Docker SBOM & Provenance Attestations

{
  "SPDXID": "SPDXRef-DOCUMENT",
  "name": "myapp",
  "packages": [
    {
      "SPDXID": "SPDXRef-package-express",
      "name": "express",
      "versionInfo": "4.18.2",
      "licenseConcluded": "MIT",
      "externalRefs": [
        {
          "referenceCategory": "PACKAGE_MANAGER",
          "referenceLocator": "pkg:npm/express@4.18.2",
          "referenceType": "purl"
        }
      ]
    }
  ]
}

# Build พร้อมทั้ง SBOM และ Provenance
docker buildx build \
  --sbom=true \
  --provenance=true \
  -t myapp:latest \
  --push .

# หรือใช้ shorthand
docker buildx build --sbom --provenance -t myapp:latest --push .

# สร้าง SBOM attestation
docker buildx build \
  --tag myregistry/myapp:v1.0 \
  --attest type=sbom \
  --push .

# หรือใช้ shorthand
docker buildx build \
  --tag myregistry/myapp:v1.0 \
  --sbom=true \
  --push .

# Build และ export SBOM ไว้ที่ local
docker buildx build \
  --sbom=true \
  --output type=local,dest=./output \
  .

# ตรวจสอบไฟล์ SBOM
ls -la ./output/
# sbom.spdx.json

# ดูเนื้อหา SBOM
cat ./output/sbom.spdx.json | jq '.'

# สร้าง provenance attestation (default: mode=min)
docker buildx build \
  --tag myregistry/myapp:v1.0 \
  --provenance=true \
  --push .

# หรือใช้ mode=max เพื่อข้อมูลเต็ม
docker buildx build \
  --tag myregistry/myapp:v1.0 \
  --provenance=mode=max \
  --push .

# mode=min (default)
docker buildx build --provenance=true -t myapp:v1 --push .

# mode=max (full provenance)
docker buildx build --provenance=mode=max -t myapp:v1 --push .

# ปิด provenance
docker buildx build --provenance=false -t myapp:v1 --push .

# ใช้ environment variable เพื่อ disable default attestations
BUILDX_NO_DEFAULT_ATTESTATIONS=1 docker buildx build -t myapp:v1 --push .

# ดู SBOM แบบ raw
docker buildx imagetools inspect myregistry/myapp:v1.0 \
  --format '{{ json .SBOM.SPDX }}'

# ดูรายการ packages
docker buildx imagetools inspect myregistry/myapp:v1.0 \
  --format '{{ range .SBOM.SPDX.packages }}{{ .name }}@{{ .versionInfo }}{{ println }}{{ end }}'

# สำหรับ multi-platform images
docker buildx imagetools inspect myregistry/myapp:v1.0 \
  --format '{{ json (index .SBOM "linux/amd64").SPDX }}'

# ดู provenance แบบ raw
docker buildx imagetools inspect myregistry/myapp:v1.0 \
  --format '{{ json .Provenance }}'

# ดู source repository
docker buildx imagetools inspect myregistry/myapp:v1.0 \
  --format '{{ .Provenance.SLSA.source }}'

# ดู build timestamp
docker buildx imagetools inspect myregistry/myapp:v1.0 \
  --format '{{ .Provenance.SLSA.metadata.buildStartedOn }}'

# Quick view ของ image
docker scout quickview myregistry/myapp:v1.0

# ดู SBOM
docker scout sbom myregistry/myapp:v1.0

# สแกน vulnerabilities
docker scout cves myregistry/myapp:v1.0

# เปรียบเทียบ images
docker scout compare --to myregistry/myapp:v1.0 myregistry/myapp:v2.0

name: Build and Push Docker Image

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write  # จำเป็นสำหรับ OIDC token

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log into registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push Docker image
        id: build-and-push
        uses: docker/build-push-action@v5
        with:
          context: .
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
          sbom: true
          provenance: true
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Scan for vulnerabilities
        uses: docker/scout-action@v1
        with:
          command: cves
          image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
          sarif-file: scout-report.sarif
          write-comment: true
          github-token: ${{ secrets.GITHUB_TOKEN }}

docker-build:
  image: docker:cli
  stage: build
  services:
    - docker:dind
  variables:
    DOCKER_TLS_CERTDIR: "/certs"
  before_script:
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
  script:
    - docker buildx create --use
    - |
      docker buildx build \
        --tag $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA \
        --tag $CI_REGISTRY_IMAGE:latest \
        --sbom=true \
        --provenance=mode=max \
        --push \
        .
  only:
    - main

# Sign ด้วย key pair (สร้าง key ก่อน)
cosign generate-key-pair
cosign sign --key cosign.key myregistry/myapp:v1.0

# Sign ด้วย Sigstore (keyless - แนะนำ)
cosign sign myregistry/myapp:v1.0

# Sign พร้อม annotations
cosign sign \
  --annotations "commit=$COMMIT_SHA" \
  --annotations "repo=github.com/org/repo" \
  myregistry/myapp:v1.0

# Verify signature
cosign verify myregistry/myapp:v1.0

# Verify ด้วย public key
cosign verify --key cosign.pub myregistry/myapp:v1.0

# Verify ด้วย certificate identity
cosign verify \
  --certificate-identity=user@example.com \
  --certificate-oidc-issuer=https://accounts.google.com \
  myregistry/myapp:v1.0

# Verify SBOM attestation
cosign verify-attestation \
  --type spdx \
  myregistry/myapp:v1.0

# Verify Provenance attestation
cosign verify-attestation \
  --type slsaprovenance \
  myregistry/myapp:v1.0

# Verify และแสดงเนื้อหา
cosign verify-attestation \
  --type spdx \
  myregistry/myapp:v1.0 | jq '.payload | @base64d | fromjson'

# Verify policy ด้วย Kyverno/Cue
cosign verify-attestation \
  --type slsaprovenance \
  --policy policy.cue \
  myregistry/myapp:v1.0