CASPR is a Code Trust Auditing framework. It provides an organisation with necessary tools to verify, validate and attribute changes happening to their code repositories and make it part of their Build Process.
- Python >= 3.6
- PIP
- Pipenv
- Postman (Optional)
Setup SPAR verification server first so that you can upload your trusted keys. Clone the repository and open the SPAR directory in your terminal / CMD.
Create a .env file in the directory. Please refer to the .env.example file.
Example
APP_CONFIG=spar.config.DevelopmentConfig
FLASK_ENV=development
DB_URL=postgresql+psycopg2://postgres:test@localhost/spar
SECRET_KEY=super-secret
Use Pipenv to install the dependancies:
pipenv install
If there are issues in the pipenv lock file, please use:
pipenv install -r requirements.txt
After the installation of the dependancies and creation of the virtual environment, use the following command to use the environment:
pipenv shell
Once the environment is activated, run the following command to setup your database:
flask db upgrade
Run the following to start the server:
flask run -h 0.0.0.0 -p 5000
The server will start listening at http://localhost:5000/
On first run, the server will ask you to setup an admin account. Please go through the process as indicated on screen.
- Download the Postman collection: SPAR_collection
- Import the Postman collection.
- Login to the SPAR server.
- Click on "Create Access Token".
- Enter a name and create a new Access Token.
- Copy the access token in green at the top.
- Edit the SPAR collection in Postman, go to variables and set the access_token to the one you have copied.
- Set the server_url to your server base URL.
- Generate a gpg keypair using the following command:
gpg --full-generate-key
- Export the generated key using the following command:
gpg --export -a "demo@example.com" > public.key
- Copy your fingerprint from the following command:
gpg --list-keys
Output:
pub rsa3072 2022-07-14 [SC]
3C37CC8474AE4160751C663AE1304A151744A119
uid [ultimate] Demo <demo@example.com>
sub rsa3072 2022-07-14 [E]
Here 3C37CC8474AE4160751C663AE1304A151744A119 is the fingerprint.
- In the same directory, download this python file: replace_rewlines.py
- Run the file using the following command:
python replace_newlines.py
- Open the "Upload Signing Public Key" postman request.
- In JSON body, paste the fingerprint from step 11, and public key output from step 13.
- Click on send. Your Public key will be registered.
- Go to the repository you want to add the CASS scripts to.
- Go to settings -> secrets -> actions -> New repository secret
- Set name as: SERVER_API_URL and the value as <server_url>/api/get-signing-key
- Create another repository secret Name: ACCESS_TOKEN value:
- Go to the repository you want to add the CASS scripts to.
- Go to settings -> CI/CD -> Variables -> Expand -> Add Variable.
- Set key as: SERVER_API_URL and the value as <server_url>/api/get-signing-key
- Create another repository secret key: ACCESS_TOKEN value:
- Go to the repository you want to add the CASS scripts to.
- Go to Repository settings -> Pipelines -> Repository Variables.
- Set name as: SERVER_API_URL and the value as <server_url>/api/get-signing-key
- Create another repository secret Name: ACCESS_TOKEN value:
Now your repository is ready to use the SPAR server. Please refer to the installation of CASS scripts.
Follow the documentation for whichever remote repository you are using.
- Go to the CASS/github directory
- Run yarn install
- Run yarn build
- Copy the directory: .github to your repository
- Copy the files: action.yml, package.json dist/index.js to your repository.
- Edit action.yml, under "runs" set main to the index.js file relative to your repository root.
- If you already have github actions configured, please add the actions in your yml file.
- Copy the .gitlab-ci.yml, index.js and package.json files in your repository.
- Setup your runner to run for the tag: local or change the tag name in the gitlab-ci.yml file.
- If you add the package.json and index.js files in a folder, edit the gitlab-ci.yml script tag to reflect the change.
script:
- npm install
- git show --pretty=raw -s $CI_COMMIT_SHA | node folder/index.js
- Copy the bitbucket-pipelines.yml, index.js and package.json files in your repository.
- If you add the package.json and index.js files in a folder, edit the bitbucket-pipelines.yml script tag to reflect the change.
script:
- npm install
- git show --pretty=raw -s $BITBUCKET_COMMIT
- git show --pretty=raw -s $BITBUCKET_COMMIT | node folder/index.js
- Configure your git repository to use commit signing
git config --local user.signingkey <Fingerprint from gpg>
# Use gpg --list-keys to get your fingerprint
- Configure email
git config --local user.email <email>
- Setup gpg to be used for signing
git config --local gpg.program <path-to-gpg>
# git config --local gpg.program /opt/homebrew/bin/gpg
- Make sure every commit will be signed
git config --local commit.gpgsign true
# Alternately you can sign each commit manually using the -S flag
# E.g. git commit -S -m "Signed commit"
- Try to sign a new commit, and push to the remote for verification.
git add <changed_file>
git commit -m "Signed commit"
- Check your remote repository CI/CD process. The commit will be verified.