Skip to content

Commit d98cd1f

Browse files
mbobenmboben
committed
Merge branch 'v1_13_0-upgrade' into 'main'
Upgrade to v1.13.0 See merge request flarenetwork/network/go-flare!6
2 parents ded2ebf + db8f7f5 commit d98cd1f

835 files changed

Lines changed: 24306 additions & 26969 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/actions/go-build/action.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
name: 'Build Go'
2+
description: 'Builds go binary'
3+
inputs:
4+
go_version:
5+
description: 'Go version to use for building'
6+
required: true
7+
working_directory:
8+
description: 'Directory containing the go source'
9+
required: false
10+
default: '.'
11+
12+
runs:
13+
using: 'composite'
14+
steps:
15+
- name: Set up Go
16+
uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495
17+
with:
18+
go-version: ${{ inputs.go_version }}
19+
20+
- name: Install dependencies
21+
shell: bash
22+
run: sudo apt-get update -y && sudo apt-get install -y rsync
23+
24+
- name: Build
25+
working-directory: ${{ inputs.working_directory }}
26+
shell: bash
27+
env:
28+
GOPATH: ${{ github.workspace }}/go
29+
run: |
30+
cd avalanchego
31+
./scripts/build.sh

‎.github/actions/slsa3-build-callback/action.yml‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
name: 'Build Callback Action'
2+
description: 'Builds go-flare binaries for SLSA provenance'
3+
inputs:
4+
slsa-workflow-inputs:
5+
description: 'All inputs as JSON'
6+
required: true
7+
slsa-layout-file:
8+
description: 'Location to store layout content'
9+
required: true
10+
11+
# Unused secrets - SLSA BYOB framework requires these to be declared
12+
slsa-workflow-secret1: {}
13+
slsa-workflow-secret2: {}
14+
slsa-workflow-secret3: {}
15+
slsa-workflow-secret4: {}
16+
slsa-workflow-secret5: {}
17+
slsa-workflow-secret6: {}
18+
slsa-workflow-secret7: {}
19+
slsa-workflow-secret8: {}
20+
slsa-workflow-secret9: {}
21+
slsa-workflow-secret10: {}
22+
slsa-workflow-secret11: {}
23+
slsa-workflow-secret12: {}
24+
slsa-workflow-secret13: {}
25+
slsa-workflow-secret14: {}
26+
slsa-workflow-secret15: {}
27+
28+
outputs:
29+
attestations:
30+
description: 'Attestation metadata for built artifacts'
31+
value: ${{ steps.generate-attestations.outputs.attestations }}
32+
build-artifacts-name:
33+
description: 'Name of uploaded build artifacts'
34+
value: ${{ steps.upload.outputs.name }}
35+
build-artifacts-sha256:
36+
description: 'SHA256 of uploaded artifacts'
37+
value: ${{ steps.upload.outputs.sha256 }}
38+
39+
runs:
40+
using: 'composite'
41+
steps:
42+
- name: Build
43+
uses: ./../__TOOL_CHECKOUT_DIR__/.github/actions/go-build
44+
with:
45+
go_version: ${{ fromJSON(inputs.slsa-workflow-inputs).go_version }}
46+
working_directory: ./../__TOOL_CHECKOUT_DIR__
47+
48+
- name: Generate layout file
49+
id: generate-layout
50+
env:
51+
SLSA_OUTPUTS_ARTIFACTS_FILE: ${{ inputs.slsa-layout-file }}
52+
BUILD_DIR: ./../__TOOL_CHECKOUT_DIR__/avalanchego/build
53+
BINARY_NAME: ${{ fromJSON(inputs.slsa-workflow-inputs).build_artifact_name }}
54+
shell: bash
55+
run: ./../__TOOL_ACTION_DIR__/generate-layout.sh
56+
57+
- name: Copy binaries for secure upload
58+
shell: bash
59+
run: |
60+
mkdir -p ./binaries
61+
cp -r ./../__TOOL_CHECKOUT_DIR__/avalanchego/build/* ./binaries/
62+
63+
- name: Upload binaries
64+
id: upload
65+
uses: slsa-framework/slsa-github-generator/actions/delegator/secure-upload-folder@v2.1.0
66+
with:
67+
name: ${{ fromJSON(inputs.slsa-workflow-inputs).build_artifact_name }}
68+
path: ./binaries/

