From 385d2fb857a8bd1624a5e5cee29841d20cd48dda Mon Sep 17 00:00:00 2001 From: Yevdo Abramov <5107130+alenon@users.noreply.github.com> Date: Wed, 28 Oct 2026 14:32:15 +0200 Subject: [PATCH] RTDEV-101449 - Samples-key-not-on-argv --- .../anchore-sbom-evidence-example.yml | 14 +++- .../anchore-scan-evidence-example.yml | 14 +++- .../workflows/blazemeter-evidence-example.yml | 14 +++- .github/workflows/build-and-deploy.yml | 70 +++++++++++++++++-- .github/workflows/build.yml | 56 +++++++++++++-- .github/workflows/codeql-evidence-example.yml | 16 ++++- .../workflows/cypress-evidence-example.yml | 14 +++- .../workflows/dependabot-evidence-example.yml | 14 +++- .github/workflows/dive-evidence-example.yml | 14 +++- .github/workflows/jira-evidence-example.yml | 14 +++- .github/workflows/junit-evidence-example.yml | 14 +++- .../workflows/katalon-evidence-example.yml | 14 +++- .../owasp-depcheck-evidence-example.yml | 14 +++- .github/workflows/promote-to-prod.yml | 14 +++- .github/workflows/sample-argv-check.yml | 13 ++++ .../workflows/scorecard-evidence-example.yml | 14 +++- .../workflows/semgrep-evidence-example.yml | 14 +++- .github/workflows/simple-evidence.yml | 42 ++++++++++- .github/workflows/test-evd.yml | 28 +++++++- .../workflows/testRail-evidence-example.yml | 14 +++- .github/workflows/tfsec-evidence-example.yml | 14 +++- .github/workflows/trivy-evidence-example.yml | 14 +++- .../workflows/trufflehog-evidence-example.yml | 14 +++- .github/workflows/zap-evidence-example.yml | 14 +++- .gitignore | 1 + README.md | 46 ++++++++++-- examples/anchore/anchore-sbom-readme.md | 19 ++++- examples/anchore/anchore-scan-readme.md | 19 ++++- examples/aquasecurity/tfsec/README.md | 19 ++++- examples/aquasecurity/trivy/README.md | 17 ++++- examples/blazemeter/README.md | 12 +++- examples/cypress/README.md | 35 +++++++--- examples/dive/README.md | 17 ++++- examples/github/codeql/README.md | 64 ++++++++++++----- examples/github/dependabot/README.md | 33 ++++++--- examples/gitlab/provenance/.gitlab-ci.yml | 23 +++++- examples/gitlab/provenance/README.md | 15 +++- examples/gitlab/sbom/.gitlab-ci.yml | 23 +++++- examples/gitlab/sbom/README.md | 12 +++- examples/jenkins-provenance/README.md | 2 + examples/jira/README.md | 31 +++++--- examples/junit/README.md | 19 ++++- examples/katalon/README.md | 11 ++- examples/scorecard/README.md | 19 ++++- examples/semgrep/README.md | 19 ++++- examples/testRail/README.md | 35 +++++++--- examples/trufflehog/README.md | 19 ++++- scripts/check-signing-key-not-argv.sh | 48 +++++++++++++ 48 files changed, 899 insertions(+), 136 deletions(-) create mode 100644 .github/workflows/sample-argv-check.yml create mode 100755 scripts/check-signing-key-not-argv.sh diff --git a/.github/workflows/anchore-sbom-evidence-example.yml b/.github/workflows/anchore-sbom-evidence-example.yml index 5ecf76c..dd4b993 100644 --- a/.github/workflows/anchore-sbom-evidence-example.yml +++ b/.github/workflows/anchore-sbom-evidence-example.yml @@ -45,12 +45,24 @@ jobs: # Attaching the evidence to associated package - name: Attach evidence using jfrog cli + env: + EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }} run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT jf evd create \ --package-name $IMAGE_NAME \ --package-version $VERSION \ --package-repo-name $REPO_NAME \ - --key "${{ secrets.PRIVATE_KEY }}" \ + --key "$evidence_signing_key_file" \ --key-alias "${{ vars.EVIDENCE_KEY_ALIAS }}" \ --predicate ./anchore-sbom.json \ --predicate-type http://anchore.com/syft/sbom/v1 \ diff --git a/.github/workflows/anchore-scan-evidence-example.yml b/.github/workflows/anchore-scan-evidence-example.yml index d1c7531..608989f 100644 --- a/.github/workflows/anchore-scan-evidence-example.yml +++ b/.github/workflows/anchore-scan-evidence-example.yml @@ -47,12 +47,24 @@ jobs: # Attaching the evidence to associated package - name: Attach evidence using jfrog cli + env: + EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }} run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT jf evd create \ --package-name $IMAGE_NAME \ --package-version $VERSION \ --package-repo-name $REPO_NAME \ - --key "${{ secrets.PRIVATE_KEY }}" \ + --key "$evidence_signing_key_file" \ --key-alias "${{ vars.EVIDENCE_KEY_ALIAS }}" \ --predicate ./anchore-scan-results.sarif \ --predicate-type http://anchore.com/grype/vulnerabilities/v1 \ diff --git a/.github/workflows/blazemeter-evidence-example.yml b/.github/workflows/blazemeter-evidence-example.yml index bf038fe..cf9ce6a 100644 --- a/.github/workflows/blazemeter-evidence-example.yml +++ b/.github/workflows/blazemeter-evidence-example.yml @@ -83,12 +83,24 @@ jobs: - name: Attach evidence to the package working-directory: examples/blazemeter + env: + EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }} run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT jf evd create \ --package-name $IMAGE_NAME \ --package-version $TAG_NAME \ --package-repo-name $REPO_NAME \ - --key "${{ secrets.PRIVATE_KEY }}" \ + --key "$evidence_signing_key_file" \ --key-alias "${{ secrets.PRIVATE_KEY_ALIAS }}" \ --predicate "blazemeter-predicate.json" \ --predicate-type "http://blazemeter.com/performance-results/v1" \ diff --git a/.github/workflows/build-and-deploy.yml b/.github/workflows/build-and-deploy.yml index 1e6eb5c..0f12a28 100644 --- a/.github/workflows/build-and-deploy.yml +++ b/.github/workflows/build-and-deploy.yml @@ -45,18 +45,42 @@ jobs: jf rt build-docker-create example-project-docker-dev --image-file build-metadata --build-name ${{ vars.BUILD_NAME }} --build-number ${{ github.run_number }} - name: Evidence on docker + env: + EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }} run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT echo '{ "actor": "${{ github.actor }}", "date": "'$(date -u +"%Y-%m-%dT%H:%M:%SZ")'" }' > sign.json jf evd create --package-name example-project-app --package-version ${{ github.run_number }} --package-repo-name example-project-docker-dev-local \ - --key "${{ secrets.PRIVATE_KEY }}" --key-alias KEY-ALIAS \ + --key "$evidence_signing_key_file" --key-alias KEY-ALIAS \ --predicate ./sign.json --predicate-type https://jfrog.com/evidence/signature/v1 echo '๐Ÿ”Ž Evidence attached: `signature` ๐Ÿ” ' - name: Upload readme file + env: + EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }} run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT jf rt upload ./README.md example-project-generic-dev/readme/${{ github.run_number }}/ --build-name ${{ vars.BUILD_NAME }} --build-number ${{ github.run_number }} jf evd create --subject-repo-path example-project-generic-dev/readme/${{ github.run_number }}/README.md \ - --key "${{ secrets.PRIVATE_KEY }}" --key-alias KEY-ALIAS \ + --key "$evidence_signing_key_file" --key-alias KEY-ALIAS \ --predicate ./sign.json --predicate-type https://jfrog.com/evidence/signature/v1 - name: Collecting Information from Git @@ -69,11 +93,23 @@ jobs: run: jfrog rt build-publish ${{ vars.BUILD_NAME }} ${{ github.run_number }} - name: Sign build evidence + env: + EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }} run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT echo '{ "actor": "${{ github.actor }}", "date": "'$(date -u +"%Y-%m-%dT%H:%M:%SZ")'" }' > sign.json jf evd create --build-name ${{ vars.BUILD_NAME }} --build-number ${{ github.run_number }} \ --predicate ./sign.json --predicate-type https://jfrog.com/evidence/build-signature/v1 \ - --key "${{ secrets.PRIVATE_KEY }}" --key-alias KEY-ALIAS + --key "$evidence_signing_key_file" --key-alias KEY-ALIAS echo '๐Ÿ”Ž Evidence attached: `build-signature` ๐Ÿ” ' >> $GITHUB_STEP_SUMMARY - name: Create release bundle @@ -102,13 +138,25 @@ jobs: echo "๐Ÿš€ Succesfully promote to \`QA\` environemnt" >> $GITHUB_STEP_SUMMARY - name: Evidence on release-bundle + env: + EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }} run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT echo '{ "actor": "${{ github.actor }}", "date": "'$(date -u +"%Y-%m-%dT%H:%M:%SZ")'", "test": "CI test", "result": "success" }' > test_evidence.json JF_LINK=${{ vars.ARTIFACTORY_URL }}'/ui/artifactory/lifecycle/?bundleName='${{ vars.BUNDLE_NAME }}'&bundleToFlash='${{ vars.BUNDLE_NAME }}'&releaseBundleVersion='${{ github.run_number }}'&repositoryKey=release-bundles-v2&activeVersionTab=Version%20Timeline&activeKanbanTab=promotion' echo 'Test on Release bundle ['${{ vars.BUNDLE_NAME }}':'${{ github.run_number }}']('${JF_LINK}') success' >> $GITHUB_STEP_SUMMARY jf evd create --release-bundle ${{ vars.BUNDLE_NAME }} --release-bundle-version ${{ github.run_number }} \ --predicate ./test_evidence.json --predicate-type https://jfrog.com/evidence/testing-results/v1 \ - --key "${{ secrets.PRIVATE_KEY }}" --key-alias KEY-ALIAS + --key "$evidence_signing_key_file" --key-alias KEY-ALIAS echo '๐Ÿ”Ž Evidence attached: integration-test ๐Ÿงช ' >> $GITHUB_STEP_SUMMARY @@ -145,9 +193,21 @@ jobs: echo "RESULT=$result" >> $GITHUB_ENV - name: Promote to Production + env: + EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }} run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT if [ "${{ env.RESULT }}" == "true" ]; then - jf evd create --key "${{ secrets.PRIVATE_KEY }}" --key-alias KEY-ALIAS \ + jf evd create --key "$evidence_signing_key_file" --key-alias KEY-ALIAS \ --release-bundle ${{ vars.BUNDLE_NAME }} --release-bundle-version ${{ github.run_number }} \ --predicate ./policy.json --predicate-type https://jfrog.com/evidence/approval/v1 jf release-bundle-promote ${{ vars.BUNDLE_NAME }} ${{ github.run_number }} PROD --signing-key PGP-RSA-2048 --sync=true diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 178c1e1..ac12fe2 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -46,29 +46,65 @@ jobs: jfrog rt build-docker-create example-project-docker-dev --image-file build-metadata --build-name ${{ vars.BUILD_NAME }} --build-number ${{ github.run_number }} - name: Evidence on docker + env: + EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }} run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT echo '{ "actor": "${{ github.actor }}", "date": "'$(date -u +"%Y-%m-%dT%H:%M:%SZ")'" }' > sign.json jf evd create --package-name example-project-app --package-version 65 --package-repo-name example-project-docker-dev-local \ - --key "${{ secrets.PRIVATE_KEY }}" \ + --key "$evidence_signing_key_file" \ --predicate ./sign.json --predicate-type https://jfrog.com/evidence/signature/v1 echo '๐Ÿ”Ž Evidence attached: `signature` ๐Ÿ” ' - name: Upload readme file + env: + EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }} run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT jf rt upload ./README.md example-project-generic-dev/readme/${{ github.run_number }}/ --build-name ${{ vars.BUILD_NAME }} --build-number ${{ github.run_number }} jf evd create --subject-repo-path example-project-generic-dev/readme/${{ github.run_number }}/README.md \ - --key "${{ secrets.PRIVATE_KEY }}" \ + --key "$evidence_signing_key_file" \ --predicate ./sign.json --predicate-type https://jfrog.com/evidence/signature/v1 - name: Publish build info run: jfrog rt build-publish ${{ vars.BUILD_NAME }} ${{ github.run_number }} - name: Sign build evidence + env: + EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }} run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT echo '{ "actor": "${{ github.actor }}", "date": "'$(date -u +"%Y-%m-%dT%H:%M:%SZ")'" }' > sign.json jf evd create --build-name ${{ vars.BUILD_NAME }} --build-number ${{ github.run_number }} \ --predicate ./sign.json --predicate-type https://jfrog.com/evidence/build-signature/v1 \ - --key "${{ secrets.PRIVATE_KEY }}" + --key "$evidence_signing_key_file" echo '๐Ÿ”Ž Evidence attached: `build-signature` ๐Ÿ” ' >> $GITHUB_STEP_SUMMARY - name: Create release bundle @@ -80,11 +116,23 @@ jobs: echo '๐Ÿ“ฆ Release bundle ['${{ vars.BUNDLE_NAME }}']('${NAME_LINK}'):['${{ github.run_number }}']('${VER_LINK}') created' >> $GITHUB_STEP_SUMMARY - name: Evidence on release-bundle v2 + env: + EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }} run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT echo '{ "actor": "${{ github.actor }}", "date": "'$(date -u +"%Y-%m-%dT%H:%M:%SZ")'" }' > rbv2_evidence.json JF_LINK=${{ vars.ARTIFACTORY_URL }}'/ui/artifactory/lifecycle/?bundleName='${{ vars.BUNDLE_NAME }}'&bundleToFlash='${{ vars.BUNDLE_NAME }}'&releaseBundleVersion='${{ github.run_number }}'&repositoryKey=release-bundles-v2&activeVersionTab=Version%20Timeline&activeKanbanTab=promotion' echo 'Test on Release bundle ['${{ vars.BUNDLE_NAME }}':'${{ github.run_number }}']('${JF_LINK}') success' >> $GITHUB_STEP_SUMMARY jf evd create --release-bundle ${{ vars.BUNDLE_NAME }} --release-bundle-version ${{ github.run_number }} \ --predicate ./rbv2_evidence.json --predicate-type https://jfrog.com/evidence/testing-results/v1 \ - --key "${{ secrets.PRIVATE_KEY }}" + --key "$evidence_signing_key_file" echo '๐Ÿ”Ž Evidence attached: integration-test ๐Ÿงช ' >> $GITHUB_STEP_SUMMARY diff --git a/.github/workflows/codeql-evidence-example.yml b/.github/workflows/codeql-evidence-example.yml index 0eff980..8c56e90 100644 --- a/.github/workflows/codeql-evidence-example.yml +++ b/.github/workflows/codeql-evidence-example.yml @@ -82,14 +82,26 @@ jobs: # Attaching the evidence to associated package - name: Attach Evidence using JFrog CLI + env: + EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }} run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT if [ ${{ matrix.language_details.name }} == 'go' ]; then PACKAGE_VERSION="v0.0.${{ github.run_number }}" jf evd create \ --package-name "jfrog.com/mygobuild" \ --package-version $PACKAGE_VERSION \ --package-repo-name go-local \ - --key "${{ secrets.PRIVATE_KEY }}" \ + --key "$evidence_signing_key_file" \ --key-alias "${{ vars.EVIDENCE_KEY_ALIAS }}" \ --predicate "results-go/go.sarif" \ --predicate-type "http://github.com/CodeQL/static-analysis" \ @@ -100,7 +112,7 @@ jobs: --package-name my-javascript-build \ --package-version $PACKAGE_VERSION \ --package-repo-name javascript-local \ - --key "${{ secrets.PRIVATE_KEY }}" \ + --key "$evidence_signing_key_file" \ --key-alias "${{ vars.EVIDENCE_KEY_ALIAS }}" \ --predicate "results-javascript/javascript.sarif" \ --predicate-type "http://github.com/CodeQL/static-analysis" \ diff --git a/.github/workflows/cypress-evidence-example.yml b/.github/workflows/cypress-evidence-example.yml index a0f47aa..985a006 100644 --- a/.github/workflows/cypress-evidence-example.yml +++ b/.github/workflows/cypress-evidence-example.yml @@ -65,12 +65,24 @@ jobs: #Steps to attach evidence to the package - name: Attach evidence to the package working-directory: examples/cypress + env: + EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }} run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT jf evd create \ --package-name $IMAGE_NAME \ --package-version $TAG_NAME \ --package-repo-name $REPO_NAME \ - --key "${{ secrets.PRIVATE_KEY }}" \ + --key "$evidence_signing_key_file" \ --key-alias "${{ secrets.PRIVATE_KEY_ALIAS }}" \ --predicate "reports/overall-report.json" \ --predicate-type "http://cypress.io/test-results/v1" \ diff --git a/.github/workflows/dependabot-evidence-example.yml b/.github/workflows/dependabot-evidence-example.yml index 21f456a..4c89a40 100644 --- a/.github/workflows/dependabot-evidence-example.yml +++ b/.github/workflows/dependabot-evidence-example.yml @@ -74,12 +74,24 @@ jobs: # Attaching the evidence to associated package - name: Attach Evidence using JFrog CLI + env: + EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }} run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT jf evd create \ --package-name $IMAGE_NAME \ --package-version $VERSION \ --package-repo-name $REPO_NAME \ - --key "${{ secrets.PRIVATE_KEY }}" \ + --key "$evidence_signing_key_file" \ --key-alias "${{ vars.EVIDENCE_KEY_ALIAS }}" \ --predicate ./dependabot.json \ --predicate-type http://Github.com/Dependabot/static-analysis \ diff --git a/.github/workflows/dive-evidence-example.yml b/.github/workflows/dive-evidence-example.yml index 578612a..1847efd 100644 --- a/.github/workflows/dive-evidence-example.yml +++ b/.github/workflows/dive-evidence-example.yml @@ -48,12 +48,24 @@ jobs: # Attaching the evidence to associated package - name: Attach evidence using jfrog cli + env: + EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }} run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT jf evd create \ --package-name $IMAGE_NAME \ --package-version $VERSION \ --package-repo-name $REPO_NAME \ - --key "${{ secrets.PRIVATE_KEY }}" \ + --key "$evidence_signing_key_file" \ --key-alias "${{ vars.EVIDENCE_KEY_ALIAS }}" \ --predicate ./dive.json \ --predicate-type dive/docker-size-scan/v1 \ diff --git a/.github/workflows/jira-evidence-example.yml b/.github/workflows/jira-evidence-example.yml index e64e3fa..1723717 100644 --- a/.github/workflows/jira-evidence-example.yml +++ b/.github/workflows/jira-evidence-example.yml @@ -77,11 +77,23 @@ jobs: - name: Create JIRA evidence + env: + EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }} run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT jf evd create \ --build-name $BUILD_NAME \ --build-number ${{ github.run_number }} \ - --key "${{ secrets.PRIVATE_KEY }}" \ + --key "$evidence_signing_key_file" \ --key-alias "${{ vars.EVIDENCE_KEY_ALIAS }}" \ --predicate ./examples/jira/helper/transformed_jira_data.json \ --predicate-type http://atlassian.com/jira/issues/v1 \ diff --git a/.github/workflows/junit-evidence-example.yml b/.github/workflows/junit-evidence-example.yml index 090743f..465548a 100644 --- a/.github/workflows/junit-evidence-example.yml +++ b/.github/workflows/junit-evidence-example.yml @@ -87,13 +87,25 @@ jobs: # Attaching the evidence to associated build - name: Attach evidence using jfrog cli + env: + EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }} run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT cd examples/junit/src if [ -f "target/consolidated-test-report.json" ]; then jf evd create \ --build-name $BUILD_NAME \ --build-number ${{ github.run_number }} \ - --key "${{ secrets.PRIVATE_KEY }}" \ + --key "$evidence_signing_key_file" \ --key-alias "${{ vars.EVIDENCE_KEY_ALIAS }}" \ --predicate ./target/consolidated-test-report.json \ --predicate-type https://jfrog.com/evidence/junit-test-results/v1 \ diff --git a/.github/workflows/katalon-evidence-example.yml b/.github/workflows/katalon-evidence-example.yml index 14612bc..5939925 100644 --- a/.github/workflows/katalon-evidence-example.yml +++ b/.github/workflows/katalon-evidence-example.yml @@ -141,21 +141,31 @@ jobs: - name: Attach evidence to the package working-directory: examples/katalon shell: pwsh + env: + EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }} run: | + if ([string]::IsNullOrWhiteSpace($env:EVIDENCE_SIGNING_KEY)) { + Write-Error "Evidence signing key is empty" + exit 1 + } + $evidenceSigningKeyFile = Join-Path $env:RUNNER_TEMP "evidence-signing.key" + $utf8 = New-Object System.Text.UTF8Encoding $false + [System.IO.File]::WriteAllText($evidenceSigningKeyFile, ($env:EVIDENCE_SIGNING_KEY.TrimEnd("`r", "`n") + "`n"), $utf8) + icacls $evidenceSigningKeyFile /inheritance:r /grant:r "$($env:USERNAME):(F)" | Out-Null + Remove-Item Env:\EVIDENCE_SIGNING_KEY $packageName = "${{ env.IMAGE_NAME }}" $packageVersion = "${{ env.TAG_NAME }}" $packageRepoName = "${{ env.REPO_NAME }}" $predicatePath = "reports\katalon-results.json" $providerId = "katalon" $predicateType = "http://katalon.com/test-results/v1" - $privateKey = "${{ secrets.PRIVATE_KEY }}" $privateKeyAlias = "${{ secrets.PRIVATE_KEY_ALIAS }}" $commandArgs = @( "evd", "create", "--package-name", $packageName, "--package-version", $packageVersion, "--package-repo-name", $packageRepoName, - "--key", $privateKey, + "--key", $evidenceSigningKeyFile, "--key-alias", $privateKeyAlias, "--provider-id", $providerId, "--predicate", $predicatePath, diff --git a/.github/workflows/owasp-depcheck-evidence-example.yml b/.github/workflows/owasp-depcheck-evidence-example.yml index 35b7fdd..f9aa12c 100644 --- a/.github/workflows/owasp-depcheck-evidence-example.yml +++ b/.github/workflows/owasp-depcheck-evidence-example.yml @@ -79,11 +79,23 @@ jobs: # Attaching the evidence to associated build - name: Attach evidence to associated build + env: + EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }} run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT jf evd create \ --build-name $BUILD_NAME \ --build-number ${{ github.run_number }} \ - --key "${{ secrets.PRIVATE_KEY }}" \ + --key "$evidence_signing_key_file" \ --key-alias "${{ vars.EVIDENCE_KEY_ALIAS }}" \ --predicate ./reports/dependency-check-report.json \ --predicate-type https://owasp.org/dependency-check \ diff --git a/.github/workflows/promote-to-prod.yml b/.github/workflows/promote-to-prod.yml index a150889..2b87fd6 100644 --- a/.github/workflows/promote-to-prod.yml +++ b/.github/workflows/promote-to-prod.yml @@ -46,9 +46,21 @@ jobs: result=$(jq .approved ./policy.json) echo "RESULT=$result" >> $GITHUB_ENV - name: Promote to Production + env: + EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }} run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT if [ "${{ env.RESULT }}" == "true" ]; then - jf evd create --key "${{ secrets.PRIVATE_KEY }}" --key-alias SIGNING-KEY \ + jf evd create --key "$evidence_signing_key_file" --key-alias SIGNING-KEY \ --release-bundle ${{ inputs.bundle-name }} --release-bundle-version ${{ inputs.bundle-version }} \ --predicate ./policy.json --predicate-type https://jfrog.com/evidence/approval/v1 jf release-bundle-promote ${{ inputs.bundle-name }} ${{ inputs.bundle-version }} PROD --signing-key RSA-SIGNING --sync=true diff --git a/.github/workflows/sample-argv-check.yml b/.github/workflows/sample-argv-check.yml new file mode 100644 index 0000000..454498a --- /dev/null +++ b/.github/workflows/sample-argv-check.yml @@ -0,0 +1,13 @@ +name: Sample command-line secrets + +on: + pull_request: + push: + +jobs: + signing-key-not-argv: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - name: Reject signing keys and access tokens on the command line + run: bash scripts/check-signing-key-not-argv.sh diff --git a/.github/workflows/scorecard-evidence-example.yml b/.github/workflows/scorecard-evidence-example.yml index 43afc8e..726b22f 100644 --- a/.github/workflows/scorecard-evidence-example.yml +++ b/.github/workflows/scorecard-evidence-example.yml @@ -52,12 +52,24 @@ jobs: # Attaching the evidence to associated package - name: Attach evidence using jfrog cli + env: + EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }} run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT jf evd create \ --package-name $IMAGE_NAME \ --package-version $VERSION \ --package-repo-name $REPO_NAME \ - --key "${{ secrets.PRIVATE_KEY }}" \ + --key "$evidence_signing_key_file" \ --key-alias "${{ vars.EVIDENCE_KEY_ALIAS }}" \ --predicate ./scorecard-results.sarif \ --predicate-type http://openssf.org/scorecard/security-scan/v1 \ diff --git a/.github/workflows/semgrep-evidence-example.yml b/.github/workflows/semgrep-evidence-example.yml index 4ac7e5d..ccb6622 100644 --- a/.github/workflows/semgrep-evidence-example.yml +++ b/.github/workflows/semgrep-evidence-example.yml @@ -57,12 +57,24 @@ jobs: # Attaching the evidence to associated package - name: Attach Evidence using JFrog CLI + env: + EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }} run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT jf evd create \ --package-name js-semgrep-sample-build \ --package-version "0.0.1" \ --package-repo-name javascript-local \ - --key "${{ secrets.PRIVATE_KEY }}" \ + --key "$evidence_signing_key_file" \ --key-alias "${{ vars.EVIDENCE_KEY_ALIAS }}" \ --predicate "semgrep-results.sarif" \ --predicate-type "http://semgrep.com/security-scan/v1" \ diff --git a/.github/workflows/simple-evidence.yml b/.github/workflows/simple-evidence.yml index 42e3a51..ae62292 100644 --- a/.github/workflows/simple-evidence.yml +++ b/.github/workflows/simple-evidence.yml @@ -48,7 +48,19 @@ jobs: jf rt build-docker-create dev-docker-local --image-file metadata.json --build-name ${{ vars.BUILD_NAME }} --build-number ${{ github.run_number }} - name: Set Signing Evidence on Docker + env: + EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }} run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT # Create signing evidence JSON file SIGNING_ACTOR="${{ github.actor }}" SIGNING_DATE=$(date -u +"%Y-%m-%dT%H:%M:%SZ") @@ -62,7 +74,7 @@ jobs: --package-name ${{ vars.IMAGE_NAME }} \ --package-version "${{ github.run_number }}" \ --package-repo-name ${{ vars.DEV_DOCKER_REPO_KEY }} \ - --key "${{ secrets.PRIVATE_KEY }}" \ + --key "$evidence_signing_key_file" \ --key-alias SIGNING-KEY \ --predicate ./sign.json \ --predicate-type https://jfrog.com/evidence/signature/v1 @@ -83,7 +95,19 @@ jobs: jf rt build-add-git jf rt build-publish - name: Sign Build Evidence + env: + EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }} run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT # Define actor and date for the signing evidence ACTOR="${{ github.actor }}" DATE=$(date -u +"%Y-%m-%dT%H:%M:%SZ") @@ -100,7 +124,7 @@ jobs: --build-number "${{ github.run_number }}" \ --predicate ./sign.json \ --predicate-type https://jfrog.com/evidence/build-signature/v1 \ - --key "${{ secrets.PRIVATE_KEY }}" \ + --key "$evidence_signing_key_file" \ --key-alias SIGNING-KEY # Add a summary entry to GitHub Actions @@ -144,7 +168,19 @@ jobs: echo "๐Ÿš€ Succesfully promote to \`QA\` environemnt" >> $GITHUB_STEP_SUMMARY - name: Attach Test Evidence to Release Bundle + env: + EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }} run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT ACTOR="${{ github.actor }}" # Create the test evidence JSON DATE=$(date -u +"%Y-%m-%dT%H:%M:%SZ") TEST_NAME="CI test" @@ -169,7 +205,7 @@ jobs: --release-bundle-version "${{ github.run_number }}" \ --predicate ./test_evidence.json \ --predicate-type https://jfrog.com/evidence/testing-results/v1 \ - --key "${{ secrets.PRIVATE_KEY }}" \ + --key "$evidence_signing_key_file" \ --key-alias SIGNING-KEY # Log the evidence attachment diff --git a/.github/workflows/test-evd.yml b/.github/workflows/test-evd.yml index 777e1d8..ac500a1 100644 --- a/.github/workflows/test-evd.yml +++ b/.github/workflows/test-evd.yml @@ -33,20 +33,44 @@ jobs: --predicate-type https://cypress.io/evidence/e2e/v1 --predicate test-report.json - name: Create evidence key from pbcopy + env: + EVIDENCE_SIGNING_KEY: ${{ secrets.KEY1 }} run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT echo "๐Ÿ“‹ Creating evidence from test results..." echo '{name: "test", key: "test"}' > test-report.json jf evd create \ --subject-repo-path dev-generic-local/Target.file \ --predicate-type https://cypress.io/evidence/e2e/v1 --predicate test-report.json \ - --key ${{secrets.KEY1}} + --key "$evidence_signing_key_file" - name: Create evidence key terminal + env: + EVIDENCE_SIGNING_KEY: ${{ secrets.KEY }} run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT echo "๐Ÿ“‹ Creating evidence from test results..." echo '{name: "test", key: "test"}' > test-report.json jf evd create \ --subject-repo-path dev-generic-local/Target.file \ --predicate-type https://cypress.io/evidence/e2e/v1 --predicate test-report.json \ - --key ${{secrets.KEY}} + --key "$evidence_signing_key_file" diff --git a/.github/workflows/testRail-evidence-example.yml b/.github/workflows/testRail-evidence-example.yml index c24662b..ebdc5fa 100644 --- a/.github/workflows/testRail-evidence-example.yml +++ b/.github/workflows/testRail-evidence-example.yml @@ -77,12 +77,24 @@ jobs: #Steps to attach evidence to the package - name: Attach evidence to the package working-directory: examples/testRail + env: + EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }} run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT jf evd create \ --package-name $IMAGE_NAME \ --package-version $TAG_NAME \ --package-repo-name $REPO_NAME \ - --key "${{ secrets.PRIVATE_KEY }}" \ + --key "$evidence_signing_key_file" \ --key-alias "${{ secrets.PRIVATE_KEY_ALIAS }}" \ --predicate "reports/overall-report.json" \ --predicate-type "http://testrail.com/test-results" \ diff --git a/.github/workflows/tfsec-evidence-example.yml b/.github/workflows/tfsec-evidence-example.yml index 5ae8359..a170fe1 100644 --- a/.github/workflows/tfsec-evidence-example.yml +++ b/.github/workflows/tfsec-evidence-example.yml @@ -52,11 +52,23 @@ jobs: # Attaching the evidence to associated package - name: Attach evidence using jfrog cli + env: + EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }} run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT jf evd create \ --build-name my-tf-build \ --build-number ${{ github.run_number }} \ - --key "${{ secrets.PRIVATE_KEY }}" \ + --key "$evidence_signing_key_file" \ --key-alias "${{ vars.EVIDENCE_KEY_ALIAS }}" \ --predicate ./tfsec.json \ --predicate-type http://aquasec.com/tfsec/security-scan \ diff --git a/.github/workflows/trivy-evidence-example.yml b/.github/workflows/trivy-evidence-example.yml index 76d797f..f1c2c3f 100644 --- a/.github/workflows/trivy-evidence-example.yml +++ b/.github/workflows/trivy-evidence-example.yml @@ -53,12 +53,24 @@ jobs: # Attaching the evidence to associated package - name: Attach evidence using jfrog cli + env: + EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }} run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT jf evd create \ --package-name $IMAGE_NAME \ --package-version $VERSION \ --package-repo-name $REPO_NAME \ - --key "${{ secrets.PRIVATE_KEY }}" \ + --key "$evidence_signing_key_file" \ --key-alias "${{ vars.EVIDENCE_KEY_ALIAS }}" \ --predicate ./trivy-results.json \ --predicate-type http://aquasec.com/trivy/security-scan \ diff --git a/.github/workflows/trufflehog-evidence-example.yml b/.github/workflows/trufflehog-evidence-example.yml index a558704..14707b7 100644 --- a/.github/workflows/trufflehog-evidence-example.yml +++ b/.github/workflows/trufflehog-evidence-example.yml @@ -52,14 +52,26 @@ jobs: # Attaching the evidence to associated package - name: Attach evidence using jfrog cli + env: + EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }} run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT ls python ./examples/trufflehog/jsonl_to_json_converted.py jf evd create \ --package-name $IMAGE_NAME \ --package-version $VERSION \ --package-repo-name $REPO_NAME \ - --key "${{ secrets.PRIVATE_KEY }}" \ + --key "$evidence_signing_key_file" \ --key-alias "${{ vars.EVIDENCE_KEY_ALIAS }}" \ --predicate ./trufflehog.json \ --predicate-type https://trufflesecurity.com/TruffleHog \ diff --git a/.github/workflows/zap-evidence-example.yml b/.github/workflows/zap-evidence-example.yml index ed7f631..430a648 100644 --- a/.github/workflows/zap-evidence-example.yml +++ b/.github/workflows/zap-evidence-example.yml @@ -48,12 +48,24 @@ jobs: cat summary.json - name: Evidence on docker + env: + EVIDENCE_SIGNING_KEY: ${{ secrets.JIRA_TEST_PKEY }} run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT jf evd create \ --package-name ${{ env.IMAGE_NAME }} \ --package-version "${{ env.IMAGE_TAG }}" \ --package-repo-name ${{ env.DOCKER_REPO }} \ - --key "${{ secrets.JIRA_TEST_PKEY }}" \ + --key "$evidence_signing_key_file" \ --key-alias ${{ vars.JIRA_TEST_KEY }} \ --predicate ./summary.json \ --predicate-type https://jfrog.com/evidence/zap-scan/v1 \ No newline at end of file diff --git a/.gitignore b/.gitignore index 80b53c4..864c2a9 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,3 @@ /examples/jira/bin/* *.pem +evidence-signing*.key diff --git a/README.md b/README.md index d2a7245..7032d30 100644 --- a/README.md +++ b/README.md @@ -79,7 +79,7 @@ PRIVATE_KEY (the key used to sign evidence) |------------|-------------|---------------| | ARTIFACTORY_ACCESS_TOKEN | A valid JFrog Access Token with permissions to deploy and annotate. | | | JF_USER | Your JFrog Platform username, used for the docker login action. | my-user | -| PRIVATE_KEY | The raw private key used to sign all evidence created in the workflow. | -----BEGIN PRIVATE KEY-----... | +| PRIVATE_KEY | PEM signing key. The workflow writes it to a job-private file and passes that path to --key. | -----BEGIN PRIVATE KEY-----... | ### GitHub Variables @@ -154,10 +154,22 @@ Now we attach the first piece of evidence directly to the Docker image package. ```yaml - name: Evidence on docker + env: + EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }} run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT echo '{ "actor": "${{ github.actor }}", "date": "'$(date -u +"%Y-%m-%dT%H:%M:%SZ")'" }' > sign.json