@@ -296,7 +296,7 @@ func CreateAndPushImageSignature(ctx context.Context, imageName string, keyName
296296// image, same as `cosign attest` or Tekton Chains would, and pushes it to the stub
297297// registry as a new tag for that image akin to how cosign and Tekton Chains do it
298298func CreateAndPushAttestation (ctx context.Context , imageName , keyName string ) (context.Context , error ) {
299- return createAndPushAttestationWithPatches (ctx , imageName , keyName , nil )
299+ return createAndPushAttestationInternal (ctx , imageName , keyName , nil , false )
300300}
301301
302302// createAndPushAttestation for a named image in the Context creates an attestation
@@ -306,6 +306,11 @@ func CreateAndPushAttestation(ctx context.Context, imageName, keyName string) (c
306306// statement as required by the tests. This implementation now includes transparency
307307// log upload to generate bundle information like Tekton Chains does for attestations.
308308func createAndPushAttestationWithPatches (ctx context.Context , imageName , keyName string , patches * godog.Table ) (context.Context , error ) {
309+ return createAndPushAttestationInternal (ctx , imageName , keyName , patches , false )
310+ }
311+
312+ // createAndPushAttestationInternal is the internal implementation that supports both SLSA v0.2 and v1
313+ func createAndPushAttestationInternal (ctx context.Context , imageName , keyName string , patches * godog.Table , useV1 bool ) (context.Context , error ) {
309314 var state * imageState
310315 ctx , err := testenv .SetupState (ctx , & state )
311316 if err != nil {
@@ -322,22 +327,28 @@ func createAndPushAttestationWithPatches(ctx context.Context, imageName, keyName
322327 return ctx , err
323328 }
324329
325- // generates a mostly-empty statement, but with the required fields already filled in
326- // at this point we could add more data to the statement but the minimum works, we'll
327- // need to add more data to the attestation in more elaborate tests so:
328- // TODO: create a hook to add more data to the attestation
329- statement , err := attestation .CreateStatementFor (imageName , image )
330- if err != nil {
331- return ctx , err
332- }
330+ var statement any
333331
334- statement , err = applyPatches (statement , patches )
335- if err != nil {
336- return ctx , err
332+ if useV1 {
333+ // SLSA v1.0
334+ statement , err = attestation .CreateV1StatementFor (imageName , image )
335+ if err != nil {
336+ return ctx , err
337+ }
338+ } else {
339+ // SLSA v0.2
340+ v02Statement , err := attestation .CreateStatementFor (imageName , image )
341+ if err != nil {
342+ return ctx , err
343+ }
344+
345+ statement , err = applyPatches (v02Statement , patches )
346+ if err != nil {
347+ return ctx , err
348+ }
337349 }
338350
339- // signs the attestation with the named key
340- signedAttestation , err := attestation .SignStatement (ctx , keyName , * statement )
351+ signedAttestation , err := attestation .SignStatement (ctx , keyName , statement )
341352 if err != nil {
342353 return ctx , err
343354 }
@@ -484,6 +495,12 @@ func createAndPushAttestationWithPatches(ctx context.Context, imageName, keyName
484495 return ctx , nil
485496}
486497
498+ // CreateAndPushV1Attestation for a named image creates a SLSA v1.0 attestation
499+ // and pushes it to the stub registry
500+ func CreateAndPushV1Attestation (ctx context.Context , imageName , keyName string ) (context.Context , error ) {
501+ return createAndPushAttestationInternal (ctx , imageName , keyName , nil , true )
502+ }
503+
487504// CreateAndPushImageWithParent creates a parent image and a test image for the given imageName.
488505func CreateAndPushImageWithParent (ctx context.Context , imageName string ) (context.Context , error ) {
489506 var err error
@@ -1164,6 +1181,7 @@ func AddStepsTo(sc *godog.ScenarioContext) {
11641181 sc .Step (`^a valid image signature of "([^"]*)" image signed by the "([^"]*)" key$` , CreateAndPushImageSignature )
11651182 sc .Step (`^a valid attestation of "([^"]*)" signed by the "([^"]*)" key$` , CreateAndPushAttestation )
11661183 sc .Step (`^a valid attestation of "([^"]*)" signed by the "([^"]*)" key, patched with$` , createAndPushAttestationWithPatches )
1184+ sc .Step (`^a valid slsa v1 attestation of "([^"]*)" signed by the "([^"]*)" key$` , CreateAndPushV1Attestation )
11671185 sc .Step (`^a signed and attested keyless image named "([^"]*)"$` , createAndPushKeylessImage )
11681186 sc .Step (`^a OCI policy bundle named "([^"]*)" with$` , createAndPushPolicyBundle )
11691187 sc .Step (`^an image named "([^"]*)" with signature from "([^"]*)"$` , steal ("sig" ))
0 commit comments