Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add SLSA3 #113

Open
wants to merge 5 commits into
base: master
Choose a base branch
from
+120 −95
Open

Add SLSA3 #113

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
288f216
slsa3 build
rafaelbreno Sep 18, 2024
1a25014
digest
rafaelbreno Oct 4, 2024
3b41874
manifest
rafaelbreno Oct 4, 2024
4cc624c
fix builds
brooksn Oct 9, 2024
3a52e27
Merge pull request #1 from brooksn/slsa3-fix
rafaelbreno Oct 9, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
169 changes: 76 additions & 93 deletions .github/workflows/image-push.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,8 @@ jobs:
contents: read
id-token: write
runs-on: runs-on,runner=4cpu-linux-x64,run-id=${{ github.run_id }}
outputs:
digest: ${{ steps.digest.outputs.digest }}
steps:
- name: Check out code
uses: actions/checkout@v4
Expand All @@ -22,9 +24,6 @@ jobs:
echo "$(make -s log | grep TAG)" >> "$GITHUB_ENV"
echo "$(make -s log | grep ARCH)" >> "$GITHUB_ENV"

- name: Set up QEMU
uses: docker/setup-qemu-action@v3

- name: Docker meta
id: meta-amd64
uses: docker/metadata-action@v5
Expand All @@ -36,49 +35,42 @@ jobs:
with:
secrets: |
secret/data/github/repo/${{ github.repository }}/dockerhub/${{ github.repository_owner }}/credentials username | DOCKER_USERNAME ;
secret/data/github/repo/${{ github.repository }}/dockerhub/${{ github.repository_owner }}/credentials password | DOCKER_PASSWORD

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3

- name: Login to Container Registry
uses: docker/login-action@v3
with:
username: ${{ env.DOCKER_USERNAME }}
password: ${{ env.DOCKER_PASSWORD }}
secret/data/github/repo/${{ github.repository }}/dockerhub/${{ github.repository_owner }}/credentials password | DOCKER_PASSWORD ;
secret/data/github/repo/${{ github.repository }}/rancher-prime-registry/credentials registry | PRIME_REGISTRY ;
secret/data/github/repo/${{ github.repository }}/rancher-prime-registry/credentials username | PRIME_REGISTRY_USERNAME ;
secret/data/github/repo/${{ github.repository }}/rancher-prime-registry/credentials password | PRIME_REGISTRY_PASSWORD

- name: Build container image
- name: Build and push container image
id: build-amd64
uses: docker/build-push-action@v6
uses: rancher/ecm-distro-tools/actions/publish-image@master
env:
META_LABELS: ${{ steps.meta-amd64.outputs.labels }}
with:
context: .
file: Dockerfile
platforms: linux/amd64
labels: ${{ steps.meta-amd64.outputs.labels }}
outputs: type=image,name=${{ env.REGISTRY_IMAGE }},push-by-digest=true,name-canonical=true,push=true
build-args: |
TAG=${{ env.TAG }}
ARCH=${{ env.ARCH }}

- name: Export digest
run: |
mkdir -p /tmp/digests
digest="${{ steps.build-amd64.outputs.digest }}"
touch "/tmp/digests/${digest#sha256:}"
image: hardened-calico
tag: ${{ github.event.release.tag_name }}

- name: Upload digest
uses: actions/upload-artifact@v4
with:
name: digests-linux-amd64
path: /tmp/digests/*
if-no-files-found: error
retention-days: 1
public-repo: rancher
public-username: ${{ env.DOCKER_USERNAME }}
public-password: ${{ env.DOCKER_PASSWORD }}

prime-repo: rancher
prime-registry: ${{ env.PRIME_REGISTRY }}
prime-username: ${{ env.PRIME_REGISTRY_USERNAME }}
prime-password: ${{ env.PRIME_REGISTRY_PASSWORD }}

- name: Digest
id: digest
run: |
IMAGE_DIGEST=$(jq -r '.["containerimage.digest"]' /tmp/metadata.json)
echo "digest=$IMAGE_DIGEST" >> "$GITHUB_OUTPUT"

build-arm64-digest:
permissions:
contents: read
id-token: write
runs-on: runs-on,runner=4cpu-linux-arm64,run-id=${{ github.run_id }}
outputs:
digest: ${{ steps.digest.outputs.digest }}
steps:
- name: Check out code
uses: actions/checkout@v4
Expand All @@ -89,9 +81,6 @@ jobs:
echo "$(make -s log | grep TAG)" >> "$GITHUB_ENV"
echo "$(make -s log | grep ARCH)" >> "$GITHUB_ENV"

