Retrospective: Adopting SLSA 1.0 Compliance Across 100+ Repos With Sigstore 1.8

name: SLSA 1.0 Level 2 Compliance Pipeline
# Workflow to build, sign, and verify container images per SLSA 1.0 Level 2
# Requires Sigstore Cosign 2.2+ (bundled with Sigstore 1.8)
# Uses GitHub OIDC for keyless signing, no long-lived secrets
# More info: https://github.com/sigstore/cosign
on:
  push:
    tags: ['v*'] # Only run on version tags for production releases
  workflow_dispatch: # Allow manual triggers for testing

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}
  COSIGN_VERSION: v2.2.0 # Matches Sigstore 1.8 bundled version
  SLSA_LEVEL: 2

jobs:
  build-and-sign:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write # Required for OIDC token exchange with Sigstore
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0 # Fetch full history for SLSA provenance attestation

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata for Docker
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=semver,pattern={{version}}
            type=sha,format=long

      - name: Build Docker image
        uses: docker/build-push-action@v5
        with:
          context: .
          push: false # Don't push yet, we need to sign first
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

      - name: Install Cosign
        uses: sigstore/cosign-installer@v3
        with:
          cosign-release: ${{ env.COSIGN_VERSION }}

      - name: Sign container image with Cosign (keyless)
        id: sign
        run: |
          # Sign all tags generated by metadata step
          for tag in ${{ steps.meta.outputs.tags }}; do
            cosign sign --yes \\
              --oidc-issuer https://token.actions.githubusercontent.com \\
              --oidc-client-id sigstore \\
              "$tag" 2>&1 | tee sign-output.log
            # Check for signing errors
            if [ $? -ne 0 ]; then
              echo "::error::Failed to sign image tag $tag. See sign-output.log for details."
              exit 1
            fi
          done
        env:
          COSIGN_EXPERIMENTAL: 1 # Enable keyless signing with OIDC

      - name: Generate SLSA provenance attestation
        uses: slsa-framework/slsa-github-generator@v2.0.0
        with:
          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }}
          # Upload provenance to Rekor transparency log
          upload-to-rekor: true
          rekor-server: https://rekor.sigstore.dev

      - name: Push signed image to registry
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

      - name: Verify signed image
        run: |
          # Verify all signed tags
          for tag in ${{ steps.meta.outputs.tags }}; do
            cosign verify "$tag" \\
              --oidc-issuer https://token.actions.githubusercontent.com \\
              --certificate-identity ${{ github.server_url }}/${{ github.repository }}/.github/workflows/slsa-compliance.yml@${{ github.ref }} \\
              --certificate-oidc-issuer https://token.actions.githubusercontent.com 2>&1 | tee verify-output.log
            if [ $? -ne 0 ]; then
              echo "::error::Failed to verify signed image $tag. See verify-output.log for details."
              exit 1
            fi
          done
        env:
          COSIGN_EXPERIMENTAL: 1

      - name: Upload signing artifacts
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: slsa-signing-artifacts
          path: |
            sign-output.log
            verify-output.log
            provenance.json
          retention-days: 30

#!/usr/bin/env python3
"""
Script to verify SLSA 1.0 provenance and signature for a local container image
Requires sigstore 1.8+ (pip install sigstore==1.8.0 from https://github.com/sigstore/sigstore)
Uses Rekor transparency log to check for tampered artifacts
"""
import sys
import subprocess
import json
from pathlib import Path
from sigstore.verify import Verifier, policy
from sigstore.oidc import GitHubOIDCIdentity
from sigstore.transparency import RekorLog

# Configuration
REKOR_SERVER = "https://rekor.sigstore.dev"
EXPECTED_REPO = "my-org/my-repo" # Replace with target repo
EXPECTED_WORKFLOW = ".github/workflows/slsa-compliance.yml"
MIN_SLSA_LEVEL = 2

def check_cosign_installed():
    """Verify Cosign is installed and matches Sigstore 1.8 bundled version"""
    try:
        result = subprocess.run(
            ["cosign", "version"],
            capture_output=True,
            text=True,
            check=True
        )
        # Parse version: Cosign 2.2.0 (bundled with Sigstore 1.8)
        version_line = [line for line in result.stdout.split("\n") if "Cosign" in line][0]
        cosign_version = version_line.split()[1]
        if not cosign_version.startswith("2.2."):
            print("::error::Cosign version {cosign_version} does not match Sigstore 1.8 bundled 2.2.x")
            sys.exit(1)
        print(f"✅ Cosign version {cosign_version} verified")
    except subprocess.CalledProcessError as e:
        print(f"::error::Cosign not installed or failed to run: {e.stderr}")
        sys.exit(1)
    except IndexError:
        print("::error::Could not parse Cosign version output")
        sys.exit(1)

