From 8a1959b8e04e25a91dd7e3a129f599d6ebfbcade Mon Sep 17 00:00:00 2001 From: houdini91 Date: Mon, 9 Jun 2025 09:52:19 +0300 Subject: [PATCH 01/10] valint update --- docs/guides/secure-sfw-slsa/basic-examples.md | 62 +++++ .../secure-sfw-slsa/customizing-provenance.md | 220 ++++++++++-------- 2 files changed, 191 insertions(+), 91 deletions(-) diff --git a/docs/guides/secure-sfw-slsa/basic-examples.md b/docs/guides/secure-sfw-slsa/basic-examples.md index 84acbd349..02bd9b692 100644 --- a/docs/guides/secure-sfw-slsa/basic-examples.md +++ b/docs/guides/secure-sfw-slsa/basic-examples.md @@ -115,6 +115,53 @@ valint slsa docker-archive:busybox_archive.tar ``` +
+ Generate and attach source SBOM evidence reference + +Generate an SBOM for the Git repository and attach it to the SLSA provenance as a by-product evidence reference. + +```bash +valint slsa --source git:https://github.com/your-org/your-repo.git --git-tag v1.0.0 +``` + +
+ +
+ Generate and attach target image SBOM evidence reference + +Generate an SBOM for the primary image target and attach it to the provenance. + +```bash +valint slsa alpine:latest --bom +``` + +
+ +
+ Combine source and image SBOM evidence references + +Attach SBOMs for both the source repository and the image in a single provenance document. + +```bash +valint slsa alpine:latest \ + --bom \ + --source git:https://github.com/your-org/your-repo.git --git-tag v1.0.0 +``` + +
+ +
+ Attach third-party scan evidence with --input + +Include external scan results (e.g., a Trivy JSON report) as an additional by-product evidence reference. + +```bash +valint slsa alpine:latest --input trivy:scan_result.json +``` + +
+ +
Directory target @@ -186,6 +233,8 @@ valint verify busybox:latest -i attest-slsa ```
+ +
Attest and verify Git repository target @@ -259,3 +308,16 @@ valint verify [target] -i [attest-slsa, statement-slsa] -f \
+ + + + + + + + + + + + + diff --git a/docs/guides/secure-sfw-slsa/customizing-provenance.md b/docs/guides/secure-sfw-slsa/customizing-provenance.md index f13678b4f..e5162c2c4 100644 --- a/docs/guides/secure-sfw-slsa/customizing-provenance.md +++ b/docs/guides/secure-sfw-slsa/customizing-provenance.md @@ -1,109 +1,147 @@ --- -sidebar_label: "Customizing Provenance" + +sidebar\_label: "Customizing Provenance" title: "Customizing the Provenance Document" -sidebar_position: 5 -toc_min_heading_level: 2 -toc_max_heading_level: 5 ---- +sidebar\_position: 5 +toc\_min\_heading\_level: 2 +toc\_max\_heading\_level: 5 +--------------------------- + +Use the following flags to tailor the provenance document to your needs. + +## Include external by-products + +| Flag | Purpose | Example | +| --------------------- | -------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------- | +| `--by-product ` | Attach the contents of a file (e.g., log, SBOM) as a by-product | `valint slsa busybox:latest --by-product /path/to/file.txt` | +| `--components ` | When the by-product is an SBOM, include finer-grained components such as `layers`, `packages`, or `files` (comma‑separated list) | `valint slsa busybox:latest --components layers,packages,files` | + +## Override key provenance fields + +| Flag | Field | Example | +| --------------- | ---------------------------- | ------------------------------------ | +| `--invocation` | Invocation ID | `--invocation my_invocation` | +| `--build-type` | Build type | `--build-type docker` | +| `--builder-id` | Builder ID | `--builder-id 12345` | +| `--started-on` | Build start time (RFC 3339) | `--started-on 2023-07-25T15:30:00Z` | +| `--finished-on` | Build finish time (RFC 3339) | `--finished-on 2023-07-25T16:00:00Z` | -You can customize the provenance object by using the following flags: -* `--by-product` includes the contents of an external file, such as a log file or an SBOM. -For example, -```valint slsa busybox:latest --by-product /path/to/my_file.txt``` -* `--components` extend `byproduct` when it is an SBOM with detailed target components such as layers packages, and files. -For example, -```valint slsa busybox:latest --components layers,packages,files``` -* Set specific provenance fields such as: - * `--invocation`: invocation ID - * `--build-type`: build type - * `--builder-id`: builder ID - * `--started-on`: build start time - * `--finished-on`: build finish time -For Example, +**Full example** + +```bash +valint slsa busybox:latest \ + --source git:https://github.com/my_org/my_repo.git \ + --git-tag v1.0.0 \ + --invocation my_invocation \ + --build-type docker \ + --builder-id 12345 \ + --started-on 2023-07-25T15:30:00Z \ + --finished-on 2023-07-25T16:00:00Z ``` -valint slsa busybox:latest --invocation my_invocation --build-type docker --builder-id 12345 --started-on 2023-07-25T15:30:00Z --finished-on 2023-07-25T16:00:00Z + +## Add extra evidence (by-product references) + +| Flag | Purpose | +| -------------------- | ----------------------------------------------------------------------------------------------- | +| `--source ` | Generate an SBOM for the specified Git repository | +| `--bom` | Generate an SBOM for the primary container‑image target | +| `--input ` | Generate evidence for any additional target (extra Git repo, image, or third‑party tool output) | + +```bash +valint bom \ + --source https://github.com/your-org/your-repo.git \ + --bom \ + --input ghcr.io/your-org/extra-image:latest ``` -* `-env` or `--all-env` adds environment variables to the `internaParameters`. -For example, -```yaml -#Attach all environment variables + +## Add environment variables + +* `--all-env` – Attach **all** environment variables to `internalParameters`. +* `--env ` – Attach a **specific** variable. + +```bash +# Attach all environment variables valint slsa busybox:latest --all-env -# Attach a specific environment variable + +# Attach a single variable valint slsa busybox:latest --env MY_ENV ``` -* `--external` adds parameters to the `externalParameters` in the form of key=value pairs. -For example, -```valint slsa busybox:latest --external my_custom_param=my_custom_value``` -* `--predicate` adds a full or partial SLSA provenance predicate. -For example, -```valint slsa busybox:latest --predicate custom.predicate.json``` -Where `custom.predicate.json` specifies custom `externalParameters`, `builderDependencies`, and metadata. + +## Extend external parameters + +* `--external ` – Add key–value pairs to `externalParameters`. + +```bash +valint slsa busybox:latest --external my_custom_param=my_custom_value +``` + +## Supply a custom predicate or statement + +| Flag | Purpose | Example | +| -------------------- | ------------------------------------------ | -------------------------------------------------------------- | +| `--predicate ` | Merge a full or partial SLSA **predicate** | `valint slsa busybox:latest --predicate custom.predicate.json` | +| `--statement ` | Merge a full or partial SLSA **statement** | `valint slsa busybox:latest --statement custom.statement.json` | + +### Predicate template (`custom.predicate.json`) + ```json { - "buildDefinition": { - "externalParameters": { - "custom_external": { - "digest": { - "sha1": "910b17c3bc81ca8c791aaa394d508219e03879f8" - }, - "name": "build-environment", - "value": "production", - "uri": "https://company.com/my_repo/event" - } - } - }, - "runDetails": { - "builder": { - "builderDependencies": [ - { - "uri": "https://github.com/.github/reusable_build.yaml", - "name": "my_tool", - "annotations": { - "vendor": "My company Inc", - "version": "1.0" - } - } - ] - }, - "metadata": { - "invocationID": "https://company.com/my_repo/build.sh", - "startedOn": "2023-07-25T15:30:00Z", - "finishedOn": "2023-07-25T16:00:00Z" - } - } + "buildDefinition": { + "externalParameters": { + "custom_external": { + "name": "build-environment", + "value": "production", + "uri": "https://company.com/my_repo/event", + "digest": { "sha1": "910b17c3bc81ca8c791aaa394d508219e03879f8" } + } + } + }, + "runDetails": { + "builder": { + "builderDependencies": [ + { + "uri": "https://github.com/.github/reusable_build.yaml", + "name": "my_tool", + "annotations": { "vendor": "My company Inc", "version": "1.0" } + } + ] + }, + "metadata": { + "invocationID": "https://company.com/my_repo/build.sh", + "startedOn": "2023-07-25T15:30:00Z", + "finishedOn": "2023-07-25T16:00:00Z" + } + } } -``` -* `--statement` adds a full or partial SLSA provenance statement. -For example, -```valint slsa busybox:latest --statement custom.statement.json``` -The following `custom.predicate.json` includes custom subject and byproducts. +``` + +### Statement template (`custom.statement.json`) + ```json { - "_type": "https://in-toto.io/Statement/v0.1", - "predicateType": "https://slsa.dev/provenance/v1", - "subject": [ - { - "name": "index.docker.io/my_image", - "digest": { - "sha256": "62aedd01bd8520c43d06b09f7a0f67ba9720bdc04631a8242c65ea995f3ecac8" - } - } - ], - "predicate": { - "runDetails": { - "byproducts": [ - { + "_type": "https://in-toto.io/Statement/v0.1", + "predicateType": "https://slsa.dev/provenance/v1", + "subject": [ + { + "name": "index.docker.io/my_image", + "digest": { + "sha256": "62aedd01bd8520c43d06b09f7a0f67ba9720bdc04631a8242c65ea995f3ecac8" + } + } + ], + "predicate": { + "runDetails": { + "byproducts": [ + { "uri": "pkg:docker/index.docker.io/my_image:latest@sha256:7ad00cd55506625f2afad262de6002c8cef20d214b353e51d1025e40e8646e18?index=0", "digest": { - "sha256": "7ad00cd55506625f2afad262de6002c8cef20d214b353e51d1025e40e8646e18" + "sha256": "7ad00cd55506625f2afad262de6002c8cef20d214b353e51d1025e40e8646e18" }, "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip", - "annotations": { - "tag": "v0.0.1" - } - } - ] - } - } + "annotations": { "tag": "v0.0.1" } + } + ] + } + } } -``` \ No newline at end of file +``` From c904f2af89f72a77017de7252c3e2d1b66283880 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Thu, 12 Jun 2025 12:49:19 +0300 Subject: [PATCH 02/10] buildah --- docusaurus.config.js | 1 + 1 file changed, 1 insertion(+) diff --git a/docusaurus.config.js b/docusaurus.config.js index 09bc040e5..b2df3ed72 100644 --- a/docusaurus.config.js +++ b/docusaurus.config.js @@ -93,6 +93,7 @@ const config = { "guides/secure-sfw-slsa/README.md", "guides/secure-sfw-slsa/slsa-lvl-1.md", "guides/secure-sfw-slsa/slsa-lvl-2.md", + "guides/secure-sfw-slsa/slsa-lvl-2-on-scale.md", "guides/secure-sfw-slsa/slsa-lvl-3.md", "guides/secure-sfw-slsa/customizing-provenance.md", "guides/secure-sfw-slsa/basic-examples.md", From b3aecb9b2e299779b94c22beb64a22a96b662d2e Mon Sep 17 00:00:00 2001 From: houdini91 Date: Fri, 13 Jun 2025 12:42:56 +0300 Subject: [PATCH 03/10] debug --- .../secure-sfw-slsa/slsa-lvl-2-on-scale.md | 949 ++++++++++++++++++ 1 file changed, 949 insertions(+) create mode 100644 docs/guides/secure-sfw-slsa/slsa-lvl-2-on-scale.md diff --git a/docs/guides/secure-sfw-slsa/slsa-lvl-2-on-scale.md b/docs/guides/secure-sfw-slsa/slsa-lvl-2-on-scale.md new file mode 100644 index 000000000..cae1424d5 --- /dev/null +++ b/docs/guides/secure-sfw-slsa/slsa-lvl-2-on-scale.md @@ -0,0 +1,949 @@ +--- + +sidebar\_label: "SLSA Provenance at Scale" +title: "SLSA L1 & L2 Provenance from Logs" +sidebar\_position: 5 +toc\_min\_heading\_level: 2 +toc\_max\_heading\_level: 5 +--------------------------- + +Scribe supports automatic generation of [SLSA Level 2](https://slsa.dev/provenance/v1.0) provenance for container images at scale — without modifying your pipelines. Instead of injecting provenance generators directly into your CI, this method leverages build log analysis from GitHub workflows and other supported platforms. + +This complements the existing SLSA policy engine in Scribe Hub and is ideal for organizations that want to validate image builds across multiple repositories retroactively or externally. + +## 🔍 Overview + +At the heart of this feature is the automated creation of rich, SLSA Level 2-compliant provenance documents. These provenance statements are structured, verifiable attestations that include detailed information extracted from: + +* The source code repository and its history (via GitHub SCM APIs) +* The container image build targets (e.g., image digests, tags, IDs) +* Workflow metadata from the CI system (timestamps, runners, inputs) +* Associated SBOMs — linking both the source and built image artifacts as evidence + +By including direct references to SBOMs, the provenance offers a more complete and auditable view of the build, enabling both traceability and transparency. + +This enables producers to: + +* Analyze GitHub Actions logs across many repositories +* Discover image builds (Docker, Buildah, Podman) +* Extract critical build metadata automatically +* Generate valid in-toto SLSA provenance statements (Level 2) +* Export evidence locally or directly into the Scribe Hub +* Attach results under the correct repository or workflow run + +This allows scalable, retroactive attestation for compliance, auditing, and secure software verification. + +## ✅ When to Use + +* You want SLSA provenance but cannot modify the CI pipelines +* You want to verify builds retroactively (e.g., last 30 days) +* You operate across 10s or 100s of repositories +* You want SLSA Level 2 as structured, independently validated evidence + +## 🧪 Example Usage L1 + +```bash +platforms discover github \ + --scope.organization scribe-security \ + --scope.repository "valint" \ + --repository.mapping *::valint_slsa::v1 \ + --commit.skip \ + --slsa-enable \ + --slsa.tags-only \ + --slsa.latest-only +``` + +## 🧪 Example Usage L2 + +This simplified command will: + +* Scan recent GitHub workflows for the `scribe-security` organization +* Match release workflows from `*valint*` repositories +* Extract image build metadata from logs +* Generate SLSA Level 2 provenance +* Include links to source and image SBOMs + +This command will: + +* Query workflows named “release” on the `main` branch of all `*valint*` repositories +* Discover image builds based on log patterns (e.g., docker/buildah/podman) +* Create an in-toto SLSA v1.0 provenance statement for each tag +* Export that evidence under the appropriate product key using the mapping + +## 📂 Key Flags + +| Flag | Description | +| ---------------------- | -------------------------------------------------------------- | +| `--slsa-enable` | Enable SLSA provenance extraction and export | +| `--slsa.tags-only` | Limit to tag-based builds only | +| `--slsa.latest-only` | Limit to only latest image for each tag | +| `--slsa.scope.*` | Narrow provenance to branches, tags, workflows, or image names | +| `--repository.mapping` | Assign product key for evidence export | +| `--skip-cache` | Force recomputation even if cached results exist | + +## 🚧 What's Collected in the Provenance Attestation +* **`subject`**: Identifies the primary **output artifact(s)** of your build, including the image reference and its cryptographic digest. This unequivocally links the attestation to the artifact it describes. +* **`predicate.buildDefinition`**: Describes **how the artifact was built**. This includes: + * **Build System Details**: Information about the CI/CD platform used (e.g., GitHub Actions workflow file, specific job, and run ID). + * **Source Code**: The exact Git repository URL, commit SHA, and branch/tag that was built. + * **Build Parameters**: Any external inputs or internal parameters that influenced the build, such as build arguments and a list of used secret names (without their values). + * **Resolved Dependencies**: A comprehensive list of all inputs consumed by the build, including base images (Image SBOM source), third-party actions (Log Source), and tools. +* **`predicate.runDetails`**: Details **what happened during the build execution**. This covers: + * **Builder Identity**: A precise reference to the specific workflow definition or builder tool that orchestrated the build. + * **Execution Metadata**: Timestamps for the start and end of the build, along with a unique invocation ID. + * **Byproducts**: Additional artifacts produced during the build that contribute to the overall evidence. This includes references to **build logs**, intermediate container layers, and the **generated Image SBOMs**, linking them to their corresponding digests and relevant build context. + +**For a full example, see** [Appendix A - Provenance Example](#appendix-a---provenance-example). + +## 🛌 Compatibility + +**Log Sources** +* GitHub Actions + +**Build Tools** +* Docker +* Podman +* Buildah + +## 📄 Related Pages + +* [Platforms Documentation](https://scribe-security.netlify.app/docs/platforms/discover.md) +* [SLSA Provenance Spec](https://slsa.dev/spec/v1.0/provenance/) + +--- + +### Appendix A - Provenance Example + +
+ SLSA Provenance example + +```YAML +{ + "_type": "https://in-toto.io/Statement/v0.1", + "predicateType": "https://slsa.dev/provenance/v1", + "subject": [ + { + "name": "index.docker.io/scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1", + "digest": { + "sha256": "f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1" + } + }, + { + "name": "index.docker.io/scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1", + "digest": { + "sha256": "96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d" + } + }, + { + "name": "scribe://target/", + "digest": { + "sha256": "7f7cb3f64eedcf3c4f90545dd611bf739b7e990584995143bc61f97aeaa7dc71" + } + } + ], + "predicate": { + "buildDefinition": { + "buildType": "https://docs.scribesecurity.com/buildtypes/github-workflow/v1", + "externalParameters": { + "context": { + "ADDED_BY": "platforms", + "event": "push", + "git_branch": "v2.0.4", + "git_commit": "8845c03b89e38df1d1f3d18268f6253ac5fd190e", + "git_ref": "refs/tags/v2.0.4", + "repository": "https://github.com/scribe-security/gatekeeper-valint", + "run_name": "release", + "source_git_url": "git:https://github.com/scribe-security/gatekeeper-valint.git" + }, + "head_commit": { + "author": { + "email": "mdstrauss91@gmail.com", + "name": "houdini91" + }, + "committer": { + "email": "mdstrauss91@gmail.com", + "name": "houdini91" + }, + "id": "8845c03b89e38df1d1f3d18268f6253ac5fd190e", + "message": "upstream", + "timestamp": "2025-06-05T10:57:04Z", + "tree_id": "60391731fb5752c01eaeb94a0f6252789bb08759" + }, + "pipeline": { + "actor": "houdini91", + "build_num": "49", + "job": "call-release ", + "run_id": "15465260889", + "type": "github", + "workflow": "release" + }, + "source": { + "digest": { + "sha1": "8845c03b89e38df1d1f3d18268f6253ac5fd190e" + }, + "uri": "git:https://github.com/scribe-security/gatekeeper-valint.git@refs/tags/v2.0.4" + } + }, + "internalParameters": { + "build": { + "build_args": [ + "BUILD_DATE=2025-06-05T10:59:13Z", + "BUILD_VERSION=2.0.4", + "VCS_REF=8845c03b89e38df1d1f3d18268f6253ac5fd190e", + "VCS_URL=https://github.com/scribe-security/gatekeeper-valint", + "BUILD_VERSION=2.0.4", + "DESCRIPTION=\"Valint", + "PROJECT_NAME=gatekeeper-valint]" + ], + "build_log": "• running cmd=[docker buildx] cwd=/tmp/goreleaserdocker213353077 args=[--builder default build . --load -t scribesecurity/gatekeeper-valint:v2.0.4 -t scribesecurity/gatekeeper-valint:latest --build-arg=BUILD_DATE=2025-06-05T10:59:13Z --build-arg=BUILD_VERSION=2.0.4 --build-arg=VCS_REF=8845c03b89e38df1d1f3d18268f6253ac5fd190e --build-arg=VCS_URL=https://github.com/scribe-security/gatekeeper-valint --build-arg=BUILD_VERSION=2.0.4 --build-arg=DESCRIPTION=\"Valint gatekeeper external data provider\" --build-arg=PROJECT_NAME=gatekeeper-valint]", + "secret_list": [ + "SCRIBE_DEV_M2M_CLIENT_ID", + "SCRIBE_DEV_M2M_CLIENT_SECRET", + "SCRIBE_STAGING_M2M_CLIENT_ID", + "SCRIBE_STAGING_M2M_CLIENT_SECRET" + ] + }, + "context": { + "actor": "houdini91", + "asset_id": "sha256:96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d", + "asset_name": "scribesecurity/gatekeeper-valint:v2.0.4", + "asset_type": "image", + "build_num": "49", + "content_body_type": "slsa", + "content_type": "statement-slsa", + "context_type": "local", + "created": "2025-06-05T11:01:59.058746094Z", + "extra_labels": [ + "component-group=base_image", + "component-group=metadata" + ], + "format_encoding": "json", + "format_type": "slsa", + "format_version": "v1", + "git_branch": "v2.0.4", + "git_commit": "8845c03b89e38df1d1f3d18268f6253ac5fd190e", + "git_ref": "refs/tags/v2.0.4", + "git_url": "git:https://github.com/scribe-security/gatekeeper-valint.git", + "hostname": "mikey-laptop", + "imageID": "sha256:96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d", + "image_name": "index.docker.io/scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1", + "input_name": "scribesecurity/gatekeeper-valint", + "input_scheme": "docker", + "input_tag": "v2.0.4@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1", + "job_name": "call-release ", + "labels": [ + "platform=github", + "asset_type=slsa_target", + "parent-asset-id=scribe-security/gatekeeper-valint", + "parent-asset-type=repository", + "parent-asset-name=gatekeeper-valint", + "cache_key=15465260889", + "component-group=base_image", + "component-group=metadata" + ], + "name": "slsa_test_jun_11", + "organization": "scribe-security", + "platform": "linux/amd64", + "predicate_type": "https://slsa.dev/provenance/v1", + "product_version": "v1", + "repoDigest": [ + "scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1" + ], + "run_id": "15465260889", + "sbomcomponents": [ + "base_image", + "metadata" + ], + "sbomgroup": "container", + "sbomhashs": [ + "sha256-f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1", + "sha256-96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d" + ], + "sbomname": "index.docker.io/scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1", + "sbompurl": "pkg:docker/index.docker.io/scribesecurity/gatekeeper-valint%40sha256%3Af27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1@sha256%3A96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d?arch=amd64", + "sbomtype": "container", + "sbomversion": "sha256:96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d", + "size": 124078632, + "target_type": "container", + "timestamp": "2025-06-12T11:48:47+03:00", + "tool": "valint", + "tool_vendor": "Scribe Security", + "tool_version": "2.0.0-3-SNAPSHOT-a1e7b37", + "user": "mikey", + "workflow": "release" + } + }, + "resolvedDependencies": [ + { + "uri": "git:https://github.com/scribe-security/gatekeeper-valint.git@refs/tags/v2.0.4", + "digest": { + "sha1": "8845c03b89e38df1d1f3d18268f6253ac5fd190e" + }, + "name": "refs/tags/v2.0.4", + "annotations": { + "branch": "v2.0.4", + "tag": "" + } + }, + { + "uri": "scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1", + "name": "index.docker.io/scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1", + "mediaType": "application/vnd.docker.distribution.manifest.v2+json", + "annotations": { + "ADDED_BY": "valint", + "SBOM_METADATA": { + "OS": "linux", + "actor": "houdini91", + "architecture": "amd64", + "build_num": "49", + "context_type": "local", + "created": "2025-06-05T11:01:59.058746094Z", + "entrypoint": "/home/scribe/docker/entrypoint.sh, /home/scribe/${PROJECT_NAME}", + "git_branch": "v2.0.4", + "git_commit": "8845c03b89e38df1d1f3d18268f6253ac5fd190e", + "git_ref": "refs/tags/v2.0.4", + "git_url": "git:https://github.com/scribe-security/gatekeeper-valint.git", + "hostname": "mikey-laptop", + "imageEnvironment_0": "PATH=/home/scribe/:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "imageEnvironment_1": "PROJECT_NAME=gatekeeper-valint", + "imageID": "sha256:96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d", + "imageUser": "65532:65532", + "input_name": "scribesecurity/gatekeeper-valint", + "input_scheme": "docker", + "input_tag": "v2.0.4@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1", + "job_name": "call-release ", + "label_io.artifacthub.package.license": "Apache-2.0", + "label_io.artifacthub.package.name": "gatekeeper-valint", + "label_io.artifacthub.package.readme-url": "https://raw.githubusercontent.com/scribe-security/gatekeeper-valint/README.md", + "label_io.artifacthub.package.vendor": "Scribe security, Inc.", + "label_org.opencontainers.image.created": "2025-06-05T10:59:13Z", + "label_org.opencontainers.image.description": "\"Valint gatekeeper external data provider\"", + "label_org.opencontainers.image.revision": "8845c03b89e38df1d1f3d18268f6253ac5fd190e", + "label_org.opencontainers.image.source": "https://github.com/scribe-security/gatekeeper-valint", + "label_org.opencontainers.image.title": "gatekeeper-valint", + "label_org.opencontainers.image.vendor": "Scribe security, Inc.", + "label_org.opencontainers.image.version": "2.0.4", + "labels_0": "platform=github", + "labels_1": "asset_type=slsa_target", + "labels_2": "parent-asset-id=scribe-security/gatekeeper-valint", + "labels_3": "parent-asset-type=repository", + "labels_4": "parent-asset-name=gatekeeper-valint", + "labels_5": "cache_key=15465260889", + "manifest-digest": "sha256:94023f7bbe13163404aada47909e965ee98addd9b65edc805d293235be582596", + "media-type": "application/vnd.docker.distribution.manifest.v2+json", + "name": "slsa_test_jun_11", + "organization": "scribe-security", + "product_version": "v1", + "registry_location": "index.docker.io", + "registry_scheme": "https", + "repoDigest_0": "scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1", + "run_id": "15465260889", + "size": "124078632", + "target_type": "container", + "timestamp": "2025-06-12T11:48:47+03:00", + "user": "mikey", + "workflow": "release" + } + } + }, + { + "uri": "https://github.com/actions/checkout", + "digest": { + "sha1": "942562b9c7d4b1f2557f1da21f4d3eb4eb4fd01f2ad78b2a6e187d1b193e0a0f" + }, + "name": "actions/checkout@v3", + "annotations": { + "action_ref": "v3", + "action_ref_type": "major", + "env": { + "ARTIFACTORY_URL": "https://scribesecuriy.jfrog.io", + "GOPRIVATE": "github.com/scribe-security/*", + "GO_VERSION": "1.21" + }, + "inputs": { + "clean": "true", + "fetch-depth": "0", + "fetch-tags": "false", + "lfs": "false", + "persist-credentials": "true", + "repository": "scribe-security/gatekeeper-valint", + "set-safe-directory": "true", + "sparse-checkout-cone-mode": "true", + "ssh-strict": "true", + "submodules": "false", + "token": "***" + }, + "version": "3.6.0" + } + }, + { + "uri": "https://github.com/actions/setup-go", + "digest": { + "sha1": "1b5ba729a06c8434c34b6776887b6934e562a955369e9f11807883dd5e99cd81" + }, + "name": "actions/setup-go@v3", + "annotations": { + "action_ref": "v3", + "action_ref_type": "major", + "env": { + "ARTIFACTORY_URL": "https://scribesecuriy.jfrog.io", + "GOPRIVATE": "github.com/scribe-security/*", + "GO_VERSION": "1.21" + }, + "inputs": { + "cache": "false", + "check-latest": "false", + "go-version": "1.21", + "token": "***" + }, + "version": "3.6.1" + } + }, + { + "uri": "https://github.com/actions/cache", + "digest": { + "sha1": "912f76fb11db1ca09ae23248a39eb86e79ea0f0f6e183d9cb96d0b778eeea4e2" + }, + "name": "actions/cache@v3", + "annotations": { + "action_ref": "v3", + "action_ref_type": "major", + "env": { + "ARTIFACTORY_URL": "https://scribesecuriy.jfrog.io", + "GOPRIVATE": "github.com/scribe-security/*", + "GO_VERSION": "1.21" + }, + "inputs": { + "enableCrossOsArchive": "false", + "fail-on-cache-miss": "false", + "key": "Linux-go-1.21-14fb4d3c9f15f444578334a60ca0e69141dd77054775852da7ca35a3e2e5f96e", + "lookup-only": "false", + "path": "~/go/pkg/mod", + "restore-keys": "Linux-go-1.21-" + }, + "version": "3.4.3" + } + }, + { + "uri": "https://github.com/docker/login-action", + "digest": { + "sha1": "074da69a9e77797ae469f40db0f64632c02629b61bfa229f2fa803f41a464283" + }, + "name": "docker/login-action@v2", + "annotations": { + "action_ref": "v2", + "action_ref_type": "major", + "env": { + "ARTIFACTORY_URL": "https://scribesecuriy.jfrog.io", + "GOPRIVATE": "github.com/scribe-security/*", + "GO_VERSION": "1.21" + }, + "inputs": { + "ecr": "auto", + "logout": "true", + "password": "***", + "username": "scribesecurity" + }, + "version": "2.2.0" + } + }, + { + "uri": "https://github.com/actions/upload-artifact", + "digest": { + "sha1": "290722aa3281d5caf23d0acdc3dbeb3424786a1a01a9cc97e72f147225e37c38" + }, + "name": "actions/upload-artifact@v4", + "annotations": { + "action_ref": "v4", + "action_ref_type": "major", + "env": { + "ARTIFACTORY_URL": "https://scribesecuriy.jfrog.io", + "GOPRIVATE": "github.com/scribe-security/*", + "GO_VERSION": "1.21" + }, + "inputs": { + "compression-level": "6", + "if-no-files-found": "warn", + "include-hidden-files": "false", + "name": "artifacts", + "overwrite": "false", + "path": "dist/**/*" + }, + "version": "4.6.2" + } + } + ] + }, + "runDetails": { + "builder": { + "id": "https://github.com/scribe-security/gatekeeper-valint/blob/8845c03b89e38df1d1f3d18268f6253ac5fd190e/.github/workflows/release.yml", + "builderDependencies": [ + { + "uri": "https://scribesecuriy.jfrog.io/scribe-docker-public-local/valint:2.0.0-3-SNAPSHOT-a1e7b37", + "name": "valint", + "annotations": { + "ADDED_BY": "valint", + "vendor": "Scribe security, Inc", + "version": "2.0.0-3-SNAPSHOT-a1e7b37" + } + } + ] + }, + "metadata": { + "invocationID": "15465260889", + "startedOn": "2025-06-05T10:57:25Z", + "finishedOn": "2025-06-05T10:57:25Z" + }, + "byproducts": [ + { + "uri": "pkg:layer/index.docker.io/scribesecurity/gatekeeper-valint%40sha256%3Af27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1@sha256%3A7483facda2dd4ca8c8ec97443ccac2dbb8202c11a80bd2032c532f3e42b2a22e?index=0", + "digest": { + "sha256": "7483facda2dd4ca8c8ec97443ccac2dbb8202c11a80bd2032c532f3e42b2a22e" + }, + "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip", + "annotations": { + "ADDED_BY": "valint", + "CreatedBy": "COPY /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt # buildkit", + "index": "0", + "size": "221335" + } + }, + { + "uri": "pkg:layer/index.docker.io/scribesecurity/gatekeeper-valint%40sha256%3Af27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1@sha256%3A73d4c6ce708fe21d12ec8dc1bb9d293564b5af387e52b540b1290bdaaf648097?index=1", + "digest": { + "sha256": "73d4c6ce708fe21d12ec8dc1bb9d293564b5af387e52b540b1290bdaaf648097" + }, + "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip", + "annotations": { + "ADDED_BY": "valint", + "CreatedBy": "COPY / / # buildkit", + "index": "1", + "size": "28812158" + } + }, + { + "uri": "pkg:layer/index.docker.io/scribesecurity/gatekeeper-valint%40sha256%3Af27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1@sha256%3A6a796d2334354cef859a961595c4b6688c57d28426ea7e81c46794f98ddf22f8?index=2", + "digest": { + "sha256": "6a796d2334354cef859a961595c4b6688c57d28426ea7e81c46794f98ddf22f8" + }, + "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip", + "annotations": { + "ADDED_BY": "valint", + "CreatedBy": "RUN |6 DESCRIPTION=\"Valint gatekeeper external data provider\" BUILD_DATE=2025-06-05T10:59:13Z BUILD_VERSION=2.0.4 VCS_REF=8845c03b89e38df1d1f3d18268f6253ac5fd190e VCS_URL=https://github.com/scribe-security/gatekeeper-valint PROJECT_NAME=gatekeeper-valint /bin/sh -c /bin/mkdir -p /etc/scribe/keys /home/scribe/ # buildkit", + "index": "2", + "size": "0" + } + }, + { + "uri": "pkg:layer/index.docker.io/scribesecurity/gatekeeper-valint%40sha256%3Af27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1@sha256%3Af48ae6c678043a30b5faff13298cf1e6db0c82d5ae7e1ef89b0c4225f97960f4?index=3", + "digest": { + "sha256": "f48ae6c678043a30b5faff13298cf1e6db0c82d5ae7e1ef89b0c4225f97960f4" + }, + "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip", + "annotations": { + "ADDED_BY": "valint", + "CreatedBy": "COPY . /home/scribe/ # buildkit", + "index": "3", + "size": "95045139" + } + }, + { + "uri": "pkg:layer/index.docker.io/scribesecurity/gatekeeper-valint%40sha256%3Af27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1@sha256%3A5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef?index=4", + "digest": { + "sha256": "5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef" + }, + "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip", + "annotations": { + "ADDED_BY": "valint", + "CreatedBy": "WORKDIR /home/scribe/", + "index": "4", + "size": "0" + } + }, + { + "uri": "pkg:OS/wolfi@20230201", + "name": "wolfi", + "annotations": { + "ADDED_BY": "valint", + "BugReportURL": "https://github.com/wolfi-dev/os/issues", + "HomeURL": "https://wolfi.dev", + "ID": "wolfi", + "Name": "Wolfi", + "PrettyName": "Wolfi", + "VersionID": "20230201" + } + }, + { + "uri": "https://api.github.com/repos/scribe-security/gatekeeper-valint/actions/runs/15465260889/logs", + "digest": { + "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" + }, + "name": "scribe-security/gatekeeper-valint/release/15465260889/call-release ", + "mediaType": "text/plain", + "annotations": { + "ADDED_BY": "platforms", + "build_args": [ + "BUILD_DATE=2025-06-05T10:59:13Z", + "BUILD_VERSION=2.0.4", + "VCS_REF=8845c03b89e38df1d1f3d18268f6253ac5fd190e", + "VCS_URL=https://github.com/scribe-security/gatekeeper-valint", + "BUILD_VERSION=2.0.4", + "DESCRIPTION=\"Valint", + "PROJECT_NAME=gatekeeper-valint]" + ], + "build_log": "• running cmd=[docker buildx] cwd=/tmp/goreleaserdocker213353077 args=[--builder default build . --load -t scribesecurity/gatekeeper-valint:v2.0.4 -t scribesecurity/gatekeeper-valint:latest --build-arg=BUILD_DATE=2025-06-05T10:59:13Z --build-arg=BUILD_VERSION=2.0.4 --build-arg=VCS_REF=8845c03b89e38df1d1f3d18268f6253ac5fd190e --build-arg=VCS_URL=https://github.com/scribe-security/gatekeeper-valint --build-arg=BUILD_VERSION=2.0.4 --build-arg=DESCRIPTION=\"Valint gatekeeper external data provider\" --build-arg=PROJECT_NAME=gatekeeper-valint]", + "imageID_log": "#13 writing image sha256:96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d done", + "log_filepath": "0_call-release _ release.txt", + "workflow_file": "https://github.com/scribe-security/gatekeeper-valint/blob/8845c03b89e38df1d1f3d18268f6253ac5fd190e/.github/workflows/release.yml" + } + }, + { + "uri": "scribesecurity/gatekeeper-valint:v2.0.4@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1", + "digest": { + "sha256": "96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d" + }, + "name": "scribesecurity/gatekeeper-valint:v2.0.4", + "mediaType": "application/vnd.docker.distribution.manifest.v2+json", + "annotations": { + "ADDED_BY": "platforms", + "image_id": "sha256:96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d" + } + }, + { + "uri": "https://github.com/scribe-security/gatekeeper-valint.git", + "digest": { + "sha1": "8845c03b89e38df1d1f3d18268f6253ac5fd190e" + }, + "name": "https://github.com/scribe-security/gatekeeper-valint.git", + "mediaType": "application/vnd.in-toto+json", + "annotations": { + "context": { + "actor": "houdini91", + "build_num": "49", + "content_body_type": "cyclonedx-json", + "content_type": "statement-cyclonedx-json", + "context_type": "local", + "dir_id": "sha256:a89281ab7752d169fd47c0d8ac1cbeac701d4f63608774b2ab0e2a6624bedbc4", + "dir_path": "/home/mikey/scribe/platforms_lib/output/clone/15465260889/v2.0.4/8845c03b89e38df1d1f3d18268f6253ac5fd190e/gatekeeper-valint/clone/gatekeeper-valint", + "extra_labels": [ + "component-group=packages", + "component-group=dep", + "component-group=metadata" + ], + "format_encoding": "json", + "format_type": "cyclonedx", + "format_version": "1.5", + "git_branch": "v2.0.4", + "git_commit": "8845c03b89e38df1d1f3d18268f6253ac5fd190e", + "git_ref": "refs/tags/v2.0.4", + "git_url": "git:https://github.com/scribe-security/gatekeeper-valint.git", + "hostname": "mikey-laptop", + "input_name": "https://github.com/scribe-security/gatekeeper-valint.git", + "input_scheme": "git", + "job_name": "call-release ", + "labels": [ + "platform=github", + "asset_type=slsa_target", + "parent-asset-id=scribe-security/gatekeeper-valint", + "parent-asset-type=repository", + "parent-asset-name=gatekeeper-valint", + "cache_key=15465260889", + "component-group=packages", + "component-group=dep", + "component-group=metadata" + ], + "name": "slsa_test_jun_11", + "organization": "scribe-security", + "predicate_type": "https://cyclonedx.org/bom/v1.5", + "product_version": "v1", + "ref": "113193", + "run_id": "15465260889", + "sbomcomponents": [ + "packages", + "dep", + "metadata" + ], + "sbomgroup": "git", + "sbomhashs": [ + "sha1-8845c03b89e38df1d1f3d18268f6253ac5fd190e" + ], + "sbomname": "https://github.com/scribe-security/gatekeeper-valint.git", + "sbompurl": "pkg:git/https%3A/github.com/scribe-security/gatekeeper-valint.git@8845c03b89e38df1d1f3d18268f6253ac5fd190e", + "sbomtype": "file", + "sbomversion": "sha1:8845c03b89e38df1d1f3d18268f6253ac5fd190e", + "store": "scribe", + "target_git_commit": "8845c03b89e38df1d1f3d18268f6253ac5fd190e", + "target_git_ref": "refs/tags/v2.0.4", + "target_git_tag": "v2.0.4", + "target_git_url": "https://github.com/scribe-security/gatekeeper-valint.git", + "target_type": "git", + "timestamp": "2025-06-12T11:48:42+03:00", + "tool": "valint", + "tool_vendor": "Scribe