Skip to content

Commit 6e8c945

Browse files
loicsikidiloicsikidi
authored
feat: init project (#1)
1 parent 7f246ee commit 6e8c945

25 files changed

Lines changed: 2257 additions & 0 deletions

‎.envrc‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
watch_file shell.nix
2+
use nix

‎.github/workflows/go-test.yaml‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
name: Go tests
2+
on:
3+
push:
4+
branches: ["main"]
5+
pull_request:
6+
branches: ["**"]
7+
schedule: # daily at 19:00 UTC
8+
- cron: '0 19 * * *'
9+
workflow_dispatch:
10+
permissions:
11+
contents: read
12+
jobs:
13+
test:
14+
runs-on: ubuntu-latest
15+
strategy:
16+
fail-fast: false
17+
matrix:
18+
go:
19+
- { go-version: stable }
20+
- { go-version: oldstable }
21+
- { go-version-file: go.mod }
22+
deps:
23+
- locked
24+
- latest
25+
# Exclude (oldstable, latest) and (go.mod, latest)
26+
# root cause: latest version of boulder requires Go 1.25.0
27+
exclude:
28+
- go: { go-version: oldstable }
29+
deps: latest
30+
# - go: { go-version-file: go.mod }
31+
# deps: latest
32+
steps:
33+
- uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
34+
with:
35+
persist-credentials: false
36+
- uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
37+
with:
38+
go-version: ${{ matrix.go.go-version }}
39+
go-version-file: ${{ matrix.go.go-version-file }}
40+
- uses: geomys/sandboxed-step@7d75eb49d17fdeeb3656b3a57d35932d205bcfb9 # v1.2.1
41+
with:
42+
run: |
43+
if [ "${{ matrix.deps }}" = "latest" ]; then
44+
go get -u -t ./...
45+
fi
46+
go test -v -race ./...
47+
staticcheck:
48+
runs-on: ubuntu-latest
49+
steps:
50+
- uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
51+
with:
52+
persist-credentials: false
53+
- uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
54+
with:
55+
go-version: stable
56+
- uses: geomys/sandboxed-step@7d75eb49d17fdeeb3656b3a57d35932d205bcfb9 # v1.2.1
57+
with:
58+
run: go run honnef.co/go/tools/cmd/staticcheck@latest ./...
59+
govulncheck:
60+
runs-on: ubuntu-latest
61+
steps:
62+
- uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
63+
with:
64+
persist-credentials: false
65+
- uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
66+
with:
67+
go-version: stable
68+
- uses: geomys/sandboxed-step@7d75eb49d17fdeeb3656b3a57d35932d205bcfb9 # v1.2.1
69+
with:
70+
run: go run golang.org/x/vuln/cmd/govulncheck@latest ./...

‎.github/workflows/lint.yaml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
name: Lint checks
2+
3+
on:
4+
push:
5+
branches: ["main"]
6+
pull_request:
7+
branches: ["**"]
8+
9+
permissions: {}
10+
11+
jobs:
12+
pre-commit:
13+
name: pre-commit hooks
14+
runs-on: ubuntu-latest
15+
permissions:
16+
contents: read
17+
steps:
18+
- name: Checkout code
19+
uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
20+
with:
21+
persist-credentials: false
22+
- name: Install Nix
23+
uses: cachix/install-nix-action@0b0e072294b088b73964f1d72dfdac0951439dbd # v31.8.4
24+
with:
25+
nix_path: nixpkgs=channel:nixos-unstable
26+
github_access_token: ${{ secrets.GITHUB_TOKEN }}
27+
- name: Run pre-commit hooks
28+
run: nix-shell --run "pre-commit run --all-files"
29+
30+
golangci:
31+
name: lint
32+
runs-on: ubuntu-latest
33+
permissions:
34+
contents: read
35+
steps:
36+
- name: Checkout code
37+
uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
38+
with:
39+
persist-credentials: false
40+
- name: Install Golang
41+
uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
42+
with:
43+
go-version-file: go.mod
44+
- name: golangci-lint
45+
uses: golangci/golangci-lint-action@e7fa5ac41e1cf5b7d48e45e42232ce7ada589601 # v9.1.0
46+
with:
47+
version: latest
48+
install-mode: binary
49+
skip-cache: true

