Unify functions for use in sign & verify --vsa (#71)

* Use receivers for manifest functions
* Move SaveImage/SaveIndex from image-signing-verifier
* Ignore test fixtures in coverage
* Add AddImagesToIndex function

pkg/oci/layout.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"strings"
 
+	"github.com/docker/attest/pkg/attestation"
 	att "github.com/docker/attest/pkg/attestation"
 	v1 "github.com/google/go-containerregistry/pkg/v1"
 	"github.com/google/go-containerregistry/pkg/v1/layout"
@@ -50,7 +51,7 @@ func (r *OCILayoutResolver) Attestations(ctx context.Context, predicateType stri
 	var envs []*att.Envelope
 	manifest := r.AttestationManifest.Manifest
 	for i, l := range manifest.Layers {
-		if l.Annotations[InTotoPredicateType] != predicateType {
+		if l.Annotations[attestation.InTotoPredicateType] != predicateType {
 			continue
 		}
 		layer := layers[i]
@@ -121,7 +122,7 @@ func attestationManifestFromOCILayout(path string, platform *v1.Platform) (*Atte
 		}
 	}
 	for _, mf := range mfs2.Manifests {
-		if mf.Annotations[att.DockerReferenceType] != AttestationManifestType {
+		if mf.Annotations[att.DockerReferenceType] != attestation.AttestationManifestType {
 			continue
 		}
 

pkg/oci/oci.go

@@ -57,7 +57,7 @@ func ExtractEnvelopes(ia *AttestationManifest, predicateType string) ([]*att.Env
 	for i, l := range manifest.Layers {
 		if (strings.HasPrefix(string(l.MediaType), "application/vnd.in-toto.")) &&
 			strings.HasSuffix(string(l.MediaType), "+dsse") &&
-			l.Annotations[InTotoPredicateType] == predicateType {
+			l.Annotations[att.InTotoPredicateType] == predicateType {
 			reader, err := layers[i].Uncompressed()
 			if err != nil {
 				return nil, fmt.Errorf("failed to get layer contents: %w", err)

pkg/oci/referrers.go

@@ -79,7 +79,7 @@ func (r *ReferrersResolver) resolveAttestations(ctx context.Context) error {
 			if err != nil {
 				return fmt.Errorf("failed to get manifest: %w", err)
 			}
-			if manifest.Annotations[att.DockerReferenceType] != AttestationManifestType {
+			if manifest.Annotations[att.DockerReferenceType] != att.AttestationManifestType {
 				continue
 			}
 			if manifest.Annotations[att.DockerReferenceDigest] != subjectDigest {

pkg/oci/registry_test.go

@@ -29,9 +29,12 @@ func TestRegistry(t *testing.T) {
 		Replace:     true,
 		SkipSubject: true,
 	}
-	attIdx, err := oci.SubjectIndexFromPath(oci.UnsignedTestImage)
+	attIdx, err := oci.IndexFromPath(oci.UnsignedTestImage)
 	require.NoError(t, err)
-	signedIndex, err := attest.Sign(ctx, attIdx.Index, signer, opts)
+	signedManifests, err := attest.SignStatements(ctx, attIdx.Index, signer, opts)
+	require.NoError(t, err)
+	signedIndex := attIdx.Index
+	signedIndex, err = attestation.AddImagesToIndex(signedIndex, signedManifests)
 	require.NoError(t, err)
 
 	indexName := fmt.Sprintf("%s/repo:root", u.Host)

pkg/oci/types.go

@@ -11,17 +11,15 @@ import (
 )
 
 const (
-	AttestationManifestType            = "attestation-manifest"
-	InTotoPredicateType                = "in-toto.io/predicate-type"
-	OciReferenceTarget                 = "org.opencontainers.image.ref.name"
-	LocalPrefix                        = "oci://"
-	RegistryPrefix                     = "docker://"
-	OCI                     SourceType = "OCI"
-	Docker                  SourceType = "Docker"
+	OciReferenceTarget            = "org.opencontainers.image.ref.name"
+	LocalPrefix                   = "oci://"
+	RegistryPrefix                = "docker://"
+	OCI                SourceType = "OCI"
+	Docker             SourceType = "Docker"
 )
 
 type SourceType string
-type SubjectIndex struct {
+type NamedIndex struct {
 	Index v1.ImageIndex
 	Name  string
 }
@@ -42,7 +40,7 @@ type ImageSpec struct {
 	Platform   *v1.Platform
 }
 
-func SubjectIndexFromPath(path string) (*SubjectIndex, error) {
+func IndexFromPath(path string) (*NamedIndex, error) {
 	wrapperIdx, err := layout.ImageIndexFromPath(path)
 	if err != nil {
 		return nil, fmt.Errorf("failed to load image index: %w", err)
@@ -59,13 +57,13 @@ func SubjectIndexFromPath(path string) (*SubjectIndex, error) {
 	if err != nil {
 		return nil, fmt.Errorf("failed to extract ImageIndex for digest %s: %w", idxDigest.String(), err)
 	}
-	return &SubjectIndex{
+	return &NamedIndex{
 		Index: idx,
 		Name:  imageName,
 	}, nil
 }
 
-func SubjectIndexFromRemote(image string) (*SubjectIndex, error) {
+func IndexFromRemote(image string) (*NamedIndex, error) {
 	ref, err := name.ParseReference(image)
 	if err != nil {
 		return nil, fmt.Errorf("failed to parse image reference %s: %w", image, err)
@@ -76,17 +74,17 @@ func SubjectIndexFromRemote(image string) (*SubjectIndex, error) {
 	if err != nil {
 		return nil, fmt.Errorf("failed to pull image %s: %w", image, err)
 	}
-	return &SubjectIndex{
+	return &NamedIndex{
 		Index: idx,
 		Name:  image,
 	}, nil
 }
 
-func LoadSubjectIndex(input *ImageSpec) (*SubjectIndex, error) {
+func LoadIndex(input *ImageSpec) (*NamedIndex, error) {
 	if input.Type == OCI {
-		return SubjectIndexFromPath(input.Identifier)
+		return IndexFromPath(input.Identifier)
 	} else {
-		return SubjectIndexFromRemote(input.Identifier)
+		return IndexFromRemote(input.Identifier)
 	}
 }