Merge pull request #40 from docker/feat-support-more-verify-options

feat: add att style and referrers repo opts

.github/workflows/release.yml

@@ -17,7 +17,7 @@ jobs:
           password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }}
       - name: Generate GitHub App Token
         id: app-token
-        uses: actions/create-github-app-token@ad38cffc07bac6e3857755914c4c88bfd2db4da4 # v1.10.2
+        uses: actions/create-github-app-token@31c86eb3b33c9b601a1f60f98dcbfd1d70f379b4 # v1.10.3
         with:
           app-id: ${{ vars.APP_ID }}
           private-key: ${{ secrets.DOCKER_READ_APP_PRIVATE_KEY }}

.github/workflows/scorecards.yml

@@ -42,7 +42,7 @@ jobs:
 
       - name: Generate GitHub App Token
         id: app-token
-        uses: actions/create-github-app-token@ad38cffc07bac6e3857755914c4c88bfd2db4da4 # v1.10.2
+        uses: actions/create-github-app-token@31c86eb3b33c9b601a1f60f98dcbfd1d70f379b4 # v1.10.3
         with:
           app-id: ${{ vars.DOCKER_READ_APP_ID }}
           private-key: ${{ secrets.DOCKER_READ_APP_PRIVATE_KEY }}
@@ -70,7 +70,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
+        uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
         with:
           name: SARIF file
           path: results.sarif

.github/workflows/workflow.yaml

@@ -26,7 +26,7 @@ jobs:
 
       - name: Generate GitHub App Token
         id: app-token
-        uses: actions/create-github-app-token@ad38cffc07bac6e3857755914c4c88bfd2db4da4 # v1.10.2
+        uses: actions/create-github-app-token@31c86eb3b33c9b601a1f60f98dcbfd1d70f379b4 # v1.10.3
         with:
           app-id: ${{ vars.DOCKER_READ_APP_ID }}
           private-key: ${{ secrets.DOCKER_READ_APP_PRIVATE_KEY }}
@@ -74,7 +74,7 @@ jobs:
 
       - name: Generate GitHub App Token
         id: app-token
-        uses: actions/create-github-app-token@ad38cffc07bac6e3857755914c4c88bfd2db4da4 # v1.10.2
+        uses: actions/create-github-app-token@31c86eb3b33c9b601a1f60f98dcbfd1d70f379b4 # v1.10.3
         with:
           app-id: ${{ vars.DOCKER_READ_APP_ID }}
           private-key: ${{ secrets.DOCKER_READ_APP_PRIVATE_KEY }}

charts/attest-provider/Chart.yaml

@@ -1,8 +1,8 @@
 apiVersion: v2
 description: A Helm chart for attest external data provider
 name: attest-provider
-version: 0.0.2
+version: 0.0.5
 home: https://github.com/docker/attest-provider
 sources:
   - https://github.com/docker/attest-provider.git
-appVersion: 0.0.2
+appVersion: 0.0.5

charts/attest-provider/templates/attest-provider-deployment.yaml

@@ -4,7 +4,7 @@ metadata:
   name: attest-provider
   namespace: {{ .Release.Namespace }}
 spec:
-  replicas: 1
+  replicas: {{ .Values.replicas }}
   selector:
     matchLabels:
       run: attest-provider
@@ -47,6 +47,11 @@ spec:
         volumeMounts:
         - name: tuf-temp
           mountPath: /tuf_temp
+        {{- if .Values.localPolicyDir }}
+        - name: local-policy
+          mountPath: {{ .Values.localPolicyDir }}
+          readOnly: true
+        {{- end }}
         {{- if .Values.clientCAFile }}
         - name: gatekeeper-ca-cert
           mountPath: /tmp/gatekeeper
@@ -63,6 +68,11 @@ spec:
       volumes:
       - name: tuf-temp
         emptyDir: {}
+      {{- if .Values.localPolicyDir }}
+      - name: local-policy
+        configMap:
+          name: {{ .Values.localPolicyConfigMap }}
+      {{- end }}
       {{- if .Values.clientCAFile }}
       - name: gatekeeper-ca-cert
         secret:

