Skip to content

Draft: Get SHA256 hashes from artifacts

Hi all,

As discussed, this MR is a PoC for retrieving the SHA256 hashes from Build artifacts. Here's some sample output from the rspec test:

% bundle exec rspec spec/workers/ci/slsa/publish_provenance_worker_spec.rb:15
[...]
{"ci_artifacts.txt"=>"30e568f0d80caf46208f268c5682ac51796a6e692561d1de4ab141ea6a858ebe", "empty_image.png"=>"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "generated.yml"=>"98dfb2a1de76f8214fca9133fa20667f38cf2ce69d1c204e84edb6ec87739159", "rails_sample.jpg"=>"f2d1fd9d8d8a3368d468fa067888605d74a66f41c16f55979ceaf2af77375844"}
[...]

I've also tested this manually in the console. See test output below:

> build = Ci::Build.last
> pps = Ci::Slsa::PublishProvenanceService.new(build)
[...]
> pps.execute
{"test.txt"=>"3c5bba498d6f7a2cb4c195cf0873c8b68c9407f04dfa9acaad7fe4875e5e93f1"}

Which is correct:

> file = Ci::Build.last.job_artifacts.filter { |a| a.file_type == "archive" }[0].file.file
> entry = Zip::File.open(file).entries[0]
> Digest::SHA256.hexdigest(entry.get_input_stream.read)
3c5bba498d6f7a2cb4c195cf0873c8b68c9407f04dfa9acaad7fe4875e5e93f1

Merge request reports

Loading