Added tenancy aware attestation commands #9542

kommendorkapten · 2024-08-30T14:21:51Z

This PR introduces a functionality to configure the host using --hostname flag instead of using GH_HOST environment variable.

It also updates the attestation commands (verify, download, inspect and trusted-root) to support tenancy mode.

cliAutomation · 2024-08-30T14:22:05Z

Hi! Thanks for the pull request. Please ensure that this change is linked to an issue by mentioning an issue number in the description of the pull request. If this pull request would close the issue, please put the word 'Fixes' before the issue number somewhere in the pull request body. If this is a tiny change like fixing a typo, feel free to ignore this message.

pkg/cmd/attestation/inspect/bundle.go

kommendorkapten · 2024-08-30T14:32:23Z

pkg/cmd/attestation/verify/policy_test.go

 	require.NoError(t, err)
 }

-func ValidateSignerWorkflow(t *testing.T) {


These tests wasn't run before, so I fixed that.

malancas · 2024-08-30T18:05:19Z

pkg/cmd/attestation/trustedroot/trustedroot.go

+		for _, target := range tufOpt.targets {
+			t, err := tufClient.GetTarget(target)
+			if err != nil {
+				return err


If we can't reach the target here, should the client facing error message include some content about checking the URL itself? Maybe the returned error already includes something like this.

The error will contain context concerning the target, but we can do better. Let me add more context to the error message.

andyfeller

Haven't dug into all of the pkg/cmd/attestation changes but wanted to touch on some of the foundational changes here.

andyfeller · 2024-09-03T13:26:44Z

internal/ghinstance/host.go

 func TenantName(h string) (string, bool) {
 	normalizedHostName := NormalizeHostname(h)
-	return cutSuffix(normalizedHostName, "."+tenancyHost)
+	t, f := cutSuffix(normalizedHostName, "."+tenancyHost)
+
+	if !f {
+		return t, f
+	}
+
+	// make sure tenant name is valid
+	re := regexp.MustCompile(`^[a-z0-9\-]+$`)
+	if !re.MatchString(t) {
+		return "", false
+	}
+	return t, true


@kommendorkapten : Could you elaborate on how gh would behave when invalid tenant hosts were specified? Any console output you could share?

Depending on ☝️, we might need to revisit this because this is a larger issue than just core gh as cli/go-gh has similar capability. 🤔

That is a good question. Currently some commands are failing before this test happens, as they are instantiating the API client first, which tries to parse (and possibly connect) the URL. But as this function can be called from everywhere we should be on par in cli/go-gh, I can prepare a PR once we have a rough agreement on how the cli should behave.

As the tenant is derived from the hostname, this PR simply prompts invalid hostname $host. Having all commands exhibit a similar behaviour should be good.

One thing though, TenantName returns bool (found), but with a corresponding check of IsTenancy, an error case can be detected.

@andyfeller any thoughts?

I'm trying to think of a middle ground as this feels suboptimal. 🤔 Let me see if I can unwind what's going on here to see what alternatives might be available.

Is there somewhere else we can handle invalid tenancy names?

The only place I see ghrepo.TenantName being called is within ghrepo.FormatRemoteUrl, which is used throughout the code base:

cli/internal/ghrepo/repo.go

Lines 95 to 103 in 78c1d00

func FormatRemoteURL(repo Interface, protocol string) string {

if protocol == "ssh" {

if tenant, found := ghinstance.TenantName(repo.RepoHost()); found {

return fmt.Sprintf("%s@%s:%s/%s.git", tenant, repo.RepoHost(), repo.RepoOwner(), repo.RepoName())

}

return fmt.Sprintf("git@%s:%s/%s.git", repo.RepoHost(), repo.RepoOwner(), repo.RepoName())

}

return fmt.Sprintf("%s%s/%s.git", ghinstance.HostPrefix(repo.RepoHost()), repo.RepoOwner(), repo.RepoName())

}

If we accepted this code as is, it feels like we'd disguise the problem of an invalid tenancy name as an error with a seemingly legitimate URL.

Above, you state there are some scenarios that are failing, however I don't have a clear idea of concrete examples.

Currently some commands are failing before this test happens, as they are instantiating the API client first, which tries to parse (and possibly connect) the URL.

