Skip to content

Commit

Permalink
Remove slsa-verifier tech debt (flutter#3382)
Browse files Browse the repository at this point in the history
* Remove the provenance injection workaround, as provenance should be correctly created now, and slsa-verifier 2.4.1 no longer requires this piece anyway
  • Loading branch information
drewroengoogle authored Jan 2, 2024
1 parent d2fdd49 commit f6a3c6c
Showing 1 changed file with 4 additions and 4 deletions.
8 changes: 4 additions & 4 deletions cloud_build/get_docker_image_provenance.sh
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,9 @@
# This script is used to pull a docker image's provenance and save it to a file.
DOCKER_IMAGE_URL=$1
OUTPUT_DIRECTORY=$2
# Getting the docker image provenance can be flaky, so retry up to 3 times.
# Getting the docker image provenance can be flaky due to the provenance not
# uploading fast enough, or a transient error from artifact registry, so retry
# up to 3 times.
MAX_ATTEMPTS=3

# Download the jq binary in order to obtain the artifact registry url from the
Expand All @@ -18,10 +20,8 @@ for attempt in $(seq 1 $MAX_ATTEMPTS)
do
echo "(Attempt $attempt) Obtaining provenance for $1"
gcloud artifacts docker images describe \
$DOCKER_IMAGE_URL --show-provenance --format json > tmp.json
$DOCKER_IMAGE_URL --show-provenance --format json > $OUTPUT_DIRECTORY
COMMAND_RESULT=$?
val=$(cat tmp.json | jq -r '.provenance_summary.provenance[0].envelope.payload' | base64 -d | jq '.predicate.recipe.arguments.sourceProvenance')
cat tmp.json | jq ".provenance_summary.provenance[0].build.intotoStatement.slsaProvenance.recipe.arguments.sourceProvenance = ${val}" > $OUTPUT_DIRECTORY
if [[ $COMMAND_RESULT -eq 0 ]]
then
echo "Successfully obtained provenance and saved to $2"
Expand Down

0 comments on commit f6a3c6c

Please sign in to comment.