fix: update the GCB builder ID

[ramonpetgrave64]

Addresses slsa-framework/slsa-github-generator#3344

...
FAILED: SLSA verification failed: builderID does not match provenance: expected version 'v0.3', got ''

The GCB Builder ID for newer provenances now does not include the tag @v0.3 under the inTotoSlsaProvenanceV1 .

• https://cloud.google.com/build/docs/securing-builds/view-build-provenance

We'll have to verify without the tag. Not including the tag is still compatible with slsa-verifier for older provenances.

GCB docs on how to verify also suggest to leave out the tag

slsa-verifier verify-image "$IMAGE" \
--provenance-path provenance.json \
--source-uri SOURCE \
--builder-id=BUILDER_ID

Where:
...
BUILDER_ID the unique ID for the builder, for example https://cloudbuild.googleapis.com/GoogleHostedWorker

Testing

Tested in a GCP cloud console

A helper script to debug, checking against the age of the build (index), and the tag the check.
Similar to our e2e test

rpetgrave@cloudshell:~ (slsa-tooling)$ do_test () {
    idx=$1
    tag=$2

    BUILDER_ID="https://cloudbuild.googleapis.com/GoogleHostedWorker${tag}"
    IMAGE_REGISTRY="us-west2-docker.pkg.dev"
    IMAGE_NAME="slsa-tooling/example-package-repo/e2e-gcb-tag-main-annotated-slsa3"
    build_id=$(gcloud builds list --filter "results.images.name=${IMAGE_REGISTRY}/${IMAGE_NAME}" --region=us-west2 --project slsa-tooling --limit=20 --format=json | jq -r '.[env.idx | tonumber].id')
    image_digest=$(gcloud builds describe "${build_id}" --project=slsa-tooling --region=us-west2 --format="value(results.images[0].digest)")
    gcloud artifacts docker images describe "${IMAGE_REGISTRY}/${IMAGE_NAME}@${image_digest}" --show-provenance --format json > provenance.json
    IMAGE="${IMAGE_REGISTRY}/${IMAGE_NAME}@${image_digest}"
    SOURCE="https://github.com/slsa-framework/example-package"

    slsa-verifier verify-image "$IMAGE" \
    --provenance-path provenance.json \
    --source-uri "$SOURCE" \
    --builder-id="$BUILDER_ID"
}

Using the tag fails for recent builds up until the builds from December and older.

rpetgrave@cloudshell:~ (slsa-tooling)$ do_test 0 @v0.3 # fail
WARNING: Insecure SLSA_VERIFIER_TESTING is enabled.
Verification succeeded with key "global-pae-google-hosted-worker_1"
FAILED: SLSA verification failed: builderID does not match provenance: expected version 'v0.3', got ''

rpetgrave@cloudshell:~ (slsa-tooling)$ do_test 8 @v0.3 # fail
WARNING: Insecure SLSA_VERIFIER_TESTING is enabled.
Verification succeeded with key "global-pae-google-hosted-worker_1"
FAILED: SLSA verification failed: builderID does not match provenance: expected version 'v0.3', got ''

rpetgrave@cloudshell:~ (slsa-tooling)$ do_test 9 @v0.3 # pass
WARNING: Insecure SLSA_VERIFIER_TESTING is enabled.
Verification succeeded with key "global-pae-provenanceSigner_1"
PASSED: Verified SLSA provenance

Not using the tag passes for all past and current provenances.

rpetgrave@cloudshell:~ (slsa-tooling)$ do_test 0 "" # pass
WARNING: Insecure SLSA_VERIFIER_TESTING is enabled.
Verification succeeded with key "global-pae-google-hosted-worker_1"
PASSED: Verified SLSA provenance

rpetgrave@cloudshell:~ (slsa-tooling)$ do_test 8 "" # pass
WARNING: Insecure SLSA_VERIFIER_TESTING is enabled.
Verification succeeded with key "global-pae-google-hosted-worker_1"
PASSED: Verified SLSA provenance

rpetgrave@cloudshell:~ (slsa-tooling)$ do_test 9 "" # pass
WARNING: Insecure SLSA_VERIFIER_TESTING is enabled.
Verification succeeded with key "global-pae-provenanceSigner_1"
PASSED: Verified SLSA provenance

rpetgrave@cloudshell:~ (slsa-tooling)$ do_test 15 "" # pass
WARNING: Insecure SLSA_VERIFIER_TESTING is enabled.
Verification succeeded with key "global-pae-provenanceSigner_1"
PASSED: Verified SLSA provenance

[ramonpetgrave64]

@laurentsimon

[laurentsimon]

Thanks. So slsa-verifier is able to verify properly :) I know we have some code that looks for the version but it seems it's only relevant for v0.1 provenance https://github.com/slsa-framework/slsa-verifier/blob/main/verifiers/internal/gcb/provenance.go#L210-L236. Looks like v1.0 does not have this differentiation https://github.com/slsa-framework/slsa-verifier/blob/main/verifiers/internal/gcb/slsaprovenance/v1.0/provenance.go#L27-L35. So the fix looks good, thanks!