extern/hishtory
1
0
Fork 0
mirror of https://github.com/ddworken/hishtory.git synced 2025-03-18 09:18:34 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add SLSA validation with current binary built by SLSA

Browse Source
This commit is contained in:
David Dworken 2024-03-24 21:48:01 -07:00
parent 0c3e515008
commit 59e8a6dd5b
No known key found for this signature in database
2 changed files with 2 additions and 2 deletions
.github/workflows
slsa-releaser.yml
scripts
actions-validate.py

1
.github/workflows/slsa-releaser.yml vendored
View File

@ -220,7 +220,6 @@ jobs:
export HISHTORY_TEST=1 export HISHTORY_TEST=1
curl https://hishtory.dev/install.py | python3 - curl https://hishtory.dev/install.py | python3 -
unset HISHTORY_TEST unset HISHTORY_TEST
# go build
python3 scripts/actions-validate.py python3 scripts/actions-validate.py
echo DONE > hishtory-release-validation-completed echo DONE > hishtory-release-validation-completed
- name: Release - name: Release

3
scripts/actions-validate.py
View File

@ -8,6 +8,7 @@ ALL_FILES = ['hishtory-linux-amd64', 'hishtory-linux-arm64', 'hishtory-darwin-am
def validate_slsa(hishtory_binary: str) -> None: def validate_slsa(hishtory_binary: str) -> None:
assert os.path.exists(hishtory_binary) assert os.path.exists(hishtory_binary)
subprocess.check_output(['chmod', "+x", hishtory_binary])
for filename in ALL_FILES: for filename in ALL_FILES:
try: try:
print(f"Validating {filename} with {hishtory_binary=}") print(f"Validating {filename} with {hishtory_binary=}")
@ -68,7 +69,7 @@ def main() -> None:
if "darwin" in filename: if "darwin" in filename:
validate_macos_signature(filename) validate_macos_signature(filename)
print("Starting validation of SLSA attestations") print("Starting validation of SLSA attestations")
# validate_slsa("./hishtory") # TODO: Re-enable validation using the local binary validate_slsa("./hishtory-darwin-amd64")
validate_slsa(os.path.expanduser("~/.hishtory/hishtory")) validate_slsa(os.path.expanduser("~/.hishtory/hishtory"))
print("Validating other metadata") print("Validating other metadata")
validate_hishtory_status("./hishtory-darwin-amd64", True) validate_hishtory_status("./hishtory-darwin-amd64", True)