|
| 1 | +#!/bin/bash |
| 2 | +set -uo pipefail # prevent accessing unset env vars, prevent masking pipeline errors to the next command |
| 3 | + |
| 4 | +#docs |
| 5 | +#title :verify_provenance.sh |
| 6 | +#description :This script will download and verify a signed Powertools for AWS Lambda (Python) release build with SLSA Verifier |
| 7 | +#author :@heitorlessa |
| 8 | +#date :July 1st 2023 |
| 9 | +#version :0.1 |
| 10 | +#usage :bash verify_provenance.sh {release version} |
| 11 | +#notes :Meant to use in GitHub Actions or locally (MacOS, Linux, WSL). |
| 12 | +#os_version :Ubuntu 22.04.2 LTS |
| 13 | +#============================================================================== |
| 14 | + |
| 15 | +# Check if RELEASE_VERSION is provided as a command line argument |
| 16 | +if [[ $# -eq 1 ]]; then |
| 17 | + export readonly RELEASE_VERSION="$1" |
| 18 | +else |
| 19 | + echo "ERROR: Please provider Powertools release version as a command line argument." |
| 20 | + echo "Example: bash verify_provenance.sh 2.20.0" |
| 21 | + exit 1 |
| 22 | +fi |
| 23 | + |
| 24 | +export readonly ARCHITECTURE=$(uname -m | sed 's/x86_64/amd64/g') # arm64, x86_64 ->amd64 |
| 25 | +export readonly OS_NAME=$(uname -s | tr '[:upper:]' '[:lower:]') # darwin, linux |
| 26 | +export readonly SLSA_VERIFIER_VERSION="2.3.0" |
| 27 | +export readonly SLSA_VERIFIER_CHECKSUM_FILE="SHA256SUM.md" |
| 28 | +export readonly SLSA_VERIFIER_BINARY="./slsa-verifier-${OS_NAME}-${ARCHITECTURE}" |
| 29 | + |
| 30 | +export readonly RELEASE_BINARY="aws_lambda_powertools-${RELEASE_VERSION}-py3-none-any.whl" |
| 31 | +export readonly ORG="aws-powertools" |
| 32 | +export readonly REPO="powertools-lambda-python" |
| 33 | +export readonly PROVENANCE_FILE="multiple.intoto.jsonl" |
| 34 | + |
| 35 | +export readonly FILES=("${SLSA_VERIFIER_BINARY}" "${SLSA_VERIFIER_CHECKSUM_FILE}" "${PROVENANCE_FILE}" "${RELEASE_BINARY}") |
| 36 | + |
| 37 | +function debug() { |
| 38 | + TIMESTAMP=$(date -u "+%FT%TZ") # 2023-05-10T07:53:59Z |
| 39 | + echo ""${TIMESTAMP}" DEBUG - [*] $1" |
| 40 | +} |
| 41 | + |
| 42 | +function error() { |
| 43 | + cleanup |
| 44 | + TIMESTAMP=$(date -u "+%FT%TZ") # 2023-05-10T07:53:59Z |
| 45 | + echo ""${TIMESTAMP}" ERROR - [!] $1" |
| 46 | + echo ""${TIMESTAMP}" ERROR - [!] exiting" |
| 47 | + exit 1 |
| 48 | +} |
| 49 | + |
| 50 | +function download_slsa_verifier() { |
| 51 | + readonly SLSA_URL="https://github.com/slsa-framework/slsa-verifier/releases/download/v${SLSA_VERIFIER_VERSION}/slsa-verifier-${OS_NAME}-${ARCHITECTURE}" |
| 52 | + # debug "Downloading SLSA Verifier for - Binary: slsa-verifier-${OS_NAME}-${ARCHITECTURE}" |
| 53 | + debug "Downloading SLSA Verifier binary: ${SLSA_URL}" |
| 54 | + curl \ |
| 55 | + --location \ |
| 56 | + --fail \ |
| 57 | + --silent \ |
| 58 | + -O "${SLSA_URL}" || error "Failed to download SLSA Verifier binary" |
| 59 | + |
| 60 | + readonly SLSA_CHECKSUM_URL="https://raw.githubusercontent.com/slsa-framework/slsa-verifier/f59b55ef2190581d40fc1a5f3b7a51cab2f4a652/${SLSA_VERIFIER_CHECKSUM_FILE}" |
