Git-Mirrors/constellation
1
0
Fork 0
mirror of https://github.com/edgelesssys/constellation.git synced 2025-02-23 16:30:11 -05:00
Code Issues Packages Projects Releases Wiki Activity

Compare all measurements against respective targets

Browse Source
This commit is contained in:
miampf 2025-01-28 17:13:06 +01:00
parent 5377d81026
commit f440427343
No known key found for this signature in database
GPG Key ID: EF039364B5B6886C
1 changed files with 13 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
.github/workflows/check-measurements-reproducibility.yml vendored
View File

@ -25,11 +25,19 @@ jobs:
bazel build //image/system:stable
bazel build //image/measured-boot/cmd
buildPath="$PWD/bazel-bin/image"
# create measurements
cd $(mktemp -d)
sudo env "PATH=$PATH" "$buildPath/measured-boot/cmd/cmd_/cmd" "$buildPath/system/qemu_qemu-vtpm_stable/constellation" ./own-measurements.json
# download release measurements and compare
# download release measurements
curl -O https://cdn.confidential.cloud/constellation/v2/ref/-/stream/stable/v2.20.0/image/measurements.json
jd -set ./own-measurements.json ./measurements.json
# compare all measurements with our own
for directory in $buildPath/system/!(mkosi_wrapper.sh); do
dirname="$(basename $directory)"
csp="$(echo $dirname | cut -d_ -f1)"
attestationVariant="$(echo $dirname | cut -d_ -f2)"
echo "Comparing measurements of CSP $csp with attestation variant $attestationVariant"
jq --arg attestation_variant "$attestationVariant" --arg csp "$csp" '.list.[] | select(.attestationVariant == $attestation_variant) | select((.csp | ascii_downcase) == $csp)' measurements.json > their-measurements.json
sudo env "PATH=$PATH" "$buildPath/measured-boot/cmd/cmd_/cmd" "$directory/constellation" ./own-measurements.json
jd ./their-measurements.json ./own-measurements.json
done