Add support for separate attestation storage repo (#62)

* Add support for separate attestation storage repo
* Move mapping file types and parsing to config package
* Change signature of Verify to take image/platform
* Separate Attestation Resolvers to their own files (registry, layout and referrers)
* Add support configuring referrers resolution style in mapping.yaml
* Add registry test

pkg/config/config.go

@@ -0,0 +1,49 @@
+package config
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+
+	"github.com/docker/attest/pkg/tuf"
+	goyaml "gopkg.in/yaml.v3"
+)
+
+const (
+	MappingFilename = "mapping.yaml"
+)
+
+func LoadLocalMappings(configDir string) (*PolicyMappings, error) {
+	if configDir == "" {
+		return nil, nil
+	}
+	mappings := &PolicyMappings{}
+	path := filepath.Join(configDir, MappingFilename)
+	mappingFile, err := os.ReadFile(path)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read local policy mapping file %s: %w", path, err)
+	}
+	err = goyaml.Unmarshal(mappingFile, mappings)
+	if err != nil {
+		return nil, fmt.Errorf("failed to unmarshal policy mapping file %s: %w", path, err)
+	}
+	return mappings, nil
+}
+
+func LoadTufMappings(tufClient tuf.TUFClient, localTargetsDir string) (*PolicyMappings, error) {
+	if tufClient == nil {
+		return nil, fmt.Errorf("tuf client not set")
+	}
+	filename := MappingFilename
+	_, fileContents, err := tufClient.DownloadTarget(filename, filepath.Join(localTargetsDir, filename))
+	if err != nil {
+		return nil, fmt.Errorf("failed to download policy mapping file %s: %w", filename, err)
+	}
+	mappings := &PolicyMappings{}
+
+	err = goyaml.Unmarshal(fileContents, mappings)
+	if err != nil {
+		return nil, fmt.Errorf("failed to unmarshal policy mapping file %s: %w", filename, err)
+	}
+	return mappings, nil
+}

pkg/config/types.go

@@ -0,0 +1,48 @@
+package config
+
+type PolicyMappings struct {
+	Version  string          `json:"version"`
+	Kind     string          `json:"kind"`
+	Policies []PolicyMapping `json:"policies"`
+	Mirrors  []PolicyMirror  `json:"mirrors"`
+}
+
+type AttestationSource string
+
+const (
+	AttestationSourceAttached  AttestationSource = "attached"
+	AttestationSourceReferrers AttestationSource = "referrers"
+)
+
+type PolicyMapping struct {
+	Id           string              `json:"id"`
+	Description  string              `json:"description"`
+	Origin       *PolicyOrigin       `json:"origin"`
+	Files        []PolicyMappingFile `json:"files"`
+	Attestations *ReferrersConfig    `json:"attestations"`
+}
+
+type ReferrersConfig struct {
+	Style AttestationSource `json:"style"`
+	Repo  string            `json:"repo"`
+}
+
+type PolicyMappingFile struct {
+	Path string `json:"path"`
+}
+
+type PolicyMirror struct {
+	PolicyId string     `yaml:"policy-id"`
+	Mirror   MirrorSpec `json:"mirror"`
+}
+
+type MirrorSpec struct {
+	Domains []string `json:"domains"`
+	Prefix  string   `json:"prefix"`
+}
+
+type PolicyOrigin struct {
+	Name   string `json:"name"`
+	Prefix string `json:"prefix"`
+	Domain string `json:"domain"`
+}