| 61 | + debug "Downloading SLSA Verifier checksums" |
| 62 | + curl \ |
| 63 | + --location \ |
| 64 | + --fail \ |
| 65 | + --silent \ |
| 66 | + -O "${SLSA_CHECKSUM_URL}" || error "Failed to download SLSA Verifier binary checksum file" |
| 67 | + |
| 68 | + debug "Verifying SLSA Verifier binary integrity" |
| 69 | + CURRENT_HASH=$(sha256sum "${SLSA_VERIFIER_BINARY}" | awk '{print $1}') |
| 70 | + if [[ $(grep "${CURRENT_HASH}" "${SLSA_VERIFIER_CHECKSUM_FILE}") ]]; then |
| 71 | + debug "SLSA Verifier binary integrity confirmed" |
| 72 | + chmod +x "${SLSA_VERIFIER_BINARY}" |
| 73 | + else |
| 74 | + error "Failed integrity check for SLSA Verifier binary: ${SLSA_VERIFIER_BINARY}" |
| 75 | + fi |
| 76 | +} |
| 77 | + |
| 78 | +function download_provenance() { |
| 79 | + readonly PROVENANCE_URL="https://github.com/${ORG}/${REPO}/releases/download/v${RELEASE_VERSION}/${PROVENANCE_FILE}" |
| 80 | + debug "Downloading attestation: ${PROVENANCE_URL}" |
| 81 | + |
| 82 | + curl \ |
| 83 | + --location \ |
| 84 | + --fail \ |
| 85 | + --silent \ |
| 86 | + -O ${PROVENANCE_URL} || error "Failed to download provenance. Does the release already exist?" |
| 87 | +} |
| 88 | + |
| 89 | +function download_release_artifact() { |
| 90 | + debug "Downloading ${RELEASE_VERSION} release from PyPi" |
| 91 | + python -m pip download \ |
| 92 | + --only-binary=:all: \ |
| 93 | + --no-deps \ |
| 94 | + --quiet \ |
| 95 | + aws-lambda-powertools=="${RELEASE_VERSION}" |
| 96 | +} |
| 97 | + |
| 98 | +function verify_provenance() { |
| 99 | + debug "Verifying attestation with slsa-verifier" |
| 100 | + "${SLSA_VERIFIER_BINARY}" verify-artifact \ |
| 101 | + --provenance-path "${PROVENANCE_FILE}" \ |
| 102 | + --source-uri github.com/${ORG}/${REPO} \ |
| 103 | + ${RELEASE_BINARY} |
| 104 | +} |
| 105 | + |
| 106 | +function cleanup() { |
| 107 | + debug "Cleaning up previously downloaded files" |
| 108 | + rm -f "${SLSA_VERIFIER_BINARY}" |
| 109 | + rm -f "${SLSA_VERIFIER_CHECKSUM_FILE}" |
| 110 | + rm -f "${PROVENANCE_FILE}" |
| 111 | + rm -f "${RELEASE_BINARY}" |
| 112 | + echo "${FILES[@]}" | xargs -n1 echo "Removed file: " |
| 113 | +} |
| 114 | + |
| 115 | +function main() { |
| 116 | + download_slsa_verifier |
| 117 | + download_provenance |
| 118 | + download_release_artifact |
| 119 | + verify_provenance |
| 120 | + cleanup |
| 121 | +} |
| 122 | + |
| 123 | +main |
| 124 | + |
| 125 | +# Lessons learned |
| 126 | +# |
| 127 | +# 1. If source doesn't match provenance |
| 128 | +# |
| 129 | +# FAILED: SLSA verification failed: source used to generate the binary does not match provenance: expected source 'awslabs/aws-lambda-powertools-python', got 'heitorlessa/aws-lambda-powertools-test' |
| 130 | +# |
| 131 | +# 2. Avoid building deps during download in Test registry endpoints |
| 132 | +# |
| 133 | +# FAILED: Could not find a version that satisfies the requirement poetry-core>=1.3.2 (from versions: 1.2.0) |
| 134 | +# |
0 commit comments