Skip to content
Security release gate

Modernize PastureStack CLI #5

Sign in to view logs

Modernize PastureStack CLI

Modernize PastureStack CLI #5

Workflow file for this run

.github/workflows/security-release-gate.yml at 3b675c7
name: Security release gate
on:
workflow_dispatch:
push:
branches:
- 'verification/cli-*'
permissions:
contents: read
concurrency:
group: cli-security-${{ github.ref }}
cancel-in-progress: false
jobs:
build-test-scan:
runs-on: ubuntu-24.04
timeout-minutes: 75
env:
DAPPER_IMAGE: pasturestack/cli-dapper:${{ github.sha }}
RUNTIME_IMAGE: pasturestack/cli-runtime:${{ github.sha }}
TRIVY_IMAGE: aquasec/trivy:0.73.0@sha256:7cced7cae583819fc7806d4cbc0dbbc7cad18b99f7d3e235192e6da8c091045c
VERSION_OVERRIDE: 0.6.15
CROSS: 'true'
SKIP_IMAGE_BUILD: 'true'
steps:
- name: Check out candidate
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: 0
persist-credentials: false
- name: Record candidate identity
shell: bash
run: |
set -euo pipefail
test -z "$(git status --porcelain)"
mkdir -p evidence
git rev-parse HEAD > evidence/source-revision.txt
sha256sum Dockerfile.dapper package/Dockerfile ubuntu-apt.lock vendor.conf \
security/dapper.openvex.json > evidence/source-locks.sha256
- name: Build, test, validate, and package twice
shell: bash
run: |
set -euo pipefail
docker build \
--build-arg DAPPER_HOST_ARCH=amd64 \
--tag "$DAPPER_IMAGE" \
--file Dockerfile.dapper \
.
source_path="$GITHUB_WORKSPACE"
source_epoch="$(git show -s --format=%ct HEAD)"
run_ci() {
docker run --rm \
--volume "${source_path}:/go/src/github.com/PastureStack/cli" \
--volume /var/run/docker.sock:/var/run/docker.sock \
--env "DAPPER_UID=$(id -u)" \
--env "DAPPER_GID=$(id -g)" \
--env "GOCACHE=/tmp/go-build-cache-${GITHUB_RUN_ID}" \
--env "XDG_CONFIG_HOME=/tmp/go-config-${GITHUB_RUN_ID}" \
--env "GIT_CONFIG_GLOBAL=/tmp/gitconfig-${GITHUB_RUN_ID}" \
--env "VERSION_OVERRIDE=$VERSION_OVERRIDE" \
--env "CROSS=$CROSS" \
--env "SKIP_IMAGE_BUILD=$SKIP_IMAGE_BUILD" \
--env "SOURCE_DATE_EPOCH=${source_epoch}" \
"$DAPPER_IMAGE" ci
}
run_ci
artifact="dist/artifacts/0.6.15/pasturestack-linux-amd64-0.6.15.tar.gz"
test -s "$artifact"
find dist/artifacts/0.6.15 -type f -print0 \
| LC_ALL=C sort -z \
| xargs -0 sha256sum > /tmp/first-artifacts.sha256
rm -rf bin build dist
run_ci
find dist/artifacts/0.6.15 -type f -print0 \
| LC_ALL=C sort -z \
| xargs -0 sha256sum > /tmp/second-artifacts.sha256
diff -u /tmp/first-artifacts.sha256 /tmp/second-artifacts.sha256
./scripts/check-pasturestack-source
mkdir -p evidence/product
tar -xzf "$artifact" -C evidence/product --strip-components=1
test -x evidence/product/pasturestack
evidence/product/pasturestack --version | grep -F '0.6.15' >/dev/null
find dist/artifacts/0.6.15 -type f -print0 \
| LC_ALL=C sort -z \
| xargs -0 sha256sum > evidence/artifacts.sha256
docker run --rm --entrypoint go \
--volume "$PWD:/work:ro" \
"$DAPPER_IMAGE" \
version -m /work/evidence/product/pasturestack \
> evidence/product-go-version.txt
- name: Build and smoke-test runtime image
shell: bash
run: |
set -euo pipefail
docker build \
--build-arg IMAGE_VERSION="$VERSION_OVERRIDE" \
--tag "$RUNTIME_IMAGE" \
--file package/Dockerfile \
.
docker run --rm "$RUNTIME_IMAGE" --version | grep -F '0.6.15' >/dev/null
- name: Record resolved build inputs
shell: bash
run: |
set -euo pipefail
docker inspect "$DAPPER_IMAGE" > evidence/dapper-image-inspect.json
docker inspect "$RUNTIME_IMAGE" > evidence/runtime-image-inspect.json
docker run --rm --entrypoint sh "$DAPPER_IMAGE" -lc \
"printf 'package\\tversion\\n'; dpkg-query -W -f='\${binary:Package}\\t\${Version}\\n' | LC_ALL=C sort" \
