|
| 1 | +/** |
| 2 | + * This code is adapted from the npm project, under ISC License. |
| 3 | + * |
| 4 | + * Original source: |
| 5 | + * https://github.com/npm/cli/blob/04f53ce13201b460123067d7153f1681342548e1/workspaces/libnpmpublish/lib/provenance.js |
| 6 | + */ |
| 7 | + |
| 8 | +import {MessageName, ReportError} from '@yarnpkg/core'; |
| 9 | +import * as sigstore from 'sigstore'; |
| 10 | + |
| 11 | +const {env} = process; |
| 12 | + |
| 13 | +const INTOTO_PAYLOAD_TYPE = `application/vnd.in-toto+json`; |
| 14 | +const INTOTO_STATEMENT_V01_TYPE = `https://in-toto.io/Statement/v0.1`; |
| 15 | +const INTOTO_STATEMENT_V1_TYPE = `https://in-toto.io/Statement/v1`; |
| 16 | +const SLSA_PREDICATE_V02_TYPE = `https://slsa.dev/provenance/v0.2`; |
| 17 | +const SLSA_PREDICATE_V1_TYPE = `https://slsa.dev/provenance/v1`; |
| 18 | + |
| 19 | +const GITHUB_BUILDER_ID_PREFIX = `https://github.com/actions/runner`; |
| 20 | +const GITHUB_BUILD_TYPE = `https://slsa-framework.github.io/github-actions-buildtypes/workflow/v1`; |
| 21 | + |
| 22 | +const GITLAB_BUILD_TYPE_PREFIX = `https://github.com/npm/cli/gitlab`; |
| 23 | +const GITLAB_BUILD_TYPE_VERSION = `v0alpha1`; |
| 24 | + |
| 25 | +export const generateProvenance = async (subject: any, opts?: sigstore.SignOptions) => { |
| 26 | + let payload: unknown; |
| 27 | + if (env.GITHUB_ACTIONS) { |
| 28 | + if (!env.ACTIONS_ID_TOKEN_REQUEST_URL) { |
| 29 | + throw new ReportError( |
| 30 | + MessageName.INVALID_PROVENANCE_ENVIRONMENT, |
| 31 | + `Provenance generation in GitHub Actions requires "write" access to the "id-token" permission`, |
| 32 | + ); |
| 33 | + } |
| 34 | + |
| 35 | + const relativeRef = (env.GITHUB_WORKFLOW_REF || ``).replace(`${env.GITHUB_REPOSITORY}/`, ``); |
| 36 | + const delimiterIndex = relativeRef.indexOf(`@`); |
| 37 | + const workflowPath = relativeRef.slice(0, delimiterIndex); |
| 38 | + const workflowRef = relativeRef.slice(delimiterIndex + 1); |
| 39 | + |
| 40 | + payload = { |
| 41 | + _type: INTOTO_STATEMENT_V1_TYPE, |
| 42 | + subject, |
| 43 | + predicateType: SLSA_PREDICATE_V1_TYPE, |
| 44 | + predicate: { |
| 45 | + buildDefinition: { |
| 46 | + buildType: GITHUB_BUILD_TYPE, |
| 47 | + externalParameters: { |
| 48 | + workflow: { |
| 49 | + ref: workflowRef, |
| 50 | + repository: `${env.GITHUB_SERVER_URL}/${env.GITHUB_REPOSITORY}`, |
| 51 | + path: workflowPath, |
| 52 | + }, |
| 53 | + }, |
| 54 | + internalParameters: { |
