Skip to content

Latest commit

 

History

History
47 lines (33 loc) · 1.24 KB

README.md

File metadata and controls

47 lines (33 loc) · 1.24 KB

CLI for SLSA BuildEnv Track

This is a proof-of-concept for the OpenSSF SLSA draft Attested Build Environments (BuildEnv) track.

The CLI in this repo implements vTPM-based attestation and integrity checking of a Linux VM image. This repo also provides demo GHA workflows showcasing how to meet SLSA BuildEnv L1 and L2 (WIP).

How To Use

Generate the initramfs

From a fresh Ubuntu 20+ VM, install the initramfs scripts:

sudo initramfs/install.sh

Generate the initramfs:

sudo mkinitramfs -o image-attestation.img

Update GRUB

TODO

CLI

Requires Go 1.21+

TODOs

  • Implement DSSE signing for ref-values command
  • Modify verify command to use reference value attestations, rather than raw inputs
  • Document verifier VM attestation flow
  • Document private key config and signing attestation
  • Add binding attestation + signature for the job id
  • Add build image components for container-based build
  • Add verification of SLSA Provenance + VSA generation
  • Add verification of "boot" in container-based build environment
  • Add mock build platform
  • Add mock L3 container-based build environment deployment with HW TPM

Disclaimer

This project is not ready for production use.