Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for passing multiple subject-name/subject-digest pairs #103

Open
vlsi opened this issue Jun 6, 2024 · 2 comments
Open

Add support for passing multiple subject-name/subject-digest pairs #103

vlsi opened this issue Jun 6, 2024 · 2 comments
Labels
feature-request New feature or request

Comments

@vlsi
Copy link

vlsi commented Jun 6, 2024

For security reasons, id-token: write, attestations: write and other privilege usages should be minimized, so the privileges should not exist for code that performs "build" steps.

In other words, the best usage would be splitting the build+attest into separate steps:

  1. build artifacts (without id-token: write)
  2. attest the results

However, then the users would have to transfer the artifacts from build to the attest job.
Of course they can make a zip file, publish it from "build artifacts", download it in the attest job, and perform the attestation.
That would be wasteful though as the only needed bit is SHA of the file, so it would be better to generate a list of filename-checksum pairs in the "build artifact" job, and use the list in "attest the results" job.

What do you think of adding @actions/upload-checksums action that would generate checksums for the specified files. Then @actions/attest-build-provenance could use the list and generate the attestations for them?

@aalmiray
Copy link

aalmiray commented Jun 7, 2024

FWIW subject-path already supports multiple subjects though it does not seem to be documented as such.
It would also be great if a file containing subject paths were to be supported as input. Specifically JReleaser computes a list of release assets that should be attested

https://jreleaser.org/guide/early-access/reference/catalog/github.html

@bdehamer
Copy link
Collaborator

@vlsi this seems like a useful feature (and we've received a few other similar requests already). We'll consider this for the next round of improvements to the attestation actions. Thanks!

@bdehamer bdehamer added the feature-request New feature or request label Jun 11, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
feature-request New feature or request
Projects
None yet
Development

No branches or pull requests

3 participants