Add OCI image annotations, SLSA provenance, and SBOM attestations

[candrews]

Add OCI image annotations to images

These annotations are useful for people to manual use as well as for use by tools. For example, Snyk uses them in its UI and Renovate uses them to find release notes.

See:
https://github.com/opencontainers/image-spec/blob/main/annotations.md#pre-defined-annotation-keys

• https://snyk.io/blog/how-and-when-to-use-docker-labels-oci-container-annotations/
• https://github.com/renovatebot/renovate/blob/34.115.1/lib/modules/datasource/docker/readme.md

Attach SLSA provenance attestations to images

The provenance attestations include facts about the build process, including details such as:

• Build timestamps
• Build parameters and environment
• Version control metadata
• Source code details
• Materials (files, scripts) consumed during the build

See:

• https://docs.docker.com/build/attestations/slsa-provenance/
• https://docs.docker.com/build/attestations/slsa-definitions/

Attach SBOM attestations to images

See: https://docs.docker.com/build/attestations/sbom/

[candrews]

@micahsnyder can you please take a look whenever you get the chance?

[micahsnyder]

Hi Craig! Thanks for this. It looks useful. Either I or someone on my team will review it and get back to you.

[micahsnyder]

@candrews one quick note -- we forgot to merge #54. We built the 1.4.0 release images based on the approved PR branch, but hadn't merged because of new commit signing requirements. Just fixed that and merged it now.

So for your PR we will at least need to rebase with main and add the change for clamav/1.4 files. Sorry for the extra busy work. I only realized went I saw your PR lacked the 1.4 directory.

[candrews]

Sorry for the extra busy work.

No worries! I've rebased this MR including adding the changes to 1.4.

[rsundriyal]

Suggested change

docker build --sbom=true --provenance mode=max,builder-id="${BUILD_URL}" --annotation "org.opencontainers.image.url=${params.REPOSITORY}" --annotation "org.opencontainers.image.source=${params.REPOSITORY}" --annotation "org.opencontainers.image.version=${params.FULL_VERSION}" --annotation "org.opencontainers.image.ref.name=${params.BRANCH}" --annotation "org.opencontainers.image.created=$(date -Iseconds)" --no-cache --tag "${params.IMAGE_NAME}:${params.FULL_VERSION}-${BUILD_NUMBER}" .

docker build --sbom=true --provenance mode=max,builder-id='${BUILD_URL}' --annotation 'org.opencontainers.image.url=${params.REPOSITORY}' --annotation 'org.opencontainers.image.source=${params.REPOSITORY}' --annotation 'org.opencontainers.image.version=${params.FULL_VERSION}' --annotation 'org.opencontainers.image.ref.name=${params.BRANCH}' --annotation 'org.opencontainers.image.created=$(date -Iseconds)' --no-cache --tag '${params.IMAGE_NAME}:${params.FULL_VERSION}-${BUILD_NUMBER}' .

Similar changes need to be done in other places.

Failure - Failed to interpolate annotation strings.

I have tested the suggested strings and it works fine. I will further check the image for expected changes and will verify them.

[candrews]

I'm not sure this change is correct.

Currently, --tag "${params.IMAGE_NAME}:${params.FULL_VERSION}-${BUILD_NUMBER}" is present (with double quotes) and working:

clamav-docker/clamav-bytecode-compiler/1.4/ubuntu/Jenkinsfile

Line 74 in fdb02aa

docker build --no-cache --tag "${params.IMAGE_NAME}:${params.FULL_VERSION}-${BUILD_NUMBER}" .

Yet you're saying that that line needs the double quotes changed to singles. If doubles are working now, why change to singles?

[rsundriyal]

Hi @candrews

Thanks for asking the question.

"org.opencontainers.image.created=$(date -Iseconds)"
This is failing to be interpolated by Jenkins Groovy. This should be in single quotes so that only shell can interpolate it and not the Jenkins.

Ideally, there should be a clear demarcation of what is being interpolated by groovy and shell. I will make the changes to it once your changes are merged.

Also,
--annotation org.opencontainers.image.created="$(date -Iseconds)" - We can do this as well to escape the "$" too to be interpolated by Groovy.

To be consistent, I prefer to use single quotes.

Let me know if it makes sense.

Thanks

[rsundriyal]

We also need to update the changes for ClamAV images with the Database.

Current changes only target the base image and not the latest database image.

Changes are required here for each version both alpine and debain images. Update DB script

[rsundriyal]

• Fix string interpolation.
• Update changes for the latest DB images.