jf evd create --package-name example-project-app --package-version 32 --package-repo-name example-project-docker-dev \ - --key "${{ secrets.PRIVATE_KEY }}" \ + --key "$evidence_signing_key_file" \ --predicate ./sign.json --predicate-type https://jfrog.com/evidence/signature/v1 echo ' Evidence attached: `signature` ' ``` @@ -168,10 +180,22 @@ To demonstrate that evidence can be attached to any artifact, not just packages, ```yaml - name: Upload readme file + env: + EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }} run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT jf rt upload ./README.md example-project-generic-dev/readme/${{ github.run_number }}/ --build-name ${{ vars.BUILD_NAME }} --build-number ${{ github.run_number }} jf evd create --subject-repo-path example-project-generic-dev/readme/${{ github.run_number }}/README.md \ - --key "${{ secrets.PRIVATE_KEY }}" \ + --key "$evidence_signing_key_file" \ --predicate ./sign.json --predicate-type https://jfrog.com/evidence/signature/v1 ``` @@ -190,7 +214,7 @@ This step performs the final action: it aggregates all previously linked artifac echo '{ "actor": "${{ github.actor }}", "date": "'$(date -u +"%Y-%m-%dT%H:%M:%SZ")'" }' > sign.json jf evd create --build-name ${{ vars.BUILD_NAME }} --build-number ${{ github.run_number }} \ --predicate ./sign.json --predicate-type https://jfrog.com/evidence/build-signature/v1 \ - --key "${{ secrets.PRIVATE_KEY }}" + --key "$evidence_signing_key_file" echo ' Evidence attached: `build-signature` ' >> $GITHUB_STEP_SUMMARY ``` @@ -200,7 +224,19 @@ The workflow now creates an immutable Release Bundle from the build we just publ ```yaml - name: Create release bundle + env: + EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }} run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT echo '{ "files": [ {"build": "'"${{ vars.BUILD_NAME }}/${{ github.run_number }}"'" } ] }' > bundle-spec.json jf release-bundle-create ${{ vars.BUNDLE_NAME }} ${{ github.run_number }} --signing-key PGP-RSA-2048 --spec bundle-spec.json --sync=true NAME_LINK=${{ vars.ARTIFACTORY_URL }}'/ui/artifactory/lifecycle/?bundleName='${{ vars.BUNDLE_NAME }}'&bundleToFlash='${{ vars.BUNDLE_NAME }}'&repositoryKey=example-project-release-bundles-v2&activeKanbanTab=promotion' @@ -220,7 +256,7 @@ Finally, we attach signed evidence to the immutable Release Bundle itself. This echo 'Test on Release bundle ['${{ vars.BUNDLE_NAME }}':'${{ github.run_number }}']('${JF_LINK}') success' >> $GITHUB_STEP_SUMMARY jf evd create --release-bundle ${{ vars.BUNDLE_NAME }} --release-bundle-version ${{ github.run_number }} \ --predicate ./rbv2_evidence.json --predicate-type https://jfrog.com/evidence/rbv2-signature/v1 \ - --key "${{ secrets.PRIVATE_KEY }}" + --key "$evidence_signing_key_file" echo ' Evidence attached: integration-test ' >> $GITHUB_STEP_SUMMARY ``` diff --git a/examples/anchore/anchore-sbom-readme.md b/examples/anchore/anchore-sbom-readme.md index 5218366..f0850c3 100644 --- a/examples/anchore/anchore-sbom-readme.md +++ b/examples/anchore/anchore-sbom-readme.md @@ -84,12 +84,25 @@ You can trigger the workflow manually from the GitHub Actions tab. The workflow - **Attach Evidence:** This final step uses `jf evd create` to attach the SBOM to the Docker image that was built at the start. The JSON SBOM serves as the official, machine-readable predicate, while the optional Markdown report provides a summary for easy viewing in the Artifactory UI. - ```bash - jf evd create \ + ```yaml + env: + EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }} + run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT + jf evd create \ --package-name $IMAGE_NAME \ --package-version $VERSION \ --package-repo-name $REPO_NAME \ - --key "${{ secrets.PRIVATE_KEY }}" \ + --key "$evidence_signing_key_file" \ --key-alias "${{ vars.EVIDENCE_KEY_ALIAS }}" \ --predicate ./anchore-sbom.json \ --provider-id "anchore" \ diff --git a/examples/anchore/anchore-scan-readme.md b/examples/anchore/anchore-scan-readme.md index 933ef07..fceecb1 100644 --- a/examples/anchore/anchore-scan-readme.md +++ b/examples/anchore/anchore-scan-readme.md @@ -86,12 +86,25 @@ You can trigger the workflow manually from the GitHub Actions tab. The workflow - **Attach Evidence:** This final step uses jf evd create to attach the scan results to the Docker image built earlier. The SARIF file serves as the official, machine-readable predicate, while the optional Markdown report provides a summary for easy viewing in the Artifactory UI. - ```bash - jf evd create \ + ```yaml + env: + EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }} + run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT + jf evd create \ --package-name $IMAGE_NAME \ --package-version $VERSION \ --package-repo-name $REPO_NAME \ - --key "${{ secrets.PRIVATE_KEY }}" \ + --key "$evidence_signing_key_file" \ --key-alias "${{ vars.EVIDENCE_KEY_ALIAS }}" \ --predicate ./anchore-scan-results.sarif \ --provider-id "anchore" \ diff --git a/examples/aquasecurity/tfsec/README.md b/examples/aquasecurity/tfsec/README.md index 582db0c..d35c02e 100644 --- a/examples/aquasecurity/tfsec/README.md +++ b/examples/aquasecurity/tfsec/README.md @@ -83,11 +83,24 @@ You can trigger the workflow manually from the GitHub Actions tab. The workflow - **Attach Evidence:** This final step uses `jf evd create --build-name` to attach the scan results to the **build information** that was published in the first step. This creates a verifiable link between the CI process and its security posture. - ```bash - jf evd create \ + ```yaml + env: + EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }} + run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT + jf evd create \ --build-name my-tf-build \ --build-number ${{ github.run_number }} \ - --key "${{ secrets.PRIVATE_KEY }}" \ + --key "$evidence_signing_key_file" \ --key-alias "${{ vars.EVIDENCE_KEY_ALIAS }}" \ --predicate ./tfsec.json \ --predicate-type http://aquasec.com/tfsec/security-scan \ diff --git a/examples/aquasecurity/trivy/README.md b/examples/aquasecurity/trivy/README.md index ca5eee4..aeac053 100644 --- a/examples/aquasecurity/trivy/README.md +++ b/examples/aquasecurity/trivy/README.md @@ -150,11 +150,24 @@ jf rt docker-push $REGISTRY_URL/$REPO_NAME/$IMAGE_NAME:$VERSION $REPO_NAME --bui * **Attach Evidence:** ``` -jf evd create \ +env: + EVIDENCE_SIGNING_KEY: ${{ secrets.TRIVY_TEST_PKEY }} +run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT + jf evd create \ --package-name $IMAGE_NAME \ --package-version $VERSION \ --package-repo-name $REPO_NAME \ - --key "${{ secrets.TRIVY_TEST_PKEY }}" \ + --key "$evidence_signing_key_file" \ --key-alias ${{ vars.TRIVY_TEST_KEY }} \ --predicate ./trivy-results.json \ --predicate-type http://aquasec.com/trivy/security-scan diff --git a/examples/blazemeter/README.md b/examples/blazemeter/README.md index eeee447..fd14169 100644 --- a/examples/blazemeter/README.md +++ b/examples/blazemeter/README.md @@ -152,11 +152,21 @@ Once the workflow completes successfully, you can navigate to your repository in * **Attach Evidence:** ```bash + umask 077 + if [ -z "${PRIVATE_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$PRIVATE_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset PRIVATE_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT jf evd create \ --package-name $IMAGE_NAME \ --package-version $TAG_NAME \ --package-repo-name $REPO_NAME \ - --key "$PRIVATE_KEY" \ + --key "$evidence_signing_key_file" \ --key-alias "$PRIVATE_KEY_ALIAS" \ --predicate "blazemeter-predicate.json" \ --predicate-type "http://blazemeter.com/performance-results/v1" \ diff --git a/examples/cypress/README.md b/examples/cypress/README.md index fdbfaf2..6f0f713 100644 --- a/examples/cypress/README.md +++ b/examples/cypress/README.md @@ -96,17 +96,30 @@ This is the core testing step. The `cypress-io/github-action` automates the enti - **Attach Evidence:** This final step uses `jf evd create` to attach the test results to the Docker image that was built at the start. The unified JSON report serves as the official, machine-readable predicate, while the optional Markdown report provides a summary for