Securing upstream releases

[jotak]

Upstream builds and releases are done through GitHub worklows:

• Every push to main triggers an OCI image build, which is pushed to quay.io.
• Releases are triggered by a git tag, and resulting images are pushed as well to quay.io.

The release process is described here. Some manual steps are involved to publish release notes and the Helm chart.

The on-push builds may remain as is, but we need to secure the release builds by:

• Generating SBOM
• Signing images
• Making releases immutable
• Automating the Helm chart generation (optional)

[Helion55]

Hi @jotak, I want to start working on this, any plans on your side?

[jotak]

Hi @Helion55 , thanks for proposing your help!
I think the plan is to edit all of our release workflows (on each repo) to add:

• SBOM generation
• signing
• provenance attestation
  You can see an example here with all those steps: https://github.com/scraly/gophers-api/blob/9efa89071937d0fa71e4acfd1b4a8c782d640fa5/.github/workflows/release.yml#L63-L95 (there's also VEX, but I think we can ignore that to begin with)

We will have 5 repositories to cover (operator, eBPF agent, FLP, web console and CLI), so let's start with just one, and once we're happy with the solution, we can replicate that on the other repos. I would start with the FLP release workflow, it's slightly simpler than the other ones.

[Helion55]

Thanks @jotak for that example, got the idea. Working on it.