Skip to content

Commit 90c6765

Browse files
migmartrimigmartri
authored
feat(attestation): in-toto 1.0 resource descriptor support (#103)
Signed-off-by: Miguel Martinez Trivino <[email protected]>
1 parent 477087c commit 90c6765

File tree

18 files changed

+680
-301
lines changed

18 files changed

+680
-301
lines changed

‎app/cli/api/attestation/v1/crafting_state.go‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
//
2+
// Copyright 2023 The Chainloop Authors.
3+
//
4+
// Licensed under the Apache License, Version 2.0 (the "License");
5+
// you may not use this file except in compliance with the License.
6+
// You may obtain a copy of the License at
7+
//
8+
// http://www.apache.org/licenses/LICENSE-2.0
9+
//
10+
// Unless required by applicable law or agreed to in writing, software
11+
// distributed under the License is distributed on an "AS IS" BASIS,
12+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
// See the License for the specific language governing permissions and
14+
// limitations under the License.
15+
16+
package v1
17+
18+
import (
19+
schemaapi "github.com/chainloop-dev/chainloop/app/controlplane/api/workflowcontract/v1"
20+
)
21+
22+
type NormalizedMaterialOutput struct {
23+
Value, Digest string
24+
IsOutput bool
25+
}
26+
27+
func (m *Attestation_Material) NormalizedOutput() *NormalizedMaterialOutput {
28+
switch m.MaterialType {
29+
case schemaapi.CraftingSchema_Material_ARTIFACT, schemaapi.CraftingSchema_Material_SBOM_CYCLONEDX_JSON, schemaapi.CraftingSchema_Material_SBOM_SPDX_JSON:
30+
a := m.GetArtifact()
31+
return &NormalizedMaterialOutput{a.Name, a.Digest, a.IsSubject}
32+
case schemaapi.CraftingSchema_Material_CONTAINER_IMAGE:
33+
a := m.GetContainerImage()
34+
return &NormalizedMaterialOutput{a.Name, a.Digest, a.IsSubject}
35+
case schemaapi.CraftingSchema_Material_STRING:
36+
a := m.GetString_()
37+
return &NormalizedMaterialOutput{Value: a.Value}
38+
}
39+
40+
return nil
41+
}

‎app/cli/internal/action/workflow_run_describe.go‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ import (
2323
"time"
2424

2525
pb "github.com/chainloop-dev/chainloop/app/controlplane/api/controlplane/v1"
26-
"github.com/chainloop-dev/chainloop/internal/attestation/renderer"
26+
"github.com/chainloop-dev/chainloop/internal/attestation/renderer/chainloop"
2727
sigs "github.com/sigstore/cosign/v2/pkg/signature"
2828

2929
"github.com/in-toto/in-toto-golang/in_toto"
@@ -47,7 +47,7 @@ type WorkflowRunAttestationItem struct {
4747
CreatedAt *time.Time `json:"createdAt"`
4848
Envelope *dsse.Envelope `json:"envelope"`
4949
statement *in_toto.Statement
50-
predicateV1 *renderer.ChainloopProvenancePredicateV1
50+
predicateV1 *chainloop.ProvenancePredicateV01
5151
Materials []*Material `json:"materials,omitempty"`
5252
EnvVars []*EnvVar `json:"envvars,omitempty"`
5353
}
@@ -63,7 +63,7 @@ type EnvVar struct {
6363
Value string `json:"value"`
6464
}
6565

66-
func (i *WorkflowRunAttestationItem) Predicate() *renderer.ChainloopProvenancePredicateV1 {
66+
func (i *WorkflowRunAttestationItem) Predicate() *chainloop.ProvenancePredicateV01 {
6767
return i.predicateV1
6868
}
6969

@@ -125,8 +125,8 @@ func (action *WorkflowRunDescribe) Run(runID string, verify bool, publicKey stri
125125
return nil, fmt.Errorf("un-marshaling predicate: %w", err)
126126
}
127127

128-
var predicate *renderer.ChainloopProvenancePredicateV1
129-
if statement.PredicateType == renderer.ChainloopPredicateTypeV1 {
128+
var predicate *chainloop.ProvenancePredicateV01
129+
if statement.PredicateType == chainloop.PredicateTypeV01 {
130130
if predicate, err = extractPredicateV1(statement); err != nil {
131131
return nil, fmt.Errorf("extracting predicate: %w", err)
132132
}
@@ -156,13 +156,13 @@ func (action *WorkflowRunDescribe) Run(runID string, verify bool, publicKey stri
156156
return item, nil
157157
}
158158

159-
func extractPredicateV1(statement *in_toto.Statement) (*renderer.ChainloopProvenancePredicateV1, error) {
159+
func extractPredicateV1(statement *in_toto.Statement) (*chainloop.ProvenancePredicateV01, error) {
160160
jsonPredicate, err := json.Marshal(statement.Predicate)
161161
if err != nil {
162162
return nil, fmt.Errorf("un-marshaling predicate: %w", err)
163163
}
164164

165-
predicate := &renderer.ChainloopProvenancePredicateV1{}
165+
predicate := &chainloop.ProvenancePredicateV01{}
166166
if err := json.Unmarshal(jsonPredicate, predicate); err != nil {
167167
return nil, fmt.Errorf("un-marshaling predicate: %w", err)
168168
}