| 55 | + github: { |
| 56 | + event_name: env.GITHUB_EVENT_NAME, |
| 57 | + repository_id: env.GITHUB_REPOSITORY_ID, |
| 58 | + repository_owner_id: env.GITHUB_REPOSITORY_OWNER_ID, |
| 59 | + }, |
| 60 | + }, |
| 61 | + resolvedDependencies: [ |
| 62 | + { |
| 63 | + uri: `git+${env.GITHUB_SERVER_URL}/${env.GITHUB_REPOSITORY}@${env.GITHUB_REF}`, |
| 64 | + digest: { |
| 65 | + gitCommit: env.GITHUB_SHA, |
| 66 | + }, |
| 67 | + }, |
| 68 | + ], |
| 69 | + }, |
| 70 | + runDetails: { |
| 71 | + builder: {id: `${GITHUB_BUILDER_ID_PREFIX}/${env.RUNNER_ENVIRONMENT}`}, |
| 72 | + metadata: { |
| 73 | + invocationId: `${env.GITHUB_SERVER_URL}/${env.GITHUB_REPOSITORY}/actions/runs/${env.GITHUB_RUN_ID}/attempts/${env.GITHUB_RUN_ATTEMPT}`, |
| 74 | + }, |
| 75 | + }, |
| 76 | + }, |
| 77 | + }; |
| 78 | + } else if (env.GITLAB_CI) { |
| 79 | + if (!env.SIGSTORE_ID_TOKEN) { |
| 80 | + throw new ReportError( |
| 81 | + MessageName.INVALID_PROVENANCE_ENVIRONMENT, |
| 82 | + `Provenance generation in GitLab CI requires "SIGSTORE_ID_TOKEN" with "sigstore" audience to be present in "id_tokens". For more info see:\nhttps://docs.gitlab.com/ee/ci/secrets/id_token_authentication.html`, |
| 83 | + ); |
| 84 | + } |
| 85 | + |
| 86 | + payload = { |
| 87 | + _type: INTOTO_STATEMENT_V01_TYPE, |
| 88 | + subject, |
| 89 | + predicateType: SLSA_PREDICATE_V02_TYPE, |
| 90 | + predicate: { |
| 91 | + buildType: `${GITLAB_BUILD_TYPE_PREFIX}/${GITLAB_BUILD_TYPE_VERSION}`, |
| 92 | + builder: {id: `${env.CI_PROJECT_URL}/-/runners/${env.CI_RUNNER_ID}`}, |
| 93 | + invocation: { |
| 94 | + configSource: { |
| 95 | + uri: `git+${env.CI_PROJECT_URL}`, |
| 96 | + digest: { |
| 97 | + sha1: env.CI_COMMIT_SHA, |
| 98 | + }, |
| 99 | + entryPoint: env.CI_JOB_NAME, |
| 100 | + }, |
| 101 | + parameters: { |
| 102 | + CI: env.CI, |
| 103 | + CI_API_GRAPHQL_URL: env.CI_API_GRAPHQL_URL, |
| 104 | + CI_API_V4_URL: env.CI_API_V4_URL, |
| 105 | + CI_BUILD_BEFORE_SHA: env.CI_BUILD_BEFORE_SHA, |
| 106 | + CI_BUILD_ID: env.CI_BUILD_ID, |
| 107 | + CI_BUILD_NAME: env.CI_BUILD_NAME, |
| 108 | + CI_BUILD_REF: env.CI_BUILD_REF, |
| 109 | + CI_BUILD_REF_NAME: env.CI_BUILD_REF_NAME, |
| 110 | + CI_BUILD_REF_SLUG: env.CI_BUILD_REF_SLUG, |
| 111 | + CI_BUILD_STAGE: env.CI_BUILD_STAGE, |
| 112 | + CI_COMMIT_BEFORE_SHA: env.CI_COMMIT_BEFORE_SHA, |
| 113 | + CI_COMMIT_BRANCH: env.CI_COMMIT_BRANCH, |
| 114 | + CI_COMMIT_REF_NAME: env.CI_COMMIT_REF_NAME, |
