Release process: stage SLSA provenance metadata #2273

puerco · 2021-10-03T04:10:39Z

What type of PR is this?

/kind feature

What this PR does / why we need it:

This PR adds the first stage of provenance metadata generation during the staging phase of the Kubernetes release process. To push towards SLSA1 compliance, our release process needs to generate provenance metadata. This PR adds the necessary packages and functionality to make the stage phase SLSA1 compliant.

It adds a new Go package provenance which creates in-toto attestations with SLSA compliant predicates. Using the package, krel/anago now writes an attestation file with the build environment information and all artifacts from stage as subjects of the attestation.

We need to complete the chain, consuming this file and verifying in the release phase, and afterwards, produce the provenance metadata for each version we release. This PR represents roughly 2/3 of the work to make the Kubernetes release process SLSA1 compliant.

Which issue(s) this PR fixes:

Part of: #2267

Special notes for your reviewer:

This first push is the first rough iteration of the code. I will run a few tests until the provenance file is correctly staged and then remove the WIP label. I'm opening the PR now to provide an early look and visibility on the effort.

/cc @justaugustus @cpanato @Verolop @palnabarun
/cc @kubernetes/release-engineering

Does this PR introduce a user-facing change?

- **The stage phase of the Kubernetes release process is now SLSA compliant!** :tada: 
- The anago state object now registers the time the release process starts.
- We now make the GCB BUILD_ID identifier available to krel as an env var to include it in the provenance metadata.
- New go pkg: `provenance`. This new package allows projects to generate provenance metadata in in-toto attestations with SLSA compliant predicates. The new package features a scanner to easily add files as subjects in the statement.
- The `provenance` package now has tests and mocks
- The staging phase of anago which krel runs now has a new step: `GenerateProvenance()`. This step writes a provenance attestation file to make `stage` SLSA1 compliant. The file describes the building environment and adds the artifacts that will be consumed from `release` as subjects in the statement.
- The deletion of the Kubernetes source in the staging workspace is now decoupled from the `StageLocalSourceTree()` function
- `PushReleaseArtifacts()` in the build package now supports uploading single files to the release bucket. Previously only directories could be uploaded with this function.
- Optimized the artifact publishing logic to only create the Kubernetes source tarball once. Previously we tarred, compressed and uploaded the whole source tree once for each tag in the release. This is not needed as all releases share the same source.

justaugustus

@puerco -- This is a nice treat to see over the weekend!

When you're happy with testing, we'll want to move the provenance package to sigs.k8s.io/release-sdk. Most, if not all of it, looks fit to be generally useful (as opposed to krel-specific).

puerco · 2021-10-03T04:55:27Z

Definitely, once it has the base features we need, I'll ship it over there. There is only one big one left to write and off it goes.

justaugustus · 2021-10-03T14:37:38Z

@puerco -- Also, just to make sure we're not reinventing the wheel, can you look into https://github.com/in-toto/in-toto-golang and see if there's functionality overlap?

justaugustus · 2021-10-03T14:46:13Z

@puerco -- Also, just to make sure we're not reinventing the wheel, can you look into https://github.com/in-toto/in-toto-golang and see if there's functionality overlap?

Yep, see similar usage in sigstore/cosign#582.
h/t @developer-guy!

puerco · 2021-10-03T21:11:41Z

@justaugustus originally that's where I lifted the types from, I was expecting to replicate just one or two but in the end there were more than a few. I reverted to the original code that embeds them.

The anago state now registers the beggining of stage/release as it is needed to generate the provenance metadata. Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>

Add a constant for the provenance filename `provenance.json` Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>

We now make the GCB BUILD_ID identifier available to krel as an envvar to include it in the provenance metadata. Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>

This commit adds a new go package: provenance This code contains the types and functions to generate provenance metadata. It currently includes code to generate SLSA compliant predicates and automatically scan direcories to add files as subjects in a provenance attestation. Signing is currently not supported but the envelope type is already in the package for the next itearation, the push towards SLSA2 in the Kubernetes release process. Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>

This commits adds testing for the provenance package. It depends on the next commit which generates the fakes. Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>

To be able to work with the source tarball, anago/stage now deletes the source tarball after staging the rest of the artifacts. Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>

