Skip to content

chore: verify SLSA token at creation #4151

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ramonpetgrave64 merged 1 commit into from
Jun 24, 2025
+4 −31
Merged

chore: verify SLSA token at creation #4151

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 1 addition & 14 deletions actions/delegator/setup-generic/dist/index.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,18 +69,6 @@ const tscommon = __importStar(__nccwpck_require__(3945));
function run() {
return __awaiter(this, void 0, void 0, function* () {
try {
/* Test locally:
$ env INPUT_SLSA-WORKFLOW-RECIPIENT="laurentsimon/slsa-delegated-tool" \
INPUT_SLSA-REKOR-LOG-PUBLIC=true \
INPUT_SLSA-RUNNER-LABEL="ubuntu-latest" \
INPUT_SLSA-BUILD-ACTION-PATH="./actions/build-artifacts-composite" \
INPUT_SLSA-WORKFLOW-INPUTS="{\"name1\":\"value1\",\"name2\":\"value2\",\"name3\":\"value3\",\"name4\":\"value4\"}" \
INPUT_SLSA-WORKFLOW-INPUTS-MASK="name2, name4" \
INPUT_SLSA-CHECKOUT-FETCH-DEPTH="2" \
INPUT_SLSA-CHECKOUT-REPOSITORY-SHA1="abcdef" \
INPUT_SLSA-VERSION="v1" \
nodejs ./dist/index.js
*/
const slsaVersion = core.getInput("slsa-version");
if (!["v1.0", "v0.2"].includes(slsaVersion)) {
throw new Error(`Unsupported slsa-version: ${slsaVersion}`);
Expand Down Expand Up @@ -172,8 +160,7 @@ function run() {
const bundle = yield (0, sigstore_1.sign)(Buffer.from(unsignedB64Token));
// Verify just to double check.
// NOTE: this is an offline verification.
// TODO(#1668): re-enable verification.
// await sigstore.verify(bundle, Buffer.from(unsignedB64Token));
yield (0, sigstore_1.verify)(bundle, Buffer.from(unsignedB64Token));
const bundleStr = JSON.stringify(bundle);
const bundleB64 = Buffer.from(bundleStr).toString("base64");
core.info(`bundleStr: ${bundleStr}`);
Expand Down
2 changes: 1 addition & 1 deletion actions/delegator/setup-generic/dist/index.js.map
View file
Open in desktop

Large diffs are not rendered by default.

18 changes: 2 additions & 16 deletions actions/delegator/setup-generic/src/main.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,24 +14,11 @@ limitations under the License.
import * as github from "@actions/github";
import * as core from "@actions/core";
import * as process from "process";
import { sign } from "sigstore";
import { sign, verify } from "sigstore";
import * as tscommon from "tscommon";

async function run(): Promise<void> {
try {
/* Test locally:
$ env INPUT_SLSA-WORKFLOW-RECIPIENT="laurentsimon/slsa-delegated-tool" \
INPUT_SLSA-REKOR-LOG-PUBLIC=true \
INPUT_SLSA-RUNNER-LABEL="ubuntu-latest" \
INPUT_SLSA-BUILD-ACTION-PATH="./actions/build-artifacts-composite" \
INPUT_SLSA-WORKFLOW-INPUTS="{\"name1\":\"value1\",\"name2\":\"value2\",\"name3\":\"value3\",\"name4\":\"value4\"}" \
INPUT_SLSA-WORKFLOW-INPUTS-MASK="name2, name4" \
INPUT_SLSA-CHECKOUT-FETCH-DEPTH="2" \
INPUT_SLSA-CHECKOUT-REPOSITORY-SHA1="abcdef" \
INPUT_SLSA-VERSION="v1" \
nodejs ./dist/index.js
*/

const slsaVersion = core.getInput("slsa-version");
if (!["v1.0", "v0.2"].includes(slsaVersion)) {
throw new Error(`Unsupported slsa-version: ${slsaVersion}`);
Expand Down Expand Up @@ -132,8 +119,7 @@ async function run(): Promise<void> {

// Verify just to double check.
// NOTE: this is an offline verification.
// TODO(#1668): re-enable verification.
// await sigstore.verify(bundle, Buffer.from(unsignedB64Token));
await verify(bundle, Buffer.from(unsignedB64Token));
const bundleStr = JSON.stringify(bundle);

const bundleB64 = Buffer.from(bundleStr).toString("base64");
Expand Down
Loading