From 4d4b56a648f01d4ed860e2c0ecf52f6dc51527ef Mon Sep 17 00:00:00 2001 From: Tonis Tiigi Date: Mon, 19 Dec 2022 20:45:27 -0800 Subject: [PATCH 1/3] add possibility to override filename for provenance Signed-off-by: Tonis Tiigi --- solver/llbsolver/proc/provenance.go | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/solver/llbsolver/proc/provenance.go b/solver/llbsolver/proc/provenance.go index 4d8506b2987f..4577e40c7eee 100644 --- a/solver/llbsolver/proc/provenance.go +++ b/solver/llbsolver/proc/provenance.go @@ -42,6 +42,11 @@ func ProvenanceProcessor(attrs map[string]string) llbsolver.Processor { return nil, err } + filename := "provenance.json" + if v, ok := attrs["filename"]; ok { + filename = v + } + res.AddAttestation(p.ID, llbsolver.Attestation{ Kind: gatewaypb.AttestationKindInToto, Metadata: map[string][]byte{ @@ -51,7 +56,7 @@ func ProvenanceProcessor(attrs map[string]string) llbsolver.Processor { InToto: result.InTotoAttestation{ PredicateType: slsa02.PredicateSLSAProvenance, }, - Path: "provenance.json", + Path: filename, ContentFunc: func() ([]byte, error) { pr, err := pc.Predicate() if err != nil { From 103a0a1f74f4279a7db9da793ba5793c8330670b Mon Sep 17 00:00:00 2001 From: Tonis Tiigi Date: Mon, 19 Dec 2022 20:49:10 -0800 Subject: [PATCH 2/3] provenance: move hermetic field into a correct struct Signed-off-by: Tonis Tiigi --- frontend/dockerfile/dockerfile_provenance_test.go | 4 ++-- solver/llbsolver/provenance/predicate.go | 15 +++++---------- 2 files changed, 7 insertions(+), 12 deletions(-) diff --git a/frontend/dockerfile/dockerfile_provenance_test.go b/frontend/dockerfile/dockerfile_provenance_test.go index f315ecb963a2..2d737511e570 100644 --- a/frontend/dockerfile/dockerfile_provenance_test.go +++ b/frontend/dockerfile/dockerfile_provenance_test.go @@ -198,7 +198,7 @@ RUN echo "ok" > /foo require.False(t, pred.Metadata.Completeness.Materials) require.False(t, pred.Metadata.Reproducible) - require.False(t, pred.Metadata.Completeness.Hermetic) + require.False(t, pred.Metadata.Hermetic) if mode == "max" || mode == "" { require.Equal(t, 2, len(pred.Metadata.BuildKitMetadata.Layers)) @@ -347,8 +347,8 @@ COPY myapp.Dockerfile / require.Equal(t, 0, len(pred.Invocation.Parameters.Locals)) require.True(t, pred.Metadata.Completeness.Materials) - require.True(t, pred.Metadata.Completeness.Hermetic) require.True(t, pred.Metadata.Completeness.Environment) + require.True(t, pred.Metadata.Hermetic) if isClient { require.False(t, pred.Metadata.Completeness.Parameters) diff --git a/solver/llbsolver/provenance/predicate.go b/solver/llbsolver/provenance/predicate.go index ec4f68cd598a..7608f5cfae9c 100644 --- a/solver/llbsolver/provenance/predicate.go +++ b/solver/llbsolver/provenance/predicate.go @@ -44,13 +44,8 @@ type Environment struct { type ProvenanceMetadata struct { slsa02.ProvenanceMetadata - Completeness ProvenanceComplete `json:"completeness"` - BuildKitMetadata BuildKitMetadata `json:"https://mobyproject.org/buildkit@v1#metadata,omitempty"` -} - -type ProvenanceComplete struct { - slsa02.ProvenanceComplete - Hermetic bool `json:"https://mobyproject.org/buildkit@v1#hermetic,omitempty"` + BuildKitMetadata BuildKitMetadata `json:"https://mobyproject.org/buildkit@v1#metadata,omitempty"` + Hermetic bool `json:"https://mobyproject.org/buildkit@v1#hermetic,omitempty"` } type BuildKitMetadata struct { @@ -211,14 +206,14 @@ func NewPredicate(c *Capture) (*ProvenancePredicate, error) { Materials: materials, }, Metadata: &ProvenanceMetadata{ - Completeness: ProvenanceComplete{ - ProvenanceComplete: slsa02.ProvenanceComplete{ + ProvenanceMetadata: slsa02.ProvenanceMetadata{ + Completeness: slsa02.ProvenanceComplete{ Parameters: c.Frontend != "", Environment: true, Materials: !incompleteMaterials, }, - Hermetic: !incompleteMaterials && !c.NetworkAccess, }, + Hermetic: !incompleteMaterials && !c.NetworkAccess, }, } From ad85ce74b1edb21c00e04857487d873f46a63995 Mon Sep 17 00:00:00 2001 From: Tonis Tiigi Date: Mon, 19 Dec 2022 22:00:55 -0800 Subject: [PATCH 3/3] provenance: fix the order of the build steps Signed-off-by: Tonis Tiigi --- solver/llbsolver/provenance/buildconfig.go | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/solver/llbsolver/provenance/buildconfig.go b/solver/llbsolver/provenance/buildconfig.go index 3234d4b1d7bb..4d9bf85ec1ba 100644 --- a/solver/llbsolver/provenance/buildconfig.go +++ b/solver/llbsolver/provenance/buildconfig.go @@ -141,11 +141,6 @@ func toBuildSteps(def *pb.Definition) ([]BuildStep, map[digest.Digest]int, error if err != nil { return nil, nil, err } - for i := 0; i < len(dgsts)/2; i++ { - j := len(dgsts) - 1 - i - dgsts[i], dgsts[j] = dgsts[j], dgsts[i] - } - indexes := map[digest.Digest]int{} for i, dgst := range dgsts { indexes[dgst] = i @@ -179,7 +174,6 @@ func walkDigests(dgsts []digest.Digest, ops map[digest.Digest]*pb.Op, dgst diges if op == nil { return nil, errors.Errorf("invalid nil input %v", dgst) } - dgsts = append(dgsts, dgst) visited[dgst] = struct{}{} for _, inp := range op.Inputs { var err error @@ -188,5 +182,6 @@ func walkDigests(dgsts []digest.Digest, ops map[digest.Digest]*pb.Op, dgst diges return nil, err } } + dgsts = append(dgsts, dgst) return dgsts, nil }