add new @actions/attest package

Signed-off-by: Brian DeHamer <[email protected]>

packages/attest/__tests__/__snapshots__/intoto.test.ts.snap

@@ -0,0 +1,19 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`buildIntotoStatement returns a provenance hydrated from env vars 1`] = `
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicate": {
+    "key": "value",
+  },
+  "predicateType": "predicatey",
+  "subject": [
+    {
+      "digest": {
+        "sha256": "7d070f6b64d9bcc530fe99cc21eaaa4b3c364e0b2d367d7735671fa202a03b32",
+      },
+      "name": "subjecty",
+    },
+  ],
+}
+`;

packages/attest/__tests__/__snapshots__/provenance.test.ts.snap

@@ -0,0 +1,42 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`buildSLSAProvenancePredicate returns a provenance hydrated from env vars 1`] = `
+{
+  "params": {
+    "buildDefinition": {
+      "buildType": "https://slsa-framework.github.io/github-actions-buildtypes/workflow/v1",
+      "externalParameters": {
+        "workflow": {
+          "path": ".github/workflows/main.yml",
+          "ref": "main",
+          "repository": "https://github.com/owner/repo",
+        },
+      },
+      "internalParameters": {
+        "github": {
+          "event_name": "push",
+          "repository_id": "repo-id",
+          "repository_owner_id": "owner-id",
+        },
+      },
+      "resolvedDependencies": [
+        {
+          "digest": {
+            "gitCommit": "babca52ab0c93ae16539e5923cb0d7403b9a093b",
+          },
+          "uri": "git+https://github.com/owner/repo@refs/heads/main",
+        },
+      ],
+    },
+    "runDetails": {
+      "builder": {
+        "id": "https://github.com/actions/runner/github-hosted",
+      },
+      "metadata": {
+        "invocationId": "https://github.com/owner/repo/actions/runs/run-id/attempts/run-attempt",
+      },
+    },
+  },
+  "type": "https://slsa.dev/provenance/v1",
+}
+`;

packages/attest/__tests__/index.test.ts

@@ -0,0 +1,6 @@
+import {attest, attestProvenance} from '../src'
+
+it('exports functions', () => {
+  expect(attestProvenance).toBeInstanceOf(Function)
+  expect(attest).toBeInstanceOf(Function)
+})

packages/attest/__tests__/intoto.test.ts

@@ -0,0 +1,23 @@
+import {buildIntotoStatement} from '../src/intoto'
+import type {Predicate, Subject} from '../src/shared.types'
+
+describe('buildIntotoStatement', () => {
+  const subject: Subject = {
+    name: 'subjecty',
+    digest: {
+      sha256: '7d070f6b64d9bcc530fe99cc21eaaa4b3c364e0b2d367d7735671fa202a03b32'
+    }
+  }
+
+  const predicate: Predicate = {
+    type: 'predicatey',
+    params: {
+      key: 'value'
+    }
+  }
+
+  it('returns a provenance hydrated from env vars', () => {
+    const statement = buildIntotoStatement(subject, predicate)
+    expect(statement).toMatchSnapshot()
+  })
+})

