From 8b1c4dcee5459fa5741718fb70841f0f00ea1a4f Mon Sep 17 00:00:00 2001 From: BlackDex Date: Fri, 10 Jan 2025 14:52:54 +0100 Subject: [PATCH] Add Attestations for containers and artifacts This commit will add attestation actions to sign the containers and binaries which can be verified via the gh cli. https://cli.github.com/manual/gh_attestation_verify Signed-off-by: BlackDex --- .github/workflows/release.yml | 88 ++++++++++++++++++++++++++++++++++- 1 file changed, 86 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9169732fa5..efc3415b0a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -4,6 +4,7 @@ on: push: branches: - main + - add-attest tags: - '*' @@ -14,7 +15,8 @@ jobs: # We will skip this check if we are creating a tag, because that has the same hash as a previous run already. skip_check: runs-on: ubuntu-24.04 - if: ${{ github.repository == 'dani-garcia/vaultwarden' }} + # if: ${{ github.repository == 'dani-garcia/vaultwarden' }} + if: ${{ github.repository == 'blackdex/vaultwarden' }} outputs: should_skip: ${{ steps.skip_check.outputs.should_skip }} steps: @@ -27,10 +29,16 @@ jobs: if: ${{ github.ref_type == 'branch' }} docker-build: + permissions: + packages: write + contents: read + attestations: write + id-token: write runs-on: ubuntu-24.04 timeout-minutes: 120 needs: skip_check - if: ${{ needs.skip_check.outputs.should_skip != 'true' && github.repository == 'dani-garcia/vaultwarden' }} + # if: ${{ needs.skip_check.outputs.should_skip != 'true' && github.repository == 'dani-garcia/vaultwarden' }} + if: ${{ needs.skip_check.outputs.should_skip != 'true' && github.repository == 'blackdex/vaultwarden' }} # Start a local docker registry to extract the final Alpine static build binaries services: registry: @@ -158,6 +166,7 @@ jobs: fi # + # Used to extract the final Alpine static build binaries - name: Add localhost registry if: ${{ matrix.base_image == 'alpine' }} shell: bash @@ -165,6 +174,7 @@ jobs: echo "CONTAINER_REGISTRIES=${CONTAINER_REGISTRIES:+${CONTAINER_REGISTRIES},}localhost:5000/vaultwarden/server" | tee -a "${GITHUB_ENV}" - name: Bake ${{ matrix.base_image }} containers + id: bake_vw uses: docker/bake-action@3fc70e1131fee40a422dd8dd0ff22014ae20a1f3 # v5.11.0 env: BASE_TAGS: "${{ env.BASE_TAGS }}" @@ -181,6 +191,56 @@ jobs: *.cache-from=${{ env.BAKE_CACHE_FROM }} *.cache-to=${{ env.BAKE_CACHE_TO }} + # Attest Debian + - name: Attest - docker.io - Debian + if: ${{ env.HAVE_DOCKERHUB_LOGIN == 'true' && matrix.base_image == 'debian' && steps.bake_vw.outputs.metadata != ''}} + uses: actions/attest-build-provenance@7668571508540a607bdfd90a87a560489fe372eb # v2.1.0 + with: + subject-name: ${{ vars.DOCKERHUB_REPO }} + subject-digest: ${{ fromJSON(steps.bake_vw.outputs.metadata).debian-multi['containerimage.digest'] }} + push-to-registry: true + + - name: Attest - ghcr.io - Debian + if: ${{ env.HAVE_GHCR_LOGIN == 'true' && matrix.base_image == 'debian' && steps.bake_vw.outputs.metadata != ''}} + uses: actions/attest-build-provenance@7668571508540a607bdfd90a87a560489fe372eb # v2.1.0 + with: + subject-name: ${{ vars.GHCR_REPO }} + subject-digest: ${{ fromJSON(steps.bake_vw.outputs.metadata).debian-multi['containerimage.digest'] }} + push-to-registry: true + + - name: Attest - quay.io - Debian + if: ${{ env.HAVE_QUAY_LOGIN == 'true' && matrix.base_image == 