feat: NVSHAS-9501 support SLSA L3 #27

holyspectral · 2024-10-08T16:27:11Z

Move the Jenkins build to GHA as dev.yml and dev-arm64.yml
Provide release.yml as SLSA-compliant release build.

flavio · 2024-10-09T07:42:56Z

From a quick look:

I would use a matrix to merge the arm64 and x86_64 jobs into a single file
The commit about the log levels doesn't belong to this PR

To make this feature work, add below secrets and variables to the repo: 1. DOCKER_REPO secret 2. DOCKER_USERNAME secret 3. DOCKER_PASSWORD secret 4. PRIME_REGISTRY secret 5. PRIME_REPO secret 6. PRIME_REGISTRY_USERNAME secret 7. PRIME_REGISTRY_PASSWORD secret 8. DEV_BUILD_REPOSITORY variable

holyspectral · 2024-10-09T14:14:21Z

@flavio Thanks for the comment!

I would use a matrix to merge the arm64 and x86_64 jobs into a single file

Yes I agree that will be much simple in the code level if we merge them into one file. There are two reasons why it's separate right now:

Many of our components don't support ARM64 right now, so the errors on ARM64 build shouldn't break AMD64 build.
ARM64 takes more time to build as it's emulated. Currently AMD64 build takes only 2.5 minutes, while ARM64 takes 18 mins. Having them separate will save my time to do the test.

I will revisit this once we setup GitHub-hosted ARM64 runners in neuvector, which should speed up the ARM64 build.

Also, according to GitHub blog, We expect to begin offering Arm runners for open source and personal accounts by the end of the year.. Hope folks can start using this in forks soon.

The commit about the log levels doesn't belong to this PR

Oops, it's fixed now. Thanks for noticing it.

pjbgf · 2024-10-09T16:12:45Z

build/Dockerfile

+
+RUN cd /usr/bin/ && rm -rf basename chcon chgrp chmod chown chroot cksum dd df dircolors dirname du install install-info join locale localedef mkdir mkfifo mknod mktemp paste pathchk readlink realpath sync smidiff smidump smilink smiquery smistrip smixlate tee tiemout tload top truncate unlink watch
+
+LABEL name="registry-adapter" \


Please note that by using BCI images, you may need to overwrite some specific labels, or you will end-up with labels from the base image instead. Here's more context.

Thanks. It's very good to know.

pjbgf · 2024-10-09T16:14:19Z

build/Dockerfile

+RUN cd /usr/bin/ && rm -rf basename chcon chgrp chmod chown chroot cksum dd df dircolors dirname du install install-info join locale localedef mkdir mkfifo mknod mktemp paste pathchk readlink realpath sync smidiff smidump smilink smiquery smistrip smixlate tee tiemout tload top truncate unlink watch
+
+LABEL name="registry-adapter" \
+      vendor="SuSE Security" \


Should this not be all capitals these days?

Suggested change

vendor="SuSE Security" \

vendor="SUSE Security" \

pjbgf · 2024-10-09T16:15:58Z

build/Dockerfile

-FROM neuvector/adapter_base:${BASE_IMAGE_TAG}
+#
+# Builder image
+FROM registry.suse.com/bci/golang:1.22.7 AS builder


Either lean on a higher level mutable tag, or add renovate/updatecli to ensure this is being kept up to date.

Suggested change

FROM registry.suse.com/bci/golang:1.22.7 AS builder

FROM registry.suse.com/bci/golang:1.22 AS builder

@jayhuang-suse any concern about this? I don't think Golang would bring breaking changes in minor update, so I'm okay with using 1.22.

pjbgf · 2024-10-09T16:19:13Z

build/Dockerfile

+COPY --from=base /chroot/ /
+COPY --from=builder /src/stage /
+
+RUN cd /usr/bin/ && rm -rf basename chcon chgrp chmod chown chroot cksum dd df dircolors dirname du install install-info join locale localedef mkdir mkfifo mknod mktemp paste pathchk readlink realpath sync smidiff smidump smilink smiquery smistrip smixlate tee tiemout tload top truncate unlink watch


This creates a new layer on the final image, so although the binaries won't be shipped, they would already be present on higher layers which translate in little to no gains in final image size. An alternative here, is to do this on an intermediate layer, and just copy that over to a final scratch image.