Security", + "tool_version": "2.0.0-3-SNAPSHOT-a1e7b37", + "user": "mikey", + "workflow": "release" + }, + "ref-id": "113193", + "target-type": "git" + } + }, + { + "uri": "https://github.com/scribe-security/gatekeeper-valint.git", + "digest": { + "sha1": "8845c03b89e38df1d1f3d18268f6253ac5fd190e" + }, + "name": "https://github.com/scribe-security/gatekeeper-valint.git", + "mediaType": "application/vnd.in-toto+json", + "annotations": { + "context": { + "actor": "houdini91", + "build_num": "49", + "content_body_type": "cyclonedx-json", + "content_type": "statement-cyclonedx-json", + "context_type": "local", + "dir_id": "sha256:a89281ab7752d169fd47c0d8ac1cbeac701d4f63608774b2ab0e2a6624bedbc4", + "dir_path": "/home/mikey/scribe/platforms_lib/output/clone/15465260889/v2.0.4/8845c03b89e38df1d1f3d18268f6253ac5fd190e/gatekeeper-valint/clone/gatekeeper-valint", + "extra_labels": [ + "component-group=packages", + "component-group=dep", + "component-group=metadata" + ], + "format_encoding": "json", + "format_type": "cyclonedx", + "format_version": "1.5", + "git_branch": "v2.0.4", + "git_commit": "8845c03b89e38df1d1f3d18268f6253ac5fd190e", + "git_ref": "refs/tags/v2.0.4", + "git_url": "git:https://github.com/scribe-security/gatekeeper-valint.git", + "hostname": "mikey-laptop", + "input_name": "https://github.com/scribe-security/gatekeeper-valint.git", + "input_scheme": "git", + "job_name": "call-release ", + "labels": [ + "platform=github", + "asset_type=slsa_target", + "parent-asset-id=scribe-security/gatekeeper-valint", + "parent-asset-type=repository", + "parent-asset-name=gatekeeper-valint", + "cache_key=15465260889", + "component-group=packages", + "component-group=dep", + "component-group=metadata" + ], + "name": "slsa_test_jun_11", + "organization": "scribe-security", + "predicate_type": "https://cyclonedx.org/bom/v1.5", + "product_version": "v1", + "ref": "113193", + "run_id": "15465260889", + "sbomcomponents": [ + "packages", + "dep", + "metadata" + ], + "sbomgroup": "git", + "sbomhashs": [ + "sha1-8845c03b89e38df1d1f3d18268f6253ac5fd190e" + ], + "sbomname": "https://github.com/scribe-security/gatekeeper-valint.git", + "sbompurl": "pkg:git/https%3A/github.com/scribe-security/gatekeeper-valint.git@8845c03b89e38df1d1f3d18268f6253ac5fd190e", + "sbomtype": "file", + "sbomversion": "sha1:8845c03b89e38df1d1f3d18268f6253ac5fd190e", + "store": "scribe", + "target_git_commit": "8845c03b89e38df1d1f3d18268f6253ac5fd190e", + "target_git_ref": "refs/tags/v2.0.4", + "target_git_tag": "v2.0.4", + "target_git_url": "https://github.com/scribe-security/gatekeeper-valint.git", + "target_type": "git", + "timestamp": "2025-06-12T11:48:42+03:00", + "tool": "valint", + "tool_vendor": "Scribe Security", + "tool_version": "2.0.0-3-SNAPSHOT-a1e7b37", + "user": "mikey", + "workflow": "release" + }, + "ref-id": "/home/mikey/.cache/valint/sha1-8845c03b89e38df1d1f3d18268f6253ac5fd190e.bom.statement.json", + "target-type": "git" + } + }, + { + "uri": "index.docker.io/scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1", + "digest": { + "sha256": "96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d" + }, + "name": "index.docker.io/scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1", + "mediaType": "application/vnd.in-toto+json", + "annotations": { + "context": { + "actor": "houdini91", + "asset_id": "sha256:96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d", + "asset_name": "scribesecurity/gatekeeper-valint:v2.0.4", + "asset_type": "image", + "build_num": "49", + "content_body_type": "cyclonedx-json", + "content_type": "statement-cyclonedx-json", + "context_type": "local", + "created": "2025-06-05T11:01:59.058746094Z", + "extra_labels": [ + "component-group=base_image", + "component-group=metadata" + ], + "format_encoding": "json", + "format_type": "slsa", + "format_version": "v1", + "git_branch": "v2.0.4", + "git_commit": "8845c03b89e38df1d1f3d18268f6253ac5fd190e", + "git_ref": "refs/tags/v2.0.4", + "git_url": "git:https://github.com/scribe-security/gatekeeper-valint.git", + "hostname": "mikey-laptop", + "imageID": "sha256:96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d", + "image_name": "index.docker.io/scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1", + "input_name": "scribesecurity/gatekeeper-valint", + "input_scheme": "docker", + "input_tag": "v2.0.4@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1", + "job_name": "call-release ", + "labels": [ + "platform=github", + "asset_type=slsa_target", + "parent-asset-id=scribe-security/gatekeeper-valint", + "parent-asset-type=repository", + "parent-asset-name=gatekeeper-valint", + "cache_key=15465260889", + "component-group=base_image", + "component-group=metadata" + ], + "name": "slsa_test_jun_11", + "organization": "scribe-security", + "platform": "linux/amd64", + "predicate_type": "https://slsa.dev/provenance/v1", + "product_version": "v1", + "ref": "113194", + "repoDigest": [ + "scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1" + ], + "run_id": "15465260889", + "sbomcomponents": [ + "base_image", + "metadata" + ], + "sbomgroup": "container", + "sbomhashs": [ + "sha256-f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1", + "sha256-96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d" + ], + "sbomname": "index.docker.io/scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1", + "sbompurl": "pkg:docker/index.docker.io/scribesecurity/gatekeeper-valint%40sha256%3Af27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1@sha256%3A96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d?arch=amd64", + "sbomtype": "container", + "sbomversion": "sha256:96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d", + "size": 124078632, + "store": "scribe", + "target_type": "container", + "timestamp": "2025-06-12T11:48:47+03:00", + "tool": "valint", + "tool_vendor": "Scribe Security", + "tool_version": "2.0.0-3-SNAPSHOT-a1e7b37", + "user": "mikey", + "workflow": "release" + }, + "ref-id": "113194", + "target-type": "container" + } + }, + { + "uri": "scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1", + "digest": { + "sha256": "96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d" + }, + "name": "index.docker.io/scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1", + "mediaType": "application/vnd.in-toto+json", + "annotations": { + "context": { + "actor": "houdini91", + "asset_id": "sha256:96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d", + "asset_name": "scribesecurity/gatekeeper-valint:v2.0.4", + "asset_type": "image", + "build_num": "49", + "content_body_type": "cyclonedx-json", + "content_type": "statement-cyclonedx-json", + "context_type": "local", + "created": "2025-06-05T11:01:59.058746094Z", + "extra_labels": [ + "component-group=base_image", + "component-group=metadata" + ], + "format_encoding": "json", + "format_type": "slsa", + "format_version": "v1", + "git_branch": "v2.0.4", + "git_commit": "8845c03b89e38df1d1f3d18268f6253ac5fd190e", + "git_ref": "refs/tags/v2.0.4", + "git_url": "git:https://github.com/scribe-security/gatekeeper-valint.git", + "hostname": "mikey-laptop", + "imageID": "sha256:96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d", + "image_name": "index.docker.io/scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1", + "input_name": "scribesecurity/gatekeeper-valint", + "input_scheme": "docker", + "input_tag": "v2.0.4@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1", + "job_name": "call-release ", + "labels": [ + "platform=github", + "asset_type=slsa_target", + "parent-asset-id=scribe-security/gatekeeper-valint", + "parent-asset-type=repository", + "parent-asset-name=gatekeeper-valint", + "cache_key=15465260889", + "component-group=base_image", + "component-group=metadata" + ], + "name": "slsa_test_jun_11", + "organization": "scribe-security", + "platform": "linux/amd64", + "predicate_type": "https://slsa.dev/provenance/v1", + "product_version": "v1", + "ref": "113194", + "repoDigest": [ + "scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1" + ], + "run_id": "15465260889", + "sbomcomponents": [ + "base_image", + "metadata" + ], + "sbomgroup": "container", + "sbomhashs": [ + "sha256-f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1", + "sha256-96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d" + ], + "sbomname": "index.docker.io/scribesecurity/gatekeeper-valint@sha256:f27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1", + "sbompurl": "pkg:docker/index.docker.io/scribesecurity/gatekeeper-valint%40sha256%3Af27e22476ce83e2c3b2230cb7b4895f004ba73c9b8ebc77a9124540bd97039f1@sha256%3A96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d?arch=amd64", + "sbomtype": "container", + "sbomversion": "sha256:96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d", + "size": 124078632, + "store": "scribe", + "target_type": "container", + "timestamp": "2025-06-12T11:48:47+03:00", + "tool": "valint", + "tool_vendor": "Scribe Security", + "tool_version": "2.0.0-3-SNAPSHOT-a1e7b37", + "user": "mikey", + "workflow": "release" + }, + "ref-id": "/home/mikey/.cache/valint/sha256-96831112f2b469894bc90f923b1e61a2cb486219d561b27fe5b92a5b3596b73d.bom.statement.json", + "target-type": "container" + } + } + ] + } + } + } +``` + +
