Add SLSA v0.1 hermetic build evidence example

Signed-off-by: Marcela Melara <[email protected]>

README.md

@@ -27,6 +27,13 @@ Read the [usage doc] for instructions on setup and tool invocation.
 We encourage you to gain a basic understanding of the [SCAI specification]
 before using the scai-generator CLI tools in this repo.
 
+## Disclaimer
+
+While the tools in this repo are conformant to the
+[in-toto Attestation Framework], they do not generate **authenticated** SCAI
+attestations. The example use cases in this repo are only provided for
+illustrative purposes.
+
 [in-toto Attestation Framework]: https://github.com/in-toto/attestation/tree/main/spec
 [intro doc]: docs/intro.md
 [usage doc]: docs/usage.md

examples/README.md

@@ -4,6 +4,7 @@ This directory contains examples for SCAI use cases:
 
 * [Binary attributes](./gcc-helloworld)
 * [Build process attributes](./sbom+slsa)
+* [Build environment attributes](./hermetic-evidence)
 * [Build platform attributes](./secure-boot)
 
 ## Usage
@@ -17,4 +18,7 @@ Each directory contains a script to run the example:
 
 The resulting metadata will be stored in the respective `metadata/` directory.
 
+:: warn :: The in-toto attestations generated for these examples are not
+digitally signed, and are only provided for demo purposes.
+
 [setup instructions]: ../docs/usage.md

examples/gcc-helloworld/README.md

@@ -1,5 +1,11 @@
-# Binary attributes example
+# Build environment attributes
 
-This example shows how to capture fine-grained binary properties during
-the compilation of a hello-world program based on the gcc flags used for a
-given build.
+This example shows how SCAI can be used to capture information as evidence for
+other supply chain metadata. Specifically, this example captures a run-time
+trace of a SLSA builder, and uses this log as evidence for the "hermetic"
+requirement of [SLSA v0.1].
+
+The SLSA Provenance and strace log files used in this example wer generated
+using [this workflow]. 
+
+[this workflow]: https://github.com/marcelamelara/private-data-objects/blob/generate-swsc-build-metadata/.github/workflows/ci-slsa3-tracing.yaml

examples/hermetic-evidence/README.md

@@ -0,0 +1,62 @@
+# Build environment attributes
+
+This example shows how SCAI can be used to capture information as evidence for
+other supply chain metadata. Specifically, this example captures a run-time
+trace of a SLSA builder, and uses this log as evidence for the [hermetic]
+requirement of the SLSA v0.1 spec.
+
+The SLSA Provenance and strace log files used in this example were generated
+using [this workflow].
+
+## A negative test
+
+The SLSA build environment used to generate the metadata in this
+example is not configured to support hermetic builds, so the included log
+should not be considered valid evidence for the claimed `IsHermeticBuild`
+attribute in the SCAI attribute assertion.
+
+## Generated SCAI attestation
+
+```jsonc
+{
+    "_type": "https://in-toto.io/Statement/v1",
+    "subject": [
+        {
+            "name": "pdo_client_wawaka",
+            "digest": {
+                "sha256": "9b151e8b47a372bb686a441349d981ebf38951d70c4e7bf4669672651da7d33e"
+            }
+        }
+    ],
+    "predicateType": "https://in-toto.io/attestation/scai/attribute-report/v0.2",
+    "predicate": {
+        "attributes": [
+            {
+                "attribute": "IsHermeticBuild",
+                "target": {
+                    "name": "pdo_client_wawaka.provenance.json",
+                    "digest": {
+                        "sha256": "d094023e47dadedb5591d70bf203b967daa1e0784b29135053e410e6627ab261"
+                    },
+                    "downloadLocation": "https://github.com/marcelamelara/private-data-objects/suites/15001861846/artifacts/856214822",
+                    "mediaType": "application/vnd.in-toto.provenance+json"
+                },
+                "evidence": {
+                    "name": "strace.log",
+                    "digest": {
+                        "sha256": "1fbd9b1a3b867657666edf7ac1f17a3cad6ff691364ab46848ca5f49720688a8"
+                    },
+                    "downloadLocation": "https://github.com/marcelamelara/private-data-objects/suites/15001861846/artifacts/856214824",
+                    "mediaType": "text/plain",
+                    "annotations": {
+                        "expectedResult": "fail"
+                    }
+                }
+            }
+        ]
+    }
+}
+```
+
+[hermetic]: https://slsa.dev/spec/v0.1/requirements#hermetic
+[this workflow]: https://github.com/marcelamelara/private-data-objects/blob/generate-swsc-build-metadata/.github/workflows/ci-slsa3-tracing.yaml

