Jenkins: record and verify a Pipeline build with CI/lock

compile:  checkout -> build -> push     nightly:  verify -> promote -> attach     Kyverno:  admit by digest

package example.webapp.build_commands

# Only approved programs run during the build. The trace records every program the build starts.
allowed := ["dirname", "expr", "java", "jspawnhelper", "ls", "mvn", "sh", "uname"]
# adapted: the tested rule checked the name only. Use the directories of your agent image.
toolchain := ["/usr/", "/bin/", "/opt/"]

deny[msg] {
    p := object.get(input, "processes", [])[_]
    i := object.get(p, "execPathId", -1)
    i >= 0
    exe := input.paths[i]
    not approved(exe)
    msg := sprintf("UNAPPROVED COMMAND: pid %v ran %v during the build. Command line: %v",
        [p.processid, exe, cmdline(p)])
}

approved(exe) {
    parts := split(exe, "/")
    allowed[_] == parts[count(parts) - 1]
    startswith(exe, toolchain[_])
}

cmdline(p) := input.cmdlines[i] {
    i := object.get(p, "cmdlineId", -1)
    i >= 0
}

cmdline(p) := "unknown" {
    object.get(p, "cmdlineId", -1) < 0
}

openssl ecparam -name prime256v1 -genkey -noout | openssl pkcs8 -topk8 -nocrypt -out policy.key
openssl pkey -in policy.key -pubout -out policy.pub
cilock sign --offline -k policy.key -f policy.json -o policy.signed.json

  environment {
    CILOCK_VERSION = 'v4.7.0-rc.2'
    CILOCK_SHA256  = 'b32d6821a602702c4795dbcb9f327950a9496efc93df183f12312f307006b5c3'
    CILOCK_INSTALLER_SHA256 = '362c3635624d95b0dcf906736bf77a295789648c4481f0ddc7ee7f3aed55323a'   // adapted: install.sh at v4.7.0-rc.2
    CILOCK_DIR     = "${env.WORKSPACE_TMP}/cilock-${CILOCK_VERSION}"   // per job, outside the source tree
    CILOCK         = "${CILOCK_DIR}/cilock"
    CILOCK_MAX_ATTESTATION_BYTES = '16MiB'   // adapted: added later, a cold Maven cache wrote a 4.4 MiB build record
  }
  stages {
    stage('Install cilock') {
      steps {
        sh '''
          pinned() { [ -x "$CILOCK" ] && [ "$(sha256sum < "$CILOCK" | cut -d' ' -f1)" = "$CILOCK_SHA256" ]; }
          if pinned; then
            echo "cilock $CILOCK_VERSION already installed at $CILOCK, sha256 matches"
          else
            mkdir -p "$CILOCK_DIR"                                  # install.sh does not create it
            curl -fsSLo "$CILOCK_DIR/install.sh" https://cilock.dev/install.sh
            echo "$CILOCK_INSTALLER_SHA256  $CILOCK_DIR/install.sh" | sha256sum -c -   # adapted: verify before it runs
            CILOCK_VERSION="$CILOCK_VERSION" CILOCK_BIN_DIR="$CILOCK_DIR" sh "$CILOCK_DIR/install.sh"
            rm -f "$CILOCK_DIR/install.sh"
            if ! pinned; then
              echo "STOP: $CILOCK has sha256 $(sha256sum < "$CILOCK" | cut -d' ' -f1), but the Jenkinsfile pins $CILOCK_SHA256. Not using it."
              rm -f "$CILOCK"; exit 1
            fi
          fi
          "$CILOCK" version
        '''
      }
    }

FROM <your agent image>
USER root
RUN mkdir -p /opt/cilock \
 && curl -fsSLo /tmp/cilock-install.sh https://cilock.dev/install.sh \
 && echo "362c3635624d95b0dcf906736bf77a295789648c4481f0ddc7ee7f3aed55323a  /tmp/cilock-install.sh" | sha256sum -c - \
 && CILOCK_VERSION=v4.7.0-rc.2 CILOCK_BIN_DIR=/opt/cilock sh /tmp/cilock-install.sh \
 && rm /tmp/cilock-install.sh

