Skip to content

Commit f0c8303

Browse files
gaganhr94gaganhr94
committed
fix: update predicateType to v0.2 in vulnerability attestations and related parsing logic
Signed-off-by: Gagan H R <hrgagan4@gmail.com>
1 parent e51a89c commit f0c8303

File tree

6 files changed

+21
-28
lines changed

6 files changed

+21
-28
lines changed

‎internal/testing/testdata/exampledata/certify-novuln.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
"digest": {"sha256": "3a2bd2c5cc4c978e8aefd8bd0ef335fb42ee31d1"}
77
}
88
],
9-
"predicateType": "https://in-toto.io/attestation/vulns/v0.1",
9+
"predicateType": "https://in-toto.io/attestation/vulns/v0.2",
1010
"predicate": {
1111
"scanner": {
1212
"uri": "osv.dev",

‎internal/testing/testdata/exampledata/certify-vuln.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
"uri": "pkg:maven/org.apache.logging.log4j/log4j-core@2.8.1"
66
}
77
],
8-
"predicateType": "https://in-toto.io/attestation/vulns/v0.1",
8+
"predicateType": "https://in-toto.io/attestation/vulns/v0.2",
99
"predicate": {
1010
"scanner": {
1111
"uri": "osv.dev",

‎internal/testing/testdata/testdata.go‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2181,7 +2181,7 @@ var (
21812181
"uri":"pkg:maven/org.apache.commons/commons-text@1.9"
21822182
}
21832183
],
2184-
"predicate_type":"https://in-toto.io/attestation/vulns/v0.1",
2184+
"predicate_type":"https://in-toto.io/attestation/vulns/v0.2",
21852185
"predicate":{
21862186
"scanner":{
21872187
"uri":"osv.dev",
@@ -2207,7 +2207,7 @@ var (
22072207
"uri":"pkg:oci/vul-secondLevel-latest?repository_url=gcr.io"
22082208
}
22092209
],
2210-
"predicate_type":"https://in-toto.io/attestation/vulns/v0.1",
2210+
"predicate_type":"https://in-toto.io/attestation/vulns/v0.2",
22112211
"predicate":{
22122212
"scanner": {
22132213
"uri": "osv.dev",
@@ -2226,7 +2226,7 @@ var (
22262226
"uri":"pkg:oci/vul-image-latest?repository_url=gcr.io"
22272227
}
22282228
],
2229-
"predicate_type":"https://in-toto.io/attestation/vulns/v0.1",
2229+
"predicate_type":"https://in-toto.io/attestation/vulns/v0.2",
22302230
"predicate":{
22312231
"scanner": {
22322232
"uri": "osv.dev",
@@ -2245,7 +2245,7 @@ var (
22452245
"uri":"pkg:maven/org.apache.logging.log4j/log4j-core@2.8.1"
22462246
}
22472247
],
2248-
"predicate_type":"https://in-toto.io/attestation/vulns/v0.1",
2248+
"predicate_type":"https://in-toto.io/attestation/vulns/v0.2",
22492249
"predicate":{
22502250
"scanner":{
22512251
"uri":"osv.dev",
@@ -2324,7 +2324,7 @@ var (
23242324
"uri": "pkg:maven/io.vertx/vertx-web-common@4.3.7?type=jar"
23252325
}
23262326
],
2327-
"predicate_type": "https://in-toto.io/attestation/vulns/v0.1",
2327+
"predicate_type": "https://in-toto.io/attestation/vulns/v0.2",
23282328
"predicate": {
23292329
"scanner": {
23302330
"uri": "osv.dev",
@@ -2344,7 +2344,7 @@ var (
23442344
"uri": "pkg:maven/io.vertx/vertx-auth-common@4.3.7?type=jar"
23452345
}
23462346
],
2347-
"predicate_type": "https://in-toto.io/attestation/vulns/v0.1",
2347+
"predicate_type": "https://in-toto.io/attestation/vulns/v0.2",
23482348
"predicate": {
23492349
"scanner": {
23502350
"uri": "osv.dev",
@@ -2364,7 +2364,7 @@ var (
23642364
"uri": "pkg:maven/io.vertx/vertx-bridge-common@4.3.7?type=jar"
23652365
}
23662366
],
2367-
"predicate_type": "https://in-toto.io/attestation/vulns/v0.1",
2367+
"predicate_type": "https://in-toto.io/attestation/vulns/v0.2",
23682368
"predicate": {
23692369
"scanner": {
23702370
"uri": "osv.dev",
@@ -2384,7 +2384,7 @@ var (
23842384
"uri": "pkg:maven/io.vertx/vertx-core@4.3.7?type=jar"
23852385
}
23862386
],
2387-
"predicate_type": "https://in-toto.io/attestation/vulns/v0.1",
2387+
"predicate_type": "https://in-toto.io/attestation/vulns/v0.2",
23882388
"predicate": {
23892389
"scanner": {
23902390
"uri": "osv.dev",
@@ -2412,7 +2412,7 @@ var (
24122412
"uri": "pkg:maven/io.vertx/vertx-web@4.3.7?type=jar"
24132413
}
24142414
],
2415-
"predicate_type": "https://in-toto.io/attestation/vulns/v0.1",
2415+
"predicate_type": "https://in-toto.io/attestation/vulns/v0.2",
24162416
"predicate": {
24172417
"scanner": {
24182418
"uri": "osv.dev",

