[Feat]: Extensibility for the environment attestor

[joshdabosh]

Describe the solution you'd like:
A way to add environment variables to the default denylist, or a way to optionally only attest a specified list of environment variables.

User value:

Some environments may have sensitive information stored in environment variables which are not covered in the denylist now. Using the environment attestor will store them in recoverable plaintext in generated attestations.

Expected behavior:

Environment variables can be selectively denied or allowed to be attested.

Proposed solution:

Add a flag to decide between allowlist / denylist, and another flag to append to either list for later filtering.

Anything else you would like to add:

Testing changes required:

Add tests to make sure environment variables are correctly filtered.

Documentation changes required:

Add flags to the CLI reference and modify the Environment attestor page.

[matglas]

This would be very valuable to have!

Some suggestions/options:

• Your own list of allowed variables.
• List of variable to obfuscate. Where the name is captured but values is *** by default.
• Using glob matching to do *_TOKEN or *_TOKEN_* to deny them.

@jkjell maybe this could have a feature label.

[jkjell]

One thing for future conversation about this is what to do with environmental variables that modify the behavior of a process. If someone decides to compile a program with ENABLE_INSECURE_BEHAVIOR=1 but, has a DENY * config for the environment attestor, a policy could still need to be able to verify the presence or absence of that flag. This is a long way of saying we'll probably need to include the config options of the attestor in the attestation itself.

[matglas]

we'll probably need to include the config options of the attestor in the attestation itself.

Agree. I think this is something that all attestors should have.

[matglas]

Would a PR that protects vars by hidding the value be a good first step?

[matglas]

@joshdabosh please see the PR and the conversation that is happening there. Curious to hear your thoughts on proposed enhancements there.