Putting that aside, I also see elsewhere in the code we have HostnameValidator which is also used throughout code:

cli/internal/ghinstance/host.go

Lines 62 to 70 in 78c1d00

func HostnameValidator(hostname string) error {

if len(strings.TrimSpace(hostname)) < 1 {

return errors.New("a value is required")

}

if strings.ContainsRune(hostname, '/') || strings.ContainsRune(hostname, ':') {

return errors.New("invalid hostname")

}

return nil

}

Thoughts

Should HostnameValidator actually be what's enhanced to determine if a tenancy host has a valid name?

Yeah, I'm also thinking how we can make this validation happen as early as possible.
A common flow is to call go-gh/v2/pkg/auth.DefaultHost() This function does not perform any validation, only reads the name from the config or the GH_HOST environment variable.

Should HostnameValidator actually be what's enhanced to determine if a tenancy host has a valid name?

YES, I support that. I would love for having a single consistent method that could be used to verify that a host is valid. And a tenant name is simply a valid domain label ([a-zA-Z0-9\-]+) that is part of a hostname. So verifying that hostname is valid (i.e parse with net/url/Parse) ought to be enough.

My recommendation would anyway be to remove the added check in this PR, create a new issue on going over host verification in the cli, and create a separate PR for that, as I think that would be easier to reason about. Sounds goo @andyfeller?

created #9598 for tracking.

pkg/httpmock/stub.go

steiza

Nice work! There was a lot to update here.

This is done by inspecting the current hostname to determine if tenancy is enabled. The attestation commands also accepts a --hostname parameter, that is used to pick the current host, similar to how the GH_HOST variable can be used. Signed-off-by: Fredrik Skogman <[email protected]>

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [cli/cli](https://redirect.github.com/cli/cli) | minor | `v2.56.0` -> `v2.57.0` | --- ### Release Notes <details> <summary>cli/cli (cli/cli)</summary> ### [`v2.57.0`](https://redirect.github.com/cli/cli/releases/tag/v2.57.0): GitHub CLI 2.57.0 [Compare Source](https://redirect.github.com/cli/cli/compare/v2.56.0...v2.57.0) #### What's Changed - Move non-integration tests to different test file by [@codysoyland](https://redirect.github.com/codysoyland) in [https://github.com/cli/cli/pull/9577](https://redirect.github.com/cli/cli/pull/9577) - Added tenancy aware attestation commands by [@kommendorkapten](https://redirect.github.com/kommendorkapten) in [https://github.com/cli/cli/pull/9542](https://redirect.github.com/cli/cli/pull/9542) - Added `--active` flag to the `gh auth status` command by [@velumuruganr](https://redirect.github.com/velumuruganr) in [https://github.com/cli/cli/pull/9520](https://redirect.github.com/cli/cli/pull/9520) - build(deps): bump github.com/sigstore/sigstore-go from 0.6.1 to 0.6.2 by [@dependabot](https://redirect.github.com/dependabot) in [https://github.com/cli/cli/pull/9601](https://redirect.github.com/cli/cli/pull/9601) - `gh attestation verify` test for custom OIDC issuers by [@bdehamer](https://redirect.github.com/bdehamer) in [https://github.com/cli/cli/pull/9595](https://redirect.github.com/cli/cli/pull/9595) - Suggest installing Rosetta when extension installation fails due to missing `darwin-arm64` binary, but a `darwin-amd64` binary is available by [@timrogers](https://redirect.github.com/timrogers) in [https://github.com/cli/cli/pull/9599](https://redirect.github.com/cli/cli/pull/9599) - Update `gh attestation verify` bundle parsing and validation errors by [@malancas](https://redirect.github.com/malancas) in [https://github.com/cli/cli/pull/9564](https://redirect.github.com/cli/cli/pull/9564) - Suppress `attestation verify` output when no TTY present by [@bdehamer](https://redirect.github.com/bdehamer) in [https://github.com/cli/cli/pull/9612](https://redirect.github.com/cli/cli/pull/9612) - Use api subdomains for tenant hosts by [@williammartin](https://redirect.github.com/williammartin) in [https://github.com/cli/cli/pull/9618](https://redirect.github.com/cli/cli/pull/9618) #### New Contributors - [@kommendorkapten](https://redirect.github.com/kommendorkapten) made their first contribution in [https://github.com/cli/cli/pull/9542](https://redirect.github.com/cli/cli/pull/9542) - [@velumuruganr](https://redirect.github.com/velumuruganr) made their first contribution in [https://github.com/cli/cli/pull/9520](https://redirect.github.com/cli/cli/pull/9520) - [@bdehamer](https://redirect.github.com/bdehamer) made their first contribution in [https://github.com/cli/cli/pull/9595](https://redirect.github.com/cli/cli/pull/9595) - [@timrogers](https://redirect.github.com/timrogers) made their first contribution in [https://github.com/cli/cli/pull/9599](https://redirect.github.com/cli/cli/pull/9599) **Full Changelog**: cli/cli@v2.56.0...v2.57.0 </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/izumin5210/dotfiles).  --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: izumin5210-update-aqua-checksum[bot] <169593670+izumin5210-update-aqua-checksum[bot]@users.noreply.github.com>