‎.github/workflows/release.yaml‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
name: Release CLI & OCI
2+
3+
on:
4+
push:
5+
tags:
6+
- "v*"
7+
8+
permissions: {}
9+
10+
jobs:
11+
release:
12+
runs-on: ubuntu-latest
13+
permissions:
14+
contents: write # publish release
15+
id-token: write # required for Cosign keyless (OIDC)
16+
attestations: write # publish attestations
17+
packages: write # publish oci images
18+
steps:
19+
- name: Checkout code
20+
uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
21+
with:
22+
fetch-depth: 0 # Required for GoReleaser changelog
23+
persist-credentials: false
24+
25+
- name: Setup QEMU (for docker buildx multi-arch)
26+
uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
27+
28+
- name: Setup Docker Buildx
29+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
30+
31+
- name: Setup Go based on go.mod
32+
uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
33+
with:
34+
go-version-file: go.mod
35+
cache: false
36+
37+
- name: Install Cosign
38+
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
39+
40+
- name: Install Syft
41+
uses: anchore/sbom-action/download-syft@fbfd9c6c189226748411491745178e0c2017392d # v0.20.10
42+
43+
- name: Login to GitHub Container Registry
44+
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
45+
with:
46+
registry: ghcr.io
47+
username: ${{ github.actor }}
48+
password: ${{ secrets.GITHUB_TOKEN }}
49+
50+
- name: Run GoReleaser
51+
uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
52+
with:
53+
distribution: goreleaser
54+
version: '~> v2'
55+
args: release --clean
56+
env:
57+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
58+
59+
- name: Attest checksums.txt provenance
60+
uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
61+
with:
62+
subject-checksums: dist/checksums.txt

‎.github/workflows/zizmor.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
name: zizmor security scan
2+
3+
on:
4+
push:
5+
branches: ["main"]
6+
pull_request:
7+
branches: ["**"]
8+
9+
permissions: {}
10+
11+
jobs:
12+
zizmor:
13+
runs-on: ubuntu-latest
14+
permissions:
15+
security-events: write
16+
steps:
17+
- name: Checkout code
18+
uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
19+
with:
20+
persist-credentials: false
21+
22+
- name: Run zizmor 🌈
23+
uses: zizmorcore/zizmor-action@e639db99335bc9038abc0e066dfcd72e23d26fb4 # v0.3.0

‎.golangci.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
version: "2"
2+
run:
3+
timeout: 2m
4+
5+
linters:
6+
default: standard
7+
exclusions:
8+
rules:
9+
- path: _test\.go
10+
linters:
11+
- errcheck

