refactor: SignIndexAttestations

pkg/attestation/attestation.go

@@ -0,0 +1,82 @@
+package attestation
+
+import (
+	"encoding/json"
+	"fmt"
+
+	v1 "github.com/google/go-containerregistry/pkg/v1"
+	"github.com/google/go-containerregistry/pkg/v1/partial"
+	"github.com/google/go-containerregistry/pkg/v1/types"
+	intoto "github.com/in-toto/in-toto-golang/in_toto"
+)
+
+// GetAttestationManifestsFromIndex extracts all attestation manifests from an index
+func GetAttestationManifestsFromIndex(index v1.ImageIndex) ([]AttestationManifest, error) {
+	idx, err := index.IndexManifest()
+	if err != nil {
+		return nil, fmt.Errorf("failed to extract IndexManifest from ImageIndex: %w", err)
+	}
+	var attestationManifests []AttestationManifest
+	for _, manifest := range idx.Manifests {
+		if manifest.Annotations[DockerReferenceType] == AttestationManifestType {
+			attestationImage, err := index.Image(manifest.Digest)
+			if err != nil {
+				return nil, fmt.Errorf("failed to extract attestation image with digest %s: %w", manifest.Digest.String(), err)
+			}
+			attestationLayers, err := GetAttestationsFromImage(attestationImage)
+			if err != nil {
+				return nil, fmt.Errorf("failed to get attestations from image: %w", err)
+			}
+			attestationManifests = append(attestationManifests,
+				AttestationManifest{
+					Manifest: manifest,
+					Attestation: AttestationImage{
+						Layers: attestationLayers,
+						Image:  attestationImage},
+					MediaType:   manifest.MediaType,
+					Annotations: manifest.Annotations,
+					Digest:      manifest.Digest})
+		}
+	}
+	return attestationManifests, nil
+}
+
+// GetAttestationsFromImage extracts all attestation layers from an image
+func GetAttestationsFromImage(image v1.Image) ([]AttestationLayer, error) {
+	layers, err := image.Layers()
+	if err != nil {
+		return nil, fmt.Errorf("failed to extract layers from image: %w", err)
+	}
+	var attestationLayers []AttestationLayer
+	for _, layer := range layers {
+		// parse layer blob as json
+		r, err := layer.Uncompressed()
+		if err != nil {
+			return nil, fmt.Errorf("failed to get layer contents: %w", err)
+		}
+		defer r.Close()
+		mt, err := layer.MediaType()
+		if err != nil {
+			return nil, fmt.Errorf("failed to get layer media type: %w", err)
+		}
+		layerDesc, err := partial.Descriptor(layer)
+		if err != nil {
+			return nil, fmt.Errorf("failed to get descriptor for layer: %w", err)
+		}
+		// copy original annotations
+		ann := make(map[string]string)
+		for k, v := range layerDesc.Annotations {
+			ann[k] = v
+		}
+		// only decode intoto statements
+		var stmt = new(intoto.Statement)
+		if mt == types.MediaType(intoto.PayloadType) {
+			err = json.NewDecoder(r).Decode(&stmt)
+			if err != nil {
+				return nil, fmt.Errorf("failed to decode statement layer contents: %w", err)
+			}
+		}
+		attestationLayers = append(attestationLayers, AttestationLayer{Layer: layer, MediaType: mt, Statement: stmt, Annotations: ann})
+	}
+	return attestationLayers, nil
+}

pkg/attestation/types.go

@@ -4,12 +4,16 @@ import (
 	"encoding/base64"
 	"fmt"
 
+	v1 "github.com/google/go-containerregistry/pkg/v1"
+	"github.com/google/go-containerregistry/pkg/v1/types"
 	intoto "github.com/in-toto/in-toto-golang/in_toto"
 	v02 "github.com/in-toto/in-toto-golang/in_toto/slsa_provenance/v0.2"
 	ociv1 "github.com/opencontainers/image-spec/specs-go/v1"
 )
 
 const (
+	DockerReferenceType        = "vnd.docker.reference.type"
+	AttestationManifestType    = "attestation-manifest"
 	DockerDsseExtKind          = "application/vnd.docker.attestation-verification.v1+json"
 	RekorTlExtKind             = "Rekor"
 	OCIDescriptorDSSEMediaType = ociv1.MediaTypeDescriptor + "+dsse"
@@ -17,6 +21,26 @@ const (
 
 var base64Encoding = base64.StdEncoding.Strict()
 
+type AttestationLayer struct {
+	Statement   *intoto.Statement
+	Layer       v1.Layer
+	MediaType   types.MediaType
+	Annotations map[string]string
+}
+
+type AttestationImage struct {
+	Layers []AttestationLayer
+	Image  v1.Image
+}
+
+type AttestationManifest struct {
+	Manifest    v1.Descriptor
+	Attestation AttestationImage
+	MediaType   types.MediaType
+	Annotations map[string]string
+	Digest      v1.Hash
+}
+
 // the following types are needed until https://github.com/secure-systems-lab/dsse/pull/61 is merged
 type Envelope struct {
 	PayloadType string      `json:"payloadType"`