Skip to content

Commit

Permalink
provide support for multiple buildTypes. The initial types are to
Browse files Browse the repository at this point in the history
support more general slsa verifiers and provide more verbose output for
tekton verifiers. This implementation will default to the slsa
buildType.
  • Loading branch information
joejstuart committed Sep 15, 2023
1 parent 94d0d16 commit 35cbe22
Show file tree
Hide file tree
Showing 17 changed files with 1,125 additions and 637 deletions.
2 changes: 2 additions & 0 deletions pkg/chains/formats/slsa/internal/slsaconfig/slsaconfig.go
Original file line number Diff line number Diff line change
Expand Up @@ -20,4 +20,6 @@ type SlsaConfig struct {
BuilderID string
// DeepInspectionEnabled configures whether to dive into child taskruns in a pipelinerun
DeepInspectionEnabled bool
// The buildType for the build definition
BuildType string
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
package buildtypes

const (
SlsaBuildType = "https://tekton.dev/chains/v2/slsa"
TektonBuildType = "https://tekton.dev/chains/v2/slsa-tekton"
)
Original file line number Diff line number Diff line change
@@ -0,0 +1,44 @@
package externalparameters

import (
"fmt"

"github.com/tektoncd/chains/pkg/chains/objects"
"github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1"
)

func buildConfigSource(provenance *v1beta1.Provenance) map[string]string {
ref := ""
for alg, hex := range provenance.RefSource.Digest {
ref = fmt.Sprintf("%s:%s", alg, hex)
break
}
buildConfigSource := map[string]string{
"ref": ref,
"repository": provenance.RefSource.URI,
"path": provenance.RefSource.EntryPoint,
}
return buildConfigSource
}

// PipelineRun adds the pipeline run spec and provenance if available
func PipelineRun(pro *objects.PipelineRunObject) map[string]any {
externalParams := make(map[string]any)

if provenance := pro.GetRemoteProvenance(); provenance != nil {
externalParams["buildConfigSource"] = buildConfigSource(provenance)
}
externalParams["runSpec"] = pro.Spec
return externalParams
}

// TaskRun adds the task run spec and provenance if available
func TaskRun(tro *objects.TaskRunObject) map[string]any {
externalParams := make(map[string]any)

if provenance := tro.GetRemoteProvenance(); provenance != nil {
externalParams["buildConfigSource"] = buildConfigSource(provenance)
}
externalParams["runSpec"] = tro.Spec
return externalParams
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,97 @@
package externalparameters

import (
"testing"

"github.com/google/go-cmp/cmp"
"github.com/tektoncd/chains/pkg/chains/objects"
"github.com/tektoncd/chains/pkg/internal/objectloader"
"github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1"
)

func TestBuildConfigSource(t *testing.T) {
provenance := &v1beta1.Provenance{
RefSource: &v1beta1.RefSource{
Digest: map[string]string{"alg1": "hex1", "alg2": "hex2"},
URI: "https://tekton.com",
EntryPoint: "/path/to/entry",
},
}

want := map[string]string{
"ref": "alg1:hex1",
"repository": "https://tekton.com",
"path": "/path/to/entry",
}

got := buildConfigSource(provenance)

if diff := cmp.Diff(want, got); diff != "" {
t.Errorf("buildConfigSource(): -want +got: %s", diff)
}
}
func createPro(path string) *objects.PipelineRunObject {
pr, err := objectloader.PipelineRunFromFile(path)
if err != nil {
panic(err)
}
tr1, err := objectloader.TaskRunFromFile("../../../testdata/v2alpha2/taskrun1.json")
if err != nil {
panic(err)
}
tr2, err := objectloader.TaskRunFromFile("../../../testdata/v2alpha2/taskrun2.json")
if err != nil {
panic(err)
}
p := objects.NewPipelineRunObject(pr)
p.AppendTaskRun(tr1)
p.AppendTaskRun(tr2)
return p
}

func TestPipelineRun(t *testing.T) {
pro := createPro("../../../testdata/v2alpha2/pipelinerun1.json")

got := PipelineRun(pro)

want := map[string]any{
"runSpec": v1beta1.PipelineRunSpec{
PipelineRef: &v1beta1.PipelineRef{Name: "test-pipeline"},
Params: v1beta1.Params{
{
Name: "IMAGE",
Value: v1beta1.ParamValue{Type: "string", StringVal: "test.io/test/image"},
},
},
ServiceAccountName: "pipeline",
},
}

if diff := cmp.Diff(want, got); diff != "" {
t.Errorf("PipelineRun(): -want +got: %s", diff)
}
}

func TestTaskRun(t *testing.T) {
tr, err := objectloader.TaskRunFromFile("../../../testdata/v2alpha2/taskrun1.json")
if err != nil {
t.Fatal(err)
}
got := TaskRun(objects.NewTaskRunObject(tr))

