Gate provenance on signing with applies_when_grep

Andrew Dunnrequested to merge
standards/applies-when-grep-r2 into main

Standard

provenance

Change type

  • Add new standard
  • Modify existing standard (prose only)
  • Modify existing standard's check.sh (add, remove, or change an assertion)
  • Modify existing standard's templates
  • Status transition: introduced -> enforcing
  • Status transition: enforcing -> archived
  • Retire / archive

What does this MR do and why?

I want provenance to check every project whose pipeline signs, because it gated on a *.lock.toml that no consumer carries.

  • applies_when_grep applies a standard where a file matching any glob also matches an extended regex. It shares applies_when_file's skip list and $SUBJECT rule.
  • provenance applies where .gitlab-ci.yml runs cosign sign or includes binary, container-sign or container-manifest, which sign the artifact.
  • The gate and both assertions read each line up to its first #, so a comment proves nothing. The SBOM and SLSA assertions also accept container-sbom, attest and container-attest.

trust-manifest keeps applies_when_file: a lock file declares policy the binary honors at runtime, so a project whose binary reads none cannot carry one.

flowchart LR
  A["applies_when_grep on .gitlab-ci.yml"] --> B{"a .gitlab-ci.yml outside skipped subtrees?"}
  B -->|no| S["SKIP, exit 0"]
  B -->|yes| C{"a line, before any #, runs cosign sign or includes binary, container-sign or container-manifest?"}
  C -->|no| S
  C -->|yes| D["SUBJECT = shallowest match"]
  D --> E["assert SBOM and SLSA on SUBJECT lines outside comments"]

Failure mode this addresses

periscope signs, attests and emits an SBOM, and provenance skipped it.

Assertion deltas

  • MODIFY: gate *.lock.toml -> a signing line in .gitlab-ci.yml
  • REMOVE: file-contains:.gitlab-ci.yml /cosign/, now the gate
  • MODIFY: SBOM and SLSA assertions read $SUBJECT, as above

Consumer impact

Twelve of 59 consumers sign on main. Every pass holds with comments stripped.

Project SHA Before After
kaniko 805a21cb SKIP PASS
assay b5f7a84e SKIP PASS
p1-vp-generator dc71eef7 SKIP PASS
p1-vp-vexer fcf6f368 SKIP PASS
periscope be6c2208 SKIP PASS
tach 80b6ab7a SKIP PASS
serviceping-redact 4f0c8880 SKIP FAIL: SBOM
manifold 94f04fa2 SKIP FAIL: SBOM, SLSA
postern f714beb5 SKIP FAIL: SBOM, SLSA
storyping 3f783b45 SKIP FAIL: SBOM, SLSA
trunk/service 2fbd62df SKIP FAIL: SBOM, SLSA
a private project SKIP FAIL: SBOM, SLSA

No signing consumer runs these checks in CI, so no merge is held.

Status transition

None.

Test plan

  • just guard passes (assertions use only closed primitives)
  • just check-one STANDARD=provenance passes against this repo
  • Ran check.sh against at least one consumer repo of each applicable shape (binary-shipping, lab); results match expectations
  • CHANGELOG updated

just ship reports 21 standard(s) passed, 0 exempt, 0 failed. Bash 3.2 test trees cover each gate path.

Reviewer checklist

  • SKILL.md frontmatter is valid YAML (name, description, status, [enforced_since])
  • check.sh sources ../../_lib.sh correctly
  • check.sh calls report at the end
  • Templates/ directory present where applicable
  • Standard appears in README's contracts table
  • Standard appears in the rendered site's /standards/ index

Closes #10 (closed)

An AI tool wrote this change and ran the checks above.

Merge request reports