mirror of
https://github.com/denoland/deno
synced 2024-09-17 23:22:46 +00:00
9b5d2f8c1b
Supply chain security for JSR. ``` $ deno publish --provenance Successfully published @divy/test_provenance@0.0.3 Provenance transparency log available at https://search.sigstore.dev/?logIndex=73657418 ``` 0. Package has been published. 1. Fetches the version manifest and verifies it's matching with uploaded files and exports. 2. Builds the attestation SLSA payload using Github actions env. 3. Creates an ephemeral key pair for signing the github token (aud=sigstore) and DSSE pre authentication tag. 4. Requests a X.509 signing certificate from Fulcio using the challenge and ephemeral public key PEM. 5. Prepares a DSSE envelop for Rekor to witness. Posts an intoto entry to Rekor and gets back the transparency log index. 6. Builds the provenance bundle and posts it to JSR.
60 lines
1.6 KiB
Rust
60 lines
1.6 KiB
Rust
// Copyright 2018-2024 the Deno authors. All rights reserved. MIT license.
|
|
|
|
use std::io::IsTerminal;
|
|
|
|
use deno_core::anyhow;
|
|
use deno_core::anyhow::bail;
|
|
use deno_core::error::AnyError;
|
|
|
|
pub enum AuthMethod {
|
|
Interactive,
|
|
Token(String),
|
|
Oidc(OidcConfig),
|
|
}
|
|
|
|
pub struct OidcConfig {
|
|
pub url: String,
|
|
pub token: String,
|
|
}
|
|
|
|
pub(crate) fn is_gha() -> bool {
|
|
std::env::var("GITHUB_ACTIONS").unwrap_or_default() == "true"
|
|
}
|
|
|
|
pub(crate) fn gha_oidc_token() -> Option<String> {
|
|
std::env::var("ACTIONS_ID_TOKEN_REQUEST_TOKEN").ok()
|
|
}
|
|
|
|
fn get_gh_oidc_env_vars() -> Option<Result<(String, String), AnyError>> {
|
|
if std::env::var("GITHUB_ACTIONS").unwrap_or_default() == "true" {
|
|
let url = std::env::var("ACTIONS_ID_TOKEN_REQUEST_URL");
|
|
let token = std::env::var("ACTIONS_ID_TOKEN_REQUEST_TOKEN");
|
|
match (url, token) {
|
|
(Ok(url), Ok(token)) => Some(Ok((url, token))),
|
|
(Err(_), Err(_)) => Some(Err(anyhow::anyhow!(
|
|
"No means to authenticate. Pass a token to `--token`, or enable tokenless publishing from GitHub Actions using OIDC. Learn more at https://deno.co/ghoidc"
|
|
))),
|
|
_ => None,
|
|
}
|
|
} else {
|
|
None
|
|
}
|
|
}
|
|
|
|
pub fn get_auth_method(
|
|
maybe_token: Option<String>,
|
|
) -> Result<AuthMethod, AnyError> {
|
|
if let Some(token) = maybe_token {
|
|
return Ok(AuthMethod::Token(token));
|
|
}
|
|
|
|
match get_gh_oidc_env_vars() {
|
|
Some(Ok((url, token))) => Ok(AuthMethod::Oidc(OidcConfig { url, token })),
|
|
Some(Err(err)) => Err(err),
|
|
None if std::io::stdin().is_terminal() => Ok(AuthMethod::Interactive),
|
|
None => {
|
|
bail!("No means to authenticate. Pass a token to `--token`.")
|
|
}
|
|
}
|
|
}
|