docs: adding SLSA verification steps to READMEs #344
Conversation
|
Starting off with a single SDK for now. If this looks good I'll add this to the other SDK READMEs in this monorepo. Let me know if what we've got so far looks good, namely:
|
rsoberano-ld
force-pushed
the
rsoberano/SEC-4729/js-core-slsa
branch
from
2c588a9 to
2a5ee2e
Compare
|
@rsoberano-ld Did you intent to mark this ready for review? |
|
For this repo, as many packages have provenance, should we make a central markdown file and link to it from relevant readme files? |
That's a great idea, I'll update that today |
packages/sdk/react-native/README.md
Outdated
| - Use the provenance published in npm to verify the authenticity of the build: | ||
| - Check the source commit for: | ||
| - Source repository is a LaunchDarkly-owned repository | ||
| - Commit author is a LaunchDarkly entity |
There was a problem hiding this comment.
Commits are approved by LD maybe? Many commits are either made by contributors, or made by former employees.
A basic example from erlang: launchdarkly/erlang-server-sdk@v3.0.3...v3.0.4
packages/sdk/react-native/README.md
Outdated
| @@ -98,6 +98,30 @@ echo "MOBILE_KEY=mob-abc" >> packages/sdk/react-native/example/.env | |||
| yarn && yarn ios-go | |||
| ``` | |||
|
|
|||
| ## Validating SDK packages with the SLSA framework | |||
|
|
|||
| LaunchDarkly uses the [SLSA framework](https://slsa.dev/spec/v1.0/about) to help developers make their supply chain more secure by ensuring the authenticity of our published SDK packages. As part of [SLSA requirements for level 3 compliance](https://slsa.dev/spec/v1.0/requirements), LaunchDarkly publishes provenance about our SDK package builds to NPM for distribution alongside our packages. | |||
There was a problem hiding this comment.
| LaunchDarkly uses the [SLSA framework](https://slsa.dev/spec/v1.0/about) to help developers make their supply chain more secure by ensuring the authenticity of our published SDK packages. As part of [SLSA requirements for level 3 compliance](https://slsa.dev/spec/v1.0/requirements), LaunchDarkly publishes provenance about our SDK package builds to NPM for distribution alongside our packages. | |
| LaunchDarkly uses the [SLSA framework](https://slsa.dev/spec/v1.0/about) to help developers make their supply chain more secure by ensuring the authenticity of our published SDK packages. As part of [SLSA requirements for level 3 compliance](https://slsa.dev/spec/v1.0/requirements), LaunchDarkly publishes provenance about our SDK package builds to npm for distribution alongside our packages. |
should this be lowercase npm to match the paragraph below? I'm not sure if there's a case where it's all caps
packages/sdk/react-native/README.md
Outdated
| @@ -98,6 +98,30 @@ echo "MOBILE_KEY=mob-abc" >> packages/sdk/react-native/example/.env | |||
| yarn && yarn ios-go | |||
| ``` | |||
|
|
|||
| ## Validating SDK packages with the SLSA framework | |||
There was a problem hiding this comment.
I saw that you're thinking of moving this info to the top-level SECURITY.md file in the cpp-sdk repo.
I think it could be nice for customers to always be able to find this info in the same place.
That means two options:
(a) move this info to the top-level SECURITY.md in this repo (could be okay, but maybe that means this info is too far from the package now? given that this repo has so many SDKs)
(b) reference this info in the top-level SECURITY.md file in this repo, but leave the details here.
If you go with (b), you could update this repo's SECURITY.md with something like: "Validating SDK packages with the SLSA framework / LaunchDarkly uses the SLSA framework to help developers make their supply chain more secure by ensuring the authenticity of our published SDK packages. As part of SLSA requirements for level 3 compliance, LaunchDarkly publishes provenance about our SDK package builds. To learn more, read the "Validating SDK packages" section in the package README." or similar.
packages/sdk/react-native/README.md
Outdated
| The SLSA framework specifies some [recommendations for verifying build artifacts](https://slsa.dev/spec/v1.0/verifying-artifacts) in their documentation. For npm packages that are published with provenance, npm already [validates the authenticity of the package using Sigstore](https://docs.npmjs.com/generating-provenance-statements#about-npm-provenance). In addition to npm's validation, we recommend the following steps: | ||
| - Ensure that the @launchdarkly/react-native-client-sdk version you're downloading was published with npm-verified provenance |
There was a problem hiding this comment.
If you move this content all to SECURITY.md (option (a) above), then you might need sub-sections for each SDK package? Something like:
| The SLSA framework specifies some [recommendations for verifying build artifacts](https://slsa.dev/spec/v1.0/verifying-artifacts) in their documentation. For npm packages that are published with provenance, npm already [validates the authenticity of the package using Sigstore](https://docs.npmjs.com/generating-provenance-statements#about-npm-provenance). In addition to npm's validation, we recommend the following steps: | |
| - Ensure that the @launchdarkly/react-native-client-sdk version you're downloading was published with npm-verified provenance | |
| The SLSA framework specifies some [recommendations for verifying build artifacts](https://slsa.dev/spec/v1.0/verifying-artifacts) in their documentation. For npm packages that are published with provenance, npm already [validates the authenticity of the package using Sigstore](https://docs.npmjs.com/generating-provenance-statements#about-npm-provenance). In addition to npm's validation, we recommend several additional steps for each package. | |
| ### Validating the React Native SDK package | |
| In addition to npm's recommendation, we recommend the following steps to validate the React Native SDK package: | |
| - Ensure that the @launchdarkly/react-native-client-sdk version you're downloading was published with npm-verified provenance |
But not needed if this content is staying here.
rsoberano-ld
requested review from
yusinto and
louis-launchdarkly
as code owners
rsoberano-ld
force-pushed
the
rsoberano/SEC-4729/js-core-slsa
branch
from
e4b9fbf to
2ebc7d8
Compare
| @@ -30,6 +30,10 @@ yarn && yarn build && cd packages/sdk/akamai-base | |||
| yarn test | |||
| ``` | |||
|
|
|||
| ## Verifying SDK build provenance with the SLSA framework | |||
|
|
|||
| LaunchDarkly uses the [SLSA framework](https://slsa.dev/spec/v1.0/about) (Supply-chain Levels for Software Artifacts) to help developers make their supply chain more secure by ensuring the authenticity and build integrity of our published SDK packages. To learn more, see the [provenance guide](PROVENANCE.md). | |||
There was a problem hiding this comment.
@kinyoklion how would the link to PROVENANCE.md work with npm? do I need to include a relative path here (../../../PROVENANCE.md), or specify the provenance file in the package.json for inclusion?
There was a problem hiding this comment.
FWIW the CONTRIBUTING.md link here doesn't seem to work: https://www.npmjs.com/package/@launchdarkly/js-server-sdk-common
There was a problem hiding this comment.
Yours should work fine. The relative path would work in github, but not NPM unfortunately.
Requirements
Describe the solution you've provided
Drafting up documentation for how consumers may use the SLSA framework to verify SDK packages published with provenance to improve supply chain security.
Describe alternatives you've considered
Provide a clear and concise description of any alternative solutions or features you've considered.
Additional context
Add any other context about the pull request here.