ci: switch from SLSA provenance to actions/attest with subject-path (#377)

Author: keelerm84

.github/actions/publish/action.yml

@@ -4,10 +4,6 @@ inputs:
   dry_run:
     description: 'Is this a dry run. If so no package will be published.'
     required: true
-outputs:
-  gem-hash:
-    description: "base64-encoded sha256 hashes of distribution files"
-    value: ${{ steps.gem-hash.outputs.gem-hash }}
 
 runs:
   using: composite
@@ -17,12 +13,6 @@ runs:
         pattern: 'gems-*'
         merge-multiple: true
 
-    - name: Hash gem for provenance
-      id: gem-hash
-      shell: bash
-      run: |
-        echo "gem-hash=$(sha256sum launchdarkly-server-sdk-*.gem | base64 -w0)" >> "$GITHUB_OUTPUT"
-
     - name: Publish Library
       shell: bash
       if: ${{ inputs.dry_run == 'false' }}

.github/workflows/manual-publish.yml

@@ -22,12 +22,10 @@ jobs:
     runs-on: ubuntu-latest
     needs: ["build-ruby-gem", "build-jruby-gem"]
 
-    outputs:
-      gem-hash: ${{ steps.publish.outputs.gem-hash }}
-
     permissions:
       id-token: write # Needed if using OIDC to get release secrets.
       contents: write
+      attestations: write # Needed for actions/attest.
 
     steps:
       - uses: actions/checkout@v4
@@ -39,7 +37,7 @@ jobs:
 
       - uses: launchdarkly/gh-actions/actions/release-secrets@release-secrets-v1.2.0
         name: "Get rubygems API key"
-        if: ${{ !inputs.dry_run }}
+        if: ${{ format('{0}', inputs.dry_run) == 'false' }}
         with:
           aws_assume_role: ${{ vars.AWS_ROLE_ARN }}
           ssm_parameter_pairs: "/production/common/releasing/rubygems/api_key = GEM_HOST_API_KEY"
@@ -52,19 +50,12 @@ jobs:
           dry_run: ${{ inputs.dry_run }}
 
       - uses: ./.github/actions/publish-docs
-        if: ${{ !inputs.dry_run }}
+        if: ${{ format('{0}', inputs.dry_run) == 'false' }}
         with:
           token: ${{secrets.GITHUB_TOKEN}}
 
-  release-provenance:
-    needs: ["publish"]
-
-    permissions:
-      actions: read
-      id-token: write
-      contents: write
-
-    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0
-    with:
-      base64-subjects: "${{ needs.publish.outputs.gem-hash }}"
-      upload-assets: ${{ !inputs.dry_run }}
+      - name: Attest build provenance
+        if: ${{ format('{0}', inputs.dry_run) == 'false' }}
+        uses: actions/attest@v4
+        with:
+          subject-path: 'launchdarkly-server-sdk-*.gem'

.github/workflows/release-please.yml

@@ -15,7 +15,6 @@ jobs:
 
     outputs:
       release-created: ${{ steps.release.outputs.release_created }}
-      upload-tag-name: ${{ steps.release.outputs.tag_name }}
 
     steps:
       - uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4.4.0
@@ -40,12 +39,10 @@ jobs:
     needs: ["release-package", "build-ruby-gem", "build-jruby-gem"]
     if: ${{ needs.release-package.outputs.release-created == 'true' }}
 
-    outputs:
-      gem-hash: ${{ steps.publish.outputs.gem-hash }}
-
     permissions:
       id-token: write # Needed if using OIDC to get release secrets.
       contents: write # Contents and pull-requests are for release-please to make releases.
+      attestations: write # Needed for actions/attest.
 
     steps:
       - uses: actions/checkout@v4
@@ -72,17 +69,7 @@ jobs:
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
-  release-provenance:
-    needs: ["release-package", "publish"]
-    if: ${{ needs.release-package.outputs.release-created == 'true' }}
-
-    permissions:
-      actions: read
-      id-token: write
-      contents: write
-
-    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0
-    with:
-      base64-subjects: "${{ needs.publish.outputs.gem-hash }}"
-      upload-assets: true
-      upload-tag-name: ${{ needs.release-package.outputs.upload-tag-name }}
+      - name: Attest build provenance
+        uses: actions/attest@v4
+        with:
+          subject-path: 'launchdarkly-server-sdk-*.gem'

PROVENANCE.md

@@ -1,10 +1,10 @@
-## Verifying SDK build provenance with the SLSA framework
+## Verifying SDK build provenance with GitHub artifact attestations
 
-LaunchDarkly uses the [SLSA framework](https://slsa.dev/spec/v1.0/about) (Supply-chain Levels for Software Artifacts) to help developers make their supply chain more secure by ensuring the authenticity and build integrity of our published SDK packages.
+LaunchDarkly uses [GitHub artifact attestations](https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds) to help developers make their supply chain more secure by ensuring the authenticity and build integrity of our published SDK packages.
 
