feat: enforce live supply chain provenance gates

2026-07-10 16:47:45 +09:00
parent aa284e9bd4
commit 040af64191
8 changed files with 351 additions and 0 deletions
@@ -0,0 +1,40 @@
+# CI Security, Signing and Provenance
+
+`.gitea/workflows/casan-supply-chain.yml` is the release gate for Control
+Panel images. It fails closed if the runner is missing `osv-scanner` or Trivy,
+if any high/critical source or image issue is found, if a main-branch commit is
+not cryptographically signed, or if the attestation signing key is unavailable.
+
+## Runner bootstrap
+
+Provision the dedicated `ci-runner` with Node 22/npm (for `npm sbom`), Docker,
+OpenSSL, Python 3, Git, OSV-Scanner v2 and Trivy. Verify each downloaded scanner
+against vendor provenance/checksums before making it available under a trusted
+system directory (`/usr/local/bin` or `/usr/bin`). Do not make a project-local
+binary trusted.
+
+The job generates a CycloneDX SBOM (`npm sbom`), queries OSV live for lockfile
+vulnerabilities, and uses Trivy for filesystem, secret, misconfiguration and
+image scanning. This follows the tools' supported source/image scan interfaces.
+
+## Gitea secrets and policies
+
+Configure these repository/organization values before enabling production
+deployments:
+
+| Value | Purpose |
+|---|---|
+| `GITEA_TOKEN` | Push only the scanned images to the Gitea registry. Scope: package write. |
+| `CASAN_ATTESTATION_PRIVATE_KEY` | PEM private key held in the secret manager; signs SLSA/in-toto provenance. |
+| `CASAN_REGISTRY` (variable) | Optional container registry host; defaults to the Gitea server host. |
+
+Register the matching public key in the release-verification trust store, then
+protect `main`: require the `CASAN Supply Chain and Provenance` check, reject
+force-pushes, require signed commits, and restrict direct pushes to enrolled
+signers. The workflow independently checks every new commit's Git signature;
+branch UI policy alone is not treated as evidence.
+
+The output artifact contains `npm.cyclonedx.json`, OSV/Trivy reports, image
+digest files, the signed `provenance.intoto.json` and public key. Copy only the
+two digest references into `infra/production/casan-prod.env`; tags are refused
+by production preflight.