‎.goreleaser.yaml‎

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
version: 2
2+
3+
project_name: tpm-trust
4+
5+
builds:
6+
- id: tpm-trust
7+
main: ./
8+
binary: tpm-trust
9+
env:
10+
- CGO_ENABLED=0
11+
goos:
12+
- linux
13+
goarch:
14+
- amd64
15+
- arm64
16+
ldflags:
17+
- -s -w -X main.builtBy=goreleaser
18+
19+
archives:
20+
- id: tpm-trust-archives
21+
ids:
22+
- tpm-trust
23+
formats: [ 'tar.gz' ]
24+
name_template: "tpm-trust_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
25+
26+
checksum:
27+
name_template: "checksums.txt"
28+
algorithm: sha256
29+
30+
sboms:
31+
- artifacts: archive
32+
- id: source
33+
artifacts: source
34+
35+
# Signature in Sigstore bundle format
36+
signs:
37+
- id: cosign-checksum
38+
cmd: cosign
39+
signature: "${artifact}.sigstore.json"
40+
args:
41+
- "sign-blob"
42+
- "--bundle=${signature}"
43+
- "${artifact}"
44+
- "--yes"
45+
artifacts: checksum
46+
47+
release:
48+
github:
49+
owner: loicsikidi
50+
name: "{{ .ProjectName }}"
51+
draft: true
52+
prerelease: auto
53+
mode: append
54+
header: |
55+
## {{ .ProjectName }} {{ .Tag }}
56+
57+
### What's Changed
58+
59+
This release contains the `tpm-trust` binary and OCI images built from commit [{{ .FullCommit }}](https://github.com/loicsikidi/{{ .ProjectName }}/tree/{{ .FullCommit }}).
60+
61+
### Artifacts
62+
63+
- **`tpm-trust_$VERSION_$OS_$ARCH.$EXTENSION`** - CLI binaries for various platforms (stored in archives)
64+
- **`tpm-trust_$VERSION_$OS_$ARCH.$EXTENSION.sbom.json`** - SBOMs for the binaries in SPDX format
65+
- **`checksums.txt`** - SHA-256 checksums of all artifacts
66+
- **`checksums.txt.sigstore.json`** - Sigstore signature bundle for checksum verification
67+
68+
### Verification
69+
70+
> [!IMPORTANT]
71+
> If you are not familiar with the concepts around software supply chain security,
72+
> (eg. build provenance attestation, keyless signature, etc.), please read the following resources first:
73+
> - [Cosign Signing Overview](https://docs.sigstore.dev/cosign/signing/overview/)
74+
> - [SLSA provenance attestation](https://slsa.dev/spec/v1.2/provenance)
75+
> - [GitHub attest-build-provenance action](https://github.com/actions/attest-build-provenance)
76+
77+
For complete security verification, follow this two-step process:
78+
79+
**Step 1: Verify Integrity with Cosign**
80+
81+
First, verify the **integrity** of the checksums file using Cosign:
82+
83+
> [!TIP]
84+
> Make sure to use **`cosign >= v2.4.3`** to support the [Sigstore bundle format](https://docs.sigstore.dev/about/bundle/).
85+
86+
```bash
87+
# Verify the checksums signature
88+
cosign verify-blob \
89+
--bundle checksums.txt.sigstore.json \
90+
--certificate-identity-regexp 'https://github.com/loicsikidi/{{ .ProjectName }}/.github/workflows/release.yaml@refs/tags/{{ .Tag }}' \
91+
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
92+
checksums.txt
93+
94+
# Verify any artifact matches the checksum
95+
sha256sum -c checksums.txt
96+
```
97+
98+
**Step 2: Verify Provenance with GitHub CLI**
99+
100+
Once the checksum integrity is established, verify the **provenance** using GitHub's attestation system:
101+
102+
```bash
103+
# Verify the archive
104+
gh attestation verify tpm-trust_{{ .Version }}_linux_amd64.tar.gz --repo loicsikidi/{{ .ProjectName }}
105+
```
106+
footer: |
107+
**Generated with GoReleaser 🚀**
108+
109+
changelog:
110+
use: github
111+
sort: asc
112+
filters:
113+
exclude:
114+
- '^docs'
115+
- '^test'

‎LICENSE‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
BSD 3-Clause License
2+
3+
Copyright (c) 2025, Loïc Sikidi
4+
5+
Redistribution and use in source and binary forms, with or without
6+
modification, are permitted provided that the following conditions are met:
7+
8+
1. Redistributions of source code must retain the above copyright notice, this
9+
list of conditions and the following disclaimer.
10+
11+
2. Redistributions in binary form must reproduce the above copyright notice,
12+
this list of conditions and the following disclaimer in the documentation
13+
and/or other materials provided with the distribution.
14+
15+
3. Neither the name of the copyright holder nor the names of its
16+
contributors may be used to endorse or promote products derived from
17+
this software without specific prior written permission.
18+
19+
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
20+
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21+
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
22+
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
23+
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24+
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
25+
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
26+
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
27+
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
28+
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

0 commit comments

Comments
 (0)