Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Nikhil/blog zh #371

Merged
merged 3 commits into from
Aug 2, 2023
Merged

Nikhil/blog zh #371

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
82435a8
slsa hyperlink fix
nikhilchauhangithub Aug 1, 2023
181b09b
slsa github generator link fix
nikhilchauhangithub Aug 1, 2023
1db2d05
all link fix in zh blog page
nikhilchauhangithub Aug 1, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions i18n/zh/docusaurus-plugin-content-blog/reach-slsa-l3/index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ Google 提出的用于保证整个软件供应链完整性的框架 SLSA，是

截止目前，SLSA 标准处于 alpha 阶段，相关的定义可能会发生变化。

下图描述了软件供应链中已知的攻击点。更多详细描述，可参考https://slsa.dev/。
下图描述了软件供应链中已知的攻击点。更多详细描述，可参考https://slsa.dev/

![slsa-dev](./images/slsa-dev.png)

Expand Down Expand Up @@ -121,15 +121,15 @@ e) **第三方依赖的完整性：**Provenance 记录运行构建步骤时可

在 KubeEdge 版本发布的流程（.github/workflows/release.yml）中，集成了 slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml 和 slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml，可保障构建和发布产物（包括二进制文件和容器镜像）的流程满足 SLSA L3 等级的要求。

更多关于 slsa-github-generator 的详细说明请见https://github.com/slsa-framework/slsa-github-generator。
更多关于 slsa-github-generator 的详细说明请见https://github.com/slsa-framework/slsa-github-generator

### 关于 Provenance

Provenance 是构建的元数据包括构建过程、构建源和依赖关系，是软件构建和发布执行流程的一种证明，并且是可以被验证的，包括构建的源码仓库、代码分支、配置文件等信息。在 SLSA L3 级别，Provenance 内容是真实的、防篡改的，并且不会被项目维护者更改。二进制发布产物的 Provenance 文件随发布软件包一起发布，名称为 multiple.intoto.jsonl，容器镜像的 Provenance 文件随镜像文件一起上传到 KubeEdge dockerhub 公开仓库中。具体的 Provenance 格式说明，请参考https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/generic/README.md#provenance-format。

### 如何校验 KubeEdge 发布产物是否满足 SLSA L3 等级

详细步骤描述请见https://github.com/kubeedge/kubeedge/pull/4285。
详细步骤描述请见https://github.com/kubeedge/kubeedge/pull/4285

校验示例如下：

Expand Down