‎pkg/certifier/attestation/vuln/attestation_vuln.go‎

Lines changed: 7 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -21,13 +21,10 @@ import (
2121
attestationv1 "github.com/in-toto/attestation/go/v1"
2222
)
2323

24-
// PredicateVuln This is a new predicate type for vulnerabilities based off
25-
// https://github.com/sigstore/cosign/blob/main/specs/COSIGN_VULN_ATTESTATION_SPEC.md.
26-
// This is used by the certifier to attest to vulnerabilities in an artifact.
27-
// Currently, the predicate is defined here but the intention is to upstream this to
28-
// https://github.com/in-toto/attestation in the near future once the quirks are worked out.
24+
// PredicateVuln is the predicate type for vulnerability attestations as defined by the
25+
// in-toto attestation framework. See https://github.com/in-toto/attestation/blob/main/spec/predicates/vulns_02.md
2926
const (
30-
PredicateVuln = "https://in-toto.io/attestation/vulns/v0.1"
27+
PredicateVuln = "https://in-toto.io/attestation/vulns/v0.2"
3128
)
3229

3330
// VulnerabilityStatement defines the statement header and the vulnerability predicate
@@ -44,13 +41,11 @@ type Metadata struct {
4441
}
4542

4643
// Result defines the Vulnerability ID and its alias. There can be multiple
47-
// results per artifact
48-
// TODO: The spec has a discrepency that needs to be resolved, we are following
49-
// the example json in the spec since that seems to be what 2 examples we've seen
50-
// are using. Tracking https://github.com/in-toto/attestation/issues/391
44+
// results per artifact.
5145
type Result struct {
52-
Id string `json:"id,omitempty"`
53-
Severity []Severity `json:"severity,omitempty"`
46+
Id string `json:"id,omitempty"`
47+
Severity []Severity `json:"severity,omitempty"`
48+
Annotations []map[string]interface{} `json:"annotations,omitempty"`
5449
}
5550

5651
// Severity describes the severity of a vulnerability using one or more quantitative scoring method.
@@ -59,9 +54,6 @@ type Severity struct {
5954
Method string `json:"method,omitempty"`
6055
// required
6156
Score string `json:"score,omitempty"`
62-
// ambiguous type definition ins spec, look at
63-
// https://github.com/in-toto/attestation/issues/390https://github.com/in-toto/attestation/issues/390
64-
Annotations []map[string]interface{} `json:"annotations,omitempty"`
6557
}
6658

6759
// DB defines the scanner database used at the time of scan

‎pkg/handler/processor/guesser/type_ite6.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,8 @@ func (_ *ite6TypeGuesser) GuessDocumentType(blob []byte, format processor.Format
3939
return processor.DocumentITE6Generic
4040
} else if strings.HasPrefix(statement.PredicateType, "https://in-toto.io/attestation/certify/v0.1") {
4141
return processor.DocumentITE6Generic
42-
} else if strings.HasPrefix(statement.PredicateType, "https://in-toto.io/attestation/vulns/v0.1") {
42+
} else if strings.HasPrefix(statement.PredicateType, "https://in-toto.io/attestation/vulns/v0.1") ||
43+
strings.HasPrefix(statement.PredicateType, "https://in-toto.io/attestation/vulns/v0.2") {
4344
return processor.DocumentITE6Vul
4445
} else if strings.HasPrefix(statement.PredicateType, "https://in-toto.io/attestation/clearlydefined/v0.1") {
4546
return processor.DocumentITE6ClearlyDefined

‎pkg/ingestor/parser/vuln/vuln.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515

1616
// Package vuln attestation parser parses the attestation defined by by
1717
// the certifier using the predicate type
18-
// "https://in-toto.io/attestation/vulns/v0.1" Three different types of ingest
18+
// "https://in-toto.io/attestation/vulns/v0.2" Three different types of ingest
1919
// predicates are created.
2020
//
2121
// - IsOccurences are created mapping between any package

0 commit comments

Comments
 (0)