test the system image makefile provenance

.github/workflows/full_provenance.yaml

@@ -1,38 +1,38 @@
-# Container-based SLSA provenance generator that works with multiple provenance subjects.
-# Does not upload provenances to ENT, as to the existing logic for
-# importing provenances as part of transparent release, which does not yet
-# support mulitple subjects and expects specific ENT tag names.
-# TODO: b/333745447 - Merge with .github/workflows/provenance.yaml
-name: Build Full SLSA3 Provenances
+# # Container-based SLSA provenance generator that works with multiple provenance subjects.
+# # Does not upload provenances to ENT, as to the existing logic for
+# # importing provenances as part of transparent release, which does not yet
+# # support mulitple subjects and expects specific ENT tag names.
+# # TODO: b/333745447 - Merge with .github/workflows/provenance.yaml
+# name: Build Full SLSA3 Provenances
 
-# See https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions#example-using-concurrency-to-cancel-any-in-progress-job-or-run
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
-  cancel-in-progress: true
+# # See https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions#example-using-concurrency-to-cancel-any-in-progress-job-or-run
+# concurrency:
+#   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+#   cancel-in-progress: true
 
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
+# on:
+#   push:
+#     branches: [main]
+#   pull_request:
+#     branches: [main]
 
-jobs:
-  build_binary:
-    if: |
-      github.event_name == 'push' ||
-      contains(github.event.pull_request.labels.*.name, 'provenance:force-run')
+# jobs:
+#   build_binary:
+#     if: |
+#       github.event_name == 'push' ||
+#       contains(github.event.pull_request.labels.*.name, 'provenance:force-run')
 
-    # We use the same job template to generate provenances for multiple binaries.
-    strategy:
-      fail-fast: false
-      matrix:
-        buildconfig:
-          - buildconfigs_full_provenance/oak_containers_kernel.toml
-          - buildconfigs_full_provenance/oak_restricted_kernel_simple_io_init_rd_wrapper_bin.toml
+#     # We use the same job template to generate provenances for multiple binaries.
+#     strategy:
+#       fail-fast: false
+#       matrix:
+#         buildconfig:
+#           - buildconfigs_full_provenance/oak_containers_kernel.toml
+#           - buildconfigs_full_provenance/oak_restricted_kernel_simple_io_init_rd_wrapper_bin.toml
 
-    permissions:
-      actions: read
-      id-token: write
-    uses: ./.github/workflows/reusable_full_provenance.yaml
-    with:
-      build-config-path: ${{ matrix.buildconfig }}
+#     permissions:
+#       actions: read
+#       id-token: write
+#     uses: ./.github/workflows/reusable_full_provenance.yaml
+#     with:
+#       build-config-path: ${{ matrix.buildconfig }}

.github/workflows/provenance.yaml

@@ -16,26 +16,24 @@ on:
 
 jobs:
   build_binary:
-    if: |
-      github.event_name == 'push' ||
-      contains(github.event.pull_request.labels.*.name, 'provenance:force-run')
 
     # We use the same job template to generate provenances for multiple binaries.
     strategy:
       fail-fast: false
       matrix:
         buildconfig:
-          - buildconfigs/key_xor_test_app.toml
-          - buildconfigs/oak_containers_kernel.toml
-          - buildconfigs/oak_containers_stage1.toml
-          - buildconfigs/oak_echo_enclave_app.toml
-          - buildconfigs/oak_echo_raw_enclave_app.toml
-          - buildconfigs/oak_functions_enclave_app.toml
-          - buildconfigs/oak_functions_insecure_enclave_app.toml
-          - buildconfigs/oak_restricted_kernel_simple_io_wrapper_bin.toml
-          - buildconfigs/oak_restricted_kernel_simple_io_init_rd_wrapper_bin.toml
-          - buildconfigs/stage0_bin.toml
-          - buildconfigs/oak_orchestrator.toml
+          # - buildconfigs/key_xor_test_app.toml
+          # - buildconfigs/oak_containers_kernel.toml
+          # - buildconfigs/oak_containers_stage1.toml
+          - buildconfigs/oak_containers_system_image.toml
+          # - buildconfigs/oak_echo_enclave_app.toml
+          # - buildconfigs/oak_echo_raw_enclave_app.toml
+          # - buildconfigs/oak_functions_enclave_app.toml
+          # - buildconfigs/oak_functions_insecure_enclave_app.toml
+          # - buildconfigs/oak_restricted_kernel_simple_io_wrapper_bin.toml
+          # - buildconfigs/oak_restricted_kernel_simple_io_init_rd_wrapper_bin.toml
+          # - buildconfigs/stage0_bin.toml
+          # - buildconfigs/oak_orchestrator.toml
 