When running a multi-tag release (eg official + rc), krel would compress and upload the whole kubernetes source for each version. Now, we only do it once as the tarball is exactly the same for all release in a single run. This should speed the release process. Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>

anago/stage will now generate the provenance metadata of the artifacts produced after building. While staging the files, an in-toto attestation is built and uploaded with the release. Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>

Regenerate the stage implementation fakes with the new provenance functions Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>

This commit adds the new provenance functions in anago/stage to the integration tests in TestStageArtifacts() Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>

This commit modifies the function Instance.PushReleaseArtifacts() in the build package to support pushing single files to the release buckets. Before, PushReleaseArtifacts() would fail if applied to a single file. Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>

puerco · 2021-10-04T04:46:19Z

OK, this os ready to go! PTAL @justaugustus 🚀

Here is a sample of the provenance metadata: provenance.json.gz
And the GCB stage run: faaa3a02-87b1-484b-b344-539b8245cab1

That run was hacked to run faster, I'll kick off a full stage to test but it should not have any difference.

The generated metadata is in the test bucket, here:
gs://kubernetes-release-gcb/stage/v1.23.0-alpha.3.105+0ac956ff2bef9c/provenance.json

The next step will be to read that file during release and, after validation, propagate the provenance metadata in subsequent attestation files for each tag we release 🥳

puerco · 2021-10-04T04:48:04Z

/priority important-soon

justaugustus

@puerco -- Phenomenal work!

I've left a set of non-blocking comments that we should address in a follow-up.
In addition, to capture the "in-person" review we did earlier...

Let's emit a SHA512 for all artifacts, not just src.tar.gz

  "subject": [
    {
      "name": "gs://kubernetes-release-gcb/stage/v1.23.0-alpha.3.105+0ac956ff2bef9c/src.tar.gz",
      "digest": {
        "sha256": "a9ac55b2fe04c940d1755bd63e0be95565930046a9f79207ac2a6b7a375788a5",
        "sha512": "d99203a4480697e5e6f5624d77a296ca8686065b6669dd25d05a6e6e389ad49b2a374fbed0697e267bf81b5fe1a3d318460186e5818ab3707204d5e86445aaa5"
      }
    },
    {
      "name": "gs://kubernetes-release-gcb/stage/v1.23.0-alpha.3.105+0ac956ff2bef9c/v1.23.0-alpha.4/gcs-stage/v1.23.0-alpha.4/SHA256SUMS",
      "digest": {
        "sha256": "71d47a3948d18f3fdee6c88ee3b254663f40be9f5598aa8841b9ab0fb78d7c60"
      }
    },

In:

    "materials": [
      {
        "uri": "git+https://github.com/kubernetes/kubernetes",
        "digest": {
          "sha1": "commit 94db9bed6b7c56420e722d1b15db4610c9cacd3f"
        }
      }
    ]

Should sha1 be:

commit 94db9bed6b7c56420e722d1b15db4610c9cacd3f

OR

94db9bed6b7c56420e722d1b15db4610c9cacd3f

justaugustus · 2021-10-05T08:31:49Z

pkg/anago/stage.go


 	"github.com/blang/semver"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"

+	intoto "github.com/in-toto/in-toto-golang/in_toto"


Non-blocking: This should be in the previous import group

justaugustus · 2021-10-05T08:32:52Z

pkg/anago/stage.go

@@ -740,40 +753,53 @@ func (d *DefaultStage) GenerateBillOfMaterials() error {
 }

 func (d *DefaultStage) StageArtifacts() error {
+	// Generat the intoto attestation, reloaded with the current run data


Non-blocking:

Suggested change

// Generat the intoto attestation, reloaded with the current run data

// Generate the in-toto attestation, reloaded with the current run data

justaugustus · 2021-10-05T08:33:52Z

pkg/anago/stage.go

+	if err != nil {
+		return errors.Wrap(err, "generating the provenance attestation")
+	}
+	// Init a the push options we will use


Non-blocking:

Suggested change

// Init a the push options we will use

// Init push options for provenance document

justaugustus · 2021-10-05T08:37:16Z

pkg/anago/stage.go

+		"--type=":          options.ReleaseType,
+		"--branch=":        options.ReleaseBranch,
+		"--build-version=": options.BuildVersion,


Non-blocking:

