mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-10-13 16:54:48 +00:00
Bind container promotion to attested digests
This commit is contained in:
pulse-triage[bot]
parent
6d4ee48000
commit
e67e4a7c5f
10 changed files with 476 additions and 60 deletions
|
|
@ -397,6 +397,9 @@ class ReleasePromotionPolicyTest(unittest.TestCase):
|
|||
self.assertIn("r2_prefix: $r2_prefix", activation)
|
||||
self.assertIn(".r2_prefix == $r2_prefix", activation)
|
||||
self.assertIn(".r2_prefix == $r2_prefix", convergence)
|
||||
for digest_field in ("server_image_digest", "control_plane_image_digest"):
|
||||
self.assertIn(digest_field, activation)
|
||||
self.assertIn(digest_field, convergence)
|
||||
self.assertIn("committed=true", activation)
|
||||
self.assertIn("Immutably committed, attested, and publicly verified ${TAG}", activation)
|
||||
self.assertIn("Draft activation marker digest does not match", activation)
|
||||
|
|
@ -1968,6 +1971,10 @@ class ReleasePromotionPolicyTest(unittest.TestCase):
|
|||
self.assertNotIn("subject-name: docker.io/rcourtman/pulse-agent", publish)
|
||||
self.assertNotIn("subject-name: ghcr.io/${{ github.repository_owner }}/pulse-agent", publish)
|
||||
self.assertIn("create-storage-record: false", publish)
|
||||
self.assertIn("server_digest:", publish)
|
||||
self.assertIn("control_plane_digest:", publish)
|
||||
self.assertIn("Verify exact image identities and provenance", publish)
|
||||
self.assertIn("verify-release-container-images.sh", publish)
|
||||
self.assertIn("target: runtime_prebuilt", publish)
|
||||
self.assertIn("target: control_plane_prebuilt", publish)
|
||||
self.assertIn("Verify exact-candidate container payload", publish)
|
||||
|
|
@ -1975,6 +1982,14 @@ class ReleasePromotionPolicyTest(unittest.TestCase):
|
|||
self.assertNotIn("PULSE_UPDATE_SIGNING_KEY", publish)
|
||||
self.assertNotIn("provenance: false", publish)
|
||||
self.assertIn("validate_artifact_release_line.py", promote)
|
||||
self.assertIn("source_sha:", promote)
|
||||
self.assertIn("server_digest:", promote)
|
||||
self.assertIn("control_plane_digest:", promote)
|
||||
self.assertIn("verify-release-container-images.sh", promote)
|
||||
self.assertIn('docker_source="docker.io/rcourtman/${image}@${expected_digest}"', promote)
|
||||
self.assertIn('ghcr_source="ghcr.io/${OWNER}/${image}@${expected_digest}"', promote)
|
||||
self.assertNotIn('"rcourtman/${image}:${TAG}"', promote)
|
||||
self.assertNotIn('"ghcr.io/${OWNER}/${image}:${TAG}"', promote)
|
||||
self.assertIn("control_plane.py --branch-for-version", demo)
|
||||
self.assertIn("demo-stable", demo)
|
||||
self.assertIn("Refusing prerelease tag", demo)
|
||||
|
|
|
|||
138
scripts/release_control/verify_release_container_images_test.py
Normal file
138
scripts/release_control/verify_release_container_images_test.py
Normal file
|
|
@ -0,0 +1,138 @@
|
|||
#!/usr/bin/env python3
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import os
|
||||
from pathlib import Path
|
||||
import subprocess
|
||||
import tempfile
|
||||
import textwrap
|
||||
import unittest
|
||||
|
||||
|
||||
ROOT = Path(__file__).resolve().parents[2]
|
||||
SCRIPT = ROOT / "scripts" / "verify-release-container-images.sh"
|
||||
SOURCE_SHA = "a" * 40
|
||||
DIGEST = "sha256:" + "b" * 64
|
||||
|
||||
|
||||
class VerifyReleaseContainerImagesTests(unittest.TestCase):
|
||||
def run_verifier(
|
||||
self,
|
||||
*,
|
||||
overrides: dict[str, str] | None = None,
|
||||
gh_exit: int = 0,
|
||||
tag: str = "v6.4.1",
|
||||
source_sha: str = SOURCE_SHA,
|
||||
) -> tuple[subprocess.CompletedProcess[str], str]:
|
||||
with tempfile.TemporaryDirectory() as temp:
|
||||
temp_path = Path(temp)
|
||||
bin_path = temp_path / "bin"
|
||||
bin_path.mkdir()
|
||||