‎app/controlplane/internal/biz/integration/dependencytrack/dependencytrack.go‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -28,11 +28,11 @@ import (
2828
contractAPI "github.com/chainloop-dev/chainloop/app/controlplane/api/workflowcontract/v1"
2929
"github.com/chainloop-dev/chainloop/app/controlplane/internal/biz"
3030
"github.com/chainloop-dev/chainloop/app/controlplane/internal/integrations/dependencytrack"
31-
"github.com/chainloop-dev/chainloop/internal/attestation/renderer"
31+
"github.com/chainloop-dev/chainloop/internal/attestation/renderer/chainloop"
3232
"github.com/chainloop-dev/chainloop/internal/credentials"
3333
"github.com/chainloop-dev/chainloop/internal/servicelogger"
34+
errors "github.com/go-kratos/kratos/v2/errors"
3435
"github.com/go-kratos/kratos/v2/log"
35-
"github.com/go-openapi/errors"
3636
"github.com/secure-systems-lab/go-securesystemslib/dsse"
3737
)
3838

@@ -106,11 +106,16 @@ func (uc *Integration) UploadSBOMs(envelope *dsse.Envelope, orgID, workflowID st
106106
}
107107

108108
// There is at least one enabled integration, extract the SBOMs
109-
predicate, err := renderer.ExtractPredicate(envelope)
109+
predicates, err := chainloop.ExtractPredicate(envelope)
110110
if err != nil {
111111
return err
112112
}
113113

114+
predicate := predicates.V01
115+
if predicate == nil {
116+
return errors.Forbidden("not implemented", "only v0.1 predicate is supported for now")
117+
}
118+
114119
repo, err := uc.ociUC.FindMainRepo(ctx, orgID)
115120
if err != nil {
116121
return err

‎app/controlplane/internal/service/attestation.go‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ import (
2828
"github.com/chainloop-dev/chainloop/app/controlplane/internal/biz"
2929
"github.com/chainloop-dev/chainloop/app/controlplane/internal/biz/integration/dependencytrack"
3030
"github.com/chainloop-dev/chainloop/app/controlplane/internal/usercontext"
31-
"github.com/chainloop-dev/chainloop/internal/attestation/renderer"
31+
"github.com/chainloop-dev/chainloop/internal/attestation/renderer/chainloop"
3232
"github.com/chainloop-dev/chainloop/internal/credentials"
3333
casJWT "github.com/chainloop-dev/chainloop/internal/robotaccount/cas"
3434
sl "github.com/chainloop-dev/chainloop/internal/servicelogger"
@@ -282,11 +282,16 @@ func bizAttestationToPb(att *biz.Attestation) (*cpAPI.AttestationItem, error) {
282282
return nil, err
283283
}
284284

285-
predicate, err := renderer.ExtractPredicate(att.Envelope)
285+
predicates, err := chainloop.ExtractPredicate(att.Envelope)
286286
if err != nil {
287287
return nil, err
288288
}
289289

290+
predicate := predicates.V01
291+
if predicate == nil {
292+
return nil, errors.InternalServer("invalid attestation type", "attestation does not contain a V01 predicate")
293+
}
294+
290295
return &cpAPI.AttestationItem{
291296
Envelope: encodedAttestation,
292297
EnvVars: extractEnvVariables(predicate.Env),
@@ -308,7 +313,7 @@ func extractEnvVariables(in map[string]string) []*cpAPI.AttestationItem_EnvVaria
308313
return res
309314
}
310315

311-
func extractMaterials(in []*renderer.ChainloopProvenanceMaterial) []*cpAPI.AttestationItem_Material {
316+
func extractMaterials(in []*chainloop.ProvenanceMaterial) []*cpAPI.AttestationItem_Material {
312317
res := make([]*cpAPI.AttestationItem_Material, 0, len(in))
313318
for _, m := range in {
314319
res = append(res, &cpAPI.AttestationItem_Material{Name: m.Name, Value: m.Material.String(), Type: m.Type})

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,6 @@ require (
2222
github.com/getsentry/sentry-go v0.17.0
2323
github.com/go-kratos/kratos/contrib/log/zap/v2 v2.0.0-20230113095809-bebea0c103a8
2424
github.com/go-kratos/kratos/v2 v2.5.3
25-
github.com/go-openapi/errors v0.20.3
2625
github.com/golang-jwt/jwt v3.2.2+incompatible
2726
github.com/golang-jwt/jwt/v4 v4.5.0
2827
github.com/google/go-containerregistry v0.14.1-0.20230409045903-ed5c185df419
@@ -110,6 +109,7 @@ require (
110109
github.com/go-logr/logr v1.2.4 // indirect
111110
github.com/go-logr/stdr v1.2.2 // indirect
112111
github.com/go-openapi/analysis v0.21.4 // indirect
112+
github.com/go-openapi/errors v0.20.3 // indirect
113113
github.com/go-openapi/inflect v0.19.0 // indirect
114114
github.com/go-openapi/jsonpointer v0.19.5 // indirect
115115
github.com/go-openapi/jsonreference v0.20.0 // indirect

0 commit comments

Comments
 (0)