Skip to content

Commit d98fa5e

Browse files
NiveditJainNiveditJain
committed
2 parents 871704a + ce050e9 commit d98fa5e

6 files changed

Lines changed: 186 additions & 4 deletions

File tree

‎.github/workflows/integration-tests.yml‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
name: Integration Tests for Exosphere
1+
name: Integration Tests
22

33
on:
44
push:
@@ -8,9 +8,21 @@ on:
88
- 'state-manager/**'
99
- 'python-sdk/**'
1010
- '.github/workflows/integration-tests.yml'
11+
pull_request:
12+
branches: [main]
13+
paths:
14+
- 'integration-tests/**'
15+
- 'state-manager/**'
16+
- 'python-sdk/**'
17+
- '.github/workflows/integration-tests.yml'
18+
1119

1220
jobs:
1321
test:
22+
defaults:
23+
run:
24+
working-directory: integration-tests
25+
if: github.repository == 'exospherehost/exospherehost'
1426
runs-on: ubuntu-latest
1527
services:
1628
mongodb:

‎.github/workflows/publish-python-sdk.yml‎

Lines changed: 59 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,64 @@ jobs:
9090
print(f'Version {version} is valid for PyPI publishing (contains beta indicator)')
9191
"
9292
93+
- name: Generate requirements file for SBOM
94+
run: |
95+
uv export --locked --format=requirements-txt --output-file=requirements.txt
96+
echo "Generated requirements.txt for SBOM creation from lockfile"
97+
98+
- name: Install SBOM generation tools
99+
run: |
100+
uv tool install cyclonedx-bom
101+
echo "Installed cyclonedx-bom version:"
102+
uv tool run cyclonedx-bom --version
103+
uv tool install pip-audit
104+
echo "Installed pip-audit version:"
105+
uv tool run pip-audit --version
106+
107+
- name: Generate SBOM with CycloneDX
108+
run: |
109+
uv tool run cyclonedx-py requirements --format json --output-file sbom-cyclonedx.json requirements.txt
110+
echo "Generated CycloneDX SBOM in JSON format"
111+
112+
- name: Generate vulnerability report with pip-audit
113+
run: |
114+
uv tool run pip-audit --format json --output vulnerability-report.json --requirement requirements.txt || true
115+
echo "Generated vulnerability report (non-blocking)"
116+
93117
- run: uv build
94118

95-
- run: uv publish
119+
- name: Publish to PyPI with provenance
120+
run: |
121+
# Get the current version
122+
VERSION=$(uv run python -c "
123+
import sys
124+
sys.path.append('.')
125+
from exospherehost._version import version
126+
print(version)
127+
")
128+
129+
echo "Checking if exospherehost version $VERSION already exists on PyPI..."
130+
131+
# Query PyPI JSON API to check if version exists
132+
HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://pypi.org/pypi/exospherehost/$VERSION/json")
133+
134+
if [ "$HTTP_STATUS" = "200" ]; then
135+
echo "Version $VERSION already exists on PyPI. Skipping publish."
136+
exit 0
137+
elif [ "$HTTP_STATUS" = "404" ]; then
138+
echo "Version $VERSION not found on PyPI. Proceeding with publish."
139+
uv publish --provenance
140+
else
141+
echo "Unexpected HTTP status $HTTP_STATUS when checking PyPI. Proceeding with publish."
142+
uv publish --provenance
143+
fi
144+
145+
- name: Upload SBOM artifacts
146+
uses: actions/upload-artifact@v4
147+
with:
148+
name: sbom-artifacts-beta-${{ github.sha }}
149+
path: |
150+
python-sdk/sbom-cyclonedx.json
151+
python-sdk/requirements.txt
152+
python-sdk/vulnerability-report.json
153+
retention-days: 30

‎.github/workflows/release-python-sdk.yml‎

Lines changed: 68 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -122,6 +122,73 @@ jobs:
122122
print(f'Version {version} is valid for release publishing')
123123
"
124124
125+
- name: Generate requirements file for SBOM
126+
run: |
127+
uv export --locked --format=requirements-txt --output-file=requirements.txt
128+
echo "Generated requirements.txt for SBOM creation from lockfile"
129+
130+
- name: Install SBOM generation tools
131+
run: |
132+
uv tool install cyclonedx-bom
133+
uv tool install pip-audit
134+
135+
- name: Generate SBOM with CycloneDX
136+
run: |
137+
uv tool run cyclonedx-py requirements --format json --output-file sbom-cyclonedx.json requirements.txt
138+
uv tool run cyclonedx-py requirements --format xml --output-file sbom-cyclonedx.xml requirements.txt
139+
echo "Generated CycloneDX SBOM in JSON and XML formats"
140+
141+
- name: Generate vulnerability report with pip-audit
142+
run: |
143+
uv tool run pip-audit --format json --output vulnerability-report.json --requirement requirements.txt || true
144+
echo "Generated vulnerability report (non-blocking)"
145+
146+
- name: Create SBOM summary
147+
run: |
148+
echo "## Software Bill of Materials (SBOM)" > sbom-summary.md
149+
echo "" >> sbom-summary.md
150+
echo "This release includes the following supply chain security artifacts:" >> sbom-summary.md
151+
echo "" >> sbom-summary.md
152+
echo "- **Provenance**: Cryptographic proof of build integrity using GitHub's OIDC tokens" >> sbom-summary.md
153+
echo "- **SBOM**: Complete dependency inventory in CycloneDX format" >> sbom-summary.md
154+
echo "- **Vulnerability Report**: Security scan results for all dependencies" >> sbom-summary.md
155+
echo "" >> sbom-summary.md
156+
echo "### Dependencies Count:" >> sbom-summary.md
157+
echo "- Direct dependencies: $(grep -c '^[^#]' requirements.txt || echo '0')" >> sbom-summary.md
158+
echo "- Total dependencies (including transitive): $(wc -l < requirements.txt)" >> sbom-summary.md
159+
echo "" >> sbom-summary.md
160+
echo "### Verification:" >> sbom-summary.md
161+
echo "You can verify this package's provenance on PyPI using:" >> sbom-summary.md
162+
echo '```bash' >> sbom-summary.md
163+
echo 'pip install sigstore' >> sbom-summary.md
164+
echo 'python -m sigstore verify --bundle <bundle-file> exospherehost==${{ startsWith(github.ref_name, 'v') && substring(github.ref_name, 1) || github.ref_name }}' >> sbom-summary.md
165+
echo '```' >> sbom-summary.md
166+
125167
- run: uv build
126168