+ + + + + + + From f67c059ab85dfe2f9ce052671f727548bfbf369b Mon Sep 17 00:00:00 2001 From: houdini91 Date: Sun, 15 Jun 2025 12:25:39 +0300 Subject: [PATCH 04/10] debug --- .../{slsa-lvl-2-on-scale.md => slsa-on-scale.md} | 0 docusaurus.config.js | 2 +- 2 files changed, 1 insertion(+), 1 deletion(-) rename docs/guides/secure-sfw-slsa/{slsa-lvl-2-on-scale.md => slsa-on-scale.md} (100%) diff --git a/docs/guides/secure-sfw-slsa/slsa-lvl-2-on-scale.md b/docs/guides/secure-sfw-slsa/slsa-on-scale.md similarity index 100% rename from docs/guides/secure-sfw-slsa/slsa-lvl-2-on-scale.md rename to docs/guides/secure-sfw-slsa/slsa-on-scale.md diff --git a/docusaurus.config.js b/docusaurus.config.js index b2df3ed72..fed7abbff 100644 --- a/docusaurus.config.js +++ b/docusaurus.config.js @@ -93,7 +93,7 @@ const config = { "guides/secure-sfw-slsa/README.md", "guides/secure-sfw-slsa/slsa-lvl-1.md", "guides/secure-sfw-slsa/slsa-lvl-2.md", - "guides/secure-sfw-slsa/slsa-lvl-2-on-scale.md", + "guides/secure-sfw-slsa/slsa-on-scale.md", "guides/secure-sfw-slsa/slsa-lvl-3.md", "guides/secure-sfw-slsa/customizing-provenance.md", "guides/secure-sfw-slsa/basic-examples.md", From 9efbd0f505d8478ccac72502a731a83df9970c85 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Sun, 15 Jun 2025 12:43:31 +0300 Subject: [PATCH 05/10] Rephrase --- docs/guides/secure-sfw-slsa/s | 0 docs/guides/secure-sfw-slsa/s2 | 0 docs/guides/secure-sfw-slsa/slsa-on-scale.md | 91 +++++++++++++------- 3 files changed, 58 insertions(+), 33 deletions(-) create mode 100644 docs/guides/secure-sfw-slsa/s create mode 100644 docs/guides/secure-sfw-slsa/s2 diff --git a/docs/guides/secure-sfw-slsa/s b/docs/guides/secure-sfw-slsa/s new file mode 100644 index 000000000..e69de29bb diff --git a/docs/guides/secure-sfw-slsa/s2 b/docs/guides/secure-sfw-slsa/s2 new file mode 100644 index 000000000..e69de29bb diff --git a/docs/guides/secure-sfw-slsa/slsa-on-scale.md b/docs/guides/secure-sfw-slsa/slsa-on-scale.md index cae1424d5..8eb054db2 100644 --- a/docs/guides/secure-sfw-slsa/slsa-on-scale.md +++ b/docs/guides/secure-sfw-slsa/slsa-on-scale.md @@ -5,42 +5,53 @@ title: "SLSA L1 & L2 Provenance from Logs" sidebar\_position: 5 toc\_min\_heading\_level: 2 toc\_max\_heading\_level: 5 ---------------------------- +--- -Scribe supports automatic generation of [SLSA Level 2](https://slsa.dev/provenance/v1.0) provenance for container images at scale — without modifying your pipelines. Instead of injecting provenance generators directly into your CI, this method leverages build log analysis from GitHub workflows and other supported platforms. +Scribe simplifies the generation of **[SLSA Level 1 & Level 2](https://slsa.dev/provenance/v1.0)** provenance for container images at scale, all without requiring modifications to your existing pipelines. Instead of injecting provenance generators directly into your CI, our method intelligently leverages **build log analysis** from GitHub workflows and other supported platforms. -This complements the existing SLSA policy engine in Scribe Hub and is ideal for organizations that want to validate image builds across multiple repositories retroactively or externally. +This capability significantly enhances the existing SLSA policy engine within Scribe Hub, making it an ideal solution for organizations that need to **validate image builds across multiple repositories, retroactively, or externally**. ## 🔍 Overview -At the heart of this feature is the automated creation of rich, SLSA Level 2-compliant provenance documents. These provenance statements are structured, verifiable attestations that include detailed information extracted from: +At the heart of this feature is the automated creation of rich, SLSA-compliant provenance documents. These provenance statements are structured, verifiable attestations that include detailed information extracted from: -* The source code repository and its history (via GitHub SCM APIs) -* The container image build targets (e.g., image digests, tags, IDs) -* Workflow metadata from the CI system (timestamps, runners, inputs) -* Associated SBOMs — linking both the source and built image artifacts as evidence + * The source code repository and its history (via GitHub SCM APIs) + * The container image build targets (e.g., image digests, tags, IDs) + * Workflow metadata from the CI system (timestamps, runners, inputs) + * Associated SBOMs — linking both the source and built image artifacts as evidence By including direct references to SBOMs, the provenance offers a more complete and auditable view of the build, enabling both traceability and transparency. This enables producers to: -* Analyze GitHub Actions logs across many repositories -* Discover image builds (Docker, Buildah, Podman) -* Extract critical build metadata automatically -* Generate valid in-toto SLSA provenance statements (Level 2) -* Export evidence locally or directly into the Scribe Hub -* Attach results under the correct repository or workflow run + * Analyze GitHub Actions logs across many repositories + * Discover image builds (Docker, Buildah, Podman) + * Extract critical build metadata automatically + * Generate valid in-toto SLSA provenance statements (Level 1 or Level 2, depending on usage) + * Export evidence locally or directly into the Scribe Hub + * Attach results under the correct repository or workflow run This allows scalable, retroactive attestation for compliance, auditing, and secure software verification. ## ✅ When to Use -* You want SLSA provenance but cannot modify the CI pipelines -* You want to verify builds retroactively (e.g., last 30 days) -* You operate across 10s or 100s of repositories -* You want SLSA Level 2 as structured, independently validated evidence + * You want SLSA provenance but cannot modify the CI pipelines + * You want to verify builds retroactively (e.g., last 30 days) + * You operate across 10s or 100s of repositories + * You want SLSA Level 1 (unsigned) or Level 2 (signed) as structured, independently validated evidence + +## 🚀 SLSA Levels Explained with Scribe + +Scribe's `platforms discover` tool generates SLSA provenance by analyzing your build logs. The SLSA level achieved depends on whether the generated provenance is cryptographically signed. + + * **SLSA Level 1 (Unsigned Provenance):** This level of provenance is generated by default when you use `platforms discover`. It captures essential information about the build process, as extracted from logs, but the provenance statement itself is not cryptographically signed. This provides a valuable, machine-readable record of the build, offering transparency and traceability. + + * **SLSA Level 2 (Signed Provenance):** To achieve SLSA Level 2, the provenance generated by `platforms discover` must be cryptographically signed by a trusted entity. Scribe facilitates this through the `--valint.sign` flag, which integrates with a signing service (like Scribe Hub's attestation signing service). Signing the provenance provides strong assurance that the provenance has not been tampered with and that it originates from a verified source. -## 🧪 Example Usage L1 + +## 🧪 Example Usage L1 (Unsigned Provenance) + +The following command will generate SLSA Level 1 provenance. The provenance document will contain rich build metadata but will not be cryptographically signed. ```bash platforms discover github \ @@ -50,34 +61,48 @@ platforms discover github \ --commit.skip \ --slsa-enable \ --slsa.tags-only \ - --slsa.latest-only ``` -## 🧪 Example Usage L2 +This command will: + + * Scan recent GitHub workflows for the `scribe-security` organization. + * Match release workflows from `valint` repositories. + * Extract image build metadata from logs. + * Generate SLSA Level 1 provenance (unsigned). + * Include links to source and image SBOMs. + * Export that evidence under the appropriate product key using the mapping. -This simplified command will: +## 🧪 Example Usage L2 (Signed Provenance) -* Scan recent GitHub workflows for the `scribe-security` organization -* Match release workflows from `*valint*` repositories -* Extract image build metadata from logs -* Generate SLSA Level 2 provenance -* Include links to source and image SBOMs +To generate SLSA Level 2 provenance, you need to sign the provenance statement. This is done by adding the `--valint.sign` flag. This typically requires integration with a signing service (e.g., Scribe Hub's attestation signing). + +```bash +platforms discover --valint.sign github \ + --scope.organization scribe-security \ + --scope.repository "valint" \ + --repository.mapping *::valint_slsa::v1 \ + --commit.skip \ + --slsa-enable \ + --slsa.tags-only +``` This command will: -* Query workflows named “release” on the `main` branch of all `*valint*` repositories -* Discover image builds based on log patterns (e.g., docker/buildah/podman) -* Create an in-toto SLSA v1.0 provenance statement for each tag -* Export that evidence under the appropriate product key using the mapping + * Perform all actions of the L1 example. + * **Additionally, it will cryptographically sign the generated SLSA provenance statements**, elevating them to SLSA Level 2. ## 📂 Key Flags | Flag | Description | | ---------------------- | -------------------------------------------------------------- | | `--slsa-enable` | Enable SLSA provenance extraction and export | +| `--valint.sign` | **(For SLSA L2)** Enables cryptographic signing of the generated SLSA provenance. This typically requires configuration for a signing backend (e.g., X509 Keys, Sigstore - GitHub's OIDC, or an external KMS). | | `--slsa.tags-only` | Limit to tag-based builds only | -| `--slsa.latest-only` | Limit to only latest image for each tag | -| `--slsa.scope.