| 115 | + CI_COMMIT_REF_PROTECTED: env.CI_COMMIT_REF_PROTECTED, |
| 116 | + CI_COMMIT_REF_SLUG: env.CI_COMMIT_REF_SLUG, |
| 117 | + CI_COMMIT_SHA: env.CI_COMMIT_SHA, |
| 118 | + CI_COMMIT_SHORT_SHA: env.CI_COMMIT_SHORT_SHA, |
| 119 | + CI_COMMIT_TIMESTAMP: env.CI_COMMIT_TIMESTAMP, |
| 120 | + CI_COMMIT_TITLE: env.CI_COMMIT_TITLE, |
| 121 | + CI_CONFIG_PATH: env.CI_CONFIG_PATH, |
| 122 | + CI_DEFAULT_BRANCH: env.CI_DEFAULT_BRANCH, |
| 123 | + CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX: |
| 124 | + env.CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX, |
| 125 | + CI_DEPENDENCY_PROXY_GROUP_IMAGE_PREFIX: env.CI_DEPENDENCY_PROXY_GROUP_IMAGE_PREFIX, |
| 126 | + CI_DEPENDENCY_PROXY_SERVER: env.CI_DEPENDENCY_PROXY_SERVER, |
| 127 | + CI_DEPENDENCY_PROXY_USER: env.CI_DEPENDENCY_PROXY_USER, |
| 128 | + CI_JOB_ID: env.CI_JOB_ID, |
| 129 | + CI_JOB_NAME: env.CI_JOB_NAME, |
| 130 | + CI_JOB_NAME_SLUG: env.CI_JOB_NAME_SLUG, |
| 131 | + CI_JOB_STAGE: env.CI_JOB_STAGE, |
| 132 | + CI_JOB_STARTED_AT: env.CI_JOB_STARTED_AT, |
| 133 | + CI_JOB_URL: env.CI_JOB_URL, |
| 134 | + CI_NODE_TOTAL: env.CI_NODE_TOTAL, |
| 135 | + CI_PAGES_DOMAIN: env.CI_PAGES_DOMAIN, |
| 136 | + CI_PAGES_URL: env.CI_PAGES_URL, |
| 137 | + CI_PIPELINE_CREATED_AT: env.CI_PIPELINE_CREATED_AT, |
| 138 | + CI_PIPELINE_ID: env.CI_PIPELINE_ID, |
| 139 | + CI_PIPELINE_IID: env.CI_PIPELINE_IID, |
| 140 | + CI_PIPELINE_SOURCE: env.CI_PIPELINE_SOURCE, |
| 141 | + CI_PIPELINE_URL: env.CI_PIPELINE_URL, |
| 142 | + CI_PROJECT_CLASSIFICATION_LABEL: env.CI_PROJECT_CLASSIFICATION_LABEL, |
| 143 | + CI_PROJECT_DESCRIPTION: env.CI_PROJECT_DESCRIPTION, |
| 144 | + CI_PROJECT_ID: env.CI_PROJECT_ID, |
| 145 | + CI_PROJECT_NAME: env.CI_PROJECT_NAME, |
| 146 | + CI_PROJECT_NAMESPACE: env.CI_PROJECT_NAMESPACE, |
| 147 | + CI_PROJECT_NAMESPACE_ID: env.CI_PROJECT_NAMESPACE_ID, |
| 148 | + CI_PROJECT_PATH: env.CI_PROJECT_PATH, |
| 149 | + CI_PROJECT_PATH_SLUG: env.CI_PROJECT_PATH_SLUG, |
| 150 | + CI_PROJECT_REPOSITORY_LANGUAGES: env.CI_PROJECT_REPOSITORY_LANGUAGES, |
| 151 | + CI_PROJECT_ROOT_NAMESPACE: env.CI_PROJECT_ROOT_NAMESPACE, |
| 152 | + CI_PROJECT_TITLE: env.CI_PROJECT_TITLE, |
| 153 | + CI_PROJECT_URL: env.CI_PROJECT_URL, |
| 154 | + CI_PROJECT_VISIBILITY: env.CI_PROJECT_VISIBILITY, |
| 155 | + CI_REGISTRY: env.CI_REGISTRY, |
| 156 | + CI_REGISTRY_IMAGE: env.CI_REGISTRY_IMAGE, |
| 157 | + CI_REGISTRY_USER: env.CI_REGISTRY_USER, |