easy viewing in the Artifactory UI. - ```bash - jf evd create \ - --package-name $IMAGE_NAME \ - --package-version $TAG_NAME \ - --package-repo-name $REPO_NAME \ - --key "${{ secrets.PRIVATE_KEY }}" \ - --key-alias "${{ secrets.PRIVATE_KEY_ALIAS }}" \ - --predicate "reports/overall-report.json" \ - --predicate-type "http://cypress.io/test-results/v1" \ - --provider-id "cypress" \ - [--markdown "reports/cypress-results.md"] + ```yaml + env: + EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }} + run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT + jf evd create \ + --package-name $IMAGE_NAME \ + --package-version $TAG_NAME \ + --package-repo-name $REPO_NAME \ + --key "$evidence_signing_key_file" \ + --key-alias "${{ secrets.PRIVATE_KEY_ALIAS }}" \ + --predicate "reports/overall-report.json" \ + --predicate-type "http://cypress.io/test-results/v1" \ + --provider-id "cypress" \ + [--markdown "reports/cypress-results.md"] ``` The --markdown flag is included only if ATTACH_OPTIONAL_MARKDOWN_TO_EVIDENCE is set to true. diff --git a/examples/dive/README.md b/examples/dive/README.md index 0e72d41..f27a108 100644 --- a/examples/dive/README.md +++ b/examples/dive/README.md @@ -138,11 +138,24 @@ jf rt docker-push $REGISTRY_DOMAIN/$REPO_NAME/$IMAGE_NAME:$VERSION $REPO_NAME -- This final step uses `jf evd create` to attach the Dive analysis to the Docker image built earlier. The `dive.json` file serves as the official, machine-readable predicate, while the optional Markdown report provides a summary for easy viewing in the Artifactory UI. ``` -jf evd create \ +env: + EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }} +run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT + jf evd create \ --package-name $IMAGE_NAME \ --package-version $VERSION \ --package-repo-name $REPO_NAME \ - --key "${{ secrets.PRIVATE_KEY }}" \ + --key "$evidence_signing_key_file" \ --key-alias "${{ vars.EVIDENCE_KEY_ALIAS }}" \ --predicate ./dive.json \ --predicate-type dive/docker-size-scan/v1 diff --git a/examples/github/codeql/README.md b/examples/github/codeql/README.md index 887b8f9..54ed1f0 100644 --- a/examples/github/codeql/README.md +++ b/examples/github/codeql/README.md @@ -73,29 +73,55 @@ The workflow attaches CodeQL analysis results as evidence using the following fo ### For Go Packages: ```yaml -jf evd create \ ---package-name "jfrog.com/mygobuild" \ ---package-version $PACKAGE_VERSION \ ---package-repo-name go-local \ ---key "${{ secrets.CODEQL_SIGNING_KEY }}" \ ---key-alias ${{ vars.CODEQL_KEY_ALIAS }} \ ---predicate "results-go/go.sarif" \ ---predicate-type "http://github.com/CodeQL/static-analysis" \ ---markdown "results-go/go-report.md" +env: + EVIDENCE_SIGNING_KEY: ${{ secrets.CODEQL_SIGNING_KEY }} +run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT + jf evd create \ + --package-name "jfrog.com/mygobuild" \ + --package-version $PACKAGE_VERSION \ + --package-repo-name go-local \ + --key "$evidence_signing_key_file" \ + --key-alias ${{ vars.CODEQL_KEY_ALIAS }} \ + --predicate "results-go/go.sarif" \ + --predicate-type "http://github.com/CodeQL/static-analysis" \ + --markdown "results-go/go-report.md" ``` ### For JavaScript Packages: ```yaml -jf evd create \ ---package-name my-javascript-build \ ---package-version $PACKAGE_VERSION \ ---package-repo-name javascript-local \ ---key "${{ secrets.CODEQL_SIGNING_KEY }}" \ ---key-alias ${{ vars.CODEQL_KEY_ALIAS }} \ ---predicate "results-javascript/javascript.sarif" \ ---predicate-type "http://github.com/CodeQL/static-analysis" \ ---provider-id "github" \ ---markdown "results-javascript/javascript-report.md" +env: + EVIDENCE_SIGNING_KEY: ${{ secrets.CODEQL_SIGNING_KEY }} +run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT + jf evd create \ + --package-name my-javascript-build \ + --package-version $PACKAGE_VERSION \ + --package-repo-name javascript-local \ + --key "$evidence_signing_key_file" \ + --key-alias ${{ vars.CODEQL_KEY_ALIAS }} \ + --predicate "results-javascript/javascript.sarif" \ + --predicate-type "http://github.com/CodeQL/static-analysis" \ + --provider-id "github" \ + --markdown "results-javascript/javascript-report.md" ``` diff --git a/examples/github/dependabot/README.md b/examples/github/dependabot/README.md index b8d6b1e..0fa5988 100644 --- a/examples/github/dependabot/README.md +++ b/examples/github/dependabot/README.md @@ -101,16 +101,29 @@ The Fetch Dependabot Vulnerability Snapshot step retrieves Dependabot alerts and - **Attach Evidence:** This final step uses `jf evd create` to attach the Dependabot alert data to the Docker image. The `dependabot.json` file serves as the official, machine-readable predicate, while the optional Markdown report provides a summary for easy viewing in the Artifactory UI. - ```bash - jf evd create \ - --package-name $IMAGE_NAME \ - --package-version $VERSION \ - --package-repo-name $REPO_NAME \ - --key "${{ secrets.TEST_PRVT_KEY }}" \ - --key-alias ${{ vars.TEST_PUB_KEY_ALIAS }} \ - --provider-id "github" \ - --predicate ./dependabot.json \ - --predicate-type http://Github.com/Dependabot/static-analysis + ```yaml + env: + EVIDENCE_SIGNING_KEY: ${{ secrets.TEST_PRVT_KEY }} + run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT + jf evd create \ + --package-name $IMAGE_NAME \ + --package-version $VERSION \ + --package-repo-name $REPO_NAME \ + --key "$evidence_signing_key_file" \ + --key-alias ${{ vars.TEST_PUB_KEY_ALIAS }} \ + --provider-id "github" \ + --predicate ./dependabot.json \ + --predicate-type http://Github.com/Dependabot/static-analysis ``` ## References diff --git a/examples/gitlab/provenance/.gitlab-ci.yml b/examples/gitlab/provenance/.gitlab-ci.yml index 0518657..d31f84e 100644 --- a/examples/gitlab/provenance/.gitlab-ci.yml +++ b/examples/gitlab/provenance/.gitlab-ci.yml @@ -18,8 +18,11 @@ build_and_publish: - apt-get update - apt-get install -y curl python3 python3-pip - curl -fL https://install-cli.jfrog.io | sh - - jf config add --url ${ARTIFACTORY_URL} --access-token ${ARTIFACTORY_ACCESS_TOKEN} --interactive=false + - export JF_URL="${ARTIFACTORY_URL}" + - export JF_ACCESS_TOKEN="${ARTIFACTORY_ACCESS_TOKEN}" script: + - export JF_URL="${ARTIFACTORY_URL}" + - export JF_ACCESS_TOKEN="${ARTIFACTORY_ACCESS_TOKEN}" - jf npmc --repo-resolve evidence-npm --repo-deploy evidence-npm - jf npm publish - jf npm pack @@ -42,8 +45,11 @@ create_md_file_and_attach_evidence: - apt-get update - apt-get install -y curl python3 python3-pip jq - curl -fL https://install-cli.jfrog.io | sh - - jf config add --url ${ARTIFACTORY_URL} --access-token ${ARTIFACTORY_ACCESS_TOKEN} --interactive=false + - export JF_URL="${ARTIFACTORY_URL}" + - export JF_ACCESS_TOKEN="${ARTIFACTORY_ACCESS_TOKEN}" script: + - export JF_URL="${ARTIFACTORY_URL}" + - export JF_ACCESS_TOKEN="${ARTIFACTORY_ACCESS_TOKEN}" # Extract predicate from the artifacts-metadata.json file - | if [ -f "${PREDICATE_FILE}" ]; then @@ -62,7 +68,18 @@ create_md_file_and_attach_evidence: echo "No artifacts metadata file found: ${PREDICATE_FILE}" fi - python3 json-to-md.py - - jf evd create --package-name="${PACKAGE_NAME}" --package-version="${PACKAGE_VERSION}" --package-repo-name="${REPO_NAME}" --key="${PRIVATE_KEY}" --key-alias="${PRIVATE_KEY_ALIAS}" --predicate="${PREDICATE_FILE}" --predicate-type="${PREDICATE_TYPE}" --provider-id="gitlab" --markdown="${MARKDOWN_FILE}" + - | + umask 077 + if [ -z "${PRIVATE_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$PRIVATE_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset PRIVATE_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT + jf evd create --package-name="${PACKAGE_NAME}" --package-version="${PACKAGE_VERSION}" --package-repo-name="${REPO_NAME}" --key="$evidence_signing_key_file" --key-alias="${PRIVATE_KEY_ALIAS}" --predicate="${PREDICATE_FILE}" --predicate-type="${PREDICATE_TYPE}" --provider-id="gitlab" --markdown="${MARKDOWN_FILE}" dependencies: - build_and_publish needs: diff --git a/examples/gitlab/provenance/README.md b/examples/gitlab/provenance/README.md index 8a1e88c..8d47f65 100644 --- a/examples/gitlab/provenance/README.md +++ b/examples/gitlab/provenance/README.md @@ -113,7 +113,8 @@ Once the pipeline