|
| 1 | +#!/usr/bin/env python |
| 2 | + |
| 3 | +# Copyright 2022, TUF contributors |
| 4 | +# SPDX-License-Identifier: MIT OR Apache-2.0 |
| 5 | + |
| 6 | +"""Hatch plugin to generate in-toto link metadata for a build. |
| 7 | +
|
| 8 | +Hooks into the hatch build process to record the used sources as materials and the built |
| 9 | +artifact(s) as products, signing the resulting link metadata with a configured |
| 10 | +functionary key. |
| 11 | +
|
| 12 | +
|
| 13 | + export HATCH_BUILD_HOOK_ENABLE_CUSTOM=true |
| 14 | + export HATCH_IN_TOTO_GPG_KEYID=<gpg key id> |
| 15 | + **OR** export HATCH_IN_TOTO_KEY=<encrypted ed25519 private key data> |
| 16 | + export HATCH_IN_TOTO_KEY_PW=<decryption password> |
| 17 | + python -m build |
| 18 | +
|
| 19 | +""" |
| 20 | +import os |
| 21 | + |
| 22 | +from hatchling.builders.hooks.plugin.interface import BuildHookInterface |
| 23 | +from in_toto.models.link import FILENAME_FORMAT, Link |
| 24 | +from in_toto.models.metadata import Metablock |
| 25 | +from in_toto.runlib import record_artifacts_as_dict |
| 26 | +from securesystemslib.keys import decrypt_key |
| 27 | + |
| 28 | +IN_TOTO_DIR = ".in_toto" |
| 29 | + |
| 30 | +# TODO: Is there a better way to configure this? KEY makes sense as envvar, but |
| 31 | +# non-confidential config would be nice as arg. Can we use `build`s `--config-setting`? |
| 32 | +class EnvVars: |
| 33 | + KEY = "HATCH_IN_TOTO_KEY" |
| 34 | + KEY_PW = "HATCH_IN_TOTO_KEY_PW" |
| 35 | + GPG_KEYID = "HATCH_IN_TOTO_GPG_KEYID" |
| 36 | + |
| 37 | + |
| 38 | +# Define exclude filters for recording materials in the project directory |
| 39 | +# NOTE: No filters needed for products, because they are recorded explicitly |
| 40 | +# TODO: Consider configuration via pyproject.toml |
| 41 | +# see https://ofek.dev/hatch/latest/config/build/#build-hooks |
| 42 | +MATERIAL_EXCLUDES = [ |
| 43 | + "__pycache__", |
| 44 | + "build", |
| 45 | + "dist", |
| 46 | + "htmlcov", |
| 47 | + ".*", |
| 48 | + "*~", |
| 49 | + "*.egg-info", |
| 50 | + "*.pyc", |
| 51 | +] |
| 52 | + |
| 53 | + |
| 54 | +class InTotoBuildHook(BuildHookInterface): |
| 55 | + def __init__(self, *args, **kwargs): |
| 56 | + super().__init__(*args, **kwargs) |
| 57 | + |
| 58 | + # Common config for artifact recording |
| 59 | + self.lstrip = [f"{self.root}/"] |
| 60 | + |
| 61 | + # Parse config from envvars |
| 62 | + key_data = os.environ.get(EnvVars.KEY) |
| 63 | + key_pw = os.environ.get(EnvVars.KEY_PW) |
| 64 | + self.gpg_keyid = os.environ.get(EnvVars.GPG_KEYID) |
| 65 | + |
| 66 | + if key_data and self.gpg_keyid: |
| 67 | + raise ValueError( |
| 68 | + f"Set only one of {EnvVars.KEY} or {EnvVars.GPG_KEYID}" |
| 69 | + ) |
| 70 | + |
| 71 | + if not (key_data or self.gpg_keyid): |
| 72 | + raise ValueError( |
| 73 | + f"Requires one of {EnvVars.KEY} or {EnvVars.GPG_KEYID}" |
| 74 | + ) |
| 75 | + |
| 76 | + self.key = None |
| 77 | + if key_data: |
| 78 | + if not key_pw: |
| 79 | + raise ValueError( |
| 80 | + f"Requires {EnvVars.KEY_PW} if {EnvVars.KEY} is set" |
| 81 | + ) |
| 82 | + |
| 83 | + self.key = decrypt_key(key_data, key_pw) |
| 84 | + |
| 85 | + def initialize(self, version, build_data): |
| 86 | + self.materials = record_artifacts_as_dict( |
| 87 | + [self.root], |
| 88 | + exclude_patterns=MATERIAL_EXCLUDES, |
| 89 | + lstrip_paths=self.lstrip, |
| 90 | + ) |
| 91 | + |
| 92 | + def finalize(self, version, build_data, artifact_path): |
| 93 | + products = record_artifacts_as_dict( |
| 94 | + [artifact_path], lstrip_paths=self.lstrip |
| 95 | + ) |
| 96 | + |
| 97 | + link = Metablock( |
| 98 | + signed=Link( |
| 99 | + name=self.target_name, |
| 100 | + materials=self.materials, |
| 101 | + products=products, |
| 102 | + ) |
| 103 | + ) |
| 104 | + if self.key: |
| 105 | + sig = link.sign(self.key) |
| 106 | + elif self.gpg_keyid: |
| 107 | + sig = link.sign_gpg(self.gpg_keyid) |
| 108 | + else: |
| 109 | + raise RuntimeError("No signing key") |
| 110 | + |
| 111 | + link_filename = FILENAME_FORMAT.format( |
| 112 | + step_name=self.target_name, keyid=sig["keyid"] |
| 113 | + ) |
| 114 | + |
| 115 | + link.dump(os.path.join(IN_TOTO_DIR, link_filename)) |
0 commit comments