packages/attest/__tests__/provenance.test.ts

@@ -0,0 +1,213 @@
+import * as github from '@actions/github'
+import {mockFulcio, mockRekor, mockTSA} from '@sigstore/mock'
+import nock from 'nock'
+import {SIGSTORE_GITHUB, SIGSTORE_PUBLIC_GOOD} from '../src/endpoints'
+import {attestProvenance, buildSLSAProvenancePredicate} from '../src/provenance'
+
+// Dummy workflow environment
+const env = {
+  GITHUB_REPOSITORY: 'owner/repo',
+  GITHUB_REF: 'refs/heads/main',
+  GITHUB_SHA: 'babca52ab0c93ae16539e5923cb0d7403b9a093b',
+  GITHUB_WORKFLOW_REF: 'owner/repo/.github/workflows/main.yml@main',
+  GITHUB_SERVER_URL: 'https://github.com',
+  GITHUB_EVENT_NAME: 'push',
+  GITHUB_REPOSITORY_ID: 'repo-id',
+  GITHUB_REPOSITORY_OWNER_ID: 'owner-id',
+  GITHUB_RUN_ID: 'run-id',
+  GITHUB_RUN_ATTEMPT: 'run-attempt',
+  RUNNER_ENVIRONMENT: 'github-hosted'
+}
+
+describe('buildSLSAProvenancePredicate', () => {
+  it('returns a provenance hydrated from env vars', () => {
+    const predicate = buildSLSAProvenancePredicate(env)
+    expect(predicate).toMatchSnapshot()
+  })
+})
+
+describe('attestProvenance', () => {
+  // Capture original environment variables so we can restore them after each
+  // test
+  const originalEnv = process.env
+
+  // Subject to attest
+  const subjectName = 'subjective'
+  const subjectDigest = {
+    sha256: '7d070f6b64d9bcc530fe99cc21eaaa4b3c364e0b2d367d7735671fa202a03b32'
+  }
+
+  // Fake an OIDC token
+  const oidcPayload = {sub: '[email protected]', iss: ''}
+  const oidcToken = `.${Buffer.from(JSON.stringify(oidcPayload)).toString(
+    'base64'
+  )}.}`
+
+  const tokenURL = 'https://token.url'
+  const attestationID = '1234567890'
+
+  beforeEach(async () => {
+    jest.clearAllMocks()
+
+    nock(tokenURL)
+      .get('/')
+      .query({audience: 'sigstore'})
+      .reply(200, {value: oidcToken})
+
+    // Set-up GHA environment variables
+    process.env = {
+      ...originalEnv,
+      ...env,
+      ACTIONS_ID_TOKEN_REQUEST_URL: tokenURL,
+      ACTIONS_ID_TOKEN_REQUEST_TOKEN: 'token'
+    }
+  })
+
+  afterEach(() => {
+    // Restore the original environment
+    process.env = originalEnv
+  })
+
+  describe('when using the github Sigstore instance', () => {
+    const {fulcioURL, tsaServerURL} = SIGSTORE_GITHUB
+
+    beforeEach(async () => {
+      // Mock Sigstore
+      await mockFulcio({baseURL: fulcioURL, strict: false})
+      await mockTSA({baseURL: tsaServerURL})
+
+      // Mock GH attestations API
+      nock('https://api.github.com')
+        .post(/^\/repos\/.*\/.*\/attestations$/)
+        .reply(201, {id: attestationID})
+    })
+
+    describe('when the sigstore instance is explicitly set', () => {
+      it('attests provenance', async () => {
+        const attestation = await attestProvenance({
+          subjectName,
+          subjectDigest,
+          token: 'token',
+          sigstore: 'github'
+        })
+
+        expect(attestation).toBeDefined()
+        expect(attestation.bundle).toBeDefined()
+        expect(attestation.certificate).toMatch(/-----BEGIN CERTIFICATE-----/)
+        expect(attestation.tlogID).toBeUndefined()
+        expect(attestation.attestationID).toBe(attestationID)
+      })
+    })
+
+    describe('when the sigstore instance is inferred from the repo visibility', () => {
+      const savedRepository = github.context.payload.repository
+
+      beforeEach(() => {
+        /* eslint-disable-next-line @typescript-eslint/no-explicit-any */