‎.github/actions/slsa3-build-callback/generate-layout.sh‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
#!/bin/bash
2+
set -euo pipefail
3+
4+
mkdir -p "$(dirname "$SLSA_OUTPUTS_ARTIFACTS_FILE")"
5+
6+
subjects=""
7+
for binary in "$BUILD_DIR/avalanchego" "$BUILD_DIR/plugins/evm"; do
8+
if [ -f "$binary" ]; then
9+
hash=$(sha256sum "$binary" | awk '{print $1}')
10+
subject_name=$(basename "$binary")
11+
12+
[ -n "$subjects" ] && subjects+=","
13+
14+
printf -v subject '{"name": "%s", "digest": {"sha256": "%s"}}' "$subject_name" "$hash"
15+
subjects+="$subject"
16+
fi
17+
done
18+
19+
cat <<EOF > "$SLSA_OUTPUTS_ARTIFACTS_FILE"
20+
{
21+
"version": 1,
22+
"attestations": [{
23+
"name": "$BINARY_NAME-binaries",
24+
"subjects": [${subjects}]
25+
}]
26+
}
27+
EOF
28+
29+
cat "$SLSA_OUTPUTS_ARTIFACTS_FILE"

‎.github/workflows/README.md‎

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
# Go-Flare binary release workflow
2+
3+
> Note: The SLSA3 isolated build job always runs on `ubuntu-latest`
4+
5+
## What is SLSA?
6+
7+
[SLSA](https://slsa.dev/) (Supply-chain Levels for Software Artifacts, pronounced "salsa") is an open security framework that defines a set of standards and controls to protect software integrity across the entire build pipeline. It's organized into four build levels (1–4), each adding stronger guarantees around build integrity and provenance.
8+
9+
SLSA Build Level 3 (the level implemented here) requires that:
10+
* Builds run in an isolated, ephemeral environment that cannot be influenced by the calling workflow.
11+
* A signed, non-forgeable provenance attestation is generated, recording what was built, from which source, and by which builder.
12+
* The build process itself is defined and verifiable, not dependent on mutable or untrusted inputs.
13+
14+
## Security Properties Introduced
15+
16+
**Reproducible Build Verification**
17+
18+
On every release, the binary is built twice, completely independently, and compared. If the hashes match, the build is confirmed reproducible. If they differ, the release fails and diffoscope runs automatically to show exactly what caused the difference.
19+
20+
The Go build flags that make this possible are:
21+
* `trimpath` strips local filesystem paths from the binary
22+
* `buildvcs=false` removes embedded VCS metadata that varies between builds
23+
24+
**Hash-Pinned GitHub Actions**
25+
26+
Where possible, GitHub Action and reusable workflow references in the pipeline are pinned to a full commit SHA rather than a mutable tag (e.g. `actions/checkout@f43a0e5ff2bd`... instead of @v3). This prevents a compromised or modified upstream action from silently altering the build, a common supply chain attack vector.
27+
28+
**SLSA3 Provenance Attestation**
29+
30+
Every release build produces a signed provenance file (`.build.slsa`) that cryptographically attests to what was built, from which exact source commit, and by which workflow. The attestation is signed via Sigstore and recorded in the Rekor public transparency log, making it independently verifiable and tamper-evident. This makes it impossible to publish a binary that wasn't produced by the declared build process.
31+
32+
**Keyless Release Signing**
33+
34+
The final release artifact is signed using Cosign. The resulting .sig and .pem files are published alongside the release artifact and can be used to confirm there was no tampering with release files.
35+
36+
## Pipeline Architecture
37+
The build pipeline is split across three workflow files, orchestrated by `build-binary.yaml`.
38+
39+
```
40+
build-binary.yaml
41+
├── build-go-slsa3.yaml (SLSA3 isolated build + provenance)
42+
├── build-go-verification.yaml (independent verification/reproducible build)