charts/attest-provider/values.yaml

@@ -1,8 +1,9 @@
-image: "docker/attest-provider:0.0.2@sha256:de950017a4077835504f441d6a7224ea84b51c8d86e75e8c8ac8e307190724fd"
+image: "docker/attest-provider:0.0.3@sha256:7a86f674235cae3f7fa0691ae56d385b2b13951c3cf4cb04356d486a6698d354"
 
 certDir: /certs
 clientCAFile: /tmp/gatekeeper/ca.crt
 port: 8090
+replicas: 1
 
 # uncomment these lines to use the dev TUF root
 # tufRoot: dev

main.go

@@ -40,6 +40,9 @@ var (
 
 	policyDir      string
 	policyCacheDir string
+
+	attestationStyle string
+	referrersRepo    string
 )
 
 const (
@@ -73,6 +76,9 @@ func init() {
 	flag.StringVar(&policyDir, "local-policy-dir", "", "path to local policy directory (overrides TUF policy)")
 	flag.StringVar(&policyCacheDir, "policy-cache-dir", defaultPolicyCacheDir, "path to store policy downloaded from TUF")
 
+	flag.StringVar(&attestationStyle, "attestation-style", "referrers", "attestation style [referrers, attached]")
+	flag.StringVar(&referrersRepo, "referrers-source", "", "repo from which to fetch Referrers for attestation lookup")
+
 	flag.Parse()
 }
 
@@ -80,12 +86,14 @@ func main() {
 	mux := http.NewServeMux()
 
 	validateHandler, err := handler.NewValidateHandler(&handler.ValidateHandlerOptions{
-		TUFRoot:        tufRoot,
+		TUFRoot:          tufRoot,
-		TUFOutputPath:  tufoutputPath,
+		TUFOutputPath:    tufoutputPath,
-		TUFMetadataURL: metadataURL,
+		TUFMetadataURL:   metadataURL,
-		TUFTargetsURL:  targetsURL,
+		TUFTargetsURL:    targetsURL,
-		PolicyDir:      policyDir,
+		PolicyDir:        policyDir,
-		PolicyCacheDir: policyCacheDir,
+		PolicyCacheDir:   policyCacheDir,
+		AttestationStyle: attestationStyle,
+		ReferrersRepo:    referrersRepo,
 	})
 	if err != nil {
 		klog.ErrorS(err, "unable to create validate handler")

pkg/handler/validate.go

@@ -10,6 +10,7 @@ import (
 	"github.com/docker/attest-provider/internal/embed"
 	"github.com/docker/attest-provider/pkg/utils"
 	"github.com/docker/attest/pkg/attest"
+	"github.com/docker/attest/pkg/config"
 	"github.com/docker/attest/pkg/oci"
 	"github.com/docker/attest/pkg/policy"
 	"github.com/docker/attest/pkg/tuf"
@@ -33,6 +34,9 @@ type ValidateHandlerOptions struct {
 
 	PolicyDir      string
 	PolicyCacheDir string
+
+	AttestationStyle string
+	ReferrersRepo    string
 }
 
 type validateHandler struct {
@@ -104,9 +108,11 @@ func (h *validateHandler) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 	}
 
 	policyOpts := &policy.PolicyOptions{
-		TufClient:       tufClient,
+		TufClient:        tufClient,
-		LocalTargetsDir: h.opts.PolicyCacheDir,
+		LocalTargetsDir:  h.opts.PolicyCacheDir,
-		LocalPolicyDir:  h.opts.PolicyDir,
+		LocalPolicyDir:   h.opts.PolicyDir,
+		AttestationStyle: config.AttestationStyle(h.opts.AttestationStyle),
+		ReferrersRepo:    h.opts.ReferrersRepo,
 	}
 
 	results := make([]externaldata.Item, 0)