'debian' && steps.bake_vw.outputs.metadata != ''}} + uses: actions/attest-build-provenance@7668571508540a607bdfd90a87a560489fe372eb # v2.1.0 + with: + subject-name: ${{ vars.QUAY_REPO }} + subject-digest: ${{ fromJSON(steps.bake_vw.outputs.metadata).debian-multi['containerimage.digest'] }} + push-to-registry: true + + # Attest Alpine + - name: Attest - docker.io - Alpine + if: ${{ env.HAVE_DOCKERHUB_LOGIN == 'true' && matrix.base_image == 'alpine' && steps.bake_vw.outputs.metadata != ''}} + uses: actions/attest-build-provenance@7668571508540a607bdfd90a87a560489fe372eb # v2.1.0 + with: + subject-name: ${{ vars.DOCKERHUB_REPO }} + subject-digest: ${{ fromJSON(steps.bake_vw.outputs.metadata).alpine-multi['containerimage.digest'] }} + push-to-registry: true + + - name: Attest - ghcr.io - Alpine + if: ${{ env.HAVE_GHCR_LOGIN == 'true' && matrix.base_image == 'alpine' && steps.bake_vw.outputs.metadata != ''}} + uses: actions/attest-build-provenance@7668571508540a607bdfd90a87a560489fe372eb # v2.1.0 + with: + subject-name: ${{ vars.GHCR_REPO }} + subject-digest: ${{ fromJSON(steps.bake_vw.outputs.metadata).alpine-multi['containerimage.digest'] }} + push-to-registry: true + + - name: Attest - quay.io - Alpine + if: ${{ env.HAVE_QUAY_LOGIN == 'true' && matrix.base_image == 'alpine' && steps.bake_vw.outputs.metadata != ''}} + uses: actions/attest-build-provenance@7668571508540a607bdfd90a87a560489fe372eb # v2.1.0 + with: + subject-name: ${{ vars.QUAY_REPO }} + subject-digest: ${{ fromJSON(steps.bake_vw.outputs.metadata).alpine-multi['containerimage.digest'] }} + push-to-registry: true + # Extract the Alpine binaries from the containers - name: Extract binaries @@ -229,6 +289,12 @@ jobs: name: vaultwarden-${{ env.SOURCE_VERSION }}-linux-amd64 path: vaultwarden-amd64 + - name: Attest amd64 artifact + uses: actions/attest-build-provenance@7668571508540a607bdfd90a87a560489fe372eb # v2.1.0 + if: ${{ matrix.base_image == 'alpine' }} + with: + subject-path: vaultwarden-amd64 + - name: "Upload arm64 artifact" uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b #v4.5.0 if: ${{ matrix.base_image == 'alpine' }} @@ -236,6 +302,12 @@ jobs: name: vaultwarden-${{ env.SOURCE_VERSION }}-linux-arm64 path: vaultwarden-arm64 + - name: Attest arm64 artifact + uses: actions/attest-build-provenance@7668571508540a607bdfd90a87a560489fe372eb # v2.1.0 + if: ${{ matrix.base_image == 'alpine' }} + with: + subject-path: vaultwarden-arm64 + - name: "Upload armv7 artifact" uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b #v4.5.0 if: ${{ matrix.base_image == 'alpine' }} @@ -243,10 +315,22 @@ jobs: name: vaultwarden-${{ env.SOURCE_VERSION }}-linux-armv7 path: vaultwarden-armv7 + - name: Attest armv7 artifact + uses: actions/attest-build-provenance@7668571508540a607bdfd90a87a560489fe372eb # v2.1.0 + if: ${{ matrix.base_image == 'alpine' }} + with: + subject-path: vaultwarden-armv7 + - name: "Upload armv6 artifact" uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b #v4.5.0 if: ${{ matrix.base_image == 'alpine' }} with: name: vaultwarden-${{ env.SOURCE_VERSION }}-linux-armv6 path: vaultwarden-armv6 + + - name: Attest armv6 artifact + uses: actions/attest-build-provenance@7668571508540a607bdfd90a87a560489fe372eb # v2.1.0 + if: ${{ matrix.base_image == 'alpine' }} + with: + subject-path: vaultwarden-armv6 # End Upload artifacts to Github Actions