43+
└── release job (verify + sign + publish)
44+
```
45+
46+
### SLSA BYOB Framework
47+
48+
SLSA3 build uses the [Build Your Own Builder (BYOB) framework](https://github.com/slsa-framework/slsa-github-generator/blob/main/BYOB.md). BYOB allows wrapping an existing build process into a SLSA3-compliant builder without implementing provenance generation from scratch.
49+
50+
The framework introduces three components:
51+
52+
* Tool Reusable Workflow (TRW) — The SLSA3 builder that callers invoke. It initializes the BYOB framework and delegates execution to the SLSA runner.
53+
* Tool Callback Action (TCA) — The action that BYOB invokes in an isolated, ephemeral VM — separate from the calling workflow. It runs the actual build, hashes the output artifacts, and uploads them securely.
54+
* BYOB Delegator — Receives the SLSA token from the TRW, runs the TCA in isolation, and generates the signed provenance attestation.
55+
56+
### Job Flow
57+
58+
`slsa-setup` initializes the BYOB framework via `setup-generic@v2.1.0`, passing the TCA path and workflow inputs. It receives back a short-lived `slsa-token` that encodes the build parameters.
59+
60+
`slsa-run` passes the token to the BYOB delegator, which takes over. It runs the TCA in an isolated VM, collects artifact digests from the SLSA layout file produced by `generate-layout.sh`, and generates a signed `.build.slsa` provenance file.
61+
62+
`build-go-verification` runs in parallel. A plain second build using the same go-build composite action, producing an independent binary used only for the reproducibility check.
63+
64+
`release` pulls everything together:
65+
66+
* Compares the SLSA build binary against the verification binary
67+
* Verifies the SLSA provenance with slsa-verifier, asserting source URI and builder identity
68+
* Packages, signs, and verifies the release zip with Cosign
69+
* Publishes the release with the zip, .build.slsa, and Cosign .sig/.pem files
70+
71+
## Verification Guide
72+
73+
Each release publishes the following files:
74+
75+
| File | Description |
76+
|------|-------------|
77+
| `go-flare-<tag>-linux-amd64.zip` | Release binary |
78+
| `go-flare-<tag>-linux-amd64.zip.build.slsa` | SLSA provenance attestation |
79+
| `go-flare-<tag>-linux-amd64.zip.sig` | Cosign signature |
80+
| `go-flare-<tag>-linux-amd64.zip.pem` | Cosign certificate |
81+
82+
### Verifying SLSA Provenance
83+
84+
The SLSA attestation covers the raw `avalanchego` binary, not the zip archive. Extract it first, then verify:
85+
86+
```
87+
unzip go-flare-<tag>-linux-amd64.zip avalanchego
88+
slsa-verifier verify-artifact \
89+
avalanchego \
90+
--provenance-path go-flare-<tag>-linux-amd64.zip.build.slsa \
91+
--source-uri github.com/flare-foundation/go-flare \
92+
--builder-id https://github.com/flare-foundation/go-flare/.github/workflows/build-go-slsa3.yaml@refs/tags/<tag>
93+
```
94+
95+
A successful verification confirms that the binary was built from the declared source repository, by the declared workflow, in an isolated SLSA3-compliant environment.
96+
97+
### Verifying the Cosign Signature
98+
99+
Install [cosign](https://github.com/sigstore/cosign), then run:
100+
101+
```
102+
cosign verify-blob \
103+
--certificate go-flare-<tag>-linux-amd64.zip.pem \
104+
--certificate-identity https://github.com/flare-foundation/go-flare/.github/workflows/build-binary.yaml@refs/tags/<tag> \
105+
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
106+
--signature go-flare-<tag>-linux-amd64.zip.sig \
107+
go-flare-<tag>-linux-amd64.zip
108+
```
109+
110+
This confirms the release zip was signed by the official release workflow and has not been tampered with since signing.

0 commit comments

Comments
 (0)