Return VSA and rich errors from verification (#38)

* Start of richer results from verification

* Pull out VSA code from signing

* Expose attestation signing fns

* Add VSA test

* Notes for policy result

* Require separate policy for VSA creation

* Load test signing key from tests

* Return rich object from policy

* Add result object schema and fix tests

* Ensure example test runs

* Remove data.yaml files from mock policies

* Don't run example - TUF policy isn't compatible

* Add attestation to manifests for all subjects

* Ensure adding attestation doesn't touch statements

* Don't export sign function

* Remove attestations from VerificationResult

* Change bool to Outcome enum in result

* Use outputLayout directly

* Make clearer that Outcome strings are for VSA

* Return multiple SLSA levels from policy

* Fix unmarshalling of policy-id (#39)

* Rename function

* Rename policy.VerificationResult -> policy.Result

* Re-add test for canonical input

---------

Co-authored-by: James Carnegie <james.carnegie@docker.com>
Co-authored-by: James Carnegie <kipz@users.noreply.github.com>

pkg/policy/testdata/mock-tuf-allow-canonical/doi/policy.rego

@@ -0,0 +1,7 @@
+package attest
+
+import rego.v1
+
+result := {
+  "success": input.isCanonical,
+}

pkg/policy/testdata/mock-tuf-allow-canonical/mapping.yaml

@@ -0,0 +1,16 @@
+# map repos to policies
+version: v1
+kind: policy-mapping
+policies:
+  - origin:
+      domain: docker.io
+      prefix: library/
+    id: docker-official-images
+    description: Docker Official Images
+    files:
+      - path: doi/policy.rego
+mirrors:
+  - policy-id: docker-official-images
+    mirror:
+      domains: [localhost:5001, registry.local:5000]
+      prefix: ""

pkg/policy/testdata/mock-tuf-allow/doi/policy.rego

@@ -2,4 +2,6 @@ package attest
 
 import rego.v1
 
-allow := true
+result := {
+  "success": true,
+}

pkg/policy/testdata/mock-tuf-allow/mapping.yaml

@@ -9,3 +9,8 @@ policies:
     description: Docker Official Images
     files:
       - path: doi/policy.rego
+mirrors:
+  - policy-id: docker-official-images
+    mirror:
+      domains: [localhost:5001, registry.local:5000]
+      prefix: ""

pkg/policy/testdata/mock-tuf-deny/doi/policy.rego

@@ -2,4 +2,6 @@ package attest
 
 import rego.v1
 
-allow := false
+result := {
+  "success": false,
+}

pkg/policy/testdata/mock-tuf-verify-sig/doi/policy.rego

@@ -3,13 +3,17 @@ package attest
 import rego.v1
 
 keys := [{
-    "id": "a0c296026645799b2a297913878e81b0aefff2a0c301e97232f717e14402f3e4",
-    "key": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEgH23D1i2+ZIOtVjmfB7iFvX8AhVN\n9CPJ4ie9axw+WRHozGnRy99U2dRge3zueBBg2MweF0zrToXGig2v3YOrdw==\n-----END PUBLIC KEY-----",
-    "from": "2023-12-15T14:00:00Z",
-    "to": null
+  "id": "a0c296026645799b2a297913878e81b0aefff2a0c301e97232f717e14402f3e4",
+  "key": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEgH23D1i2+ZIOtVjmfB7iFvX8AhVN\n9CPJ4ie9axw+WRHozGnRy99U2dRge3zueBBg2MweF0zrToXGig2v3YOrdw==\n-----END PUBLIC KEY-----",
+  "from": "2023-12-15T14:00:00Z",
+  "to": null
 }]
 
-allow if {
+success if {
   some env in attestations.attestation("foo")
   statement := attestations.verify_envelope(env, keys)
 }
+
+result := {
+  "success": success
+}

pkg/policy/testdata/mock-tuf-wrong-key/doi/policy.rego

@@ -2,18 +2,20 @@ package attest
 
 import rego.v1
 
-keys := {
-  "a0c296026645799b2a297913878e81b0aefff2a0c301e97232f717e14402f3e4": {
-    "id": "a0c296026645799b2a297913878e81b0aefff2a0c301e97232f717e14402f3e4",
-    "key": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEHyZpSgzvqFqNv7f3x7865OS38rAb\nQMcff55zM2UH/KR3Pr84a8QsGDNgaNGzJQJWjtMSgfV8WnNoffNK+svFNg==\n-----END PUBLIC KEY-----",
-    "from": "2023-12-15T14:00:00Z",
-    "to": null,
-  }
-}
+keys := [{
+  "id": "a0c296026645799b2a297913878e81b0aefff2a0c301e97232f717e14402f3e4",
+  "key": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEHyZpSgzvqFqNv7f3x7865OS38rAb\nQMcff55zM2UH/KR3Pr84a8QsGDNgaNGzJQJWjtMSgfV8WnNoffNK+svFNg==\n-----END PUBLIC KEY-----",
+  "from": "2023-12-15T14:00:00Z",
+  "to": null,
+}]
 
-allow if {
+default success := false
+
+success if {
   some env in attestations.attestation("foo")
   statement := attestations.verify_envelope(env, keys)
 }
 
-allow := true
+result := {
+  "success": success
+}