Suggested change

"--type=": options.ReleaseType,

"--branch=": options.ReleaseBranch,

"--build-version=": options.BuildVersion,

"release-type": options.ReleaseType,

"branch": options.ReleaseBranch,

"build-version": options.BuildVersion,

Otherwise, we get:

"recipe": { "type": "https://cloudbuild.googleapis.com/CloudBuildYaml@v1", "definedInMaterial": 0, "entryPoint": "https://github.com/kubernetes/release/blob/master/gcb/stage/cloudbuild.yaml", "arguments": { "--branch=": "master", "--build-version=": "v1.23.0-alpha.3.105+0ac956ff2bef9c", "--type=": "alpha" } },

(Note the extraneous -- and = in the arguments.)

justaugustus · 2021-10-05T08:39:50Z

pkg/anago/stage.go

+	if options.NoMock {
+		arguments["--nomock"] = "true"
+	}


Non-blocking:

(Similar to previous review comment)

Suggested change

if options.NoMock {

arguments["--nomock"] = "true"

}

if options.NoMock {

arguments["nomock"] = "true"

}

Hmmmm... do we want "true" (string) or true (bool) / does it matter?

justaugustus · 2021-10-05T08:44:22Z

pkg/build/push.go

+	finfo, err := os.Stat(srcPath)
+	if err != nil {
+		return errors.Wrap(err, "checking if source path is a directory")
+	}
+
+	// If we are handling a single file copy instead of rsync
+	if !finfo.IsDir() {
+		return errors.Wrap(
+			bi.objStore.CopyToRemote(srcPath, dstPath), "copying file to GCS",
+		)
+	}
+
 	return errors.Wrap(
 		bi.objStore.RsyncRecursive(srcPath, dstPath), "rsync artifacts to GCS",
 	)


Non-blocking: Let's handle "this" (dir vs file logic) in the sigs.k8s.io/release-sdk/object package instead.

justaugustus · 2021-10-05T08:44:45Z

pkg/provenance/predicate.go

+	)
+}
+
+// AddMaterial adds a material to the entry


Suggested change

// AddMaterial adds a material to the entry

// AddMaterial adds material to the entry

justaugustus · 2021-10-05T08:45:12Z

pkg/provenance/predicate.go

+
+type defaultPredicateImplementation struct{}
+
+// Write dumps the predicate data into a JSON file


Suggested change

// Write dumps the predicate data into a JSON file

// Write dumps the predicate data as a JSON file

justaugustus · 2021-10-05T08:45:42Z

pkg/provenance/predicate_test.go

+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/require"


Non-blocking:

Suggested change

"github.com/stretchr/testify/require"

"github.com/stretchr/testify/require"

justaugustus · 2021-10-05T08:47:06Z

pkg/provenance/statement.go

+	"github.com/pkg/errors"
+	"sigs.k8s.io/release-utils/hash"
+
+	intoto "github.com/in-toto/in-toto-golang/in_toto"


Non-blocking: Separate import groups

Suggested change

"github.com/pkg/errors"

"sigs.k8s.io/release-utils/hash"

intoto "github.com/in-toto/in-toto-golang/in_toto"

intoto "github.com/in-toto/in-toto-golang/in_toto"

"github.com/pkg/errors"

"sigs.k8s.io/release-utils/hash"

k8s-ci-robot · 2021-10-05T08:53:20Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: justaugustus, puerco

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [justaugustus,puerco]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

This commit addresses nits noted in kubernetes#2273. Signed-off-by: Adolfo García Veytia <[email protected]>

k8s-ci-robot requested review from cpanato, justaugustus, palnabarun, Verolop and a team October 3, 2021 04:10

puerco added this to the v1.23 milestone Oct 3, 2021

puerco mentioned this pull request Oct 3, 2021

SLSA Level 1 compliance in the Kubernetes Release Process #2267

Closed

15 tasks

puerco force-pushed the provenance branch from 6214407 to c3d5fcd Compare October 3, 2021 04:44

justaugustus reviewed Oct 3, 2021

View reviewed changes

puerco force-pushed the provenance branch 2 times, most recently from 2721499 to 995ee00 Compare October 3, 2021 06:20

puerco force-pushed the provenance branch from 995ee00 to 67fb14e Compare October 3, 2021 20:52

puerco force-pushed the provenance branch 3 times, most recently from f6071c7 to 9e9957f Compare October 3, 2021 23:57

puerco added 4 commits October 3, 2021 18:58

Add startTime to anago state

4edb72f

The anago state now registers the beggining of stage/release as it is needed to generate the provenance metadata. Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>

