 KiB
YAML
# Reference workflow — NOT wired into this repository's CI.
|
|
#
|
|
# Copy this into your own project's .github/workflows/ directory.
|
|
#
|
|
# SLSA Build L2 pattern: Packer signs the provenance attestation keyless, using
|
|
# the GitHub Actions workflow's own OIDC identity (Fulcio) and records the
|
|
# signature in the Rekor transparency log. This yields signed, transparently
|
|
# logged provenance produced by a hosted platform.
|
|
#
|
|
# This does NOT confer SLSA L3 on its own: the build job can still reach the
|
|
# (ephemeral) signing material. See github-actions-l3-delegated.yml for the
|
|
# L3-compatible delegated-signing pattern.
|
|
|
|
name: build-and-sign-provenance
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- "v*"
|
|
|
|
permissions:
|
|
contents: read
|
|
# Required so Packer's keyless signing can request an OIDC token from GitHub
|
|
# and exchange it with Fulcio for a short-lived signing certificate.
|
|
id-token: write
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
# Must match the workflow's OIDC identity so verification can pin it.
|
|
KEYLESS_IDENTITY: "https://github.com/${{ github.repository }}/.github/workflows/build-and-sign-provenance.yml@${{ github.ref }}"
|
|
KEYLESS_OIDC_ISSUER: "https://token.actions.githubusercontent.com"
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Install Packer
|
|
uses: hashicorp/setup-packer@main
|
|
with:
|
|
version: latest
|
|
|
|
- name: Initialize plugins
|
|
run: packer init .
|
|
|
|
# The template below is expected to declare two input variables and a
|
|
# keyless provenance post-processor. NOTE: Packer's `env()` function may
|
|
# only appear in a variable `default`, never inline in a block, so the
|
|
# workflow passes the values with `-var` instead.
|
|
#
|
|
# variable "keyless_identity" { type = string }
|
|
# variable "keyless_oidc_issuer" { type = string }
|
|
#
|
|
# post-processor "provenance" {
|
|
# signing_mode = "keyless"
|
|
# upload_tlog = true
|
|
# keyless_identity = var.keyless_identity
|
|
# keyless_oidc_issuer = var.keyless_oidc_issuer
|
|
# }
|
|
#
|
|
# Packer picks up the ambient GitHub OIDC token automatically from the
|
|
# ACTIONS_ID_TOKEN_REQUEST_URL / ACTIONS_ID_TOKEN_REQUEST_TOKEN variables
|
|
# that are available when `id-token: write` is granted above.
|
|
- name: Build and sign
|
|
run: |
|
|
packer build \
|
|
-var "keyless_identity=${KEYLESS_IDENTITY}" \
|
|
-var "keyless_oidc_issuer=${KEYLESS_OIDC_ISSUER}" \
|
|
.
|
|
|
|
# Verify the signed attestation with Rekor-backed transparency evidence
|
|
# using the generated Sigstore bundle sidecar (*.sigstore.json).
|
|
- name: Verify attestation
|
|
run: |
|
|
for att in *.provenance.json; do
|
|
packer verify-attestation \
|
|
-signing-mode=keyless \
|
|
-bundle="${att%.json}.sigstore.json" \
|
|
-require-rekor \
|
|
-require-timestamp \
|
|
-keyless-identity="${KEYLESS_IDENTITY}" \
|
|
-keyless-oidc-issuer="${KEYLESS_OIDC_ISSUER}" \
|
|
-predicate-type="https://slsa.dev/provenance/v1" \
|
|
"${att}"
|
|
done
|
|
|
|
- name: Upload provenance artifacts
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: provenance
|
|
path: |
|
|
*.provenance.json
|
|
*.sigstore.json
|