a078fba81d
Adds a new rego builtin `attest.internals.reproducible_git_checksum`. This is needed for verifying DOI provenance, see https://github.com/docker/doi-image-policy/blob/main/slsa.md#doi-build-reproducible-git-checksum. We use https://github.com/go-git/go-git for as much of this as possible, but it doesn't support the actual archive operation, so we shell out to `git` for that. There is some similar unexported code in bashbrew, and we should probably be using the same code in the build process as we are here. I'll create a follow-up ticket to sort that out.
27 lines
1.2 KiB
Rego
27 lines
1.2 KiB
Rego
package git_checksum_test
|
|
|
|
import rego.v1
|
|
|
|
test_reproducible_git_checksum if {
|
|
# test case from https://github.com/docker-library/meta/blob/5c3af85f2c735ea2b689271cb64ff38bcca28bec/builds.json
|
|
# build id: e1dc43214da28419a105a665f994080e83093c6849fe2851344350b8c264afd1
|
|
# grab with `curl https://raw.githubusercontent.com/docker-library/meta/5c3af85f2c735ea2b689271cb64ff38bcca28bec/builds.json | jq '."e1dc43214da28419a105a665f994080e83093c6849fe2851344350b8c264afd1"'`
|
|
|
|
repo := "https://github.com/docker-library/busybox.git"
|
|
commit := "91f9975d4bb91d7c916ef74de77911d961ac9b75"
|
|
dir := "latest/glibc/amd64"
|
|
expected_checksum := "48d47b7ee1617a53291a76942cd240773fbb59daaa874007c6d16cb3125d63c2"
|
|
|
|
result := attest.internals.reproducible_git_checksum(repo, commit, dir)
|
|
actual_checksum := result.value
|
|
actual_checksum == expected_checksum
|
|
|
|
invalid_commit := "0000000000000000000000000000000000000000"
|
|
bad_commit_result := attest.internals.reproducible_git_checksum(repo, invalid_commit, dir)
|
|
contains(bad_commit_result.error, "failed to fetch")
|
|
|
|
invalid_dir := "not_a_real_dir"
|
|
bad_dir_result := attest.internals.reproducible_git_checksum(repo, commit, invalid_dir)
|
|
contains(bad_dir_result.error, "not a valid object name")
|
|
}
|