*` | Narrow provenance to branches, tags, workflows, or image names | +| `--slsa.all-versions` | Include SLSA Provenance evidence for all published images (all versions) rather than just the latest for each tag. By default, only the latest image provenance is included. | +| `--slsa.scope.branch` | Restrict provenance to specific **branches** | +| `--slsa.scope.tag` | Restrict provenance to matching **tags** | +| `--slsa.scope.workflow` | Restrict provenance to named **workflows/jobs** | +| `--slsa.scope.image` | Restrict provenance to particular **image names/repositories** | | `--repository.mapping` | Assign product key for evidence export | | `--skip-cache` | Force recomputation even if cached results exist | From ed552d0e6bf4c02f696592905d033bd4715abebe Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 18 Jun 2025 12:02:06 +0300 Subject: [PATCH 06/10] update --- docs/guides/secure-sfw-slsa/slsa-on-scale.md | 50 +++++++++++--------- 1 file changed, 28 insertions(+), 22 deletions(-) diff --git a/docs/guides/secure-sfw-slsa/slsa-on-scale.md b/docs/guides/secure-sfw-slsa/slsa-on-scale.md index 8eb054db2..679a437ee 100644 --- a/docs/guides/secure-sfw-slsa/slsa-on-scale.md +++ b/docs/guides/secure-sfw-slsa/slsa-on-scale.md @@ -7,9 +7,7 @@ toc\_min\_heading\_level: 2 toc\_max\_heading\_level: 5 --- -Scribe simplifies the generation of **[SLSA Level 1 & Level 2](https://slsa.dev/provenance/v1.0)** provenance for container images at scale, all without requiring modifications to your existing pipelines. Instead of injecting provenance generators directly into your CI, our method intelligently leverages **build log analysis** from GitHub workflows and other supported platforms. - -This capability significantly enhances the existing SLSA policy engine within Scribe Hub, making it an ideal solution for organizations that need to **validate image builds across multiple repositories, retroactively, or externally**. +Scribe simplifies the generation of **[SLSA Level 1 & Level 2](https://slsa.dev/provenance/v1.0)** provenance for container images at scale, without requiring any changes to your existing pipelines. Instead of embedding provenance generators in each CI job, Scribe combines **Scribe Platforms’ posture attestations** with **build-log analysis** from GitHub Actions and other supported systems to produce complete provenance statements automatically. ## 🔍 Overview @@ -17,24 +15,11 @@ At the heart of this feature is the automated creation of rich, SLSA-compliant p * The source code repository and its history (via GitHub SCM APIs) * The container image build targets (e.g., image digests, tags, IDs) - * Workflow metadata from the CI system (timestamps, runners, inputs) + * CI systems and log (timestamps, runners, inputs) * Associated SBOMs — linking both the source and built image artifacts as evidence -By including direct references to SBOMs, the provenance offers a more complete and auditable view of the build, enabling both traceability and transparency. - -This enables producers to: - - * Analyze GitHub Actions logs across many repositories - * Discover image builds (Docker, Buildah, Podman) - * Extract critical build metadata automatically - * Generate valid in-toto SLSA provenance statements (Level 1 or Level 2, depending on usage) - * Export evidence locally or directly into the Scribe Hub - * Attach results under the correct repository or workflow run - -This allows scalable, retroactive attestation for compliance, auditing, and secure software verification. - ## ✅ When to Use - + * You cannot modify the CI pipelines due to authority or scale * You want SLSA provenance but cannot modify the CI pipelines * You want to verify builds retroactively (e.g., last 30 days) * You operate across 10s or 100s of repositories @@ -42,13 +27,30 @@ This allows scalable, retroactive attestation for compliance, auditing, and secu ## 🚀 SLSA Levels Explained with Scribe -Scribe's `platforms discover` tool generates SLSA provenance by analyzing your build logs. The SLSA level achieved depends on whether the generated provenance is cryptographically signed. +Scribe’s `platforms discover` command automatically creates SLSA provenance for each image build it detects. The SLSA level produced—Level 1 or Level 2—depends solely on whether the provenance is cryptographically signed. * **SLSA Level 1 (Unsigned Provenance):** This level of provenance is generated by default when you use `platforms discover`. It captures essential information about the build process, as extracted from logs, but the provenance statement itself is not cryptographically signed. This provides a valuable, machine-readable record of the build, offering transparency and traceability. - * **SLSA Level 2 (Signed Provenance):** To achieve SLSA Level 2, the provenance generated by `platforms discover` must be cryptographically signed by a trusted entity. Scribe facilitates this through the `--valint.sign` flag, which integrates with a signing service (like Scribe Hub's attestation signing service). Signing the provenance provides strong assurance that the provenance has not been tampered with and that it originates from a verified source. + * **SLSA Level 2 (Signed Provenance):** To achieve SLSA Level 2, the provenance generated by `platforms discover` must be cryptographically signed by a trusted entity. Scribe facilitates this through the `--valint.sign` flag, which integrates with a signing capability (like Scribe Hub's attestation signing capability). Signing the provenance provides strong assurance that the provenance has not been tampered with and that it originates from a verified source. +## 🛠️ What Scribe Platforms Does Under the Hood + +Behind the scenes, Scribe Platforms performs several steps to turn raw workflow logs into SLSA-compliant provenance: + +* **Analyze GitHub Actions logs across multiple repositories** + Detects every image build (Docker, Buildah, Podman) without altering your pipelines. +* **Extract critical build metadata automatically** + Pulls builder, tag, digest, and timestamp information straight from the logs. +* **Generate and Link SBOM evidence** + Generate Associates both source-code and image SBOMs with the build for end-to-end traceability. +* **Generate in-toto SLSA statements (L1 or L2)** + Produces valid provenance, optionally signing it when `--valint.sign` is enabled. +* **Export the evidence to Scribe Hub or local storage** + Tags each artifact with the correct repository, workflow run, and product key. + +(Users don’t need to run any extra steps—this all happens automatically when you invoke `platforms discover`.) + ## 🧪 Example Usage L1 (Unsigned Provenance) The following command will generate SLSA Level 1 provenance. The provenance document will contain rich build metadata but will not be cryptographically signed. @@ -107,11 +109,14 @@ This command will: | `--skip-cache` | Force recomputation even if cached results exist | ## 🚧 What's Collected in the Provenance Attestation -* **`subject`**: Identifies the primary **output artifact(s)** of your build, including the image reference and its cryptographic digest. This unequivocally links the attestation to the artifact it describes. +* **`subject`**: Captures the **single output artifact** of the build—its full image reference **plus a SHA-256 digest** (the cryptographic hash that uniquely fingerprints the image). + This hash ties the provenance unambiguously to that exact image, even if the tag is later reused. + > *Note:* If a workflow emits multiple images, Scribe generates one provenance statement per image. + * **`predicate.buildDefinition`**: Describes **how the artifact was built**. This includes: * **Build System Details**: Information about the CI/CD platform used (e.g., GitHub Actions workflow file, specific job, and run ID). * **Source Code**: The exact Git repository URL, commit SHA, and branch/tag that was built. - * **Build Parameters**: Any external inputs or internal parameters that influenced the build, such as build arguments and a list of used secret names (without their values). + ** **Build Parameters** – External inputs such ad Docker build arguments and the names of all repository-level secrets that were available to the job **(values are never stored)**. * **Resolved Dependencies**: A comprehensive list of all inputs consumed by the build, including base images (Image SBOM source), third-party actions (Log Source), and tools. * **`predicate.runDetails`**: Details **what happened during the build execution**. This covers: * **Builder Identity**: A precise reference to the specific workflow definition or builder tool that orchestrated the build. @@ -120,6 +125,7 @@ This command will: **For a full