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [cli/cli](https://github.com/cli/cli) | minor | `v2.55.0` -> `v2.57.0` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>cli/cli (cli/cli)</summary> ### [`v2.57.0`](https://github.com/cli/cli/releases/tag/v2.57.0): GitHub CLI 2.57.0 [Compare Source](cli/cli@v2.56.0...v2.57.0) #### What's Changed - Move non-integration tests to different test file by [@codysoyland](https://github.com/codysoyland) in cli/cli#9577 - Added tenancy aware attestation commands by [@kommendorkapten](https://github.com/kommendorkapten) in cli/cli#9542 - Added `--active` flag to the `gh auth status` command by [@velumuruganr](https://github.com/velumuruganr) in cli/cli#9520 - build(deps): bump github.com/sigstore/sigstore-go from 0.6.1 to 0.6.2 by [@dependabot](https://github.com/dependabot) in cli/cli#9601 - `gh attestation verify` test for custom OIDC issuers by [@bdehamer](https://github.com/bdehamer) in cli/cli#9595 - Suggest installing Rosetta when extension installation fails due to missing `darwin-arm64` binary, but a `darwin-amd64` binary is available by [@timrogers](https://github.com/timrogers) in cli/cli#9599 - Update `gh attestation verify` bundle parsing and validation errors by [@malancas](https://github.com/malancas) in cli/cli#9564 - Suppress `attestation verify` output when no TTY present by [@bdehamer](https://github.com/bdehamer) in cli/cli#9612 - Use api subdomains for tenant hosts by [@williammartin](https://github.com/williammartin) in cli/cli#9618 #### New Contributors - [@kommendorkapten](https://github.com/kommendorkapten) made their first contribution in cli/cli#9542 - [@velumuruganr](https://github.com/velumuruganr) made their first contribution in cli/cli#9520 - [@bdehamer](https://github.com/bdehamer) made their first contribution in cli/cli#9595 - [@timrogers](https://github.com/timrogers) made their first contribution in cli/cli#9599 **Full Changelog**: cli/cli@v2.56.0...v2.57.0 ### [`v2.56.0`](https://github.com/cli/cli/releases/tag/v2.56.0): GitHub CLI 2.56.0 [Compare Source](cli/cli@v2.55.0...v2.56.0) #### Important note about renewed GPG key The Debian and RedHat releases have been signed with a new GPG key. If you are experiencing issues updating your `.deb` or `.rpm` packages, please read [cli/cli#9569](cli/cli#9569). #### What's Changed - Always print URL scheme to stdout by [@heaths](https://github.com/heaths) in cli/cli#9471 - Quote repo names consistently in `gh repo sync` stdout by [@muzimuzhi](https://github.com/muzimuzhi) in cli/cli#9491 - Fetch bundle from OCI registry for verify by [@ejahnGithub](https://github.com/ejahnGithub) in cli/cli#9421 - Remove `Internal` from `gh repo create` prompt when owner is not an org by [@jtmcg](https://github.com/jtmcg) in cli/cli#9465 - Drop surplus trailing space char in flag names in web by [@muzimuzhi](https://github.com/muzimuzhi) in cli/cli#9495 - fix the trimming of log filenames for `gh run view` by [@benebsiny](https://github.com/benebsiny) in cli/cli#9482 - "offline" verification using the bundle of attestations without any additional handling of the file by [@aryanbhosale](https://github.com/aryanbhosale) in cli/cli#9523 - build(deps): bump actions/attest-build-provenance from 1.4.1 to 1.4.2 by [@dependabot](https://github.com/dependabot) in cli/cli#9518 - Fix doc typo for `repo sync` by [@muzimuzhi](https://github.com/muzimuzhi) in cli/cli#9509 - Correct the help message for -F by [@Goooler](https://github.com/Goooler) in cli/cli#9525 - chore: fix some function names by [@crystalstall](https://github.com/crystalstall) in cli/cli#9555 - verify 2nd artifact without swapping order by [@aryanbhosale](https://github.com/aryanbhosale) in cli/cli#9532 - `gh attestation verify` handles empty JSONL files by [@malancas](https://github.com/malancas) in cli/cli#9541 - Enhance Linux installation docs to redirect users to GPG renewal issue, better troubleshooting support by [@andyfeller](https://github.com/andyfeller) in cli/cli#9573 - Upgrade sigstore-go to v0.6.1 by [@codysoyland](https://github.com/codysoyland) in cli/cli#9566 - Check for nil values to prevent nil dereference panic by [@codysoyland](https://github.com/codysoyland) in cli/cli#9578 - build(deps): bump actions/attest-build-provenance from 1.4.2 to 1.4.3 by [@dependabot](https://github.com/dependabot) in cli/cli#9575 #### New Contributors - [@aryanbhosale](https://github.com/aryanbhosale) made their first contribution in cli/cli#9523 - [@Goooler](https://github.com/Goooler) made their first contribution in cli/cli#9525 - [@crystalstall](https://github.com/crystalstall) made their first contribution in cli/cli#9555 **Full Changelog**: cli/cli@v2.55.0...v2.56.0 </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