gh_log = temp_path / "gh.log"
|
||||
digest_file = temp_path / "digests"
|
||||
values = {
|
||||
"docker.io/rcourtman/pulse:v6.4.1": DIGEST,
|
||||
"docker.io/rcourtman/pulse:6.4.1": DIGEST,
|
||||
"ghcr.io/rcourtman/pulse:v6.4.1": DIGEST,
|
||||
"ghcr.io/rcourtman/pulse:6.4.1": DIGEST,
|
||||
"docker.io/rcourtman/pulse-control-plane:v6.4.1": DIGEST,
|
||||
"docker.io/rcourtman/pulse-control-plane:6.4.1": DIGEST,
|
||||
"ghcr.io/rcourtman/pulse-control-plane:v6.4.1": DIGEST,
|
||||
"ghcr.io/rcourtman/pulse-control-plane:6.4.1": DIGEST,
|
||||
}
|
||||
values.update(overrides or {})
|
||||
digest_file.write_text(
|
||||
"\n".join(f"{reference} {digest}" for reference, digest in values.items())
|
||||
+ "\n",
|
||||
encoding="utf-8",
|
||||
)
|
||||
(bin_path / "docker").write_text(
|
||||
textwrap.dedent(
|
||||
"""\
|
||||
#!/bin/sh
|
||||
reference="$4"
|
||||
digest=$(awk -v ref="$reference" '$1 == ref { print $2 }' "$DIGEST_FILE")
|
||||
[ -n "$digest" ] || exit 1
|
||||
printf '{"digest":"%s"}\n' "$digest"
|
||||
"""
|
||||
),
|
||||
encoding="utf-8",
|
||||
)
|
||||
(bin_path / "gh").write_text(
|
||||
textwrap.dedent(
|
||||
"""\
|
||||
#!/bin/sh
|
||||
printf '%s\n' "$*" >> "$GH_LOG"
|
||||
exit "$GH_EXIT"
|
||||
"""
|
||||
),
|
||||
encoding="utf-8",
|
||||
)
|
||||
for command in (bin_path / "docker", bin_path / "gh"):
|
||||
command.chmod(0o755)
|
||||
|
||||
env = os.environ.copy()
|
||||
env.update(
|
||||
{
|
||||
"PATH": f"{bin_path}:{env['PATH']}",
|
||||
"DIGEST_FILE": str(digest_file),
|
||||
"GH_LOG": str(gh_log),
|
||||
"GH_EXIT": str(gh_exit),
|
||||
}
|
||||
)
|
||||
result = subprocess.run(
|
||||
[str(SCRIPT), tag, source_sha, "rcourtman/Pulse"],
|
||||
cwd=ROOT,
|
||||
env=env,
|
||||
text=True,
|
||||
capture_output=True,
|
||||
check=False,
|
||||
)
|
||||
return result, gh_log.read_text(encoding="utf-8") if gh_log.exists() else ""
|
||||
|
||||
def test_emits_digest_proof_after_verifying_both_registries(self) -> None:
|
||||
result, calls = self.run_verifier()
|
||||
|
||||
self.assertEqual(result.returncode, 0, result.stderr)
|
||||
self.assertEqual(
|
||||
result.stdout.splitlines(),
|
||||
[f"server_digest={DIGEST}", f"control_plane_digest={DIGEST}"],
|
||||
)
|
||||
self.assertEqual(len(calls.splitlines()), 4)
|
||||
self.assertIn(f"oci://docker.io/rcourtman/pulse@{DIGEST}", calls)
|
||||
self.assertIn(f"oci://ghcr.io/rcourtman/pulse-control-plane@{DIGEST}", calls)
|
||||
self.assertIn("--repo rcourtman/Pulse", calls)
|
||||
self.assertIn("--bundle-from-oci", calls)
|
||||
self.assertIn(
|
||||
"--signer-workflow github.com/rcourtman/Pulse/.github/workflows/publish-docker.yml",
|
||||
calls,
|
||||
)
|
||||
self.assertIn(f"--source-digest {SOURCE_SHA}", calls)
|
||||
|
||||
def test_rejects_a_moved_exact_version_tag_before_attestation(self) -> None:
|
||||
changed = "sha256:" + "c" * 64
|
||||
result, calls = self.run_verifier(
|
||||
overrides={"ghcr.io/rcourtman/pulse:6.4.1": changed}
|
||||
)
|
||||
|
||||
self.assertNotEqual(result.returncode, 0)
|
||||
self.assertIn("do not resolve to one digest", result.stderr)
|
||||
self.assertEqual(calls, "")
|
||||
|
||||
def test_rejects_an_unverifiable_attestation(self) -> None:
|
||||
result, calls = self.run_verifier(gh_exit=1)
|
||||
|
||||
self.assertNotEqual(result.returncode, 0)
|
||||
self.assertEqual(len(calls.splitlines()), 1)
|
||||
|
||||
def test_rejects_invalid_release_identity_without_registry_calls(self) -> None:
|
||||
result, calls = self.run_verifier(source_sha="main")
|
||||
|
||||
self.assertNotEqual(result.returncode, 0)
|
||||
self.assertIn("Invalid release source SHA", result.stderr)
|
||||
self.assertEqual(calls, "")
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
unittest.main()
