Add mutation for adding digest to image spec

pkg/handler/mutate.go

@@ -0,0 +1,85 @@
+package handler
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"runtime/debug"
+
+	"github.com/docker/attest/pkg/oci"
+	"github.com/google/go-containerregistry/pkg/name"
+	"github.com/google/go-containerregistry/pkg/v1/remote"
+	"github.com/open-policy-agent/frameworks/constraint/pkg/externaldata"
+	"github.com/open-policy-agent/gatekeeper-external-data-provider/pkg/utils"
+	"k8s.io/klog/v2"
+)
+
+func Mutate() http.Handler {
+	return http.HandlerFunc(mutate)
+}
+
+func mutate(w http.ResponseWriter, req *http.Request) {
+	defer func() {
+		if r := recover(); r != nil {
+			klog.Error(string(debug.Stack()))
+			klog.ErrorS(fmt.Errorf("%v", r), "panic occurred")
+		}
+	}()
+
+	// read request body
+	requestBody, err := io.ReadAll(req.Body)
+	if err != nil {
+		utils.SendResponse(nil, fmt.Sprintf("unable to read request body: %v", err), w)
+		return
+	}
+
+	klog.InfoS("received request", "body", requestBody)
+
+	// parse request body
+	var providerRequest externaldata.ProviderRequest
+	err = json.Unmarshal(requestBody, &providerRequest)
+	if err != nil {
+		utils.SendResponse(nil, fmt.Sprintf("unable to unmarshal request body: %v", err), w)
+		return
+	}
+
+	results := make([]externaldata.Item, 0)
+
+	ctx := req.Context()
+	opts := oci.WithOptions(ctx, nil)
+
+	for _, key := range providerRequest.Request.Keys {
+		output, err := getReferenceWithDigest(key, opts)
+		if err != nil {
+			utils.SendResponse(nil, err.Error(), w)
+			return
+		}
+
+		results = append(results, externaldata.Item{
+			Key:   key,
+			Value: output,
+		})
+	}
+	utils.SendResponse(&results, "", w)
+}
+
+func getReferenceWithDigest(imageRef string, opts []remote.Option) (string, error) {
+	ref, err := name.ParseReference(imageRef)
+	if err != nil {
+		return "", fmt.Errorf("unable to parse reference %s: %v", imageRef, err)
+	}
+
+	// if it already contains a digest, just return it as is
+	if _, ok := ref.(name.Digest); ok {
+		return ref.String(), nil
+	}
+
+	// we need to make a request to the registry to get the digest
+	desc, err := remote.Head(ref, opts...)
+	if err != nil {
+		return "", fmt.Errorf("unable to get digest for reference %s: %v", imageRef, err)
+	}
+
+	return ref.Name() + "@" + desc.Digest.String(), nil
+}

pkg/handler/tuf.go

@@ -0,0 +1,17 @@
+package handler
+
+import (
+	"github.com/docker/attest/pkg/tuf"
+	"github.com/open-policy-agent/gatekeeper-external-data-provider/internal/embed"
+)
+
+func createTufClient(outputPath string) (*tuf.TufClient, error) {
+	// using oci tuf metadata and targets
+	// metadataURI := "registry-1.docker.io/docker/tuf-metadata:latest"
+	// targetsURI := "registry-1.docker.io/docker/tuf-targets"
+	// example using http tuf metadata and targets
+	metadataURI := "https://docker.github.io/tuf-staging/metadata"
+	targetsURI := "https://docker.github.io/tuf-staging/targets"
+
+	return tuf.NewTufClient(embed.StagingRoot, outputPath, metadataURI, targetsURI, tuf.NewVersionChecker())
+}

pkg/handler/validate.go

@@ -11,18 +11,24 @@ import (
 	"github.com/docker/attest/pkg/attest"
 	"github.com/docker/attest/pkg/oci"
 	"github.com/docker/attest/pkg/policy"
-	"github.com/docker/attest/pkg/tuf"
+	intoto "github.com/in-toto/in-toto-golang/in_toto"
 	"github.com/open-policy-agent/frameworks/constraint/pkg/externaldata"
-	"github.com/open-policy-agent/gatekeeper-external-data-provider/internal/embed"
 	"github.com/open-policy-agent/gatekeeper-external-data-provider/pkg/utils"
 	"k8s.io/klog/v2"
 )
 
-func Handler() http.Handler {
-	return http.HandlerFunc(handler)
+type ValidationResult struct {
+	Outcome    attest.Outcome      `json:"outcome"`
+	Input      *policy.PolicyInput `json:"input"`
+	VSA        *intoto.Statement   `json:"vsa"`
+	Violations []policy.Violation  `json:"violations"`
 }
 
-func handler(w http.ResponseWriter, req *http.Request) {
+func Validate() http.Handler {
+	return http.HandlerFunc(validate)
+}
+
+func validate(w http.ResponseWriter, req *http.Request) {
 	defer func() {
 		if r := recover(); r != nil {
 			klog.Error(string(debug.Stack()))
@@ -56,7 +62,6 @@ func handler(w http.ResponseWriter, req *http.Request) {
 		utils.SendResponse(nil, err.Error(), w)
 	}
 
-	// iterate over all keys
 	for _, key := range providerRequest.Request.Keys {
 		// create a resolver for remote attestations
 		platform := "linux/amd64"
@@ -103,14 +108,3 @@ func handler(w http.ResponseWriter, req *http.Request) {
 	}
 	utils.SendResponse(&results, "", w)
 }
-
-func createTufClient(outputPath string) (*tuf.TufClient, error) {
-	// using oci tuf metadata and targets
-	metadataURI := "registry-1.docker.io/docker/tuf-metadata:latest"
-	targetsURI := "registry-1.docker.io/docker/tuf-targets"
-	// example using http tuf metadata and targets
-	// metadataURI := "https://docker.github.io/tuf-staging/metadata"
-	// targetsURI := "https://docker.github.io/tuf-staging/targets"
-
-	return tuf.NewTufClient(embed.StagingRoot, outputPath, metadataURI, targetsURI, tuf.NewVersionChecker())
-}