pi-hole / FTL

The Pi-hole FTL engine
https://pi-hole.net
Other
1.34k stars 187 forks source link

Add artifact attestation #1964

Closed DL6ER closed 1 month ago

DL6ER commented 1 month ago

What does this implement/fix?

Creating a tamper-proof papertrail for all FTL binaries we build on Github Actions:

$ gh attestation verify pihole-FTL-amd64 -o pi-hole

Loaded digest sha256:67e7d2451a29ff3cd21c4a7c489ac4b1d43993f4a69bf9fbe989dda47f24685e for file://pihole-FTL-amd64
Loaded 1 attestation from GitHub API
✓ Verification succeeded!

sha256:67e7d2451a29ff3cd21c4a7c489ac4b1d43993f4a69bf9fbe989dda47f24685e was attested by:
REPO         PREDICATE_TYPE                  WORKFLOW                                                        
pi-hole/FTL  https://slsa.dev/provenance/v1  .github/workflows/build.yml@refs/heads/new/artifact_attestations

tested using gh 2.49.2 on Ubuntu 24.04 LTS


Related issue or feature (if applicable): N/A

Pull request in docs with documentation (if applicable): N/A


By submitting this pull request, I confirm the following:

  1. I have read and understood the contributors guide, as well as this entire template. I understand which branch to base my commits and Pull Requests against.
  2. I have commented my proposed changes within the code.
  3. I am willing to help maintain this change if there are issues with it later.
  4. It is compatible with the EUPL 1.2 license
  5. I have squashed any insignificant commits. (git rebase)

Checklist: