Slsa sysimage

.github/workflows/provenance.yaml

@@ -28,6 +28,7 @@ jobs:
           - buildconfigs/key_xor_test_app.toml
           - buildconfigs/oak_containers_kernel.toml
           - buildconfigs/oak_containers_stage1.toml
+          - buildconfigs/oak_containers_system_image.toml
           - buildconfigs/oak_echo_enclave_app.toml
           - buildconfigs/oak_echo_raw_enclave_app.toml
           - buildconfigs/oak_functions_enclave_app.toml

.github/workflows/reusable_provenance.yaml

@@ -75,7 +75,12 @@ jobs:
       actions: read
       id-token: write
       contents: write # For uploading provenances.
-    uses: slsa-framework/slsa-github-generator/.github/workflows/builder_container-based_slsa3.yml@v1.10.0
+    # We are using a patched version that emits stdout and stderr as the build progresses, rather than waiting until the very end to
+    # read everything in. This works around some issues we encountered when the
+    # output is very large. If our patch is eventually accepted upstream (or any other fix), we can switch back to using the main
+    # repository.
+    # See: https://github.com/slsa-framework/slsa-github-generator/issues/3571
+    uses: jul-sh/slsa-github-generator/.github/workflows/builder_container-based_slsa3.yml@oak
     with:
       builder-image: 'europe-west2-docker.pkg.dev/oak-ci/oak-development/oak-development'
       builder-digest: ${{ needs.get_inputs.outputs.builder-digest }}

buildconfigs/oak_containers_system_image.toml

@@ -0,0 +1,12 @@
+# This is the static build configuration that we use with the docker-based SLSA3 generator for
+# building the `stage1` binary, and its provenance.
+# See https://github.com/slsa-framework/slsa-github-generator/tree/main/internal/builders/docker.
+command = [
+  "nix",
+  "develop",
+  ".#systemImageProvenance",
+  "--command",
+  "just",
+  "oak_containers_system_image",
+]
+artifact_path = "./oak_containers_system_image/target/image.tar.xz"

flake.nix

@@ -235,6 +235,13 @@
                 strip-nondeterminism
               ];
             };
+            systemImageProvenance = with pkgs; mkShell {
+              inputsFrom = [
+                rust
+                bazelShell
+              ];
+              packages = [ ];
+            };
             # Shell for most CI steps (i.e. without contaniners support).
             ci = pkgs.mkShell {
               inputsFrom = [