|
||||
86
scripts/verify-release-container-images.sh
Executable file
86
scripts/verify-release-container-images.sh
Executable file
|
|
@ -0,0 +1,86 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
# Resolve every exact-version public container tag to one digest per image and
|
||||
# verify the GitHub build-provenance attestation for that digest. The two
|
||||
# machine-readable output lines are intentionally stable so release workflows
|
||||
# can carry the verified identities across the activation boundary.
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
if [ "$#" -lt 2 ] || [ "$#" -gt 3 ]; then
|
||||
echo "Usage: $0 <tag> <source-sha> [owner/repo]" >&2
|
||||
exit 2
|
||||
fi
|
||||
|
||||
TAG="$1"
|
||||
SOURCE_SHA="$2"
|
||||
REPOSITORY="${3:-${GITHUB_REPOSITORY:-rcourtman/Pulse}}"
|
||||
OWNER="${REPOSITORY%%/*}"
|
||||
VERSION="${TAG#v}"
|
||||
SIGNER_WORKFLOW="github.com/${REPOSITORY}/.github/workflows/publish-docker.yml"
|
||||
|
||||
if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-((rc|alpha|beta)\.[0-9]+))?$ ]]; then
|
||||
echo "Invalid release tag: ${TAG}" >&2
|
||||
exit 1
|
||||
fi
|
||||
if [[ ! "$SOURCE_SHA" =~ ^[0-9a-f]{40}$ ]]; then
|
||||
echo "Invalid release source SHA: ${SOURCE_SHA}" >&2
|
||||
exit 1
|
||||
fi
|
||||
if [[ ! "$REPOSITORY" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]]; then
|
||||
echo "Invalid GitHub repository: ${REPOSITORY}" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
for command in docker gh jq; do
|
||||
if ! command -v "$command" >/dev/null 2>&1; then
|
||||
echo "${command} is required to verify release container images." >&2
|
||||
exit 1
|
||||
fi
|
||||
done
|
||||
|
||||
resolve_digest() {
|
||||
local reference="$1"
|
||||
local manifest
|
||||
manifest="$(docker buildx imagetools inspect "$reference" --format '{{json .Manifest}}')"
|
||||
jq -er '.digest | select(type == "string" and test("^sha256:[0-9a-f]{64}$"))' <<<"$manifest"
|
||||
}
|
||||
|
||||
verify_image() {
|
||||
local image="$1"
|
||||
local output_name="$2"
|
||||
local docker_name="docker.io/rcourtman/${image}"
|
||||
local ghcr_name="ghcr.io/${OWNER}/${image}"
|
||||
local docker_tag_digest docker_version_digest ghcr_tag_digest ghcr_version_digest
|
||||
|
||||
docker_tag_digest="$(resolve_digest "${docker_name}:${TAG}")"
|
||||
docker_version_digest="$(resolve_digest "${docker_name}:${VERSION}")"
|
||||
ghcr_tag_digest="$(resolve_digest "${ghcr_name}:${TAG}")"
|
||||
ghcr_version_digest="$(resolve_digest "${ghcr_name}:${VERSION}")"
|
||||
|
||||
if [ "$docker_tag_digest" != "$docker_version_digest" ] || \
|
||||
[ "$docker_tag_digest" != "$ghcr_tag_digest" ] || \
|
||||
[ "$docker_tag_digest" != "$ghcr_version_digest" ]; then
|
||||
echo "Exact-version ${image} tags do not resolve to one digest:" >&2
|
||||
printf ' %s:%s = %s\n' "$docker_name" "$TAG" "$docker_tag_digest" >&2
|
||||
printf ' %s:%s = %s\n' "$docker_name" "$VERSION" "$docker_version_digest" >&2
|
||||
printf ' %s:%s = %s\n' "$ghcr_name" "$TAG" "$ghcr_tag_digest" >&2
|
||||
printf ' %s:%s = %s\n' "$ghcr_name" "$VERSION" "$ghcr_version_digest" >&2
|
||||
return 1
|
||||
fi
|
||||
|
||||
for subject in "$docker_name" "$ghcr_name"; do
|
||||
gh attestation verify "oci://${subject}@${docker_tag_digest}" \
|
||||
--repo "$REPOSITORY" \
|
||||
--bundle-from-oci \
|
||||
--signer-workflow "$SIGNER_WORKFLOW" \
|
||||
--source-digest "$SOURCE_SHA" \
|
||||
>/dev/null
|
||||
done
|
||||
|
||||
printf '%s=%s\n' "$output_name" "$docker_tag_digest"
|
||||
echo "[OK] ${image} exact-version tags and provenance resolve to ${docker_tag_digest}." >&2
|
||||
}
|
||||
|
||||
verify_image pulse server_digest
|
||||
verify_image pulse-control-plane control_plane_digest
|
||||
Loading…
Add table
Add a link
Reference in a new issue