want := map[string]any{
"runSpec": v1beta1.TaskRunSpec{
Params: v1beta1.Params{
{Name: "IMAGE", Value: v1beta1.ParamValue{Type: "string", StringVal: "test.io/test/image"}},
{Name: "CHAINS-GIT_COMMIT", Value: v1beta1.ParamValue{Type: "string", StringVal: "taskrun"}},
{Name: "CHAINS-GIT_URL", Value: v1beta1.ParamValue{Type: "string", StringVal: "https://git.test.com"}},
},
ServiceAccountName: "default",
TaskRef: &v1beta1.TaskRef{Name: "build", Kind: "Task"},
},
}

if diff := cmp.Diff(want, got); diff != "" {
t.Errorf("TaskRun(): -want +got: %s", diff)
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
package internalparameters

import (
"github.com/tektoncd/chains/pkg/chains/objects"
"github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1"
)

// SLSAInternalParameters provides the chains config as internalparameters
func SLSAInternalParameters(tko objects.TektonObject) map[string]any {
internalParams := make(map[string]any)
if provenance := tko.GetProvenance(); provenance != (*v1beta1.Provenance)(nil) && provenance.FeatureFlags != nil {
internalParams["tekton-pipelines-feature-flags"] = *provenance.FeatureFlags
}
return internalParams
}

// TektonInternalParameters provides the chains config as well as annotations and labels
func TektonInternalParameters(tko objects.TektonObject) map[string]any {
internalParams := make(map[string]any)
if provenance := tko.GetProvenance(); provenance != (*v1beta1.Provenance)(nil) && provenance.FeatureFlags != nil {
internalParams["tekton-pipelines-feature-flags"] = *provenance.FeatureFlags
}
internalParams["labels"] = tko.GetLabels()
internalParams["annotations"] = tko.GetAnnotations()
return internalParams
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,44 @@
package internalparameters

import (
"testing"

"github.com/google/go-cmp/cmp"
"github.com/tektoncd/chains/pkg/chains/objects"
"github.com/tektoncd/chains/pkg/internal/objectloader"
"github.com/tektoncd/pipeline/pkg/apis/config"
)

func TestTektonInternalParameters(t *testing.T) {
tr, err := objectloader.TaskRunFromFile("../../../testdata/v2alpha2/taskrun1.json")
if err != nil {
t.Fatal(err)
}
tro := objects.NewTaskRunObject(tr)
got := TektonInternalParameters(tro)
want := map[string]any{
"labels": tro.GetLabels(),
"annotations": tro.GetAnnotations(),
"tekton-pipelines-feature-flags": config.FeatureFlags{EnableAPIFields: "beta", ResultExtractionMethod: "termination-message"},
}

if diff := cmp.Diff(want, got); diff != "" {
t.Errorf("TaskRun(): -want +got: %s", diff)
}
}

func TestSLSAInternalParameters(t *testing.T) {
tr, err := objectloader.TaskRunFromFile("../../../testdata/v2alpha2/taskrun1.json")
if err != nil {
t.Fatal(err)
}
tro := objects.NewTaskRunObject(tr)
got := SLSAInternalParameters(tro)
want := map[string]any{
"tekton-pipelines-feature-flags": config.FeatureFlags{EnableAPIFields: "beta", ResultExtractionMethod: "termination-message"},
}

if diff := cmp.Diff(want, got); diff != "" {
t.Errorf("TaskRun(): -want +got: %s", diff)
}
}
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,9 @@ import (
slsa "github.com/in-toto/in-toto-golang/in_toto/slsa_provenance/v1"
"github.com/tektoncd/chains/pkg/chains/formats/slsa/extract"
"github.com/tektoncd/chains/pkg/chains/formats/slsa/internal/slsaconfig"
buildtypes "github.com/tektoncd/chains/pkg/chains/formats/slsa/v2alpha2/internal/build_types"
externalparameters "github.com/tektoncd/chains/pkg/chains/formats/slsa/v2alpha2/internal/external_parameters"
internalparameters "github.com/tektoncd/chains/pkg/chains/formats/slsa/v2alpha2/internal/internal_parameters"
resolveddependencies "github.com/tektoncd/chains/pkg/chains/formats/slsa/v2alpha2/internal/resolved_dependencies"
"github.com/tektoncd/chains/pkg/chains/objects"
)
Expand All @@ -34,27 +37,24 @@ const (

