cloud_build/verify_provenance.sh

#!/bin/bash
# Copyright 2023 The Flutter Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.

# This script is used to verify provenance of our artifacts using slsa-verifier.
# If slsa-verifier is unable to ensure the provenance of the artifact is
# legitimate, then the script will exit with a non-zero exit code.
set -e

# Download the jq binary in order to obtain the artifact registry url from the
# docker image provenance.
echo "Installing jq using apt..."
apt update && apt install jq=1.5+dfsg-1.3 -y

# Download slsa-verifier in order to validate the docker image provenance.
# This takes the version of slsa-verifier defined in tooling/go.mod.
echo "Installing slsa-verifier using go..."
pushd tooling
go install github.com/slsa-framework/slsa-verifier/v2/cli/slsa-verifier
popd

# This command uses slsa-verifier to ensure the provenance has the correct
# source location and builder.
# "source-uri" is the original location of the source code
# "builder-id" is where the artifact was built (Note: GoogleHostedWorker is
# a GCP Cloud Build instance)
#
# Note: jq is used in order to obtain the full artifact registry url from
# the provenance metadata.
echo "Verifying the provenance is valid and correct..."
FULLY_QUALIFIED_DIGEST=$(cat $1 | \
  jq -r .image_summary.fully_qualified_digest)
slsa-verifier verify-image $FULLY_QUALIFIED_DIGEST \
  --source-uri git+https://github.com/flutter/cocoon \
  --builder-id=https://cloudbuild.googleapis.com/GoogleHostedWorker@v0.3 \
  --provenance-path $1