Git-Mirrors/constellation
1
0
Fork 0
mirror of https://github.com/edgelesssys/constellation.git synced 2025-04-20 15:35:55 -04:00
Code Issues Packages Projects Releases Wiki Activity

implement more suggestions

Browse Source
This commit is contained in:
miampf 2025-03-04 12:09:38 +01:00
parent 6c4411584b
commit 65eea7f4bd
No known key found for this signature in database
GPG Key ID: EF039364B5B6886C
2 changed files with 4 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
.github/actions/check_measurements_reproducibility/action.yml vendored
View File

@ -39,22 +39,20 @@ runs:
# Build required binaries
pushd release
bazel build //image/system:stable
bazel build //image/measured-boot/cmd
echo "buildPath=$PWD/bazel-bin/image" | tee -a "$GITHUB_OUTPUT"
cd "$(mktemp -d)"
popd
- name: Download measurements
shell: bash
run: |
curl -O https://cdn.confidential.cloud/constellation/v2/ref/-/stream/stable/${{ inputs.version }}/image/measurements.json
curl -fsLO https://cdn.confidential.cloud/constellation/v2/ref/-/stream/stable/${{ inputs.version }}/image/measurements.json
- name: Cleanup release measurements and generate our own
shell: bash
run: |
./.github/actions/check_measurements_reproducibility/create_measurements.sh "${{ steps.build-images.outputs.buildPath }}"
${{ github.action_path }}/create_measurements.sh "${{ steps.build-images.outputs.buildPath }}"
- name: Compare measurements
shell: bash
run: |
./.github/actions/check_measurements_reproducibility/compare_measurements.sh "${{ steps.build-images.outputs.buildPath }}"
${{ github.action_path }}/compare_measurements.sh "${{ steps.build-images.outputs.buildPath }}"

2
.github/actions/check_measurements_reproducibility/create_measurements.sh vendored
View File

@ -24,5 +24,5 @@ for directory in "$1"/system/!(mkosi_wrapper.sh); do
' \
measurements.json > "$attestationVariant"_their-measurements.json
sudo --preserve-env "$1/measured-boot/cmd/cmd_/cmd" "$directory/constellation" /dev/stdout | jq '.measurements' > ./"$attestationVariant"_own-measurements.json
bazel run --run_under "sudo --preserve-env" //image/measured-boot/cmd -- "$directory/constellation" /dev/stdout | jq '.measurements' > ./"$attestationVariant"_own-measurements.json
done