yeah this is the code that the current pipeline has. I will check to see if we should do it with SLSA scope or later. Thanks for letting us know!

pjbgf · 2024-10-09T16:20:00Z

Makefile

+	ifneq ($(DRONE_TAG),)
+		GIT_TAG = $(DRONE_TAG)


Suggested change

ifneq ($(DRONE_TAG),)

GIT_TAG = $(DRONE_TAG)

ifneq ($(GITHUB_TAG),)

GIT_TAG = $(GITHUB_TAG)

pjbgf · 2024-10-09T16:20:16Z

Makefile

+		DIRTY = -dirty
+	endif
+
+	# Prioritise DRONE_TAG for backwards compatibility. However, the git tag


Assuming that we are leaning on GitHub level tags.

Suggested change

# Prioritise DRONE_TAG for backwards compatibility. However, the git tag

# Prioritise GITHUB_TAG for backwards compatibility. However, the git tag

The code comes from cis-operator and I think that's for DRONE only. I will remove this part.

pjbgf · 2024-10-09T16:21:17Z

.github/workflows/release.yml

+      matrix:
+        include:
+          - platforms: linux/amd64,linux/arm64


If a single multi-arch image is to be published, this is not needed.

pjbgf · 2024-10-09T16:21:31Z

.github/workflows/release.yml

+      uses: rancher/ecm-distro-tools/actions/publish-image@master
+      with:
+        image: registry-adapter
+        tag: ${{ github.ref_name }}${{ matrix.tag-suffix }}


Same here:

Suggested change

tag: ${{ github.ref_name }}${{ matrix.tag-suffix }}

tag: ${{ github.ref_name }}

holyspectral · 2024-10-10T00:50:44Z

I will be working on the PR a little more. Closing it for now to prevent spam. :-)

holyspectral force-pushed the main branch from 1b64d2c to 60237f6 Compare October 8, 2024 20:46

holyspectral force-pushed the main branch from 60237f6 to 0792793 Compare October 9, 2024 14:05

pjbgf reviewed Oct 9, 2024

View reviewed changes

experiment: use arm64 runner

b62a6e4

holyspectral closed this Oct 10, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: NVSHAS-9501 support SLSA L3 #27

feat: NVSHAS-9501 support SLSA L3 #27

holyspectral commented Oct 8, 2024

flavio commented Oct 9, 2024

holyspectral commented Oct 9, 2024 •

edited

Loading

pjbgf Oct 9, 2024

holyspectral Oct 10, 2024

pjbgf Oct 9, 2024

pjbgf Oct 9, 2024

holyspectral Oct 10, 2024

pjbgf Oct 9, 2024

holyspectral Oct 10, 2024

pjbgf Oct 9, 2024

pjbgf Oct 9, 2024 •

edited

Loading

holyspectral Oct 10, 2024

pjbgf Oct 9, 2024

pjbgf Oct 9, 2024

holyspectral commented Oct 10, 2024


		RUN cd /usr/bin/ && rm -rf basename chcon chgrp chmod chown chroot cksum dd df dircolors dirname du install install-info join locale localedef mkdir mkfifo mknod mktemp paste pathchk readlink realpath sync smidiff smidump smilink smiquery smistrip smixlate tee tiemout tload top truncate unlink watch

		LABEL name="registry-adapter" \

	FROM registry.suse.com/bci/golang:1.22.7 AS builder
	FROM registry.suse.com/bci/golang:1.22 AS builder

	# Prioritise DRONE_TAG for backwards compatibility. However, the git tag
	# Prioritise GITHUB_TAG for backwards compatibility. However, the git tag

	tag: ${{ github.ref_name }}${{ matrix.tag-suffix }}
	tag: ${{ github.ref_name }}

feat: NVSHAS-9501 support SLSA L3 #27

feat: NVSHAS-9501 support SLSA L3 #27

Conversation

holyspectral commented Oct 8, 2024

flavio commented Oct 9, 2024

holyspectral commented Oct 9, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

pjbgf Oct 9, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

holyspectral commented Oct 10, 2024

holyspectral commented Oct 9, 2024 •

edited

Loading

pjbgf Oct 9, 2024 •

edited

Loading