pipeline {
  agent { label 'linux-docker' }                         // adapted: your agent label
  triggers { githubPush() }
  options {
    timeout(time: 150, unit: 'MINUTES')
    timestamps()
    disableConcurrentBuilds()
    copyArtifactPermission('webapp-nightly')            // the nightly job copies evidence/ from this job
    skipDefaultCheckout()   // no second, untraced copy of the repository in the workspace
  }
  parameters {
    string(name: 'SRC', defaultValue: 'registry.example.com/apps/webapp:build', description: 'Image name')
    string(name: 'git_branch', defaultValue: 'main')
  }
  environment {
    REPO_URL     = '[email protected]:acme/webapp.git'
    BRANCH       = "${params.git_branch}"   // params.*: on the first run Jenkins has not set $git_branch yet
    IMAGE        = "${params.SRC}"
    ROOT         = 'app'                    // clone folder; the policy expects app/
    // CILOCK_VERSION, CILOCK_SHA256, CILOCK_DIR, CILOCK and CILOCK_MAX_ATTESTATION_BYTES: see step 1
    MVN_SETTINGS = '/home/jenkins/.m2/settings.xml'                                  // adapted: your settings file
    WAR_IN_IMAGE = '/opt/jboss/wildfly/standalone/deployments/webapp.war'            // where the Dockerfile puts the WAR
    TRACE        = '--trace --capture-mode trace:ptrace'
    TSA          = '--timestamp-servers http://timestamp.digicert.com --timestamp-allow-http'
  }
  stages {
    // stage('Install cilock') from step 1
    stage('Checkout (traced)') {
      steps {
        sh 'rm -rf "$ROOT" "$ROOT.git" evidence push && mkdir evidence'
        sshagent(credentials: ['git-ssh']) {
          withCredentials([file(credentialsId: 'cilock-signing-key', variable: 'CILOCK_KEY')]) {
            sh '''
              "$CILOCK" run --step checkout $TRACE --signer-file-key-path "$CILOCK_KEY" $TSA --offline \
                -a environment --material-manifest -o evidence/checkout.json -- \
                git clone --branch "$BRANCH" "$REPO_URL" "$ROOT"
              git -C "$ROOT" rev-parse HEAD > evidence/commit
              mv "$ROOT/.git" "$ROOT.git"    # keep git's own folder out of the build inputs
            '''
          }
        }
      }
    }
    stage('Build (traced)') {
      steps {
        withCredentials([
          usernamePassword(credentialsId: 'registry-push', usernameVariable: 'DOCKER_REPOSITORY_USER', passwordVariable: 'DOCKER_REPOSITORY_PASSWORD'),
          file(credentialsId: 'cilock-signing-key', variable: 'CILOCK_KEY')]) {
          dir(env.ROOT) {
            sh 'java -version; mvn -v'
            // adapted: the tested goals were the job's own goals, ending in a docker-maven-plugin goal that builds the image
            sh '''
              "$CILOCK" run --step build $TRACE --signer-file-key-path "$CILOCK_KEY" $TSA --offline \
                -a environment,maven --material-manifest -o ../evidence/build.json -- \
                mvn -B -s "$MVN_SETTINGS" -gs "$MVN_SETTINGS" \
                  -DSRC="$IMAGE" -DBUILD_NUMBER="$BUILD_NUMBER" -DBUILD_URL="$BUILD_URL" \
                  clean install docker:build
            '''
          }
        }
      }
    }
    stage('Push (recorded)') {
      steps {
        withCredentials([
          usernamePassword(credentialsId: 'registry-push', usernameVariable: 'DOCKER_REPOSITORY_USER', passwordVariable: 'DOCKER_REPOSITORY_PASSWORD'),
          file(credentialsId: 'cilock-signing-key', variable: 'CILOCK_KEY')]) {
          sh '''
            WAR_BUILT=$PWD/$ROOT/target/docker/webapp.war              # adapted: where your build writes the WAR
            CID=$(docker create "$IMAGE"); docker cp -q "$CID:$WAR_IN_IMAGE" evidence/war-in-image.war; docker rm "$CID" >/dev/null
            mkdir -p push && cd push
            "$CILOCK" run --step push --signer-file-key-path "$CILOCK_KEY" $TSA --offline -a oci --material-manifest \
              --attestor-material-bind "$WAR_BUILT=../evidence/war-in-image.war" -o ../evidence/push.json -- docker push "$IMAGE"
            cd ..
            # The image digest, read from the signed push record, for the nightly job.
            sed -n 's/.*"payload": *"\\([^"]*\\)".*/\\1/p' evidence/push.json | base64 -d \
              | grep -o "registrydigest:$IMAGE@sha256:[0-9a-f]*" | awk -F@ 'NR==1 {print $2}' > evidence/image-digest
            echo "pushed $IMAGE = ${IMAGE%:*}@$(cat evidence/image-digest)"
          '''
        }
      }
    }
  }
  post {
    always {
      archiveArtifacts allowEmptyArchive: false, artifacts: "evidence/**,${env.ROOT}/target/surefire-reports/*.xml"
      junit allowEmptyResults: true, testResults: "${env.ROOT}/target/surefire-reports/*.xml"
    }
  }
}

cilock run: step checkout ok, command exit 0; signer file, outfile evidence/checkout.json; --summary full for details
cilock run: trace ptrace+seccomp PARTIAL (gaps: fanotify-unavailable, syscalls-untraced)
[INFO] BUILD SUCCESS
cilock run: step build ok, command exit 0; signer file, outfile ../evidence/build.json; --summary full for details
cilock run: trace ptrace+seccomp PARTIAL (gaps: fanotify-unavailable, syscalls-untraced)
cilock run: step push ok, command exit 0; signer file, outfile ../evidence/push.json; --summary full for details
pushed registry.example.com/apps/webapp:build = registry.example.com/apps/webapp@sha256:8e8949f7...

