@actions/attest
生成工作流程文物签名证明的功能.
证明将一些标的物(一种命名的文物及其文摘)绑入一个 使用 转入 语句 格式。 A 类 为证明书生成签名,使用 西格斯托尔- 签发了签名证书.
证书一经创建并签名,就会被上传到GH aPI证明和与工作流程所依据的存储库有关的证明 启动.
见 利用文物证明确定建筑物的来源 有关文物证明的更多信息.
目录
使用量
attest
这个 attest 函数取所提供对象/相配对并生成 a
签名的证明.
const { attest } = require('@actions/attest');
const core = require('@actions/core');
async function run() {
// In order to persist attestations to the repo, this should be a token with
// repository write permissions.
const ghToken = core.getInput('gh-token');
const attestation = await attest({
subjects: [{name: 'my-artifact-name', digest: { 'sha256': '36ab4667...'}}],
predicateType: 'https://in-toto.io/attestation/release',
predicate: { . . . },
token: ghToken
});
console.log(attestation);
}
run();
这个 attest 函数支持以下选项:
export type AttestOptions = {
// Deprecated. Use 'subjects' instead.
subjectName?: string
// Deprecated. Use 'subjects' instead.
subjectDigest?: Record<string, string>
// Collection of subjects to be attested
subjects?: Subject[]
// URI identifying the content type of the predicate being attested.
predicateType: string
// Predicate to be attested.
predicate: object
// GitHub token for writing attestations.
token: string
// Sigstore instance to use for signing. Must be one of "public-good" or
// "github".
sigstore?: 'public-good' | 'github'
// HTTP headers to include in request to attestations API.
headers?: {[header: string]: string | number | undefined}
// Whether to skip writing the attestation to the GH attestations API.
skipWrite?: boolean
}
export type Subject = {
// Name of the subject.
name: string
// Digests of the subject. Should be a map of digest algorithms to their hex-encoded values.
digest: Record<string, string>
}
attestProvenance
这个 attestProvenance 函数接受一些文物的名称和摘要
生成一个基于这些值的建置出处证明.
证明书是首先生成的 SLSA 来源 上游 居住人口 元数据 从 GitHub 动作运行中拉出 .
const { attestProvenance } = require('@actions/attest');
const core = require('@actions/core');
async function run() {
// In order to persist attestations to the repo, this should be a token with
// repository write permissions.
const ghToken = core.getInput('gh-token');
const attestation = await attestProvenance({
subjectName: 'my-artifact-name',
subjectDigest: { 'sha256': '36ab4667...'},
token: ghToken
});
console.log(attestation);
}
run();
这个 attestProvenance 函数支持以下选项:
export type AttestProvenanceOptions = {
// Deprecated. Use 'subjects' instead.
subjectName?: string
// Deprecated. Use 'subjects' instead.
subjectDigest?: Record<string, string>
// Collection of subjects to be attested
subjects?: Subject[]
// URI identifying the content type of the predicate being attested.
token: string
// Sigstore instance to use for signing. Must be one of "public-good" or
// "github".
sigstore?: 'public-good' | 'github'
// HTTP headers to include in request to attestations API.
headers?: {[header: string]: string | number | undefined}
// Whether to skip writing the attestation to the GH attestations API.
skipWrite?: boolean
// Issuer URL responsible for minting the OIDC token from which the
// provenance data is read. Defaults to
// 'https://token.actions.githubusercontent.com".
issuer?: string
}
Attestation
这个 Attestation 返回时间 attest编号 :attestProvenance 有以下内容:
字段 :
export type Attestation = {
/*
* JSON-serialized Sigstore bundle containing the provenance attestation,
* signature, signing certificate and witnessed timestamp.
*/
bundle: SerializedBundle
/*
* PEM-encoded signing certificate used to sign the attestation.
*/
certificate: string
/*
* ID of Rekor transparency log entry created for the attestation (if
* applicable).
*/
tlogID?: string
/*
* ID of the persisted attestation (accessible via the GH API).
*/
attestationID?: string
}
有关Sigstore捆绑格式的详情,见 Bundle 原生纸 规格。 。 。 .
创建Storage记录
这个 createStorageRecord 函数创建
文物元数据存储记录
代表一个经认证的文物。 它接受定义文物的参数
和包登记细节。 存储记录中包含关于该文物存放于特定包登记册的元数据.
const { createStorageRecord } = require('@actions/attest');
const core = require('@actions/core');
async function run() {
// In order to persist attestations to the repo, this should be a token with
// repository write permissions.
const ghToken = core.getInput('gh-token');
const record = await createStorageRecord(
artifactOptions: {
name: 'my-artifact-name',
digest: { 'sha256': '36ab4667...'},
version: "v1.0.0"
},
packageRegistryOptions: {
registryUrl: "https://my-fave-pkg-registry.com"
},
token: ghToken
);
console.log(record);
}
run();
这个 createStorageRecord 函数支持以下选项:
// Artifact details to associate the record with
export type ArtifactOptions = {
// The name of the artifact
name: string
// The digest of the artifact
digest: string
// The version of the artifact
version?: string
// The status of the artifact
status?: string
}
// Includes details about the package registry the artifact was published to
export type PackageRegistryOptions = {
// The URL of the package registry
registryUrl: string
// The URL of the artifact in the package registry
artifactUrl?: string
// The package registry repository the artifact was published to.
repo?: string
// The path of the artifact in the package registry repository.
path?: string
}
// GitHub token for writing attestations.
token: string
// Optional parameters for the write operation.
// The number of times to retry the request.
retryAttempts?: number
// HTTP headers to include in request to Artifact Metadata API.
headers?: RequestHeaders
Sigstore 实例
当生成签名的证明时, 有两种不同的 Sigstore 用于签发签名证书的示例。 默认, 从公共储存库启动的工作流程将使用Sigstore公益物 并坚持向公众提供证明的签名 回科尔透明度 日志从 私人/内部存储器将使用 GitHub- 内部 Sigstore 实例 使用GitHub时间戳当局签发的签字时间戳代替 公共透明度记录.
默认的 Sigstore 实例选择可以通过通过一个明示来推翻
“公益”或“github”的数值 sigstore 选项
无论是 attest 或者说 attestProvenance。 。 。 .
存储
由 attest编号 :attestProvenance 将上传到 GH 中
与适当储存库有关的API证明。 证明
仅支持属于公共储存库或储存库的存储
到一个GitHub企业云账户.
为了为私人、非企业储存库提供证明
skipWrite 选项应设置为 true。 。 。 .