     permissions:
       actions: read

buildconfigs/oak_containers_system_image.toml

@@ -0,0 +1,13 @@
+# This is the static build configuration that we use with the docker-based SLSA3 generator for
+# building the `stage1` binary, and its provenance.
+# See https://github.com/slsa-framework/slsa-github-generator/tree/main/internal/builders/docker.
+command = [
+  "nix",
+  "develop",
+  ".#systemImageProvenance",
+  "--command",
+  "env",
+  "--chdir=oak_containers_system_image",
+  "make",
+]
+artifact_path = "./oak_containers_system_image/target/image.tar.xz"

flake.nix

@@ -233,6 +233,13 @@
                 glibc.static
               ];
             };
+            systemImageProvenance = with pkgs; mkShell {
+              inputsFrom = [
+                rust
+                bazelShell
+              ];
+              packages = [ ];
+            };
             # Shell for most CI steps (i.e. without contaniners support).
             ci = pkgs.mkShell {
               inputsFrom = [

justfile

@@ -93,7 +93,7 @@ oak_containers_kernel:
         oak_containers_kernel/target/bzImage
 
 oak_containers_system_image:
-    env --chdir=oak_containers_system_image DOCKER_BUILDKIT=0 bash build.sh
+    env --chdir=oak_containers_system_image DOCKER_BUILDKIT=0 make
 
 # Profile the Wasm execution and generate a flamegraph.
 profile_wasm:

oak_containers_system_image/Makefile

@@ -0,0 +1,29 @@
+IMAGE_BINARIES_DIRECTORY := ./target/image_binaries
+
+.PHONY: all clean
+
+all: image.tar.xz
+
+$(IMAGE_BINARIES_DIRECTORY):
+		mkdir -p $(IMAGE_BINARIES_DIRECTORY)
+
+# Build binaries
+$(IMAGE_BINARIES_DIRECTORY)/oak_containers_orchestrator: $(IMAGE_BINARIES_DIRECTORY)
+		cargo build --package=oak_containers_orchestrator --profile=release-lto --target=x86_64-unknown-linux-musl -Z unstable-options --out-dir=./target
+
+$(IMAGE_BINARIES_DIRECTORY)/oak_containers_syslogd: $(IMAGE_BINARIES_DIRECTORY)
+		cargo build --package=oak_containers_syslogd --release -Z unstable-options --out-dir=./target
+		cp $< $@
+		patchelf --set-interpreter /lib64/ld-linux-x86-64.so.2 $@
+
+# Build system image
+oak_containers_system_image.tar: $(IMAGE_BINARIES_DIRECTORY) $(IMAGE_BINARIES_DIRECTORY)/oak_containers_syslogd
+		bazel build oak_containers_system_image
+
+# Create compressed image archive
+image.tar.xz: oak_containers_system_image.tar
+		cp ../bazel-bin/oak_containers_system_image/oak_containers_system_image.tar ./target/image.tar
+		xz --force target/image.tar
+
+clean:
+		rm -rf $(IMAGE_BINARIES_DIRECTORY) target/image.tar*