+        github.context.payload.repository = {visibility: 'private'} as any
+      })
+
+      afterEach(() => {
+        github.context.payload.repository = savedRepository
+      })
+
+      it('attests provenance', async () => {
+        const attestation = await attestProvenance({
+          subjectName,
+          subjectDigest,
+          token: 'token'
+        })
+
+        expect(attestation).toBeDefined()
+        expect(attestation.bundle).toBeDefined()
+        expect(attestation.certificate).toMatch(/-----BEGIN CERTIFICATE-----/)
+        expect(attestation.tlogID).toBeUndefined()
+        expect(attestation.attestationID).toBe(attestationID)
+      })
+    })
+  })
+
+  describe('when using the public-good Sigstore instance', () => {
+    const {fulcioURL, rekorURL} = SIGSTORE_PUBLIC_GOOD
+
+    beforeEach(async () => {
+      // Mock Sigstore
+      await mockFulcio({baseURL: fulcioURL, strict: false})
+      await mockRekor({baseURL: rekorURL})
+
+      // Mock GH attestations API
+      nock('https://api.github.com')
+        .post(/^\/repos\/.*\/.*\/attestations$/)
+        .reply(201, {id: attestationID})
+    })
+
+    describe('when the sigstore instance is explicitly set', () => {
+      it('attests provenance', async () => {
+        const attestation = await attestProvenance({
+          subjectName,
+          subjectDigest,
+          token: 'token',
+          sigstore: 'public-good'
+        })
+
+        expect(attestation).toBeDefined()
+        expect(attestation.bundle).toBeDefined()
+        expect(attestation.certificate).toMatch(/-----BEGIN CERTIFICATE-----/)
+        expect(attestation.tlogID).toBeDefined()
+        expect(attestation.attestationID).toBe(attestationID)
+      })
+    })
+
+    describe('when the sigstore instance is inferred from the repo visibility', () => {
+      const savedRepository = github.context.payload.repository
+
+      beforeEach(() => {
+        /* eslint-disable-next-line @typescript-eslint/no-explicit-any */
+        github.context.payload.repository = {visibility: 'public'} as any
+      })
+
+      afterEach(() => {
+        github.context.payload.repository = savedRepository
+      })
+
+      it('attests provenance', async () => {
+        const attestation = await attestProvenance({
+          subjectName,
+          subjectDigest,
+          token: 'token'
+        })
+
+        expect(attestation).toBeDefined()
+        expect(attestation.bundle).toBeDefined()
+        expect(attestation.certificate).toMatch(/-----BEGIN CERTIFICATE-----/)
+        expect(attestation.tlogID).toBeDefined()
+        expect(attestation.attestationID).toBe(attestationID)
+      })
+    })
+  })
+
+  describe('when skipWrite is set to true', () => {
+    const {fulcioURL, rekorURL} = SIGSTORE_PUBLIC_GOOD
+    beforeEach(async () => {
+      // Mock Sigstore
+      await mockFulcio({baseURL: fulcioURL, strict: false})
+      await mockRekor({baseURL: rekorURL})
+    })
+
+    it('attests provenance', async () => {
+      const attestation = await attestProvenance({
+        subjectName,
+        subjectDigest,
+        token: 'token',
+        sigstore: 'public-good',
+        skipWrite: true
+      })
+
+      expect(attestation).toBeDefined()
+      expect(attestation.bundle).toBeDefined()
+      expect(attestation.certificate).toMatch(/-----BEGIN CERTIFICATE-----/)
+      expect(attestation.tlogID).toBeDefined()
+      expect(attestation.attestationID).toBeUndefined()
+    })
+  })
+})