completes successfully, you can navigate to your repository in * **Configure JFrog CLI:** ```bash -jf config add --url ${ARTIFACTORY_URL} --access-token ${ARTIFACTORY_ACCESS_TOKEN} --interactive=false +export JF_URL="${ARTIFACTORY_URL}" +export JF_ACCESS_TOKEN="${ARTIFACTORY_ACCESS_TOKEN}" ``` * **Configure npm Repositories:** @@ -141,11 +142,21 @@ python3 json-to-md.py * **Attach Evidence:** The final step uses `jf evd create` to attach the extracted `predicate.json` to the npm package that was published in the first stage. This creates a permanent, tamper-proof attestation of the package's build provenance. ```bash +umask 077 +if [ -z "${PRIVATE_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 +fi +evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" +printf '%s\n' "$PRIVATE_KEY" > "$evidence_signing_key_file" +chmod 600 "$evidence_signing_key_file" +unset PRIVATE_KEY +trap 'rm -f "$evidence_signing_key_file"' EXIT jf evd create \ --package-name "${PACKAGE_NAME}" \ --package-version "${PACKAGE_VERSION}" \ --package-repo-name "${REPO_NAME}" \ - --key "${PRIVATE_KEY}" \ + --key "$evidence_signing_key_file" \ --key-alias "${PRIVATE_KEY_ALIAS}" \ --predicate "${PREDICATE_FILE}" \ --predicate-type "${PREDICATE_TYPE}" \ diff --git a/examples/gitlab/sbom/.gitlab-ci.yml b/examples/gitlab/sbom/.gitlab-ci.yml index 4e7fce4..13905a1 100644 --- a/examples/gitlab/sbom/.gitlab-ci.yml +++ b/examples/gitlab/sbom/.gitlab-ci.yml @@ -25,8 +25,11 @@ build_and_push: - apk update - apk add go curl - curl -fL https://install-cli.jfrog.io | sh - - jf config add --url ${ARTIFACTORY_URL} --access-token ${ARTIFACTORY_ACCESS_TOKEN} --interactive=false + - export JF_URL="${ARTIFACTORY_URL}" + - export JF_ACCESS_TOKEN="${ARTIFACTORY_ACCESS_TOKEN}" script: + - export JF_URL="${ARTIFACTORY_URL}" + - export JF_ACCESS_TOKEN="${ARTIFACTORY_ACCESS_TOKEN}" - docker build -f ./Dockerfile -t $DOCKER_IMAGE_NAME_WITH_TAG ./ - jf rt docker-push ${DOCKER_IMAGE_NAME_WITH_TAG} $REPO_NAME --build-name=$BUILD_NAME --build-number=${BUILD_NUMBER} - jf rt build-publish ${BUILD_NAME} ${BUILD_NUMBER} @@ -47,7 +50,21 @@ create_md_file_and_attach_evidence: - apk update - apk add python3 py3-pip go curl - curl -fL https://install-cli.jfrog.io | sh - - jf config add --url ${ARTIFACTORY_URL} --access-token ${ARTIFACTORY_ACCESS_TOKEN} --interactive=false + - export JF_URL="${ARTIFACTORY_URL}" + - export JF_ACCESS_TOKEN="${ARTIFACTORY_ACCESS_TOKEN}" script: + - export JF_URL="${ARTIFACTORY_URL}" + - export JF_ACCESS_TOKEN="${ARTIFACTORY_ACCESS_TOKEN}" - python3 json-to-md.py - - jf evd create --package-name="${PACKAGE_NAME}" --package-version="${PACKAGE_VERSION}" --package-repo-name="${REPO_NAME}" --key="${PRIVATE_KEY}" --key-alias="${PRIVATE_KEY_ALIAS}" --predicate="${PREDICATE_FILE}" --predicate-type="${PREDICATE_TYPE}" --provider-id="gitlab" --markdown="${MARKDOWN_FILE}" \ No newline at end of file + - | + umask 077 + if [ -z "${PRIVATE_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$PRIVATE_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset PRIVATE_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT + jf evd create --package-name="${PACKAGE_NAME}" --package-version="${PACKAGE_VERSION}" --package-repo-name="${REPO_NAME}" --key="$evidence_signing_key_file" --key-alias="${PRIVATE_KEY_ALIAS}" --predicate="${PREDICATE_FILE}" --predicate-type="${PREDICATE_TYPE}" --provider-id="gitlab" --markdown="${MARKDOWN_FILE}" \ No newline at end of file diff --git a/examples/gitlab/sbom/README.md b/examples/gitlab/sbom/README.md index c271968..68bad20 100644 --- a/examples/gitlab/sbom/README.md +++ b/examples/gitlab/sbom/README.md @@ -78,7 +78,17 @@ Trigger the pipeline in GitLab CI/CD. The pipeline will: - **Attach Evidence:** The jf evd create command attaches the original SBOM report to the Docker image package in Artifactory. This creates a permanent, tamper-proof link between your image and its complete list of software components. ```bash - jf evd create --package-name="${PACKAGE_NAME}" --package-version="${PACKAGE_VERSION}" --package-repo-name="${REPO_NAME}" --key="${PRIVATE_KEY}" --key-alias="${PRIVATE_KEY_ALIAS}" --predicate="${PREDICATE_FILE}" --predicate-type="${PREDICATE_TYPE}" --provider-id="gitlab" --markdown="${MARKDOWN_FILE}" + umask 077 + if [ -z "${PRIVATE_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$PRIVATE_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset PRIVATE_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT + jf evd create --package-name="${PACKAGE_NAME}" --package-version="${PACKAGE_VERSION}" --package-repo-name="${REPO_NAME}" --key="$evidence_signing_key_file" --key-alias="${PRIVATE_KEY_ALIAS}" --predicate="${PREDICATE_FILE}" --predicate-type="${PREDICATE_TYPE}" --provider-id="gitlab" --markdown="${MARKDOWN_FILE}" ``` ## References diff --git a/examples/jenkins-provenance/README.md b/examples/jenkins-provenance/README.md index d7061e4..7f8fe35 100644 --- a/examples/jenkins-provenance/README.md +++ b/examples/jenkins-provenance/README.md @@ -113,6 +113,8 @@ Trigger the pipeline in Jenkins. The pipeline will: * **Generate SLSA Provenance**: The **Jenkins SLSA Plugin** automatically hooks into the build process. After the build completes, it generates an SLSA-compliant provenance file (e.g., `predicate.json`) attesting to the build's inputs, steps, and outputs. * **Attach Signed Evidence**: The final step uses `jf evd create` to attach the generated provenance file to the npm package that was published earlier. This creates a permanent, tamper-proof link between the package and its build provenance. + `PRIVATE_PEM` is the path of a Jenkins file credential. Pass that path to `--key`. + ```bash jf evd create --package-name="$PACKAGE_NAME" --package-version="$PACKAGE_VERSION" --package-repo-name="$PACKAGE_REPO_NAME" --key="$PRIVATE_PEM" --key-alias="$KEY_ALIAS" --predicate="$PREDICATE_FILE_NAME" --predicate-type="$PREDICATE_TYPE" --markdown="$MARKDOWN_FILE_NAME" ``` diff --git a/examples/jira/README.md b/examples/jira/README.md index 477e92c..3ccafce 100644 --- a/examples/jira/README.md +++ b/examples/jira/README.md @@ -223,15 +223,28 @@ This is the core logic step. The compiled Go helper is executed, using the `star This final step uses `jf evd create --build-name` to attach the Jira ticket summary to the **build information** that was published in step 2\. This creates a verifiable link between the CI process itself and the project management tickets that authorized the code changes within it. ``` -jf evd create \ - --build-name $BUILD_NAME \ - --build-number ${{ github.run_number }} \ - --key "${{ secrets.PRIVATE_KEY }}" \ - --key-alias "${{ vars.EVIDENCE_KEY_ALIAS }}" \ - --predicate ./examples/jira/helper/transformed_jira_data.json \ - --predicate-type http://atlassian.com/jira/issues/v1 \ - --provider-id "jira" \ - ${{ env.ATTACH_OPTIONAL_CUSTOM_MARKDOWN_TO_EVIDENCE == 'true' && '--markdown "examples/jira/helper/transformed_jira_data.md"' || '' }} +env: + EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }} +run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT + jf evd create \ + --build-name $BUILD_NAME \ + --build-number ${{ github.run_number }} \ + --key "$evidence_signing_key_file" \ + --key-alias "${{ vars.EVIDENCE_KEY_ALIAS }}" \ + --predicate ./examples/jira/helper/transformed_jira_data.json \ + --predicate-type http://atlassian.com/jira/issues/v1 \ + --provider-id "jira" \ + ${{ env.ATTACH_OPTIONAL_CUSTOM_MARKDOWN_TO_EVIDENCE == 'true' && '--markdown "examples/jira/helper/transformed_jira_data.md"' || '' }} ``` diff --git a/examples/junit/README.md b/examples/junit/README.md index 88bfaa9..c8a7ec7 100644 --- a/examples/junit/README.md +++ b/examples/junit/README.md @@ -158,12 +158,25 @@ python ../junit_json_to_markdown_helper.py target/consolidated-test-report.json * **Attach Evidence:** This final step uses `jf evd create --build-name` to attach the consolidated JSON test report to the **build information** that was published in the first step. This creates a verifiable link between the CI process and its resulting test quality. -```bash -jf evd create \ +```yaml +env: + EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }} +run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT + jf evd create \ --package-name $PACKAGE_NAME \ --package-version $VERSION \ --package-repo-name $REPO_NAME \ - --key "${{ secrets.PRIVATE_KEY }}" \ + --key "$evidence_signing_key_file" \ --key-alias "${{ vars.EVIDENCE_KEY_ALIAS }}" \ --predicate ./target/consolidated-test-report.json \ --predicate-type http://junit.org/test-results \ diff --git a/examples/katalon/README.md b/examples/katalon/README.md index 7c0f921..a7b4ef5 100644 --- a/examples/katalon/README.md +++ b/examples/katalon/README.md @@ -147,12 +147,21 @@ Once the workflow completes successfully, you can navigate to your repository in * **Attach Evidence:** Finally, the workflow attaches the `katalon-results.json` to the Docker image in Artifactory using `jf evd create`. This creates a permanent, tamper-proof link between the artifact and its detailed UI test results. ```bash + if ([string]::IsNullOrWhiteSpace($env:EVIDENCE_SIGNING_KEY)) { + Write-Error "Evidence signing key is empty" + exit 1 + } + $evidenceSigningKeyFile = Join-Path $env:RUNNER_TEMP "evidence-signing.key" + $utf8 = New-Object System.Text.UTF8Encoding $false + [System.IO.File]::WriteAllText($evidenceSigningKeyFile, ($env:EVIDENCE_SIGNING_KEY.TrimEnd("`r", "`n") + "`n"), $utf8) + icacls $evidenceSigningKeyFile /inheritance:r /grant:r "$($env:USERNAME):(F)" | Out-Null + Remove-Item Env:\EVIDENCE_SIGNING_KEY $commandArgs = @( "evd", "create", "--package-name", $packageName, "--package-version", $packageVersion, "--package-repo-name", $packageRepoName, - "--key", $privateKey, + "--key", $evidenceSigningKeyFile, "--key-alias", $privateKeyAlias, "--provider-id", "katalon", "--predicate", $predicatePath, diff --git a/examples/scorecard/README.md b/examples/scorecard/README.md index 221443e..d5d8f6d 100644 --- a/examples/scorecard/README.md +++ b/examples/scorecard/README.md @@ -83,12 +83,25 @@ You can trigger the workflow manually from the GitHub Actions tab. The workflow - **Attach Evidence:** This final step uses jf evd create to attach the Scorecard analysis to the Docker image built earlier. The SARIF file serves as the official, machine-readable predicate, while the optional Markdown report provides a summary for easy viewing in the Artifactory UI. - ```bash - jf evd create \ + ```yaml + env: + EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }} + run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT + jf evd create \ --package-name $IMAGE_NAME \ --package-version $VERSION \ --package-repo-name $REPO_NAME \ - --key "${{ secrets.PRIVATE_KEY }}" \ + --key "$evidence_signing_key_file" \ --key-alias "${{ vars.EVIDENCE_KEY_ALIAS }}" \ --predicate ./scorecard-results.sarif \ --predicate-type http://openssf.org/scorecard/security-scan/v1 \ diff --git a/examples/semgrep/README.md b/examples/semgrep/README.md index 3fac5e3..ec843be 100644 --- a/examples/semgrep/README.md +++ b/examples/semgrep/README.md @@ -75,12 +75,25 @@ You can trigger the workflow manually from the GitHub Actions tab. The workflow - **Attach Evidence:** This final step uses `jf evd create` to attach the scan results to the npm package that was published earlier. The SARIF file serves as the official, machine-readable predicate, while the optional Markdown report provides a summary for easy viewing in the Artifactory UI. - ```bash - jf evd create \ + ```yaml + env: + EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }} + run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT + jf evd create \ --package-name js-semgrep-sample-build \ --package-version "0.0.1" \ --package-repo-name javascript-local \ - --key "${{ secrets.PRIVATE_KEY }}" \ + --key "$evidence_signing_key_file" \ --key-alias "${{ vars.EVIDENCE_KEY_ALIAS }}" \ --predicate "results-javascript/javascript.sarif" \ --predicate-type "http://semgrep.com/security-scan/v1" \ diff --git a/examples/testRail/README.md b/examples/testRail/README.md index f4a5d17..8f00a1d 100644 --- a/examples/testRail/README.md +++ b/examples/testRail/README.md @@ -117,17 +117,30 @@ You can trigger the workflow manually from the GitHub Actions tab. The workflow - **Attach Evidence:** Finally, the workflow attaches the `overall-report.json` to the Docker image in Artifactory using `jf evd create`. This creates a permanent, tamper-proof link between the artifact and its detailed test results. - ```bash - jf evd create \ - --package-name $IMAGE_NAME \ - --package-version $TAG_NAME \ - --package-repo-name $REPO_NAME \ - --key "${{ secrets.PRIVATE_KEY }}" \ - --key-alias "${{ secrets.PRIVATE_KEY_ALIAS }}" \ - --predicate "reports/overall-report.json" \ - --predicate-type "http://testrail.com/test-results" \ - --provider-id "testrail" \ - [--markdown "reports/results.md"] + ```yaml + env: + EVIDENCE_SIGNING_KEY: ${{ secrets.PRIVATE_KEY }} + run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT + jf evd create \ + --package-name $IMAGE_NAME \ + --package-version $TAG_NAME \ + --package-repo-name $REPO_NAME \ + --key "$evidence_signing_key_file" \ + --key-alias "${{ secrets.PRIVATE_KEY_ALIAS }}" \ + --predicate "reports/overall-report.json" \ + --predicate-type "http://testrail.com/test-results" \ + --provider-id "testrail" \ + [--markdown "reports/results.md"] ``` The --markdown flag is included only if ATTACH_OPTIONAL_MARKDOWN_TO_EVIDENCE is set to true. diff --git a/examples/trufflehog/README.md b/examples/trufflehog/README.md index 26648aa..f1d56f4 100644 --- a/examples/trufflehog/README.md +++ b/examples/trufflehog/README.md @@ -124,12 +124,25 @@ python process_trufflehog_results.py trufflehog-results.json * **Attach Evidence:** This final step uses jf evd create to attach the processed trufflehog.json report to the Docker image. This creates a permanent, tamper-proof record of the secret scan for the associated build. -```bash -jf evd create \ +```yaml +env: + EVIDENCE_SIGNING_KEY: ${{ secrets.JF_PRIVATE_KEY }} +run: | + umask 077 + if [ -z "${EVIDENCE_SIGNING_KEY}" ]; then + echo "Evidence signing key is empty" >&2 + exit 1 + fi + evidence_signing_key_file="${RUNNER_TEMP:-${CI_PROJECT_DIR:-${TMPDIR:-/tmp}}}/evidence-signing.key" + printf '%s\n' "$EVIDENCE_SIGNING_KEY" > "$evidence_signing_key_file" + chmod 600 "$evidence_signing_key_file" + unset EVIDENCE_SIGNING_KEY + trap 'rm -f "$evidence_signing_key_file"' EXIT + jf evd create \ --package-name your-package-name \ --package-version your-version \ --package-repo-name your-repo-name \ - --key "${{ secrets.JF_PRIVATE_KEY }}" \ + --key "$evidence_signing_key_file" \ --key-alias ${{ vars.JF_SIGNING_KEY_ALIAS }} \ --predicate ./trufflehog-evidence.json \ --predicate-type http://trufflesecurity.com/trufflehog/secret-scan diff --git a/scripts/check-signing-key-not-argv.sh b/scripts/check-signing-key-not-argv.sh new file mode 100755 index 0000000..cf7829f --- /dev/null +++ b/scripts/check-signing-key-not-argv.sh @@ -0,0 +1,48 @@ +#!/usr/bin/env bash +# Fail when an Evidence sample puts signing-key material or an access token +# on a process command line. Step env mappings and file paths are allowed. +set -euo pipefail + +root="$(cd "$(dirname "$0")/.." && pwd)" +cd "$root" + +fail=0 + +report() { + echo "signing key or access token is still passed on a command line:" >&2 + echo "$1" >&2 + fail=1 +} + +rg_args=(--hidden --pcre2 --glob '!.git/**' --glob '!scripts/**' --glob '!.impl-session/**') +key_secret="$(rg -n "${rg_args[@]}" \ + -- '--key(?:=|\s+)["'\'']?\$\{\{\s*secrets\.' . || true)" +if [[ -n "$key_secret" ]]; then + report "$key_secret" +fi + +key_var="$(rg -n "${rg_args[@]}" \ + -- '--key(?:=|\s+)["'\'']?\$(?:\{PRIVATE_KEY\}|PRIVATE_KEY(?![A-Za-z0-9_]))' . || true)" +if [[ -n "$key_var" ]]; then + report "$key_var" +fi + +access_token="$(rg -n "${rg_args[@]}" \ + -- '--access-token(?:=|\s+)' . || true)" +if [[ -n "$access_token" ]]; then + report "$access_token" +fi + +ps_secret="$(rg -n "${rg_args[@]}" \ + -- '\$privateKey\s*=\s*"\$\{\{\s*secrets\.' . || true)" +if [[ -n "$ps_secret" ]]; then + report "$ps_secret" +fi + +ps_arg="$(rg -n "${rg_args[@]}" \ + -- '"--key",\s*\$privateKey\b' . || true)" +if [[ -n "$ps_arg" ]]; then + report "$ps_arg" +fi + +exit "$fail"