kommendorkapten requested a review from williammartin August 30, 2024 14:21

kommendorkapten requested review from a team as code owners August 30, 2024 14:21

cliAutomation added the external pull request originating outside of the CLI core team label Aug 30, 2024

github-advanced-security bot found potential problems Aug 30, 2024

View reviewed changes

pkg/cmd/attestation/inspect/bundle.go Fixed Show fixed Hide fixed

kommendorkapten commented Aug 30, 2024

View reviewed changes

kommendorkapten changed the title ~~Policy tenancy~~ Added tenancy aware attestation commands Aug 30, 2024

malancas reviewed Aug 30, 2024

View reviewed changes

andyfeller reviewed Sep 3, 2024

View reviewed changes

steiza approved these changes Sep 5, 2024

View reviewed changes

kommendorkapten mentioned this pull request Sep 11, 2024

Host validation #9598

Open

kommendorkapten force-pushed the policy-tenancy branch from c16d932 to 1b59ec8 Compare September 11, 2024 08:51

williammartin approved these changes Sep 11, 2024

View reviewed changes

kommendorkapten merged commit aa931c5 into cli:trunk Sep 11, 2024

	func FormatRemoteURL(repo Interface, protocol string) string {
	if protocol == "ssh" {
	if tenant, found := ghinstance.TenantName(repo.RepoHost()); found {
	return fmt.Sprintf("%s@%s:%s/%s.git", tenant, repo.RepoHost(), repo.RepoOwner(), repo.RepoName())
	}
	return fmt.Sprintf("git@%s:%s/%s.git", repo.RepoHost(), repo.RepoOwner(), repo.RepoName())
	}
	return fmt.Sprintf("%s%s/%s.git", ghinstance.HostPrefix(repo.RepoHost()), repo.RepoOwner(), repo.RepoName())
	}

	func HostnameValidator(hostname string) error {
	if len(strings.TrimSpace(hostname)) < 1 {
	return errors.New("a value is required")
	}
	if strings.ContainsRune(hostname, '/') \|\| strings.ContainsRune(hostname, ':') {
	return errors.New("invalid hostname")
	}
	return nil
	}

Uh oh!

Added tenancy aware attestation commands #9542

Added tenancy aware attestation commands #9542

Uh oh!

Conversation

kommendorkapten commented Aug 30, 2024

Uh oh!

cliAutomation commented Aug 30, 2024

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

andyfeller left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

andyfeller Sep 10, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Is there somewhere else we can handle invalid tenancy names?

Thoughts

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

steiza left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

andyfeller Sep 10, 2024 •

edited

Loading