examples/hermetic-evidence/metadata/container-img-desc.json

@@ -0,0 +1 @@
+{"name": "pdo_client_wawaka", "digest": {"sha256": "9b151e8b47a372bb686a441349d981ebf38951d70c4e7bf4669672651da7d33e"}}

examples/hermetic-evidence/metadata/hermetic-annotation.json

@@ -0,0 +1 @@
+{"expectedResult": "fail"}

examples/hermetic-evidence/metadata/hermetic-build.scai.json

@@ -0,0 +1,38 @@
+{
+    "_type": "https://in-toto.io/Statement/v1",
+    "subject": [
+        {
+            "name": "pdo_client_wawaka",
+            "digest": {
+                "sha256": "9b151e8b47a372bb686a441349d981ebf38951d70c4e7bf4669672651da7d33e"
+            }
+        }
+    ],
+    "predicateType": "https://in-toto.io/attestation/scai/attribute-report/v0.2",
+    "predicate": {
+        "attributes": [
+            {
+                "target": {
+                    "mediaType": "application/vnd.in-toto.provenance+json",
+                    "digest": {
+                        "sha256": "d094023e47dadedb5591d70bf203b967daa1e0784b29135053e410e6627ab261"
+                    },
+                    "downloadLocation": "https://github.com/marcelamelara/private-data-objects/suites/15001861846/artifacts/856214822",
+                    "name": "pdo_client_wawaka.provenance.json"
+                },
+                "evidence": {
+                    "mediaType": "text/plain",
+                    "digest": {
+                        "sha256": "1fbd9b1a3b867657666edf7ac1f17a3cad6ff691364ab46848ca5f49720688a8"
+                    },
+                    "annotations": {
+                        "expectedResult": "fail"
+                    },
+                    "downloadLocation": "https://github.com/marcelamelara/private-data-objects/suites/15001861846/artifacts/856214824",
+                    "name": "strace.log"
+                },
+                "attribute": "IsHermeticBuild"
+            }
+        ]
+    }
+}

examples/hermetic-evidence/metadata/is-hermetic-assertion.json

@@ -0,0 +1,22 @@
+{
+    "attribute": "IsHermeticBuild",
+    "target": {
+        "name": "pdo_client_wawaka.provenance.json",
+        "digest": {
+            "sha256": "d094023e47dadedb5591d70bf203b967daa1e0784b29135053e410e6627ab261"
+        },
+        "downloadLocation": "https://github.com/marcelamelara/private-data-objects/suites/15001861846/artifacts/856214822",
+        "mediaType": "application/vnd.in-toto.provenance+json"
+    },
+    "evidence": {
+        "name": "strace.log",
+        "digest": {
+            "sha256": "1fbd9b1a3b867657666edf7ac1f17a3cad6ff691364ab46848ca5f49720688a8"
+        },
+        "downloadLocation": "https://github.com/marcelamelara/private-data-objects/suites/15001861846/artifacts/856214824",
+        "mediaType": "text/plain",
+        "annotations": {
+            "expectedResult": "fail"
+        }
+    }
+}