example, see** [Appendix A - Provenance Example](#appendix-a---provenance-example). + ## 🛌 Compatibility **Log Sources** From 78f027e2ff0e28601bbb48d5281ec03e5c2737ac Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 18 Jun 2025 12:20:03 +0300 Subject: [PATCH 07/10] add policy results --- docs/guides/secure-sfw-slsa/slsa-on-scale.md | 40 ++++++++++++++++++-- 1 file changed, 37 insertions(+), 3 deletions(-) diff --git a/docs/guides/secure-sfw-slsa/slsa-on-scale.md b/docs/guides/secure-sfw-slsa/slsa-on-scale.md index 679a437ee..aeeca5e16 100644 --- a/docs/guides/secure-sfw-slsa/slsa-on-scale.md +++ b/docs/guides/secure-sfw-slsa/slsa-on-scale.md @@ -46,10 +46,12 @@ Behind the scenes, Scribe Platforms performs several steps to turn raw workflow Generate Associates both source-code and image SBOMs with the build for end-to-end traceability. * **Generate in-toto SLSA statements (L1 or L2)** Produces valid provenance, optionally signing it when `--valint.sign` is enabled. -* **Export the evidence to Scribe Hub or local storage** - Tags each artifact with the correct repository, workflow run, and product key. +* **Run SLSA-compliance initiatives** + Once each provenance file is written, Scribe automatically executes the matching policy-as-code initiative (`slsa.l1` for unsigned L1, `slsa.l2` for signed L2). + The initiative verifies the evidence set, emits a SARIF report, and—when applicable—signs that report before attaching it as additional evidence. +* **Execute SLSA Compliance Initiatives** +After provenance generation, Scribe automatically applies relevant policy-as-code initiatives (`slsa.l1` or `slsa.l2`). These initiatives validate the evidence, generate a SARIF report detailing compliance status, and (for Level 2) sign this report as additional, verifiable evidence. -(Users don’t need to run any extra steps—this all happens automatically when you invoke `platforms discover`.) ## 🧪 Example Usage L1 (Unsigned Provenance) @@ -108,6 +110,38 @@ This command will: | `--repository.mapping` | Assign product key for evidence export | | `--skip-cache` | Force recomputation even if cached results exist | + +## 🔒 Proving SLSA Compliance with Policy-as-Code Initiatives + +After Scribe generates SLSA provenance for your container images, it automatically takes a critical extra step: it runs **policy-as-code initiatives** against the provenance and its associated evidence. This provides a robust, verifiable way to demonstrate SLSA compliance. + +### What are Scribe Initiatives? + +Scribe Initiatives are predefined or custom sets of policy rules that evaluate your software supply chain's compliance. For SLSA, Scribe offers specific initiatives to verify various aspects of your provenance and its linked SBOMs (Software Bill of Materials) for both source and image. + +These initiatives check for things like: + + * The **existence and integrity** of the provenance document and its linked SBOMs. + * That **critical fields** in the provenance (e.g., builder identity, source repository) match expected values. + * For **SLSA Level 2**, that both the provenance and the resulting SARIF (Static Analysis Results Interchange Format) compliance report are **cryptographically signed**, ensuring their authenticity. + +The outcome of these evaluations is a **SARIF report**. This report details your compliance status, highlights any policy deviations, and links back to all relevant evidence. For SLSA Level 2, this SARIF report is also signed, adding another layer of verifiable assurance. + +This automated verification and reporting gives you: + + * **Robust Compliance Proof:** Independently validated evidence of your SLSA adherence. + * **End-to-End Traceability:** Links all artifacts and reports directly to the build process. + * **Streamlined Auditing:** A standardized, machine-readable format for compliance reporting. + +### Further Reading and Resources + +For more details on Scribe's policy-as-code initiatives and their role in SLSA compliance, explore these resources: + + * **Applying Initiatives to your SDLC:** [https://scribe-security.netlify.app/docs/guides/enforcing-sdlc-initiative](https://www.google.com/search?q=https://scribe-security.netlify.app/docs/guides/enforcing-sdlc-initiative) + * **SLSA L1 Initiative Documentation & Source:** [https://scribe-security.netlify.app/docs/configuration/initiatives/slsa.l1/](https://www.google.com/search?q=https://scribe-security.netlify.app/docs/configuration/initiatives/slsa.l1/) and [https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/slsa.l1.yaml](https://www.google.com/search?q=https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/slsa.l1.yaml) + * **SLSA L2 Initiative Documentation & Source:** [https://scribe-security.netlify.app/docs/configuration/initiatives/slsa.l2/](https://www.google.com/search?q=https://scribe-security.netlify.app/docs/configuration/initiatives/slsa.l2/) and [https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/slsa.l2.yaml](https://www.google.com/search?q=https://github.com/scribe-public/sample-policies/blob/main/v2/initiatives/slsa.l2.yaml) + + ## 🚧 What's Collected in the Provenance Attestation * **`subject`**: Captures the **single output artifact** of the build—its full image reference **plus a SHA-256 digest** (the cryptographic hash that uniquely fingerprints the image). This hash ties the provenance unambiguously to that exact image, even if the tag is later reused. From 644abde096ad92b08073ebada83854174b7ef1fe Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 18 Jun 2025 12:26:30 +0300 Subject: [PATCH 08/10] fix input name --- docs/guides/secure-sfw-slsa/slsa-on-scale.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/guides/secure-sfw-slsa/slsa-on-scale.md b/docs/guides/secure-sfw-slsa/slsa-on-scale.md index aeeca5e16..1e1430aa7 100644 --- a/docs/guides/secure-sfw-slsa/slsa-on-scale.md +++ b/docs/guides/secure-sfw-slsa/slsa-on-scale.md @@ -64,7 +64,7 @@ platforms discover github \ --repository.mapping *::valint_slsa::v1 \ --commit.skip \ --slsa-enable \ - --slsa.tags-only \ + --slsa.tags-only ``` This command will: From fa9557f26b6c55968b854ae32772496a0d479a49 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 18 Jun 2025 12:54:02 +0300 Subject: [PATCH 09/10] update --- docs/guides/secure-sfw-slsa/slsa-on-scale.md | 47 ++++++++++++++++++++ 1 file changed, 47 insertions(+) diff --git a/docs/guides/secure-sfw-slsa/slsa-on-scale.md b/docs/guides/secure-sfw-slsa/slsa-on-scale.md index 1e1430aa7..dbb109b42 100644 --- a/docs/guides/secure-sfw-slsa/slsa-on-scale.md +++ b/docs/guides/secure-sfw-slsa/slsa-on-scale.md @@ -95,6 +95,53 @@ This command will: * Perform all actions of the L1 example. * **Additionally, it will cryptographically sign the generated SLSA provenance statements**, elevating them to SLSA Level 2. + +## 🔁 Example GitHub Actions Workflow + +> ℹ️ **Tip:** It's recommended to schedule this workflow (instead of running manually) to ensure timely collection of logs before GitHub Actions deletes them (typically after 90 days). + +You can also run the `discover` command from within GitHub Actions using the [Scribe Security GitHub Action](https://github.com/scribe-security/action-platforms): + +
+Click to view GitHub Actions workflow example + +```yaml +name: Discover SLSA Provenance from GitHub + +on: + schedule: + - cron: '0 4 * * *' # Runs daily at 04:00 UTC + workflow_dispatch: + +permissions: + id-token: write # Allows Sigstore signing via GitHub OIDC identity + contents: read + +jobs: + discover-slsa: + runs-on: ubuntu-latest + env: + GITHUB_TOKEN: ${{ secrets.GH_PAT_TOKEN }} + SCRIBE_TOKEN: ${{ secrets.GH_CI_DEV_SCRIBE_SECRET }} + steps: + - name: Discover GitHub Provenance + uses: scribe-security/action-platforms@dev + with: + command: discover + platform: github + sign: true # required for SLSA Level 2 + slsa: true + args: >- + --slsa-enable + --slsa.tags-only + --scope.organization=scribe-security + --scope.repository=valint + --organization.mapping=scribe-security::valint_slsa::v1 + --repository.mapping=scribe-security*valint::valint_slsa::v1 +``` + +
+ ## 📂 Key Flags | Flag | Description | From 2f12913d84c6a9a0162fa2de3800fd9178af7940 Mon Sep 17 00:00:00 2001 From: houdini91 Date: Wed, 18 Jun 2025 15:48:33 +0300 Subject: [PATCH 10/10] comment --- docs/guides/secure-sfw-slsa/slsa-on-scale.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/guides/secure-sfw-slsa/slsa-on-scale.md b/docs/guides/secure-sfw-slsa/slsa-on-scale.md index dbb109b42..9a7f74a7d 100644 --- a/docs/guides/secure-sfw-slsa/slsa-on-scale.md +++ b/docs/guides/secure-sfw-slsa/slsa-on-scale.md @@ -74,8 +74,8 @@ This command will: * Extract image build metadata from logs. * Generate SLSA Level 1 provenance (unsigned). * Include links to source and image SBOMs. - * Export that evidence under the appropriate product key using the mapping. - + * Export the evidence under product key **`valint_slsa`** with version **`v1`**. + ## 🧪 Example Usage L2 (Signed Provenance) To generate SLSA Level 2 provenance, you need to sign the provenance statement. This is done by adding the `--valint.sign` flag. This typically requires integration with a signing service (e.g., Scribe Hub's attestation signing).