A GitHub Action to download and use our enterprise tool vcn in CI - Codenotary

Recently, we at Codenotary released a new version of a GitHub Action that can be used to download our enterprise CLI tool vcn and execute commands with it. Available on GitHub’s marketplace, it can be implemented by our customers in GitHub Action continuous integration pipelines to notarize and authenticate digital assets as part of an attestation process.

The Action has two different usages: standard and custom. The standard uses all available inputs, while the custom usage takes only the version input, leaving all the other configurations for the user.

Standard usage

This is the default usage, meaning you don’t need to configure the standard_usage input when you want to use it.

Now, as an example, let’s say you wanted to download the latest version of vcn and notarize a binary file compiled for your application. This task can be easily accomplished with an yaml file like below:

name: notarize-binary

on:
  push:
    branches: [main]

jobs:
  notarize-on-linux:
    runs-on: ubuntu-latest
    steps:
      - name: Build binary
      # Steps in which you build, test, scan, etc...

      - name: Download vcn and notarize binary
        uses: Codenotary/vcn-github-action@v2
        with:
            mode: notarize
            asset: my_binary
            cnc_host: Codenotary-trustcenter-url
            cnc_grpc_port: 443
            cnc_api_key: $

This GitHub Action yaml configuration file will run on every push to the main branch of the repository where it is. It will then use the major version 2 of our vcn-github-action to download the latest version of vcn. Following that, it will execute the notarize command, as specified with the mode input, on the my_binary asset. The command will run with the --lc-host, --lc-port and --lc-api-key flags passing the values from the cnc_host, cnc_grpc_port and the cnc_api_key inputs, respectively.

Notice how we used a secret for the API key instead of hardcoding it on the file. As a secret, it will also be redacted in the GitHub Action logs.

This is what will be logged on the Download vcn and notarize binary step:

Run Codenotary/vcn-github-action@v2
Run chmod +x /home/runner/work/_actions/Codenotary/vcn-github-action/v2/get-vcn.sh && bash /home/runner/work/_actions/Codenotary/vcn-github-action/v2/get-vcn.sh 

This action will download VCN version latest.
Downloading vcn from https://vcn-releases.Codenotary.com/vcn-latest-linux-amd64-static
Successfully downloaded file.
vcn: application/x-executable; charset=binary
File https://vcn-releases.Codenotary.com/vcn-latest-linux-amd64-static is executable.

Run test "true" = "true" && { ./vcn notarize my_binary --lc-host Codenotary-trustcenter-url --lc-port 443 --lc-api-key my_trustcenter_api_key || exit 2; }  || exit 0
VCN saved locally the trusted public key
VCN automatically trusted the signature found on current connection
Your assets will not be uploaded. They will be processed locally.
Notarization in progress...
UID:		1656698789407294142
Kind:		file
Name:		my_binary
Hash:		e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Timestamp:	2022-07-01 18:06:29.407294142 +0000 UTC
SignerID:	signer-id-number
Apikey revoked:	no
Status:		TRUSTED

Custom usage

The custom usage is for more experienced users who have a broader knowledge of vcn and want to make use of more options. The standard_usage input must then be configured with false and, as mentioned above, the only input the Action will consider is the version.

For this example I’ll show how you can notarize an asset built in a pipeline.

name: notarize-artifact

on:
  push:
    branches: [main]

jobs:
  notarize-on-linux:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v2

      # This downloads the vcn binary. No other inputs needed
      - name: Download vcn
        uses: Codenotary/vcn-github-action@v2
        with:
          standard_usage: false
      # Intermediate steps in which you build, test, scan, etc...
      ...
      # Simple notarization, including an attachment
      - name: Notarize artifact
        run: ./vcn notarize my_artifact.jar --lc-host Codenotary-trustcenter-url --lc-port 443 --lc-api-key $ --attach reports/my_scan_report
        shell: bash

Again, the Action will download the vcn tool and execute the command defined in the configuration file. As you can see, the process is very similar, however, you need to specify the vcn command with all the options as you would on a console.

This is what the Notarize artifact step will log:

Run ./vcn notarize my_artifact.jar --lc-host Codenotary-trustcenter-url --lc-port 443 --lc-api-key my_trustcenter_api_key
VCN saved locally the trusted public key
VCN automatically trusted the signature found on current connection
Your assets will not be uploaded. They will be processed locally.
Notarization in progress...
UID:		1656699498966060617
Kind:		file
Name:		my_artifact.jar
Hash:		e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Timestamp:	2022-07-01 18:18:18.966060617 +0000 UTC
SignerID:	signer-id-number-901
Apikey revoked:	no
Status:		TRUSTED

Conclusion

These examples are just a starting point showing some ways this Action can be used in continuous integration pipelines on GitHub. The main benefit is to skip the download part and be able to choose which vcn version should be used.