def verify_image_signature(image_ref):
    """Verify container image signature using Cosign and OIDC identity"""
    print(f"Verifying signature for image: {image_ref}")
    try:
        verify_cmd = [
            "cosign", "verify",
            "--oidc-issuer", "https://token.actions.githubusercontent.com",
            "--certificate-identity", f"github.com/{EXPECTED_REPO}/{EXPECTED_WORKFLOW}@*",
            "--certificate-oidc-issuer", "https://token.actions.githubusercontent.com",
            image_ref
        ]
        result = subprocess.run(
            verify_cmd,
            capture_output=True,
            text=True,
            check=True
        )
        print(f"✅ Image signature verified for {image_ref}")
        return json.loads(result.stdout)
    except subprocess.CalledProcessError as e:
        print(f"::error::Signature verification failed for {image_ref}: {e.stderr}")
        sys.exit(1)

def verify_slsa_provenance(image_ref):
    """Verify SLSA provenance attestation via Rekor log"""
    print(f"Verifying SLSA provenance for image: {image_ref}")
    try:
        # Get image digest
        digest_result = subprocess.run(
            ["docker", "inspect", "--format='{{index .RepoDigests 0}}'", image_ref],
            capture_output=True,
            text=True,
            check=True
        )
        image_digest = digest_result.stdout.strip().strip("'")
        print(f"Image digest: {image_digest}")

        # Query Rekor for provenance attestation
        rekor = RekorLog(url=REKOR_SERVER)
        entries = rekor.search(type_="cosign_v1", hash_=image_digest.split(":")[-1])

        if not entries:
            print(f"::error::No Rekor entries found for image digest {image_digest}")
            sys.exit(1)

        # Check SLSA level in provenance
        for entry in entries:
            attestation = json.loads(entry.body)
            slsa_level = attestation.get("payload", {}).get("predicate", {}).get("slsa", {}).get("level")
            if slsa_level and int(slsa_level) >= MIN_SLSA_LEVEL:
                print(f"✅ SLSA Level {slsa_level} provenance found for {image_ref}")
                return True

        print(f"::error::No SLSA Level {MIN_SLSA_LEVEL} provenance found for {image_ref}")
        sys.exit(1)
    except subprocess.CalledProcessError as e:
        print(f"::error::Failed to get image digest: {e.stderr}")
        sys.exit(1)
    except Exception as e:
        print(f"::error::Provenance verification failed: {str(e)}")
        sys.exit(1)

def main():
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} \n")
        print(f"Example: {sys.argv[0]} ghcr.io/my-org/my-repo:v1.0.0\n")
        sys.exit(1)

    image_ref = sys.argv[1]
    print(f"Starting SLSA 1.0 verification for {image_ref}")
    print(f"Expected repo: {EXPECTED_REPO}, Min SLSA Level: {MIN_SLSA_LEVEL}")

    # Pre-flight checks
    check_cosign_installed()

    # Run verifications
    verify_image_signature(image_ref)
    verify_slsa_provenance(image_ref)

    print(f"✅ All SLSA 1.0 Level {MIN_SLSA_LEVEL} checks passed for {image_ref}")

if __name__ == "__main__":
    main()

#!/usr/bin/env bash
"""
Bulk enable SLSA 1.0 Level 2 compliance across all repos in a GitHub org
Uses GitHub CLI (gh), Sigstore Cosign 2.2, and slsa-github-generator
Requires: gh auth login, cosign 2.2.0, jq
"""
set -euo pipefail # Exit on error, undefined var, pipe failure

# Configuration
GITHUB_ORG="my-org" # Replace with target GitHub org
SLSA_WORKFLOW_FILE="slsa-compliance.yml"
WORKFLOW_SOURCE_PATH="./templates/${SLSA_WORKFLOW_FILE}" # Pre-built workflow from Code Example 1
COSIGN_VERSION="v2.2.0" # Sigstore 1.8 bundled version
LOG_FILE="bulk-slsa-rollout-$(date +%Y%m%d-%H%M%S).log"

# Redirect all output to log file and stdout
exec > >(tee -a "$LOG_FILE") 2>&1

echo "=========================================="
echo "Bulk SLSA 1.0 Rollout for Org: $GITHUB_ORG"
echo "Log file: $LOG_FILE"
echo "Start time: $(date)"
echo "=========================================="

# Pre-flight checks
check_dependencies() {
    echo "Running pre-flight dependency checks..."
    local deps=("gh" "cosign" "jq" "git")
    for dep in "${deps[@]}"; do
        if ! command -v "$dep" &> /dev/null; then
            echo "::error::Dependency $dep not found. Please install it and re-run."
            exit 1
        fi
    done