127-
- run: uv publish
169+
- name: Publish to PyPI with provenance
170+
run: uv publish --provenance
171+
172+
- name: Upload SBOM artifacts
173+
uses: actions/upload-artifact@v4
174+
with:
175+
name: sbom-artifacts-${{ github.ref_name }}
176+
path: |
177+
python-sdk/sbom-cyclonedx.json
178+
python-sdk/sbom-cyclonedx.xml
179+
python-sdk/requirements.txt
180+
python-sdk/vulnerability-report.json
181+
python-sdk/sbom-summary.md
182+
retention-days: 90
183+
184+
- name: Add SBOM to release assets
185+
uses: softprops/action-gh-release@v2
186+
if: startsWith(github.ref, 'refs/tags/')
187+
with:
188+
files: |
189+
python-sdk/sbom-cyclonedx.json
190+
python-sdk/sbom-cyclonedx.xml
191+
python-sdk/sbom-summary.md
192+
python-sdk/vulnerability-report.json
193+
body_path: python-sdk/sbom-summary.md
194+
append_body: true

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
<a href="https://github.com/orgs/exospherehost/packages?repo_name=exospherehost"><img src="https://img.shields.io/badge/Kubernetes-native-326ce5?logo=kubernetes&logoColor=white" alt="Kubernetes"></a>
1010
<a href="https://discord.com/invite/zT92CAgvkj"><img src="https://badgen.net/discord/members/zT92CAgvkj" alt="Discord"></a>
1111
<a href="https://github.com/exospherehost/exospherehost"><img src="https://img.shields.io/github/stars/exospherehost/exospherehost?style=social" alt="Stars"></a>
12+
<a href="https://github.com/exospherehost/exospherehost/actions/workflows/integration-tests.yml?query=branch%3Amain"><img src="https://img.shields.io/github/actions/workflow/status/exospherehost/exospherehost/integration-tests.yml?branch=main" alt="Integration Tests (main)"></a>
1213
</p>
1314

1415
---

‎python-sdk/README.md‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,50 @@ export EXOSPHERE_API_KEY="your-api-key"
7979
- **Scalability**: Designed for high-volume batch processing and workflows
8080
- **Graph Store (beta)**: Strings-only key-value store with per-run scope for sharing data across nodes (not durable across separate runs or clusters)
8181

82+
## Supply Chain Security
83+
84+
The ExosphereHost Python SDK includes comprehensive supply chain security features to ensure package integrity and transparency:
85+
86+
### Package Provenance
87+
88+
All releases are published with cryptographic provenance using GitHub's OIDC tokens and the Sigstore ecosystem. This provides:
89+
90+
- **Cryptographic proof** that packages were built by the official ExosphereHost repository
91+
- **Tamper detection** to verify packages haven't been modified after publication
92+
- **Build transparency** showing exactly how and where packages were created
93+
94+
### Software Bill of Materials (SBOM)
95+
96+
Each release includes a complete Software Bill of Materials in industry-standard CycloneDX format:
97+
98+
- **Complete dependency inventory** listing all direct and transitive dependencies
99+
- **Vulnerability scanning** results for all dependencies
100+
- **License compliance** information for enterprise environments
101+
- **Version tracking** for security auditing and compliance
102+
103+
### Verification
104+
105+
You can verify the authenticity of any ExosphereHost package:
106+
107+
```bash
108+
# Install verification tools
109+
pip install sigstore
110+
111+
# Verify package provenance (replace X.Y.Z with actual version)
112+
python -m sigstore verify --bundle <bundle-file> exospherehost==X.Y.Z
113+
```
114+
115+
### Security Artifacts
116+
117+
For each release, you can find the following security artifacts:
118+
119+
- **SBOM files** (JSON and XML formats) attached to GitHub releases
120+
- **Vulnerability reports** showing security scan results
121+
- **Provenance attestations** available on PyPI
122+
- **Build logs** publicly available in GitHub Actions
123+
124+
These features align with modern software supply chain security best practices and help meet enterprise security requirements.
125+
82126
## Architecture
83127

84128
The SDK is built around two core concepts:

‎python-sdk/exospherehost/_version.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
version = "0.0.2b6"
1+
version = "0.0.2b7"

0 commit comments

Comments
 (0)