[feature][nodejs] SLSA v1.0 support

[ianlewis]

npm now supports SLSA v1.0 so we should support generating v1.0 by default in the builder.

• Support for SLSA v1.0 in Node.js builder by default
• e2e tests for Node.js builder with SLSA v1.0

[ianlewis]

Looks like npm does some validation on the server side that isn't compatible with SLSA v1.0 provenance generated BYOB

npm ERR! code E422
npm ERR! 422 Unprocessable Entity - PUT https://registry.npmjs.org/@ianlewis%2factions-test - Error verifying sigstore provenance bundle: Invalid GitHub Actions SLSA v1 provenance predicate:
npm ERR! buildDefinition.buildType: https://github.com/slsa-framework/slsa-github-generator/delegator-generic@v0 does not match expected value for buildType: https://slsa-framework.github.io/github-actions-buildtypes/workflow/v1,
npm ERR! buildDefinition.externalParameters.workflow.ref: <empty> does not match expected value for SourceRepositoryRef: refs/tags/v0.1.160,
npm ERR! buildDefinition.externalParameters.workflow.repository: <empty> does not match expected value for SourceRepositoryURI: https://github.com/ianlewis/actions-test,
npm ERR! buildDefinition.externalParameters.workflow.path: <empty> does not match expected value for BuildConfigURI: .github/workflows/nodejs.yml,
npm ERR! buildDefinition.internalParameters.github.event_name: <empty> does not match expected value for BuildTrigger: push,
npm ERR! buildDefinition.internalParameters.github.repository_id: <empty> does not match expected value for SourceRepositoryIdentifier: 474793590,
npm ERR! buildDefinition.internalParameters.github.repository_owner_id: <empty> does not match expected value for SourceRepositoryOwnerIdentifier: 49289,
npm ERR! runDetails.builder.id: https://github.com/ianlewis/slsa-github-generator/.github/workflows/builder_nodejs_slsa3.yml@refs/heads/nodejs-slsa-v10 does not match expected value for builderId: https://github.com/actions/runner/github-hosted

https://github.com/ianlewis/actions-test/actions/runs/5817446938/job/15772122301

This might be the kind of thing that could be solved by slsa-framework/slsa#940

/cc @steiza @MarkLodato @joshuagl

[MarkLodato]

There are two issues:

1. GitHub only accepts the one buildType. Standardize externalParameters for CI/CD builds slsa#940 could help here.
2. GitHub only accepts the one builder ID (and maybe public key identity). I'm not sure how to resolve this one.

[ianlewis]

Indeed.

I don't see anything about the key identity so far (it's actually different from the builder ID for BYOB) so fingers crossed there.

But yes, runDetails would be out of scope of slsa-framework/slsa#940

[laurentsimon]

sharing verification code (slsa-verifier?) is also a direction we could follow. It would consolidate logic verification in one codebase to help scaling across registries. (Example: Verification of GCB provenance is supported in slsa-verifier, but it's more work for each registry to implement this themselves).

[ianlewis]

It looks like they went with the structure we specified in the github-actions-buildtypes repo. If we update BYOB to follow that structure then the issues with internalParameters and externalParameters mostly go away.

npm ERR! buildDefinition.externalParameters.workflow.ref: <empty> does not match expected value for SourceRepositoryRef: refs/tags/v0.1.160,
npm ERR! buildDefinition.externalParameters.workflow.repository: <empty> does not match expected value for SourceRepositoryURI: https://github.com/ianlewis/actions-test,
npm ERR! buildDefinition.externalParameters.workflow.path: <empty> does not match expected value for BuildConfigURI: .github/workflows/nodejs.yml,
npm ERR! buildDefinition.internalParameters.github.event_name: <empty> does not match expected value for BuildTrigger: push,
npm ERR! buildDefinition.internalParameters.github.repository_id: <empty> does not match expected value for SourceRepositoryIdentifier: 474793590,
npm ERR! buildDefinition.internalParameters.github.repository_owner_id: <empty> does not match expected value for SourceRepositoryOwnerIdentifier: 49289,

[ianlewis]

@steiza @feelepxyz @kommendorkapten Is there a way that we can maybe loosen the SLSA v1.0 buildDefinition.buildType and runDetails.builder.id to allow our Node.js builder to publish provenance to the official npm registry? Right now it seems to validate against the npm CLI's values.

npm ERR! buildDefinition.buildType: https://github.com/slsa-framework/slsa-github-generator/delegator-generic@v0 does not match expected value for buildType: https://slsa-framework.github.io/github-actions-buildtypes/workflow/v1,
npm ERR! runDetails.builder.id: https://github.com/ianlewis/slsa-github-generator/.github/workflows/builder_nodejs_slsa3.yml@refs/heads/nodejs-slsa-v10 does not match expected value for builderId: https://github.com/actions/runner/github-hosted

[feelepxyz]

Is there a way that we can maybe loosen the SLSA v1.0 buildDefinition.buildType and runDetails.builder.id to allow our Node.js builder to publish provenance to the official npm registry?

Yes will take a look at this 👍

[feelepxyz]

Is there a way that we can maybe loosen the SLSA v1.0 buildDefinition.buildType and runDetails.builder.id to allow our Node.js builder to publish provenance to the official npm registry?

@ianlewis this should now be fixed! Let me know if this is working as expected.

[ianlewis]

I finally took another look at this today. Indeed the builder id error message isn't there anymore but we may still need to update our format for externalParameters and internalParameters to match what npm expects.

npm ERR! 422 Unprocessable Entity - PUT https://registry.npmjs.org/@ianlewis%2factions-test - Error verifying sigstore provenance bundle: Invalid GitHub Actions SLSA v1 provenance predicate:
npm ERR! buildDefinition.externalParameters.workflow.ref: <empty> does not match expected value for SourceRepositoryRef: refs/tags/v0.1.162,
npm ERR! buildDefinition.externalParameters.workflow.repository: <empty> does not match expected value for SourceRepositoryURI: https://github.com/ianlewis/actions-test,
npm ERR! buildDefinition.externalParameters.workflow.path: <empty> does not match expected value for BuildConfigURI: .github/workflows/nodejs.yml,
npm ERR! buildDefinition.internalParameters.github.event_name: <empty> does not match expected value for BuildTrigger: push,
npm ERR! buildDefinition.internalParameters.github.repository_id: <empty> does not match expected value for SourceRepositoryIdentifier: 474793590,
npm ERR! buildDefinition.internalParameters.github.repository_owner_id: <empty> does not match expected value for SourceRepositoryOwnerIdentifier: 49289

[ianlewis]

Probably I will need to refactor the generate-attestations action by moving some of the code into tscommon. This will allow me to create another generate-nodejs-attestations action which generates the SLSA in the way that npm expects without altering format for the rest of the BYOB workflows.