SPIKE:Investigate integrating GitLab Runner with a centralized metadata data store - example Grafeas

Summary of findings and next steps:

Findings from Spike

  • We're not sure integration with Runner is the best route. Runner mainly only talks to a GitLab instance and doesn't directly integrate with other products.
  • Along with artifacts, we'd probably want to suppport adding evidence for packages and containers that we upload to Package Registry/Container Registry.
  • To help figure out how to do this, we proposed adding support to the GitLab-Runner pipeline itself so we can figure out the pain points and pull in the right people to implement this.
  • In addition, we've proposed extending Runner in a generic way, allowing hooks to be installed. We hope that this would help with anybody wanting to integrate such a solution with Runner, without modification of the Runner source code.

Next steps

Overview

  • Secure software supply chain management refers to the ability to ensure the security of everything that goes into the software that you build. Everything refers to the dependencies that your software supply chain depends on. Dependencies refer to when a piece of software relies on another piece of software to run. In addition to validating the source of and security of dependencies prior to completing the build process, organizations also need to ensure that the final build output or artifacts are immutable and also includes build time injected attestations.

  • "Attestation is a process for demonstrating that software binaries were properly instantiated on a trusted platform."

  • Software Bill of Materials (SBOM) - content source is the paper referenced below - Deliver Uncompromised. "The software of complex systems is often built from many discrete software modules that perform distinct functions. Modern software can be rapidly or even automatically assembled. In this respect, software development increasingly resembles manufacturing processes. Thus, it is likely that any given custom or commercially available software system is, in fact, a product of a varied and often complex supply chain. Yet, all too often, and especially with open-source software, little is known concerning the pedigree of the software developer (who owns or controls the developer, for example) or the provenance of the software components (what measures were taken to ensure its integrity and trustworthiness). In recognition of this fact, good industry practices increasingly mandate the use of an SBOM that identifies the provenance of the various components. If done properly, an SBOM can estimate the overall risk of the ensemble of software elements based on the risk of the individual elements."

  • Today, GitLab pipeline jobs output an archive of files and directories. Customers who need to add an attestation to this output, can either (a) develop their own application for injecting the attestation or (b) include a script in the after_script section of a job.

  • Some customers that have solved the attestation step in the process are using Grafeas as the centralized metadata store.

Problem to investigate for this spike

  • For those customers that have adopted Grafeas, should we natively integrate the runner with Grafeas in order to complete the secure software supply chain? Example

  • If integration is the right approach, then what is the level of effort, architectural and on-going maintenance considerations for the runner team?

  • Stretch goal: could, or should GitLab solve the centralized metadata data store in a different way or is simply integrating with Grafeas the way to go for an MVC?

Reference

Integration example

image

Edited by Darren Eastman