- name: Set up QEMU
uses: docker/setup-qemu-action@v3

- name: Docker meta
id: meta-arm64
uses: docker/metadata-action@v5
Expand All @@ -103,43 +92,35 @@ jobs:
with:
secrets: |
secret/data/github/repo/${{ github.repository }}/dockerhub/${{ github.repository_owner }}/credentials username | DOCKER_USERNAME ;
secret/data/github/repo/${{ github.repository }}/dockerhub/${{ github.repository_owner }}/credentials password | DOCKER_PASSWORD

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
secret/data/github/repo/${{ github.repository }}/dockerhub/${{ github.repository_owner }}/credentials password | DOCKER_PASSWORD ;
secret/data/github/repo/${{ github.repository }}/rancher-prime-registry/credentials registry | PRIME_REGISTRY ;
secret/data/github/repo/${{ github.repository }}/rancher-prime-registry/credentials username | PRIME_REGISTRY_USERNAME ;
secret/data/github/repo/${{ github.repository }}/rancher-prime-registry/credentials password | PRIME_REGISTRY_PASSWORD

- name: Login to Container Registry
uses: docker/login-action@v3
with:
username: ${{ env.DOCKER_USERNAME }}
password: ${{ env.DOCKER_PASSWORD }}

- name: Build container image
- name: Build and push container image
id: build-arm64
uses: docker/build-push-action@v6
uses: rancher/ecm-distro-tools/actions/publish-image@master
env:
META_LABELS: ${{ steps.meta-arm64.outputs.labels }}
with:
context: .
file: Dockerfile
platforms: linux/arm64
labels: ${{ steps.meta-arm64.outputs.labels }}
outputs: type=image,name=${{ env.REGISTRY_IMAGE }},push-by-digest=true,name-canonical=true,push=true
build-args: |
TAG=${{ env.TAG }}
ARCH=${{ env.ARCH }}

- name: Export digest
image: hardened-calico
tag: ${{ github.event.release.tag_name }}

public-repo: rancher
public-username: ${{ env.DOCKER_USERNAME }}
public-password: ${{ env.DOCKER_PASSWORD }}

prime-repo: rancher
prime-registry: ${{ env.PRIME_REGISTRY }}
prime-username: ${{ env.PRIME_REGISTRY_USERNAME }}
prime-password: ${{ env.PRIME_REGISTRY_PASSWORD }}

- name: Digest
id: digest
run: |
mkdir -p /tmp/digests
digest="${{ steps.build-arm64.outputs.digest }}"
touch "/tmp/digests/${digest#sha256:}"
IMAGE_DIGEST=$(jq -r '.["containerimage.digest"]' /tmp/metadata.json)
echo "digest=$IMAGE_DIGEST" >> "$GITHUB_OUTPUT"

- name: Upload digest
uses: actions/upload-artifact@v4
with:
name: digests-linux-arm64
path: /tmp/digests/*
if-no-files-found: error
retention-days: 1
merge:
permissions:
contents: read
Expand All @@ -149,16 +130,6 @@ jobs:
- build-amd64-digest
- build-arm64-digest
steps:
- name: Download digests
uses: actions/download-artifact@v4
with:
path: /tmp/digests
pattern: digests-*
merge-multiple: true

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3

- name: Docker meta
id: meta
uses: docker/metadata-action@v5
Expand All @@ -170,20 +141,32 @@ jobs:
with:
secrets: |
secret/data/github/repo/${{ github.repository }}/dockerhub/${{ github.repository_owner }}/credentials username | DOCKER_USERNAME ;
secret/data/github/repo/${{ github.repository }}/dockerhub/${{ github.repository_owner }}/credentials password | DOCKER_PASSWORD

- name: Login to Container Registry
uses: docker/login-action@v3
with:
username: ${{ env.DOCKER_USERNAME }}
password: ${{ env.DOCKER_PASSWORD }}
secret/data/github/repo/${{ github.repository }}/dockerhub/${{ github.repository_owner }}/credentials password | DOCKER_PASSWORD ;
secret/data/github/repo/${{ github.repository }}/rancher-prime-registry/credentials registry | PRIME_REGISTRY ;
secret/data/github/repo/${{ github.repository }}/rancher-prime-registry/credentials username | PRIME_REGISTRY_USERNAME ;
secret/data/github/repo/${{ github.repository }}/rancher-prime-registry/credentials password | PRIME_REGISTRY_PASSWORD

