|
| 1 | +import logging |
| 2 | +import os |
| 3 | +import sys |
| 4 | +from pathlib import Path |
| 5 | +from typing import NoReturn |
| 6 | + |
| 7 | +from pypi_attestation_models import AttestationPayload |
| 8 | +from sigstore.oidc import IdentityError, IdentityToken, detect_credential |
| 9 | +from sigstore.sign import Signer, SigningContext |
| 10 | + |
| 11 | +# Be very verbose. |
| 12 | +sigstore_logger = logging.getLogger("sigstore") |
| 13 | +sigstore_logger.setLevel(logging.DEBUG) |
| 14 | +sigstore_logger.addHandler(logging.StreamHandler()) |
| 15 | + |
| 16 | +_GITHUB_STEP_SUMMARY = Path(os.getenv("GITHUB_STEP_SUMMARY")) |
| 17 | + |
| 18 | +# The top-level error message that gets rendered. |
| 19 | +# This message wraps one of the other templates/messages defined below. |
| 20 | +_ERROR_SUMMARY_MESSAGE = """ |
| 21 | +Attestation generation failure: |
| 22 | +
|
| 23 | +{message} |
| 24 | +
|
| 25 | +You're seeing this because the action attempted to generated PEP 740 |
| 26 | +attestations for its inputs, but failed to do so. |
| 27 | +""" |
| 28 | + |
| 29 | +# Rendered if OIDC identity token retrieval fails for any reason. |
| 30 | +_TOKEN_RETRIEVAL_FAILED_MESSAGE = """ |
| 31 | +OpenID Connect token retrieval failed: {identity_error} |
| 32 | +
|
| 33 | +This generally indicates a workflow configuration error, such as insufficient |
| 34 | +permissions. Make sure that your workflow has `id-token: write` configured |
| 35 | +at the job level, e.g.: |
| 36 | +
|
| 37 | +```yaml |
| 38 | +permissions: |
| 39 | + id-token: write |
| 40 | +``` |
| 41 | +
|
| 42 | +Learn more at https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#adding-permissions-settings. |
| 43 | +""" |
| 44 | + |
| 45 | + |
| 46 | +def die(msg: str) -> NoReturn: |
| 47 | + with _GITHUB_STEP_SUMMARY.open("a", encoding="utf-8") as io: |
| 48 | + print(_ERROR_SUMMARY_MESSAGE.format(message=msg), file=io) |
| 49 | + |
| 50 | + # HACK: GitHub Actions' annotations don't work across multiple lines naively; |
| 51 | + # translating `\n` into `%0A` (i.e., HTML percent-encoding) is known to work. |
| 52 | + # See: https://github.com/actions/toolkit/issues/193 |
| 53 | + msg = msg.replace("\n", "%0A") |
| 54 | + print(f"::error::Attestation generation failure: {msg}", file=sys.stderr) |
| 55 | + sys.exit(1) |
| 56 | + |
| 57 | + |
| 58 | +def debug(msg: str): |
| 59 | + print(f"::debug::{msg}", file=sys.stderr) |
| 60 | + |
| 61 | + |
| 62 | +# pylint: disable=redefined-outer-name |
| 63 | +def attest_dist(dist: Path, signer: Signer) -> None: |
| 64 | + # We are the publishing step, so there should be no pre-existing publish |
| 65 | + # attestation. The presence of one indicates user confusion. |
| 66 | + attestation_path = Path(f"{dist}.publish.attestation") |
| 67 | + if attestation_path.is_file(): |
| 68 | + die(f"{dist} already has a publish attestation: {attestation_path}") |
| 69 | + |
| 70 | + payload = AttestationPayload.from_dist(dist) |
| 71 | + attestation = payload.sign(signer) |
| 72 | + |
| 73 | + attestation_path.write_text(attestation.model_dump_json(), encoding="utf-8") |
| 74 | + debug(f"saved publish attestation: {dist=} {attestation_path=}") |
| 75 | + |
| 76 | + |
| 77 | +packages_dir = Path(sys.argv[1]) |
| 78 | + |
| 79 | +try: |
| 80 | + # NOTE: audience is always sigstore. |
| 81 | + oidc_token = detect_credential() |
| 82 | + identity = IdentityToken(oidc_token) |
| 83 | +except IdentityError as identity_error: |
| 84 | + # NOTE: We only perform attestations in trusted publishing flows, so we |
| 85 | + # don't need to re-check for the "PR from fork" error mode, only |
| 86 | + # generic token retrieval errors. |
| 87 | + cause = _TOKEN_RETRIEVAL_FAILED_MESSAGE.format(identity_error=identity_error) |
| 88 | + die(cause) |
| 89 | + |
| 90 | +# Collect all sdists and wheels. |
| 91 | +dists = [sdist.absolute() for sdist in packages_dir.glob("*.tar.gz")] |
| 92 | +dists.extend(whl.absolute() for whl in packages_dir.glob("*.whl")) |
| 93 | + |
| 94 | +with SigningContext.production().signer(identity, cache=True) as signer: |
| 95 | + for dist in dists: |
| 96 | + # This should never really happen, but some versions of GitHub's |
| 97 | + # download-artifact will create a subdirectory with the same name |
| 98 | + # as the artifact being downloaded, e.g. `dist/foo.whl/foo.whl`. |
| 99 | + if not dist.is_file(): |
| 100 | + die(f"Path looks like a distribution but is not a file: {dist}") |
| 101 | + |
| 102 | + attest_dist(dist, signer) |
0 commit comments