ci(release): SLSA Build L3 provenance via slsa-github-generator - #112
Merged
Conversation
Earns a legitimate SLSA Build Level 3 attestation for released artifacts
(wheel, sdist, deploy bundle, SBOM), complementing the existing cosign
signing + SBOM:
- The release job now emits a `hashes` output — base64 sha256 of the
distributables (the SLSA subjects), computed after build/SBOM and before
cosign (the .bundle signatures are excluded, they are not distributables).
- A new `provenance` job calls the slsa-github-generator generic L3 reusable
workflow, which generates and keylessly signs an in-toto provenance
attestation and attaches the .intoto.jsonl to the release. The generator
runs in an isolated trusted builder — that isolation is what makes it L3.
The generator is pinned to a version tag (v2.1.0), not a SHA, because it
reads its own ref to assert the trusted-builder identity — the documented
exception to this repo's hash-pinning convention.
Verify:
slsa-verifier verify-artifact <artifact> \
--provenance-path <artifact>.intoto.jsonl \
--source-uri github.com/mountainowl/bubo
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds SLSA Build Level 3 provenance to the release pipeline (you said yes to this), on top of the existing cosign signing + SBOM.
releasejob emits ahashesoutput — base64sha256of the distributables (wheel, sdist, deploy bundle, SBOM); these are the SLSA subjects. Computed after build/SBOM, before cosign (the.bundlesignatures aren't distributables).provenancejob callsslsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0, which builds + keyless-signs an in-toto provenance attestation in an isolated trusted builder (the isolation is what earns L3) and attaches the.intoto.jsonlto the release.Notes
v2.1.0, the current latest), not a SHA — it reads its own ref to assert the trusted-builder identity, so a SHA pin breaks it. This is the documented exception to the repo's hash-pinning convention (OpenSSF Scorecard's pinned-dependencies check may flag it; it's expected).slsa-verifier verify-artifact <art> --provenance-path <art>.intoto.jsonl --source-uri github.com/mountainowl/bubo.Verification
release.ymlparses;provenancejob wired with correctneeds/permissions/base64-subjects. (Provenance generation itself can only be exercised by a real tag push.)