Skip to content

Latest commit

 

History

History
50 lines (36 loc) · 2.3 KB

README.md

File metadata and controls

50 lines (36 loc) · 2.3 KB
Raw

Witness Webhook

Witness Webhook is a service that will listen for webhooks and create signed attestations from them.

Configuring

Witness Webhook is configured primarily through a YAML file, with a few environment variables.

Environment Variables

Variable Default Description
WITNESS_WEBHOOK_CONFIG_PATH /webhook-config.yaml The path to the yaml config file
WITNESS_WEBHOOK_LISTEN_ADDR :8085 The address the server will listen on
WITNESS_WEBHOOK_ENABLE_TLS false If true, witness-webhook will listen with TLS enabled
WITNESS_WEBHOOK_TLS_CERT Path to the TLS certificate to use
WITNESS_WEBHOOK_TLS_KEY Path to the TLS key to use
WITNESS_WEBHOOK_TLS_SKIP_VERIFY false If true, disables certificate and host name verification when establishing TLS connections. DO NOT RUN IN PRODUCTION.

YAML Config

A sample config file follows:

archivistaUrl: https://archivista.localhost
attestationDirectory: /tmp
webhooks:
  webhook1:
    type: github
    options:
      secret-file-path: /githubwebhooksecret
    signer: kms
    signerOptions:
      ref: hashivault://testkey
      hashivault-addr: https://somevaultinstance:8082

This config defines one webhook named webhook1. The server will listen for webhooks from Github at http://host:8085/webhook/webhook1. Attestations from this webhook will be signed by a KMS signer that points to a Vault transit key named testkey.

Signed attestations will be pushed to an Archivista instance at https://archivista.localhost. They will also be stored on disk at /tmp. If archivistaUrl or attestationDirectory are left blank, witness-webhook will not attempt to output attestations to the respective destinations.

For a list of available signers, take a look at the signers provided by go-witness. All options in signerOptions will be forwarded to the specified signer provider. This section will be updated to include the available signers and options soon.

Currently the available webhook handlers are:

Github

Option Default Value Description
secret-file-path Path to the file containing the secret used to verify webhooks from Github