pipeline {
  agent { label 'linux-docker' }                                   // adapted: your agent label
  triggers { cron('H 2 * * *') }
  options {
    disableConcurrentBuilds()                                      // one writer for each image
    timestamps()
  }
  environment {
    // CILOCK_VERSION, CILOCK_SHA256, CILOCK_DIR, CILOCK and CILOCK_MAX_ATTESTATION_BYTES: see step 1
    IMAGE        = 'registry.example.com/apps/webapp'              // the compile job's SRC, no tag
    STABLE_IMAGE = 'registry.example.com/apps/stable/webapp'       // where the promotion pushes
  }
  stages {
    // stage('Install cilock') from step 1
    stage('Get the records') {
      steps {
        deleteDir()
        copyArtifacts(projectName: 'webapp-compile', selector: lastSuccessful(), filter: 'evidence/**')
      }
    }
    stage('Verify, promote, attach') {
      steps {
        withCredentials([
          file(credentialsId: 'cilock-vsa-key', variable: 'VSA_KEY'),       // adapted: the VSA key, not the CI key
          file(credentialsId: 'cilock-policy', variable: 'POLICY'),
          file(credentialsId: 'cilock-policy-pub', variable: 'POLICY_PUB')]) {
          sh '''#!/bin/bash
            NIGHTLY_TAG=$BUILD_NUMBER
            set -euo pipefail
            SIGN="--signer-file-key-path $VSA_KEY"
            VSA_TSA="--vsa-timestamp-servers http://timestamp.digicert.com --vsa-timestamp-allow-http"
            DIGEST=$(cat evidence/image-digest)

            # 1. Verify the three records against the signed policy, from the image digest alone. Write a signed VSA.
            "$CILOCK" verify --offline -p "$POLICY" -k "$POLICY_PUB" \
              -a evidence/checkout.json -a evidence/build.json -a evidence/push.json \
              --subjects "$DIGEST" $SIGN $VSA_TSA --vsa-outfile evidence/vsa.json

            # 2. The promotion: a copy with a new tag, never a new build.
            docker pull -q "$IMAGE@$DIGEST" > /dev/null
            docker tag "$IMAGE@$DIGEST" "$STABLE_IMAGE:$NIGHTLY_TAG"
            docker push -q "$STABLE_IMAGE:$NIGHTLY_TAG"

            # 3. The promotion must keep the digest. Then the VSA (which names that digest) is valid for the stable image.
            docker pull -q "$STABLE_IMAGE:$NIGHTLY_TAG" > /dev/null
            STABLE_DIGEST=$(docker image inspect --format '{{range .RepoDigests}}{{println .}}{{end}}' "$STABLE_IMAGE:$NIGHTLY_TAG" \
              | awk -F@ -v r="$STABLE_IMAGE" '$1 == r {print $2; exit}')
            if [ "$STABLE_DIGEST" != "$DIGEST" ]; then
              echo "STOP: the stable image has digest $STABLE_DIGEST, the verified image has $DIGEST"; exit 1
            fi

            # 4. Attach the VSA to the stable image. --replace removes the older VSA, so Kyverno sees one verdict per image.
            "$CILOCK" attach "$STABLE_IMAGE@$DIGEST" --envelope evidence/vsa.json --replace
            echo "promoted and attached: $STABLE_IMAGE:$NIGHTLY_TAG = $STABLE_IMAGE@$DIGEST"
          '''
        }
      }
    }
  }
  post {
    always { archiveArtifacts allowEmptyArchive: true, artifacts: 'evidence/vsa.json' }
  }
}

level=info msg="Verification succeeded"
promoted and attached: registry.example.com/apps/stable/webapp:3 = registry.example.com/apps/stable/webapp@sha256:8e8949f7...
Finished: SUCCESS

mkdir -p vsa-dl && cilock download "$STABLE_IMAGE@$(cat evidence/image-digest)" --predicate-type https://slsa.dev/verification_summary/v1 --outdir vsa-dl
python3 -c 'import base64,json,glob; e=json.load(open(glob.glob("vsa-dl/*.json")[0])); p=json.loads(base64.b64decode(e["payload"])); print(p["predicate"]["verificationResult"], p["predicate"]["timeVerified"])'

level=error msg="Verification failed"
level=error msg="verification failure: Reason: \"failed to verify artifacts for step build: \nfailed to verify artifacts: mismatched digests for /home/jenkins/agent/workspace/webapp-compile/app/src/main/java/com/example/webapp/HealthServlet.java\""
level=error msg="collection rejected: \"push\", Reason: \"... policy was denied due to: no passed build record to compare with (the build step failed its own checks; see its reasons)"
Finished: FAILURE