Add attestation predicates for GitLab and GitHub

[simonbaird]

Use the CI_TYPE var to decide which one to use.

Filling in more useful content is still to do, but I want to merge this early to solidify the selection mechanism, and confirm things are working as expected.

Ref: EC-987

[simonbaird]

I tested this locally, something like this:

# Run a local build pipeline with CI_TYPE set
export CI_TYPE=gitlab && source env.sh && ./build-pipeline.sh

# Copy/paste the image ref from the build pipeline output
IMG=quay.io/sbaird/bootstrap:gitlab-84a0979b61f46b77e315042052c0e73403063bda

# See if it looks right. Check the .predicate.buildDefinition.buildType in particular
cosign download attestation $IMG | jq '.payload|@base64d|fromjson'

[chmeliik]

Both GitHub and GitLab seem to have support for generating actual tamper-proof attestations, should we use that instead?

https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds#generating-artifact-attestations-for-your-builds
https://about.gitlab.com/blog/2022/11/30/achieve-slsa-level-2-compliance-with-gitlab/#how-to-generate-artifact-metadata-with-the-gitlab-runner

[jduimovich]

Both GitHub and GitLab seem to have support for generating actual tamper-proof attestations, should we use that instead?

https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds#generating-artifact-attestations-for-your-builds https://about.gitlab.com/blog/2022/11/30/achieve-slsa-level-2-compliance-with-gitlab/#how-to-generate-artifact-metadata-with-the-gitlab-runner

Yes, I think eventually we need to use these as they will be standard.
We may also need to add additional attestations (unknown)
We'd need to update the EC policy to be able to read and validate these.

[simonbaird]

Both GitHub and GitLab seem to have support for generating actual tamper-proof attestations, should we use that instead?

https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds#generating-artifact-attestations-for-your-builds https://about.gitlab.com/blog/2022/11/30/achieve-slsa-level-2-compliance-with-gitlab/#how-to-generate-artifact-metadata-with-the-gitlab-runner

Yeah agreed, I think we'll look at that in later PRs.