> evidence/dapper-dpkg.tsv
docker run --rm --entrypoint sh "$RUNTIME_IMAGE" -lc \
"printf 'package\\tversion\\n'; dpkg-query -W -f='\${binary:Package}\\t\${Version}\\n' | LC_ALL=C sort" \
> evidence/runtime-dpkg.tsv
cp vendor.conf evidence/vendor.conf
cp ubuntu-apt.lock evidence/ubuntu-apt.lock
- name: Scan source, product, and build image
shell: bash
run: |
set -euo pipefail
docker pull "$TRIVY_IMAGE"
trivy_cache="$RUNNER_TEMP/trivy-cache"
source_tree="$(mktemp -d)"
trap 'rm -rf "$source_tree"' EXIT
mkdir -p "$trivy_cache"
git archive --format=tar HEAD | tar -xf - -C "$source_tree"
docker run --rm \
-v "$source_tree:/scan:ro" \
-v "$PWD/evidence:/evidence" \
-v "$trivy_cache:/root/.cache/trivy" \
"$TRIVY_IMAGE" fs \
--scanners vuln,secret --format json \
--output /evidence/source-security.json /scan
docker run --rm \
-v "$PWD/evidence:/evidence" \
-v "$trivy_cache:/root/.cache/trivy" \
"$TRIVY_IMAGE" rootfs \
--scanners vuln,secret --format json \
--output /evidence/product-security.json /evidence/product
docker run --rm \
-v /var/run/docker.sock:/var/run/docker.sock \
-v "$PWD:/work" -w /work \
-v "$trivy_cache:/root/.cache/trivy" \
"$TRIVY_IMAGE" image \
--scanners vuln,secret --format json \
--output /work/evidence/dapper-image-raw.json "$DAPPER_IMAGE"
docker run --rm \
-v /var/run/docker.sock:/var/run/docker.sock \
-v "$PWD:/work" -w /work \
-v "$trivy_cache:/root/.cache/trivy" \
"$TRIVY_IMAGE" image \
--scanners vuln,secret --format json \
--output /work/evidence/runtime-image-security.json "$RUNTIME_IMAGE"
jq -r '
.Results[]?.Vulnerabilities[]?
| select(.Severity == "CRITICAL" or .Severity == "HIGH")
| [.VulnerabilityID, .PkgIdentifier.PURL]
| @tsv
' evidence/dapper-image-raw.json | LC_ALL=C sort -u \
> /tmp/dapper-critical-high.tsv
jq -r '
.statements[]?
| select(
.status == "not_affected"
and .justification == "vulnerable_code_not_present"
)
| .vulnerability.name as $id
| .products[]?
| [$id, .["@id"]]
| @tsv
' security/dapper.openvex.json | LC_ALL=C sort -u \
> /tmp/dapper-vex.tsv
test -s /tmp/dapper-critical-high.tsv
diff -u /tmp/dapper-critical-high.tsv /tmp/dapper-vex.tsv
test "$(jq '.statements | length' security/dapper.openvex.json)" \
-eq "$(wc -l < /tmp/dapper-vex.tsv)"
jq -e '
all(
.statements[];
.status == "not_affected"
and .justification == "vulnerable_code_not_present"
and ((.impact_statement | type) == "string")
and ((.impact_statement | length) > 0)
)
' security/dapper.openvex.json >/dev/null
grep -F $'build\tCGO_ENABLED=0' evidence/product-go-version.txt >/dev/null
if grep -Eq '^linux-(image|modules)([-:]|[[:space:]])' evidence/dapper-dpkg.tsv; then
printf 'Unexpected Linux kernel runtime package in Dapper image\n' >&2
exit 1
fi
docker run --rm \
-v /var/run/docker.sock:/var/run/docker.sock \
-v "$PWD:/work" -w /work \
-v "$trivy_cache:/root/.cache/trivy" \
"$TRIVY_IMAGE" image \
--scanners vuln,secret \
--vex /work/security/dapper.openvex.json --show-suppressed \
--format json \
--output /work/evidence/dapper-image-applicable.json "$DAPPER_IMAGE"
docker run --rm \
-v "$source_tree:/scan:ro" \
-v "$PWD/evidence:/evidence" \
-v "$trivy_cache:/root/.cache/trivy" \
"$TRIVY_IMAGE" fs \
--format cyclonedx --output /evidence/source.cdx.json /scan
docker run --rm \
-v "$PWD/evidence:/evidence" \
-v "$trivy_cache:/root/.cache/trivy" \
"$TRIVY_IMAGE" rootfs \
--format cyclonedx --output /evidence/product.cdx.json /evidence/product
docker run --rm \
-v /var/run/docker.sock:/var/run/docker.sock \
-v "$PWD:/work" -w /work \
-v "$trivy_cache:/root/.cache/trivy" \
"$TRIVY_IMAGE" image \
--format cyclonedx \
--output /work/evidence/runtime.cdx.json "$RUNTIME_IMAGE"