- name: Create manifest list and push
working-directory: /tmp/digests
run: |
docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
$(printf '${{ env.REGISTRY_IMAGE }}@sha256:%s ' *)

id: push-manifest
uses: rancher/ecm-distro-tools/actions/publish-image@master
env:
DOCKER_METADATA_OUTPUT_JSON: ${{ steps.meta.outputs.json }}
REGISTRY_IMAGE: ${{ env.REGISTRY_IMAGE }}
IMAGE_DIGESTS: ${{ needs.build-amd64-digest.outputs.digest }} ${{ needs.build-arm64-digest.outputs.digest }}
with:
make-target: manifest-push
image: hardened-calico
tag: ${{ github.event.release.tag_name }}

public-repo: rancher
public-username: ${{ env.DOCKER_USERNAME }}
public-password: ${{ env.DOCKER_PASSWORD }}

prime-repo: rancher
prime-registry: ${{ env.PRIME_REGISTRY }}
prime-username: ${{ env.PRIME_REGISTRY_USERNAME }}
prime-password: ${{ env.PRIME_REGISTRY_PASSWORD }}

- name: Inspect image
run: |
docker buildx imagetools inspect ${{ env.REGISTRY_IMAGE }}:${{ steps.meta.outputs.version }}
46 changes: 44 additions & 2 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,32 +10,72 @@ else
ARCH=$(UNAME_M)
endif

ifndef TARGET_PLATFORMS
ifeq ($(UNAME_M), x86_64)
TARGET_PLATFORMS:=linux/amd64
else ifeq ($(UNAME_M), aarch64)
TARGET_PLATFORMS:=linux/arm64
else
TARGET_PLATFORMS:=linux/$(UNAME_M)
endif
endif

BUILD_META=-build$(shell date +%Y%m%d)
ORG ?= rancher
MACHINE := rancher
TAG ?= ${GITHUB_ACTION_TAG}
REGISTRY_IMAGE ?= $(ORG)/hardened-calico

K3S_ROOT_VERSION ?= v0.14.0

ifeq ($(TAG),)
TAG := v3.28.1$(BUILD_META)
endif

IMAGE ?= $(REGISTRY_IMAGE):$(TAG)

LABEL_ARGS = $(foreach label,$(META_LABELS),--label $(label))

ifeq (,$(filter %$(BUILD_META),$(TAG)))
$(error TAG $(TAG) needs to end with build metadata: $(BUILD_META))
endif

buildx-machine:
@docker buildx ls | grep $(MACHINE) || \
docker buildx create --name=$(MACHINE) --platform=linux/arm64,linux/amd64

.PHONY: image-build
image-build:
docker buildx build --no-cache \
--platform=$(ARCH) \
--pull \
--build-arg TAG=$(TAG:$(BUILD_META)=) \
--build-arg K3S_ROOT_VERSION=$(K3S_ROOT_VERSION) \
--tag $(ORG)/hardened-calico:$(TAG) \
--tag $(ORG)/hardened-calico:$(TAG)-$(ARCH) \
--tag $(IMAGE) \
--tag $(IMAGE)-$(ARCH) \
--load \
.

.PHONY: push-image
push-image: buildx-machine
docker buildx build \
--builder=$(MACHINE) \
--sbom=true \
--attest type=provenance,mode=max \
--platform=$(TARGET_PLATFORMS) \
--build-arg TAG=$(TAG:$(BUILD_META)=) \
--build-arg K3S_ROOT_VERSION=$(K3S_ROOT_VERSION) \
--output type=image,name=$(REGISTRY_IMAGE),push-by-digest=true,name-canonical=true,push=true \
$(LABEL_ARGS) \
--push \
--iidfile /tmp/image.digest \
--metadata-file /tmp/metadata.json \
.

.PHONY: manifest-push
manifest-push:
docker buildx imagetools create -t $(IMAGE) -t $(REGISTRY_IMAGE):latest $(IMAGE_DIGESTS)

.PHONY: image-push
image-push:
docker push $(ORG)/hardened-calico:$(TAG)-$(ARCH)
Expand All @@ -53,3 +93,5 @@ log:
@echo "SRC=$(SRC)"
@echo "BUILD_META=$(BUILD_META)"
@echo "UNAME_M=$(UNAME_M)"
@echo "META_LABELS=$(META_LABELS)"
@echo "LABEL_ARGS=$(LABEL_ARGS)"
Loading