debug.generic-generator.yml

# Copyright 2023 SLSA Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# a test workflow for debugging the generic generator

name: debug-generic-generator

on: 
    push:

permissions: read-all

env:
  GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

jobs:
  build:
    outputs:
      hashes: ${{ steps.hash.outputs.hashes }}
    runs-on: ubuntu-latest
    steps:
      - name: Build artifacts
        run: |
          # These are some amazing artifacts.
          echo "foo" > artifact1
          echo "bar" > artifact2

      - name: Generate hashes
        shell: bash
        id: hash
        run: |
          # sha256sum generates sha256 hash for all artifacts.
          # base64 -w0 encodes to base64 and outputs on a single line.
          # sha256sum artifact1 artifact2 ... | base64 -w0
          echo "hashes=$(sha256sum artifact1 artifact2 | base64 -w0)" >> "$GITHUB_OUTPUT"

      - name: Upload artifact1
        uses: actions/upload-artifact@v4
        with:
          name: artifact1
          path: artifact1
          if-no-files-found: error
          retention-days: 5

      - name: Upload artifact2
        uses: actions/upload-artifact@v4
        with:
          name: artifact2
          path: artifact2
          if-no-files-found: error
          retention-days: 5

  provenance-original:
    needs: build
    permissions:
      id-token: write # For signing.
      contents: write # For asset uploads.
      actions: read # For reading workflow info.
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0
    with:
      # echo "2e0390eb024a52963db7b95e84a9c2b12c004054a7bad9a97ec0c7c89d4681d2    binary-name" | base64 -w0
      # base64-subjects: "MmUwMzkwZWIwMjRhNTI5NjNkYjdiOTVlODRhOWMyYjEyYzAwNDA1NGE3YmFkOWE5N2VjMGM3Yzg5ZDQ2ODFkMiAgICBiaW5hcnktbmFtZQo="
      base64-subjects: "${{ needs.build.outputs.hashes }}"
      compile-generator: true
      provenance-name: build-original.intoto.jsonl
      upload-assets: true

  provenance:
    needs: build
    permissions:
      id-token: write # For signing.
      contents: write # For asset uploads.
      actions: read # For reading workflow info.
    uses: ./.github/workflows/generator_generic_slsa3.yml
    with:
      # echo "2e0390eb024a52963db7b95e84a9c2b12c004054a7bad9a97ec0c7c89d4681d2    binary-name" | base64 -w0
      # base64-subjects: "MmUwMzkwZWIwMjRhNTI5NjNkYjdiOTVlODRhOWMyYjEyYzAwNDA1NGE3YmFkOWE5N2VjMGM3Yzg5ZDQ2ODFkMiAgICBiaW5hcnktbmFtZQo="
      base64-subjects: "${{ needs.build.outputs.hashes }}"
      compile-generator: true
      provenance-name: build.intoto.jsonl
      upload-assets: true

  verify:
    needs: provenance
    runs-on: ubuntu-latest
    steps:
      - name: Download artifact1
        uses: actions/download-artifact@v4
        with:
          name: artifact1
      - name: Download artifact2
        uses: actions/download-artifact@v4
        with:
          name: artifact2
      - name: Download provenance
        uses: actions/download-artifact@v4
        with:
          name: build.intoto.jsonl
      - uses: actions/setup-go@v5
        with:
          go-version: 1.22
      - name: Setup slsa-verifier
        run: go install github.com/slsa-framework/slsa-verifier/v2/cli/slsa-verifier@verify-sigstore-go-Bundlev2
      - name: Verify
        run: |
          SLSA_VERIFIER_TESTING=1 slsa-verifier verify-artifact \
            artifact1 artifact2 \
            --provenance-path build.intoto.jsonl \
            --source-uri github.com/slsa-framework/slsa-github-generator \
            --source-branch ramonpetgrave64-internal-builder-sigstore-bundle \
            --print-provenance

  provenance2:
    needs: build
    permissions:
      id-token: write # For signing.
      contents: read # For asset uploads.
      actions: read # For the entrypoint.
    uses: ./.github/workflows/builder_generic_slsa3.yml
    with:
      base64-subjects: "${{ needs.build.outputs.hashes }}"
      provenance-name: my-debug-prov.build.slsa
      rekor-log-public: true

  verify2:
    needs: provenance2
    runs-on: ubuntu-latest
    steps:
      - name: Download artifact1
        uses: actions/download-artifact@v4
        with:
          name: artifact1
      - name: Download artifact2
        uses: actions/download-artifact@v4
        with:
          name: artifact2
      - name: Download provenance
        uses: slsa-framework/slsa-github-generator/actions/nodejs/secure-attestations-download@v2.0.0
        with:
          name: ${{ needs.provenance2.outputs.provenance-download-name }}
          sha256: ${{ needs.provenance2.outputs.provenance-download-sha256 }}
      - uses: actions/setup-go@v5
        with:
          go-version: 1.22
      - name: Setup slsa-verifier
        run: go install github.com/slsa-framework/slsa-verifier/v2/cli/slsa-verifier@testing-from-slsa-github-generator-repo-branches
      - name: Verify
        env:
          PROVENANCE_PATH: ${{ needs.provenance2.outputs.provenance-download-name }}/${{ needs.provenance2.outputs.provenance-name }}
        run: |
          pwd
          ls -lahR
          SLSA_VERIFIER_TESTING=1 slsa-verifier verify-artifact \
            artifact1 artifact2 \
            --provenance-path $PROVENANCE_PATH \
            --source-uri github.com/slsa-framework/slsa-github-generator \
            --source-branch ramonpetgrave64-internal-builder-sigstore-bundle \
            --print-provenance


  provenance3:
    needs: build
    permissions:
      id-token: write # For signing.
      contents: write # For asset uploads.
      actions: read # For the entrypoint.
    uses: ./.github/workflows/generator_generic_slsa3_alt.yml
    with:
      base64-subjects: "${{ needs.build.outputs.hashes }}"
      provenance-name: my-debug-prov3.build.slsa

  verify3:
    needs: provenance3
    runs-on: ubuntu-latest
    steps:
      - name: Download artifact1
        uses: actions/download-artifact@v4
        with:
          name: artifact1
      - name: Download artifact2
        uses: actions/download-artifact@v4
        with:
          name: artifact2
      - name: Download provenance
        uses: slsa-framework/slsa-github-generator/actions/nodejs/secure-attestations-download@v2.0.0
        with:
          name: ${{ needs.provenance3.outputs.provenance-download-name }}
          sha256: ${{ needs.provenance3.outputs.provenance-download-sha256 }}
      - uses: actions/setup-go@v5
        with:
          go-version: 1.22
      - name: Setup slsa-verifier
        run: go install github.com/slsa-framework/slsa-verifier/v2/cli/slsa-verifier@testing-from-slsa-github-generator-repo-branches
      - name: Verify
        env:
          PROVENANCE_PATH: ${{ needs.provenance3.outputs.provenance-download-name }}/${{ needs.provenance3.outputs.provenance-name }}
        run: |
          pwd
          ls -lahR
          SLSA_VERIFIER_TESTING=1 slsa-verifier verify-artifact \
            artifact1 artifact2 \
            --provenance-path $PROVENANCE_PATH \
            --source-uri github.com/slsa-framework/slsa-github-generator \
            --source-branch ramonpetgrave64-internal-builder-sigstore-bundle \
            --print-provenance