    # Check Cosign version
    local cosign_ver
    cosign_ver=$(cosign version | grep "Cosign" | awk '{print $2}')
    if [[ ! "$cosign_ver" =~ ^2\.2\. ]]; then
        echo "::error::Cosign version $cosign_ver does not match required 2.2.x (Sigstore 1.8)"
        exit 1
    fi

    # Check gh auth status
    if ! gh auth status &> /dev/null; then
        echo "::error::Not authenticated to GitHub CLI. Run 'gh auth login' first."
        exit 1
    fi

    # Check if workflow template exists
    if [[ ! -f "$WORKFLOW_SOURCE_PATH" ]]; then
        echo "::error::Workflow template not found at $WORKFLOW_SOURCE_PATH"
        exit 1
    fi

    echo "✅ All pre-flight checks passed"
}

# Get list of all repos in org (excluding forks and archived)
get_repos() {
    echo "Fetching repos for org $GITHUB_ORG..."
    gh repo list "$GITHUB_ORG" \
        --limit 1000 \
        --json nameWithOwner,isFork,isArchived \
        --jq '.[] | select(.isFork == false and .isArchived == false) | .nameWithOwner' \
        > repos.txt

    local repo_count
    repo_count=$(wc -l < repos.txt)
    echo "✅ Found $repo_count non-fork, non-archived repos"
}

# Process individual repo: add workflow, enable settings
process_repo() {
    local repo="$1"
    echo "------------------------------------------"
    echo "Processing repo: $repo"
    echo "------------------------------------------"

    # Clone repo temporarily
    local clone_dir="/tmp/slsa-rollout-${repo//\//-}"
    if [[ -d "$clone_dir" ]]; then
        rm -rf "$clone_dir"
    fi

    echo "Cloning $repo..."
    if ! gh repo clone "$repo" "$clone_dir" -- --depth 1; then
        echo "::error::Failed to clone $repo. Skipping."
        return 1
    fi

    # Create workflows directory if not exists
    mkdir -p "$clone_dir/.github/workflows"

    # Copy SLSA workflow to repo
    echo "Copying SLSA workflow to $repo..."
    cp "$WORKFLOW_SOURCE_PATH" "$clone_dir/.github/workflows/"

    # Check if workflow already exists (idempotency)
    if git -C "$clone_dir" diff --quiet; then
        echo "ℹ️ No changes needed for $repo (workflow already exists)"
        rm -rf "$clone_dir"
        return 0
    fi

    # Commit and push workflow
    echo "Committing and pushing workflow to $repo..."
    git -C "$clone_dir" add .github/workflows/"$SLSA_WORKFLOW_FILE"
    git -C "$clone_dir" commit -m "feat: add SLSA 1.0 Level 2 compliance workflow

    Automatically signs container images and generates provenance using Sigstore 1.8.
    Complies with SLSA 1.0 Level 2 requirements for supply chain security."
    git -C "$clone_dir" push origin main

    # Enable GitHub OIDC for Sigstore signing
    echo "Enabling OIDC permissions for $repo..."
    gh api repos/"$repo"/actions/permissions \
        --method PATCH \
        --field allowed_actions=all \
        --field permissions.id_token=write \
        > /dev/null

    echo "✅ Successfully processed $repo"
    rm -rf "$clone_dir"
    return 0
}

# Main execution
check_dependencies
get_repos

echo "Starting repo processing..."
passed=0
failed=0

while read -r repo; do
    if process_repo "$repo"; then
        ((passed++))
    else
        ((failed++))
    fi
done < repos.txt

# Final report
echo "=========================================="
echo "Rollout Complete"
echo "End time: $(date)"
echo "Total repos processed: $((passed + failed))"
echo "Passed: $passed"
echo "Failed: $failed"
echo "Log file: $LOG_FILE"
echo "=========================================="

if [[ $failed -gt 0 ]]; then
    echo "::error::$failed repos failed to process. Check log for details."
    exit 1
fi

echo "✅ All repos successfully enabled for SLSA 1.0 compliance"

# Check SLSA level in workflow
if [ "${{ env.SLSA_LEVEL }}" -ne 2 ]; then
  echo "::error::Only SLSA Level 2 is supported for initial rollout"
  exit 1
fi

# Keyless signing command (no static secrets)
cosign sign --yes \\
  --oidc-issuer https://token.actions.githubusercontent.com \\
  --oidc-client-id sigstore \\
  "ghcr.io/my-org/my-repo:v1.0.0"

# Kyverno policy snippet to enforce signed images
verifyImages:
  - image: "ghcr.io/my-org/*"
    cosign:
      verify: true
      keyless:
        issuer: "https://token.actions.githubusercontent.com"
        subject: "github.com/my-org/*/.github/workflows/slsa-compliance.yml"