Migrate provenance attestation to SLSAv1 by puerco · Pull Request #4502 · kubernetes/release

puerco · 2026-08-25T06:05:36Z

What type of PR is this?

/kind cleanup

What this PR does / why we need it:

In preparation to finishing the provenance work, this PR moves the provenance generation to SLSA v1.

I've scoped this PR is to only move the predicate type to v1. I added a fix in 49dea93 to attest the correct commit but I realized the PR is large as it is so once we get this in, I will start sending the rest of the fixes to the attestation contents and signing.

Aside from the code changes required to move our provenance to v1, this commit includes the foundations for the krel buildType definition (see the SLSA spec for more info). The build definition captures the krel-specific data of our builds. This is a full protobuf definition as we will check it into the upcoming slsa verifier so that it recognizes our build automatically.

Which issue(s) this PR fixes:

None

Part of kubernetes/enhancements#3027

Special notes for your reviewer:

Instead of using our custom slsa predicate, we now use the upstream types from intoto (we've moved other tools to the same a while ago).
I've migrated the simple check we do on the attestation during release to do the same in the new provenance format. This is not the final verification. this merely emulates the non-fatal verification we do today, as part of the upcoming fixes I will implement the full slsa check as defined in the spec (all of this in upcoming PRs). The attestation check is still non-fatal as we have it now.

I've run full stage and release and things seem to be working as expected.

I've included the resulting attestation in this PR if needed: provenance.json

Does this PR introduce a user-facing change?

The kubernetes release process now generates SLSAv1 attestations.

saschagrunert

Nice migration. The move from the custom SLSA v0.2 predicate to upstream v1 types, the protobuf buildType definition, and the per-tag source tracking are all solid improvements. A few comments inline.

saschagrunert · 2026-08-25T08:11:53Z

+			checked = true
+		}
+
+		if !checked && sub.GetDigest() != nil {


A subject with a nil digest (field never set) silently passes verification here. GetDigest() returns nil for an unset map, so !checked && nil != nil is false and no error is reported. A subject with an empty map[string]string{} correctly errors (non-nil, len 0), but one with a completely absent digest is accepted without any hash check.

Suggested change

if !checked && sub.GetDigest() != nil {

if !checked {

Separately, the digest values themselves are compared as raw strings with no format validation (hex length, charset). A malformed entry like {"sha256": "not-a-hash"} with a recognized algorithm key would be compared verbatim and silently fail. Validating the digest format before matching (algorithm name, expected hex length, hex charset) would make this more robust.

OK, I've added another commit making the digest checks a little more robust/

saschagrunert · 2026-08-25T08:11:53Z

-) ([]intoto.Subject, error) {
+) ([]*intoto.ResourceDescriptor, error) {
 	// Create the dummy statement to read artifacts
 	dummy := provenance.NewSLSAStatement()


GetStagingSubjects and GetBuildSubjects (line 362) still create a provenance.NewSLSAStatement() from the old bom package internally, call its ReadSubjectsFromDir/AddSubjectFromFile methods, and return dummy.Subject. This works because the pre-release bom also switched its Subject field to []*intoto.ResourceDescriptor, but it keeps the sigs.k8s.io/bom/pkg/provenance dependency around. Worth a TODO to migrate these to drop that dependency once the bom release lands?

So as part of its validation functions, bom has these functions to compute provenance subjects from paths and files. The goal is to keep them and use still them here. The dep should not be a concern as we are using bom for the SBOMs anyway.

saschagrunert · 2026-08-25T08:11:53Z

+	google.golang.org/protobuf v1.36.12
 	k8s.io/apimachinery v0.36.4
-	sigs.k8s.io/bom v0.7.1
+	sigs.k8s.io/bom v0.7.2-0.20260822012113-f3fd7c6e0240


Pre-release bom commit pin. Is there a timeline or tracking issue for the v0.7.2 bom release? If that commit gets rebased this breaks.

OK, so the plan is that I will be updating k/release with bom prereleases as we satisfy any bugs or issues that arise as we modernize the SBOM and attestations generated by krel.

Once the work here is ready I will cut a bom release, pin it here and we cut a new krel tag (after the v1.37 release)

saschagrunert · 2026-08-26T06:35:43Z

Ah this needs a rebase now.

Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>

We now record the real repo, even if $K8S_ORG/$K8S_REPO are set. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>

Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>

This adds the krel buildType definition for the SLSA build attestations Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>

This commit modifies the attester to record the actual build point (the tagged commit) instead of blindly using HEAD. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>

Since we are updating the provenance, the current verification breaks. The current verify process is not very valuable because it is not fatal, the attestation is not signed and we don't actually verify the predicate. This change modifies the attestation verification to do a simple parse of the subjects and check the hashes (regardless of the attestation type). Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>

Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>

kubernetes-prow · 2026-08-26T06:59:49Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: puerco, saschagrunert

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [puerco,saschagrunert]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

puerco · 2026-08-26T07:00:17Z

ok, I rebased the branch and pushed again. PTAL.

kubernetes-prow Bot requested review from jimangel and salaxander August 25, 2026 06:05

puerco force-pushed the slsa1 branch from ecaa7d9 to c2e44c1 Compare August 25, 2026 06:06

kubernetes-prow Bot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 25, 2026

saschagrunert reviewed Aug 25, 2026

View reviewed changes

puerco force-pushed the slsa1 branch from c8e1c58 to 2ec78de Compare August 26, 2026 00:01

saschagrunert approved these changes Aug 26, 2026

View reviewed changes

kubernetes-prow Bot assigned saschagrunert Aug 26, 2026

kubernetes-prow Bot added lgtm "Looks good to me", indicates that a PR is ready to be merged. needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels Aug 26, 2026

puerco added 10 commits August 26, 2026 00:49

Pull bom@HEAD intoto/attestation

25a4af3

Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>

Port provenance to SLSAv1+intoto/attestation

0538d6d

Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>

Regenerate fakes

c8ef4ab

Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>

Stamp provenance finishedOn after staging completes

6d7f9e3

Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>

Record the actual repo in the provenance

ec29e00

We now record the real repo, even if $K8S_ORG/$K8S_REPO are set. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>

Add SLSA buildType proto definition

f3efa87

Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>

Add make protos target

b27e736

Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>

Regenerate protos

20a5513

Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>

Use new buildType in provenance

8c79178

Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>

Add buildType README and godoc

9c2aeca

This adds the krel buildType definition for the SLSA build attestations Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>

puerco added 5 commits August 26, 2026 00:52

Record the actual build point in the provenance

3dba7d3

This commit modifies the attester to record the actual build point (the tagged commit) instead of blindly using HEAD. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>

Avoid adding empty predicate feeds

bc2dd3a

Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>

Fix linter nits

48acdce

Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>

Harden the provenance subject digest verification

80fb49a

Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>

puerco force-pushed the slsa1 branch from 2ec78de to 80fb49a Compare August 26, 2026 06:52

kubernetes-prow Bot removed lgtm "Looks good to me", indicates that a PR is ready to be merged. needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels Aug 26, 2026

saschagrunert approved these changes Aug 26, 2026

View reviewed changes

kubernetes-prow Bot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Aug 26, 2026

kubernetes-prow Bot merged commit d6e24c9 into kubernetes:master Aug 26, 2026
11 checks passed

Navigation Menu

Uh oh!

Migrate provenance attestation to SLSAv1 - #4502

Migrate provenance attestation to SLSAv1#4502
kubernetes-prow[bot] merged 15 commits into
kubernetes:masterfrom
puerco:slsa1

puerco commented Aug 25, 2026 •

edited

Loading

Uh oh!

saschagrunert left a comment

Uh oh!

saschagrunert Aug 25, 2026 •

edited

Loading

Uh oh!

puerco Aug 26, 2026

Uh oh!

Uh oh!

Uh oh!

saschagrunert Aug 25, 2026

Uh oh!

puerco Aug 25, 2026

Uh oh!

saschagrunert Aug 25, 2026

Uh oh!

puerco Aug 25, 2026

Uh oh!

Uh oh!

saschagrunert commented Aug 26, 2026

Uh oh!

kubernetes-prow Bot commented Aug 26, 2026

Uh oh!

puerco commented Aug 26, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

puerco commented Aug 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Uh oh!

saschagrunert left a comment

Choose a reason for hiding this comment

Uh oh!

saschagrunert Aug 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

puerco Aug 26, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

saschagrunert Aug 25, 2026

Choose a reason for hiding this comment

Uh oh!

puerco Aug 25, 2026

Choose a reason for hiding this comment

Uh oh!

saschagrunert Aug 25, 2026

Choose a reason for hiding this comment

Uh oh!

puerco Aug 25, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

saschagrunert commented Aug 26, 2026

Uh oh!

kubernetes-prow Bot commented Aug 26, 2026

Uh oh!

puerco commented Aug 26, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

puerco commented Aug 25, 2026 •

edited

Loading

saschagrunert Aug 25, 2026 •

edited

Loading