- name: Summarize and enforce candidate security
shell: bash
run: |
set -euo pipefail
count() {
jq "$2" "$1"
}
source_secrets=$(count evidence/source-security.json '[.Results[]?.Secrets[]?] | length')
source_critical=$(count evidence/source-security.json '[.Results[]?.Vulnerabilities[]? | select(.Severity == "CRITICAL")] | length')
source_high=$(count evidence/source-security.json '[.Results[]?.Vulnerabilities[]? | select(.Severity == "HIGH")] | length')
product_secrets=$(count evidence/product-security.json '[.Results[]?.Secrets[]?] | length')
product_critical=$(count evidence/product-security.json '[.Results[]?.Vulnerabilities[]? | select(.Severity == "CRITICAL")] | length')
product_high=$(count evidence/product-security.json '[.Results[]?.Vulnerabilities[]? | select(.Severity == "HIGH")] | length')
dapper_raw_critical=$(count evidence/dapper-image-raw.json '[.Results[]?.Vulnerabilities[]? | select(.Severity == "CRITICAL")] | length')
dapper_raw_high=$(count evidence/dapper-image-raw.json '[.Results[]?.Vulnerabilities[]? | select(.Severity == "HIGH")] | length')
dapper_applicable_critical=$(count evidence/dapper-image-applicable.json '[.Results[]?.Vulnerabilities[]? | select(.Severity == "CRITICAL" and .Status != "not_affected")] | length')
dapper_applicable_high=$(count evidence/dapper-image-applicable.json '[.Results[]?.Vulnerabilities[]? | select(.Severity == "HIGH" and .Status != "not_affected")] | length')
dapper_secrets=$(count evidence/dapper-image-applicable.json '[.Results[]?.Secrets[]?] | length')
runtime_secrets=$(count evidence/runtime-image-security.json '[.Results[]?.Secrets[]?] | length')
runtime_critical=$(count evidence/runtime-image-security.json '[.Results[]?.Vulnerabilities[]? | select(.Severity == "CRITICAL")] | length')
runtime_high=$(count evidence/runtime-image-security.json '[.Results[]?.Vulnerabilities[]? | select(.Severity == "HIGH")] | length')
{
printf 'source_secrets=%s\n' "$source_secrets"
printf 'source_critical=%s\n' "$source_critical"
printf 'source_high=%s\n' "$source_high"
printf 'product_secrets=%s\n' "$product_secrets"
printf 'product_critical=%s\n' "$product_critical"
printf 'product_high=%s\n' "$product_high"
printf 'dapper_raw_critical=%s\n' "$dapper_raw_critical"
printf 'dapper_raw_high=%s\n' "$dapper_raw_high"
printf 'dapper_applicable_critical=%s\n' "$dapper_applicable_critical"
printf 'dapper_applicable_high=%s\n' "$dapper_applicable_high"
printf 'dapper_secrets=%s\n' "$dapper_secrets"
printf 'runtime_secrets=%s\n' "$runtime_secrets"
printf 'runtime_critical=%s\n' "$runtime_critical"
printf 'runtime_high=%s\n' "$runtime_high"
} | tee evidence/security-summary.txt
test "$source_secrets" -eq 0
test "$source_critical" -eq 0
test "$source_high" -eq 0
test "$product_secrets" -eq 0
test "$product_critical" -eq 0
test "$product_high" -eq 0
test "$dapper_applicable_critical" -eq 0
test "$dapper_applicable_high" -eq 0
test "$dapper_secrets" -eq 0
test "$runtime_secrets" -eq 0
test "$runtime_critical" -eq 0
test "$runtime_high" -eq 0
- name: Upload review evidence
if: always()
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
with:
name: cli-security-${{ github.sha }}
path: evidence/
if-no-files-found: error
retention-days: 30
- name: Clean runner resources
if: always()
shell: bash
run: |
set +e
docker rm -f $(docker ps -aq --filter ancestor="$DAPPER_IMAGE") 2>/dev/null
docker rm -f $(docker ps -aq --filter ancestor="$RUNTIME_IMAGE") 2>/dev/null
docker image rm -f "$DAPPER_IMAGE" "$RUNTIME_IMAGE" "$TRIVY_IMAGE" 2>/dev/null
docker builder prune --all --force >/dev/null 2>&1
sudo rm -rf bin build dist evidence/product
true