packages/attest/__tests__/sign.test.ts

@@ -0,0 +1,105 @@
+import {mockFulcio, mockRekor, mockTSA} from '@sigstore/mock'
+import nock from 'nock'
+import {Payload, signPayload} from '../src/sign'
+
+describe('signProvenance', () => {
+  const originalEnv = process.env
+
+  // Fake an OIDC token
+  const subject = '[email protected]'
+  const oidcPayload = {sub: subject, iss: ''}
+  const oidcToken = `.${Buffer.from(JSON.stringify(oidcPayload)).toString(
+    'base64'
+  )}.}`
+
+  // Dummy provenance to be signed
+  const provenance = {
+    _type: 'https://in-toto.io/Statement/v1',
+    subject: {
+      name: 'subjective',
+      digest: {
+        sha256:
+          '7d070f6b64d9bcc530fe99cc21eaaa4b3c364e0b2d367d7735671fa202a03b32'
+      }
+    }
+  }
+
+  const payload: Payload = {
+    body: Buffer.from(JSON.stringify(provenance)),
+    type: 'application/vnd.in-toto+json'
+  }
+
+  const fulcioURL = 'https://fulcio.url'
+  const rekorURL = 'https://rekor.url'
+  const tsaServerURL = 'https://tsa.url'
+
+  beforeEach(() => {
+    // Mock OIDC token endpoint
+    const tokenURL = 'https://token.url'
+
+    process.env = {
+      ...originalEnv,
+      ACTIONS_ID_TOKEN_REQUEST_URL: tokenURL,
+      ACTIONS_ID_TOKEN_REQUEST_TOKEN: 'token'
+    }
+
+    nock(tokenURL)
+      .get('/')
+      .query({audience: 'sigstore'})
+      .reply(200, {value: oidcToken})
+  })
+
+  afterEach(() => {
+    process.env = originalEnv
+  })
+
+  describe('when visibility is public', () => {
+    beforeEach(async () => {
+      await mockFulcio({baseURL: fulcioURL, strict: false})
+      await mockRekor({baseURL: rekorURL})
+    })
+
+    it('returns a bundle', async () => {
+      const att = await signPayload(payload, {fulcioURL, rekorURL})
+
+      expect(att).toBeDefined()
+      expect(att.mediaType).toEqual(
+        'application/vnd.dev.sigstore.bundle+json;version=0.2'
+      )
+
+      expect(att.content.$case).toEqual('dsseEnvelope')
+      expect(att.verificationMaterial.content.$case).toEqual(
+        'x509CertificateChain'
+      )
+      expect(att.verificationMaterial.tlogEntries).toHaveLength(1)
+      expect(
+        att.verificationMaterial.timestampVerificationData?.rfc3161Timestamps
+      ).toHaveLength(0)
+    })
+  })
+
+  describe('when visibility is private', () => {
+    beforeEach(async () => {
+      await mockFulcio({baseURL: fulcioURL, strict: false})
+      await mockTSA({baseURL: tsaServerURL})
+    })
+
+    it('returns a bundle', async () => {
+      const att = await signPayload(payload, {fulcioURL, tsaServerURL})
+
+      expect(att).toBeDefined()
+      expect(att.mediaType).toEqual(
+        'application/vnd.dev.sigstore.bundle+json;version=0.2'
+      )
+
+      expect(att.content.$case).toEqual('dsseEnvelope')
+      expect(att.verificationMaterial.content.$case).toEqual(
+        'x509CertificateChain'
+      )
+      expect(att.verificationMaterial.tlogEntries).toHaveLength(0)
+      expect(
+        att.verificationMaterial.timestampVerificationData?.rfc3161Timestamps
+      ).toHaveLength(1)
+    })
+  })
+})

packages/attest/__tests__/store.test.ts

@@ -0,0 +1,45 @@
+import nock from 'nock'
+import {writeAttestation} from '../src/store'
+
+describe('writeAttestation', () => {
+  const originalEnv = process.env
+  const attestation = {foo: 'bar '}
+  const token = 'token'
+
+  beforeEach(() => {
+    process.env = {
+      ...originalEnv,
+      GITHUB_REPOSITORY: 'foo/bar'
+    }
+  })
+
+  afterEach(() => {
+    process.env = originalEnv
+  })
+
+  describe('when the api call is successful', () => {
+    beforeEach(() => {
+      nock('https://api.github.com')
+        .matchHeader('authorization', `token ${token}`)
+        .post('/repos/foo/bar/attestations', {bundle: attestation})
+        .reply(201, {id: '123'})
+    })
+
+    it('persists the attestation', async () => {
+      await expect(writeAttestation(attestation, token)).resolves.toEqual('123')
+    })
+  })
+
+  describe('when the api call fails', () => {
+    beforeEach(() => {
+      nock('https://api.github.com')
+        .matchHeader('authorization', `token ${token}`)
+        .post('/repos/foo/bar/attestations', {bundle: attestation})
+        .reply(500, 'oops')
+    })
+
+    it('persists the attestation', async () => {
+      await expect(writeAttestation(attestation, token)).rejects.toThrow(/oops/)
+    })
+  })
+})