examples/hermetic-evidence/metadata/pdo_client_wawaka.provenance.json

@@ -0,0 +1 @@
+{"_type":"https://in-toto.io/Statement/v0.1","predicateType":"https://slsa.dev/provenance/v0.2","subject":[{"name":"pdo_client_wawaka","digest":{"sha256":"03413b4ecb73bba78a71afaf41ac9e921a14b307c9f18fe13344774723a20d82"}}],"predicate":{"builder":{"id":"https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@refs/tags/v1.7.0"},"buildType":"https://github.com/slsa-framework/slsa-github-generator/generic@v1","invocation":{"configSource":{"uri":"git+https://github.com/marcelamelara/private-data-objects@refs/heads/generate-swsc-build-metadata","digest":{"sha1":"89ea53b883573c6295d8ee63ed7aa1e0d14c78e1"},"entryPoint":".github/workflows/ci-slsa3-tracing.yaml"},"parameters":{},"environment":{"github_actor":"marcelamelara","github_actor_id":"93797898","github_base_ref":"","github_event_name":"push","github_event_payload":{"after":"89ea53b883573c6295d8ee63ed7aa1e0d14c78e1","base_ref":null,"before":"81f0ea96ae79436cd3b407caf866c49886895788","commits":[{"author":{"email":"[email protected]","name":"Marcela Melara","username":"marcelamelara"},"committer":{"email":"[email protected]","name":"Marcela Melara","username":"marcelamelara"},"distinct":true,"id":"89ea53b883573c6295d8ee63ed7aa1e0d14c78e1","message":"Fix docker inspect command\n\nSigned-off-by: Marcela Melara \[email protected]\u003e","timestamp":"2023-08-10T16:22:31-07:00","tree_id":"ea7da4d89aec80ac777169bb0521fa44dd86f61e","url":"https://github.com/marcelamelara/private-data-objects/commit/89ea53b883573c6295d8ee63ed7aa1e0d14c78e1"}],"compare":"https://github.com/marcelamelara/private-data-objects/compare/81f0ea96ae79...89ea53b88357","created":false,"deleted":false,"forced":true,"head_commit":{"author":{"email":"[email protected]","name":"Marcela Melara","username":"marcelamelara"},"committer":{"email":"[email protected]","name":"Marcela Melara","username":"marcelamelara"},"distinct":true,"id":"89ea53b883573c6295d8ee63ed7aa1e0d14c78e1","message":"Fix docker inspect command\n\nSigned-off-by: Marcela Melara \[email protected]\u003e","timestamp":"2023-08-10T16:22:31-07:00","tree_id":"ea7da4d89aec80ac777169bb0521fa44dd86f61e","url":"https://github.com/marcelamelara/private-data-objects/commit/89ea53b883573c6295d8ee63ed7aa1e0d14c78e1"},"pusher":{"email":"[email protected]","name":"marcelamelara"},"ref":"refs/heads/generate-swsc-build-metadata","repository":{"allow_forking":true,"archive_url":"https://api.github.com/repos/marcelamelara/private-data-objects/{archive_format}{/ref}","archived":false,"assignees_url":"https://api.github.com/repos/marcelamelara/private-data-objects/assignees{/user}","blobs_url":"https://api.github.com/repos/marcelamelara/private-data-objects/git/blobs{/sha}","branches_url":"https://api.github.com/repos/marcelamelara/private-data-objects/branches{/branch}","clone_url":"https://github.com/marcelamelara/private-data-objects.git","collaborators_url":"https://api.github.com/repos/marcelamelara/private-data-objects/collaborators{/collaborator}","comments_url":"https://api.github.com/repos/marcelamelara/private-data-objects/comments{/number}","commits_url":"https://api.github.com/repos/marcelamelara/private-data-objects/commits{/sha}","compare_url":"https://api.github.com/repos/marcelamelara/private-data-objects/compare/{base}...{head}","contents_url":"https://api.github.com/repos/marcelamelara/private-data-objects/contents/{+path}","contributors_url":"https://api.github.com/repos/marcelamelara/private-data-objects/contributors","created_at":1580158534,"default_branch":"main","deployments_url":"https://api.github.com/repos/marcelamelara/private-data-objects/deployments","description":"The Private Data Objects lab provides technology for confidentiality-preserving, off-chain smart contracts.","disabled":false,"downloads_url":"https://api.github.com/repos/marcelamelara/private-data-objects/downloads","events_url":"https://api.github.com/repos/marcelamelara/private-data-objects/events","fork":true,"forks":1,"forks_count":1,"forks_url":"https://api.github.com/repos/marcelamelara/private-data-objects/forks","full_name":"marcelamelara/private-data-objects","git_commits_url":"https://api.github.com/repos/marcelamelara/private-data-objects/git/commits{/sha}","git_refs_url":"https://api.github.com/repos/marcelamelara/private-data-objects/git/refs{/sha}","git_tags_url":"https://api.github.com/repos/marcelamelara/private-data-objects/git/tags{/sha}","git_url":"git://github.com/marcelamelara/private-data-objects.git","has_discussions":false,"has_downloads":true,"has_issues":false,"has_pages":false,"has_projects":true,"has_wiki":true,"homepage":null,"hooks_url":"https://api.github.com/repos/marcelamelara/private-data-objects/hooks","html_url":"https://github.com/marcelamelara/private-data-objects","id":236592908,"is_template":false,"issue_comment_url":"https://api.github.com/repos/marcelamelara/private-data-objects/issues/comments{/number}","issue_events_url":"https://api.github.com/repos/marcelamelara/private-data-objects/issues/events{/number}","issues_url":"https://api.github.com/repos/marcelamelara/private-data-objects/issues{/number}","keys_url":"https://api.github.com/repos/marcelamelara/private-data-objects/keys{/key_id}","labels_url":"https://api.github.com/repos/marcelamelara/private-data-objects/labels{/name}","language":"C++","languages_url":"https://api.github.com/repos/marcelamelara/private-data-objects/languages","license":{"key":"apache-2.0","name":"Apache