-As part of [SLSA requirements for level 3 compliance](https://slsa.dev/spec/v1.0/requirements), LaunchDarkly publishes provenance about our SDK package builds using [GitHub's generic SLSA3 provenance generator](https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/generic/README.md#generation-of-slsa3-provenance-for-arbitrary-projects) for distribution alongside our packages. These attestations are available for download from the GitHub release page for the release version under Assets > `multiple-provenance.intoto.jsonl`.
+LaunchDarkly publishes provenance about our SDK package builds using [GitHub's `actions/attest` action](https://github.com/actions/attest). These attestations are stored in GitHub's attestation API and can be verified using the [GitHub CLI](https://cli.github.com/).
 
-To verify SLSA provenance attestations, we recommend using [slsa-verifier](https://github.com/slsa-framework/slsa-verifier). Example usage for verifying SDK packages is included below:
+To verify build provenance attestations, we recommend using the [GitHub CLI `attestation verify` command](https://cli.github.com/manual/gh_attestation_verify). Example usage for verifying SDK packages is included below:
 
 <!-- x-release-please-start-version -->
 ```
@@ -17,27 +17,33 @@ SDK_VERSION=8.13.0
 # Download gem
 $ gem fetch launchdarkly-server-sdk -v $SDK_VERSION
 
-# Download provenance from Github release
-$ curl --location -O \
-  https://github.com/launchdarkly/ruby-server-sdk/releases/download/${SDK_VERSION}/launchdarkly-server-sdk-${SDK_VERSION}.gem.intoto.jsonl
-
-# Run slsa-verifier to verify provenance against package artifacts 
-$ slsa-verifier verify-artifact \
---provenance-path launchdarkly-server-sdk-${SDK_VERSION}.gem.intoto.jsonl \
---source-uri github.com/launchdarkly/ruby-server-sdk \
-launchdarkly-server-sdk-${SDK_VERSION}.gem
+# Verify provenance using the GitHub CLI
+$ gh attestation verify launchdarkly-server-sdk-${SDK_VERSION}.gem --owner launchdarkly
 ```
 
 Below is a sample of expected output.
 
 ```
-Verified signature against tlog entry index 78214752 at URL: https://rekor.sigstore.dev/api/v1/log/entries/24296fb24b8ad77ab941c118ef7e0b2d656b962a0d670c6ac91cfa37d07b7b121ae560b00a978ecf
-Verified build using builder "https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@refs/tags/v1.7.0" at commit f43b3ad834103fdc282652efbfe4963e8dfa737b
-Verifying artifact launchdarkly-server-sdk-8.3.0.gem: PASSED
+Loaded digest sha256:... for file://launchdarkly-server-sdk-8.13.0.gem
+Loaded 1 attestation from GitHub API
+
+The following policy criteria will be enforced:
+- Predicate type must match:................ https://slsa.dev/provenance/v1
+- Source Repository Owner URI must match:... https://github.com/launchdarkly
+- Subject Alternative Name must match regex: (?i)^https://github.com/launchdarkly/
+- OIDC Issuer must match:................... https://token.actions.githubusercontent.com
+
+✓ Verification succeeded!
+
+The following 1 attestation matched the policy criteria
 
-PASSED: Verified SLSA provenance
+- Attestation #1
+  - Build repo:..... launchdarkly/ruby-server-sdk
+  - Build workflow:. .github/workflows/release-please.yml
+  - Signer repo:.... launchdarkly/ruby-server-sdk
+  - Signer workflow: .github/workflows/release-please.yml
 ```
 
-Alternatively, to verify the provenance manually, the SLSA framework specifies [recommendations for verifying build artifacts](https://slsa.dev/spec/v1.0/verifying-artifacts) in their documentation.
+For more information, see [GitHub's documentation on verifying artifact attestations](https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds#verifying-artifact-attestations-with-the-github-cli).
 
-**Note:** These instructions do not apply when building our SDKs from source. 
+**Note:** These instructions do not apply when building our SDKs from source.  

README.md

@@ -43,7 +43,7 @@ We encourage pull requests and other contributions from the community. Check out
 Verifying SDK build provenance with the SLSA framework
 ------------
 
-LaunchDarkly uses the [SLSA framework](https://slsa.dev/spec/v1.0/about) (Supply-chain Levels for Software Artifacts) to help developers make their supply chain more secure by ensuring the authenticity and build integrity of our published SDK packages. To learn more, see the [provenance guide](PROVENANCE.md). 
+LaunchDarkly uses the [SLSA framework](https://slsa.dev/spec/v1.0/about) (Supply-chain Levels for Software Artifacts) to help developers make their supply chain more secure by ensuring the authenticity and build integrity of our published SDK packages. To learn more, see the [provenance guide](PROVENANCE.md).
 
 About LaunchDarkly
 -----------

release-please-config.json

@@ -6,7 +6,10 @@
       "versioning": "default",
       "include-component-in-tag": false,
       "include-v-in-tag": false,
-      "extra-files": ["PROVENANCE.md", "lib/ldclient-rb/version.rb"]
+      "extra-files": [
+        "PROVENANCE.md",
+        "lib/ldclient-rb/version.rb"
+      ]
     }
   }
 }