// GenerateAttestation generates a provenance statement with SLSA v1.0 predicate for a pipeline run.
func GenerateAttestation(ctx context.Context, pro *objects.PipelineRunObject, slsaconfig *slsaconfig.SlsaConfig) (interface{}, error) {
rd, err := resolveddependencies.PipelineRun(ctx, pro, slsaconfig)
bp, err := byproducts(pro)
if err != nil {
return nil, err
}
bp, err := byproducts(pro)

bd, err := getBuildDefinition(ctx, slsaconfig, pro)
if err != nil {
return nil, err
}

att := intoto.ProvenanceStatementSLSA1{
StatementHeader: intoto.StatementHeader{
Type: intoto.StatementInTotoV01,
PredicateType: slsa.PredicateSLSAProvenance,
Subject: extract.SubjectDigests(ctx, pro, slsaconfig),
},
Predicate: slsa.ProvenancePredicate{
BuildDefinition: slsa.ProvenanceBuildDefinition{
BuildType: "https://tekton.dev/chains/v2/slsa",
ExternalParameters: externalParameters(pro),
InternalParameters: internalParameters(pro),
ResolvedDependencies: rd,
},
BuildDefinition: bd,
RunDetails: slsa.ProvenanceRunDetails{
Builder: slsa.Builder{
ID: slsaconfig.BuilderID,
Expand Down Expand Up @@ -82,47 +82,6 @@ func metadata(pro *objects.PipelineRunObject) slsa.BuildMetadata {
return m
}

// internalParameters adds the tekton feature flags that were enabled
// for the pipelinerun.
func internalParameters(pro *objects.PipelineRunObject) map[string]any {
internalParams := make(map[string]any)
provenance := pro.GetProvenance()
if provenance != nil && provenance.FeatureFlags != nil {
internalParams["tekton-pipelines-feature-flags"] = *provenance.FeatureFlags
}
return internalParams
}

// externalParameters adds the pipeline run spec
func externalParameters(pro *objects.PipelineRunObject) map[string]any {
externalParams := make(map[string]any)

// add the origin of top level pipeline config
// isRemotePipeline checks if the pipeline was fetched using a remote resolver
isRemotePipeline := false
if pro.Spec.PipelineRef != nil {
if pro.Spec.PipelineRef.Resolver != "" && pro.Spec.PipelineRef.Resolver != "Cluster" {
isRemotePipeline = true
}
}

if p := pro.Status.Provenance; p != nil && p.RefSource != nil && isRemotePipeline {
ref := ""
for alg, hex := range p.RefSource.Digest {
ref = fmt.Sprintf("%s:%s", alg, hex)
break
}
buildConfigSource := map[string]string{
"ref": ref,
"repository": p.RefSource.URI,
"path": p.RefSource.EntryPoint,
}
externalParams["buildConfigSource"] = buildConfigSource
}
externalParams["runSpec"] = pro.Spec
return externalParams
}

// byproducts contains the pipelineRunResults
func byproducts(pro *objects.PipelineRunObject) ([]slsa.ResourceDescriptor, error) {
byProd := []slsa.ResourceDescriptor{}
Expand All @@ -140,3 +99,39 @@ func byproducts(pro *objects.PipelineRunObject) ([]slsa.ResourceDescriptor, erro
}
return byProd, nil
}

// getBuildDefinition get the buildDefinition based on the configured buildType. This will default to the slsa buildType
func getBuildDefinition(ctx context.Context, slsaconfig *slsaconfig.SlsaConfig, pro *objects.PipelineRunObject) (slsa.ProvenanceBuildDefinition, error) {
// if buildType is not set in the chains-config, default to slsa build type
buildDefinitionType := slsaconfig.BuildType
if slsaconfig.BuildType == "" {
buildDefinitionType = buildtypes.SlsaBuildType
}

switch buildDefinitionType {
case buildtypes.SlsaBuildType:
rd, err := resolveddependencies.PipelineRun(ctx, pro, slsaconfig, resolveddependencies.AddSLSATaskDescriptor)
if err != nil {
return slsa.ProvenanceBuildDefinition{}, err
}
return slsa.ProvenanceBuildDefinition{
BuildType: buildDefinitionType,
ExternalParameters: externalparameters.PipelineRun(pro),
InternalParameters: internalparameters.SLSAInternalParameters(pro),
ResolvedDependencies: rd,
}, nil
case buildtypes.TektonBuildType:
rd, err := resolveddependencies.PipelineRun(ctx, pro, slsaconfig, resolveddependencies.AddTektonTaskDescriptor)
if err != nil {
return slsa.ProvenanceBuildDefinition{}, err
}
return slsa.ProvenanceBuildDefinition{
BuildType: buildDefinitionType,
ExternalParameters: externalparameters.PipelineRun(pro),
InternalParameters: internalparameters.TektonInternalParameters(pro),
ResolvedDependencies: rd,
}, nil
default:
return slsa.ProvenanceBuildDefinition{}, fmt.Errorf("unsupported buildType %v", buildDefinitionType)
}
}
Loading

0 comments on commit 35cbe22

Please sign in to comment.