| 158 | + CI_RUNNER_DESCRIPTION: env.CI_RUNNER_DESCRIPTION, |
| 159 | + CI_RUNNER_ID: env.CI_RUNNER_ID, |
| 160 | + CI_RUNNER_TAGS: env.CI_RUNNER_TAGS, |
| 161 | + CI_SERVER_HOST: env.CI_SERVER_HOST, |
| 162 | + CI_SERVER_NAME: env.CI_SERVER_NAME, |
| 163 | + CI_SERVER_PORT: env.CI_SERVER_PORT, |
| 164 | + CI_SERVER_PROTOCOL: env.CI_SERVER_PROTOCOL, |
| 165 | + CI_SERVER_REVISION: env.CI_SERVER_REVISION, |
| 166 | + CI_SERVER_SHELL_SSH_HOST: env.CI_SERVER_SHELL_SSH_HOST, |
| 167 | + CI_SERVER_SHELL_SSH_PORT: env.CI_SERVER_SHELL_SSH_PORT, |
| 168 | + CI_SERVER_URL: env.CI_SERVER_URL, |
| 169 | + CI_SERVER_VERSION: env.CI_SERVER_VERSION, |
| 170 | + CI_SERVER_VERSION_MAJOR: env.CI_SERVER_VERSION_MAJOR, |
| 171 | + CI_SERVER_VERSION_MINOR: env.CI_SERVER_VERSION_MINOR, |
| 172 | + CI_SERVER_VERSION_PATCH: env.CI_SERVER_VERSION_PATCH, |
| 173 | + CI_TEMPLATE_REGISTRY_HOST: env.CI_TEMPLATE_REGISTRY_HOST, |
| 174 | + GITLAB_CI: env.GITLAB_CI, |
| 175 | + GITLAB_FEATURES: env.GITLAB_FEATURES, |
| 176 | + GITLAB_USER_ID: env.GITLAB_USER_ID, |
| 177 | + GITLAB_USER_LOGIN: env.GITLAB_USER_LOGIN, |
| 178 | + RUNNER_GENERATE_ARTIFACTS_METADATA: env.RUNNER_GENERATE_ARTIFACTS_METADATA, |
| 179 | + }, |
| 180 | + environment: { |
| 181 | + name: env.CI_RUNNER_DESCRIPTION, |
| 182 | + architecture: env.CI_RUNNER_EXECUTABLE_ARCH, |
| 183 | + server: env.CI_SERVER_URL, |
| 184 | + project: env.CI_PROJECT_PATH, |
| 185 | + job: { |
| 186 | + id: env.CI_JOB_ID, |
| 187 | + }, |
| 188 | + pipeline: { |
| 189 | + id: env.CI_PIPELINE_ID, |
| 190 | + ref: env.CI_CONFIG_PATH, |
| 191 | + }, |
| 192 | + }, |
| 193 | + }, |
| 194 | + metadata: { |
| 195 | + buildInvocationId: `${env.CI_JOB_URL}`, |
| 196 | + completeness: { |
| 197 | + parameters: true, |
| 198 | + environment: true, |
| 199 | + materials: false, |
| 200 | + }, |
| 201 | + reproducible: false, |
| 202 | + }, |
| 203 | + materials: [ |
| 204 | + { |
| 205 | + uri: `git+${env.CI_PROJECT_URL}`, |
| 206 | + digest: { |
| 207 | + sha1: env.CI_COMMIT_SHA, |
| 208 | + }, |
| 209 | + }, |
| 210 | + ], |
| 211 | + }, |
| 212 | + }; |
| 213 | + } else { |
| 214 | + throw new ReportError( |
| 215 | + MessageName.INVALID_PROVENANCE_ENVIRONMENT, |
| 216 | + `Provenance generation is only supported in GitHub Actions and GitLab CI`, |
| 217 | + ); |
| 218 | + } |
| 219 | + return sigstore.attest(Buffer.from(JSON.stringify(payload)), INTOTO_PAYLOAD_TYPE, opts); |
| 220 | +}; |
0 commit comments