Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CI: "Generate provenance" fails #545

Open
hawksight opened this issue Jul 1, 2024 · 4 comments · May be fixed by #553
Open

CI: "Generate provenance" fails #545

hawksight opened this issue Jul 1, 2024 · 4 comments · May be fixed by #553

Comments

@hawksight
Copy link
Contributor

The following step in the workflow always seems to fail for quite a while: https://github.com/jetstack/jetstack-secure/blob/master/.github/workflows/release-master.yml#L95-L100

We don't see it because it only runs on master branch. Given no-one has noticed or reported I take it is not a huge issue.
But perhaps we should check why it is failing and look to fix?
@maelvls
Copy link
Member

maelvls commented Jul 2, 2024 •
edited
Loading

Hey, thanks for raising this. I hadn't noticed the failing builds on master.

For anyone looking at this, the error seems (ex: this build) to be related to the cosign.pub that is pulled from the slsa-provenance-action:

INFO: Downloading slsa-provenance_0.7.2_linux_amd64.tar.gz.sig from [https://github.com/philips-labs/slsa-provenance-action/releases/download/v0.7.2/slsa-provenance_0.7.2_linux_amd64.tar.gz.sig…](https://github.com/philips-labs/slsa-provenance-action/releases/download/v0.7.2/slsa-provenance_0.7.2_linux_amd64.tar.gz.sig%E2%80%A6)

INFO: Downloading cosign.pub from [https://github.com/philips-labs/slsa-provenance-action/releases/download/v0.7.2/cosign.pub…](https://github.com/philips-labs/slsa-provenance-action/releases/download/v0.7.2/cosign.pub%E2%80%A6)

INFO: Verifying signature…
Error: signature not found in transparency log
main.go:74: error during command execution: signature not found in transparency log
Error: Process completed with exit code 1.

This same issue was seen in philips-labs/slsa-provenance-action#161. Our makefile does use COSIGN_EXPERIMENTAL=1 (see Makefile) but I can't why the GitHub Actions workflow would also get this env var set...

The suggested fix is to disable COSIGN_EXPERIMENTAL:

     - name: Generate provenance
       uses: philips-labs/SLSA-Provenance-Action@v0.9.0
       with:
         command: generate
         subcommand: files
         arguments: --artifact-path mock
+      env:
+        COSIGN_EXPERIMENTAL: 0

@wallrj
Copy link
Member

wallrj commented Jul 12, 2024

Remember to also remove @maelvls 's warning note from the release process when we eventually fix this.

@wallrj wallrj mentioned this issue Jul 12, 2024
Merged
@hawksight hawksight linked a pull request Jul 31, 2024 that will close this issue
Draft
@hawksight
Copy link
Contributor Author

hawksight commented Jul 31, 2024 •
edited
Loading

I tried to fix this in #553 but the simple fix @maelvls suggested does not seem to fix this.

I have then tried to run this thing locally:

# Try recreating locally like the release file
echo "foobar" > mock
/Users/peter.fiddes/projects/philips-labs/slsa-provenance-action/bin/slsa-provenance generate files --artifact-path mock

# Try doing it properly
/Users/peter.fiddes/projects/philips-labs/slsa-provenance-action/bin/slsa-provenance generate container --repository "quay.io/jetstack/preflight" --output-path "provenance.json" --digest "sha256:48e30b96726a8e0dc09c68bdf9e6153cee10d5874f988745519b6ea75c579192" --tags "v0.1.49"

All getting a different error because it's running outside of GH actions:

Error: no value found for required flag: github-context
2024/07/31 18:05:05 error during command execution: no value found for required flag: github-context

I know nothing about this, but any suggestions on how I can provide the "github-context" this tool requires?
Perhaps I should create another workflow to specifically test running this. That might be the quickest way to test.
I'd prefer to do it locally though.

If there is no easy way to run it locally to attempt to rectify this... I suggest we just nuke these build steps, because they haven't worked in so long and not a single person has complained.

That should be the fall back plan.

Also I realise that this issue is a duplicate of #472.

@maelvls
Copy link
Member

maelvls commented Aug 5, 2024

I wonder if --github-context refers to the JSON blob you can obtain in github actions using ${{toJson(github)}}. I found that in https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/contexts#example-contents-of-the-github-context. Crafting this JSON by hand seems possible, maybe try:

github_context=$(cat <<"EOF"
{
  "token": "***",
  "job": "dump_contexts_to_log",
  "ref": "refs/heads/my_branch",
  "sha": "c27d339ee6075c1f744c5d4b200f7901aad2c369",
  "repository": "octocat/hello-world",
  "repository_owner": "octocat",
  "repositoryUrl": "git://github.com/octocat/hello-world.git",
  "run_id": "1536140711",
  "run_number": "314",
  "retention_days": "90",
  "run_attempt": "1",
  "actor": "octocat",
  "workflow": "Context testing",
  "head_ref": "",
  "base_ref": "",
  "event_name": "push",
  "event": {
    ...
  },
  "server_url": "https://github.com",
  "api_url": "https://api.github.com",
  "graphql_url": "https://github.com/gitapi/graphql",
  "ref_name": "my_branch",
  "ref_protected": false,
  "ref_type": "branch",
  "secret_source": "Actions",
  "workspace": "/home/runner/work/hello-world/hello-world",
  "action": "github_step",
  "event_path": "/home/runner/work/_temp/_github_workflow/event.json",
  "action_repository": "",
  "action_ref": "",
  "path": "/home/runner/work/_temp/_runner_file_commands/add_path_b037e7b5-1c88-48e2-bf78-eaaab5e02602",
  "env": "/home/runner/work/_temp/_runner_file_commands/set_env_b037e7b5-1c88-48e2-bf78-eaaab5e02602"
}
JSON
)

and then you can use the flag:

--github-context=$github_context

But I'd probably try act before hand-crafting this JSON blob 😅

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

fix: Set master build pipeline to no use experimental cosign with env var jetstack/jetstack-secure
3 participants
@wallrj @maelvls @hawksight