License 2.0","node_id":"MDc6TGljZW5zZTI=","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0"},"master_branch":"main","merges_url":"https://api.github.com/repos/marcelamelara/private-data-objects/merges","milestones_url":"https://api.github.com/repos/marcelamelara/private-data-objects/milestones{/number}","mirror_url":null,"name":"private-data-objects","node_id":"MDEwOlJlcG9zaXRvcnkyMzY1OTI5MDg=","notifications_url":"https://api.github.com/repos/marcelamelara/private-data-objects/notifications{?since,all,participating}","open_issues":0,"open_issues_count":0,"owner":{"avatar_url":"https://avatars.githubusercontent.com/u/93797898?v=4","email":"[email protected]","events_url":"https://api.github.com/users/marcelamelara/events{/privacy}","followers_url":"https://api.github.com/users/marcelamelara/followers","following_url":"https://api.github.com/users/marcelamelara/following{/other_user}","gists_url":"https://api.github.com/users/marcelamelara/gists{/gist_id}","gravatar_id":"","html_url":"https://github.com/marcelamelara","id":93797898,"login":"marcelamelara","name":"marcelamelara","node_id":"U_kgDOBZc-Cg","organizations_url":"https://api.github.com/users/marcelamelara/orgs","received_events_url":"https://api.github.com/users/marcelamelara/received_events","repos_url":"https://api.github.com/users/marcelamelara/repos","site_admin":false,"starred_url":"https://api.github.com/users/marcelamelara/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/marcelamelara/subscriptions","type":"User","url":"https://api.github.com/users/marcelamelara"},"private":false,"pulls_url":"https://api.github.com/repos/marcelamelara/private-data-objects/pulls{/number}","pushed_at":1691709763,"releases_url":"https://api.github.com/repos/marcelamelara/private-data-objects/releases{/id}","size":3391,"ssh_url":"[email protected]:marcelamelara/private-data-objects.git","stargazers":0,"stargazers_count":0,"stargazers_url":"https://api.github.com/repos/marcelamelara/private-data-objects/stargazers","statuses_url":"https://api.github.com/repos/marcelamelara/private-data-objects/statuses/{sha}","subscribers_url":"https://api.github.com/repos/marcelamelara/private-data-objects/subscribers","subscription_url":"https://api.github.com/repos/marcelamelara/private-data-objects/subscription","svn_url":"https://github.com/marcelamelara/private-data-objects","tags_url":"https://api.github.com/repos/marcelamelara/private-data-objects/tags","teams_url":"https://api.github.com/repos/marcelamelara/private-data-objects/teams","topics":[],"trees_url":"https://api.github.com/repos/marcelamelara/private-data-objects/git/trees{/sha}","updated_at":"2022-01-11T01:04:34Z","url":"https://github.com/marcelamelara/private-data-objects","visibility":"public","watchers":0,"watchers_count":0,"web_commit_signoff_required":false},"sender":{"avatar_url":"https://avatars.githubusercontent.com/u/93797898?v=4","events_url":"https://api.github.com/users/marcelamelara/events{/privacy}","followers_url":"https://api.github.com/users/marcelamelara/followers","following_url":"https://api.github.com/users/marcelamelara/following{/other_user}","gists_url":"https://api.github.com/users/marcelamelara/gists{/gist_id}","gravatar_id":"","html_url":"https://github.com/marcelamelara","id":93797898,"login":"marcelamelara","node_id":"U_kgDOBZc-Cg","organizations_url":"https://api.github.com/users/marcelamelara/orgs","received_events_url":"https://api.github.com/users/marcelamelara/received_events","repos_url":"https://api.github.com/users/marcelamelara/repos","site_admin":false,"starred_url":"https://api.github.com/users/marcelamelara/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/marcelamelara/subscriptions","type":"User","url":"https://api.github.com/users/marcelamelara"}},"github_head_ref":"","github_ref":"refs/heads/generate-swsc-build-metadata","github_ref_type":"branch","github_repository_id":"236592908","github_repository_owner":"marcelamelara","github_repository_owner_id":"93797898","github_run_attempt":"1","github_run_id":"5827089341","github_run_number":"6","github_sha1":"89ea53b883573c6295d8ee63ed7aa1e0d14c78e1"}},"metadata":{"buildInvocationID":"5827089341-1","completeness":{"parameters":true,"environment":false,"materials":false},"reproducible":false},"materials":[{"uri":"git+https://github.com/marcelamelara/private-data-objects@refs/heads/generate-swsc-build-metadata","digest":{"sha1":"89ea53b883573c6295d8ee63ed7aa1e0d14c78e1"}}]}}