Add provenance file const

566e81e

Add a constant for the provenance filename `provenance.json` Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>

Add BUILD_ID to GCB environment

dc93a10

We now make the GCB BUILD_ID identifier available to krel as an envvar to include it in the provenance metadata. Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>

pkg/provenance tests

d5366ea

This commits adds testing for the provenance package. It depends on the next commit which generates the fakes. Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>

puerco force-pushed the provenance branch 8 times, most recently from 8a890dd to 999bfd6 Compare October 4, 2021 04:09

puerco added 6 commits October 3, 2021 23:32

anago/stage: Delete archived sources after staging artifacts

47399bb

To be able to work with the source tarball, anago/stage now deletes the source tarball after staging the rest of the artifacts. Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>

generate: anago/stage implementation fakes

1313e9f

Regenerate the stage implementation fakes with the new provenance functions Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>

Add provenance functions to stage integration tests

71f3cde

This commit adds the new provenance functions in anago/stage to the integration tests in TestStageArtifacts() Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>

puerco force-pushed the provenance branch from 999bfd6 to 1998bdf Compare October 4, 2021 04:32

puerco changed the title ~~[WIP] Release process: stage SLSA provenance metadata~~ Release process: stage SLSA provenance metadata Oct 4, 2021

k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Oct 4, 2021

k8s-ci-robot added priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. and removed needs-priority labels Oct 4, 2021

justaugustus approved these changes Oct 5, 2021

View reviewed changes

k8s-ci-robot assigned justaugustus Oct 5, 2021

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Oct 5, 2021

k8s-ci-robot merged commit eff921b into kubernetes:master Oct 5, 2021

puerco deleted the provenance branch January 2, 2022 04:14

puerco added a commit to puerco/release that referenced this pull request Jan 2, 2022

Address comments from 2273

f0c6f9c

This commit addresses nits noted in kubernetes#2273. Signed-off-by: Adolfo García Veytia <[email protected]>

puerco mentioned this pull request Jan 2, 2022

Release Process: Write SLSA v0.2 provenance attestations #2375

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Release process: stage SLSA provenance metadata #2273

Release process: stage SLSA provenance metadata #2273

puerco commented Oct 3, 2021 •

edited

Loading

justaugustus left a comment

puerco commented Oct 3, 2021

justaugustus commented Oct 3, 2021

justaugustus commented Oct 3, 2021

puerco commented Oct 3, 2021

puerco commented Oct 4, 2021

puerco commented Oct 4, 2021

justaugustus left a comment

justaugustus Oct 5, 2021

justaugustus Oct 5, 2021

justaugustus Oct 5, 2021

justaugustus Oct 5, 2021

justaugustus Oct 5, 2021

justaugustus Oct 5, 2021

justaugustus Oct 5, 2021

justaugustus Oct 5, 2021

justaugustus Oct 5, 2021

justaugustus Oct 5, 2021

k8s-ci-robot commented Oct 5, 2021

	// Generat the intoto attestation, reloaded with the current run data
	// Generate the in-toto attestation, reloaded with the current run data

	// Init a the push options we will use

	// Init push options for provenance document

	// AddMaterial adds a material to the entry
	// AddMaterial adds material to the entry


		type defaultPredicateImplementation struct{}

		// Write dumps the predicate data into a JSON file

	// Write dumps the predicate data into a JSON file
	// Write dumps the predicate data as a JSON file

	"github.com/stretchr/testify/require"
	"github.com/stretchr/testify/require"

Release process: stage SLSA provenance metadata #2273

Release process: stage SLSA provenance metadata #2273

Conversation

puerco commented Oct 3, 2021 • edited Loading

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

justaugustus left a comment

Choose a reason for hiding this comment

puerco commented Oct 3, 2021

justaugustus commented Oct 3, 2021

justaugustus commented Oct 3, 2021

puerco commented Oct 3, 2021

puerco commented Oct 4, 2021

puerco commented Oct 4, 2021

justaugustus left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

k8s-ci-robot commented Oct 5, 2021

puerco commented Oct 3, 2021 •

edited

Loading