feat(publish-image-index-manifest): Expose image index manifest digest#113
Merged
Conversation
dervoeti
changed the title
…feat/slsa-provenance-index-digest
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is needed to generate SLSA provenance for our images (= signed attestations attached to an image / index manifest that prove when and how the image was built).
Add an
image-index-manifest-digestoutput to the publish-image-index-manifest action so the digest of the pushed multi-arch index can be fed into SLSA provenance generation.The digest is now computed right after
docker manifest pushin the create-index step and reused by the sign step instead of being recomputed.Optional extra information:
I added SLSA provenance to our fork of SecObserve already in a similar fashion, here is the workflow run:
https://github.com/stackabletech/SecObserve/actions/runs/28184881580
Here is an example of how to manually inspect the SLSA provenance attestation for an image:
Or using slsa-verifier:
It's basically a signed JSON document that provides a ton of metadata about the image build. The attestation is done by an isolated job that runs
https://github.com/slsa-framework/slsa-github-generator/blob/main/.github/workflows/generator_container_slsa3.yml, so it's an independent "witness" that can't be manipulated (this means we achieve SLSA level 3). Luckily it's pretty easy to do since we use GitHub actions.