docker/attest
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Create single layer images for referrers attestations

Browse Source
This commit is contained in:
James Carnegie
2024-07-09 09:39:09 +01:00
parent c3ece3f02d
commit a605278749
16 changed files with 245 additions and 185 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
pkg/oci/layout.go
View File

@@ -43,22 +43,13 @@ func (r *OCILayoutResolver) fetchAttestationManifest() (*attestation.Attestation
}
func (r *OCILayoutResolver) Attestations(ctx context.Context, predicateType string) ([]*att.Envelope, error) {
attestationImage := r.AttestationManifest.AttestationImage
layers, err := attestationImage.Image.Layers()
if err != nil {
return nil, fmt.Errorf("failed to extract layers from attestation image: %w", err)
}
var envs []*att.Envelope
manifest, err := r.AttestationManifest.AttestationImage.Image.Manifest()
if err != nil {
return nil, fmt.Errorf("failed to get manifest: %w", err)
}
for i, l := range manifest.Layers {
if l.Annotations[attestation.InTotoPredicateType] != predicateType {
for _, attestationLayer := range r.AttestationManifest.AttestationImage.OriginalLayers {
if attestationLayer.Annotations[attestation.InTotoPredicateType] != predicateType {
continue
}
layer := layers[i]
mt, err := layer.MediaType()
mt, err := attestationLayer.Layer.MediaType()
if err != nil {
return nil, fmt.Errorf("failed to get layer media type: %w", err)
}
@@ -68,7 +59,7 @@ func (r *OCILayoutResolver) Attestations(ctx context.Context, predicateType stri
}
var env = new(att.Envelope)
// parse layer blob as json
r, err := layer.Uncompressed()
r, err := attestationLayer.Layer.Uncompressed()
if err != nil {
return nil, fmt.Errorf("failed to get layer contents: %w", err)
@@ -138,8 +129,12 @@ func attestationManifestFromOCILayout(path string, platform *v1.Platform) (*atte
if err != nil {
return nil, fmt.Errorf("failed to extract attestation image with digest %s: %w", mf.Digest.String(), err)
}
layers, err := attestation.GetAttestationsFromImage(attestationImage)
if err != nil {
return nil, fmt.Errorf("failed to get attestations from image: %w", err)
}
attest := &attestation.AttestationManifest{
AttestationImage: &att.AttestationImage{Image: attestationImage},
AttestationImage: &att.AttestationImage{OriginalLayers: layers},
OriginalDescriptor: &mf,
SubjectName: name,
SubjectDescriptor: subjectDescriptor,

24
pkg/oci/oci.go
View File

@@ -47,21 +47,17 @@ func WithOptions(ctx context.Context, platform *v1.Platform) []remote.Option {
return options
}
func ExtractEnvelopes(ia *attestation.AttestationManifest, predicateType string) ([]*att.Envelope, error) {
manifest, err := ia.AttestationImage.Image.Manifest()
if err != nil {
return nil, fmt.Errorf("failed to get manifest: %w", err)
}
func ExtractEnvelopes(manifest *attestation.AttestationManifest, predicateType string) ([]*att.Envelope, error) {
var envs []*att.Envelope
layers, err := ia.AttestationImage.Image.Layers()
if err != nil {
return nil, fmt.Errorf("failed to get layers: %w", err)
}
for i, l := range manifest.Layers {
if (strings.HasPrefix(string(l.MediaType), "application/vnd.in-toto.")) &&
strings.HasSuffix(string(l.MediaType), "+dsse") &&
l.Annotations[att.InTotoPredicateType] == predicateType {
reader, err := layers[i].Uncompressed()
for _, attestationLayer := range manifest.AttestationImage.OriginalLayers {
mt, err := attestationLayer.Layer.MediaType()
if err != nil {
return nil, fmt.Errorf("failed to get layer media type: %w", err)
}
if (strings.HasPrefix(string(mt), "application/vnd.in-toto.")) &&
strings.HasSuffix(string(mt), "+dsse") &&
attestationLayer.Annotations[att.InTotoPredicateType] == predicateType {
reader, err := attestationLayer.Layer.Uncompressed()
if err != nil {
return nil, fmt.Errorf("failed to get layer contents: %w", err)
}

6
pkg/oci/referrers.go
View File

@@ -80,9 +80,13 @@ func (r *ReferrersResolver) resolveAttestations(ctx context.Context) error {
if err != nil {
return fmt.Errorf("failed to get referred image: %w", err)
}
layers, err := attestation.GetAttestationsFromImage(attestationImage)
if err != nil {
return fmt.Errorf("failed to get attestations from image: %w", err)
}
attest := &attestation.AttestationManifest{
SubjectName: r.Identifier,
AttestationImage: &attestation.AttestationImage{Image: attestationImage},
AttestationImage: &attestation.AttestationImage{OriginalLayers: layers},
OriginalDescriptor: &m,
SubjectDescriptor: desc,
}

6
pkg/oci/registry.go
View File

@@ -127,8 +127,12 @@ func FetchAttestationManifest(ctx context.Context, image string, platform *v1.Pl
return nil, fmt.Errorf("failed to get attestation image: %w", err)
}
layers, err := attestation.GetAttestationsFromImage(attestationImage)
if err != nil {
return nil, fmt.Errorf("failed to get attestations from image: %w", err)
}
attest := &attestation.AttestationManifest{
AttestationImage: &att.AttestationImage{Image: attestationImage},
AttestationImage: &att.AttestationImage{OriginalLayers: layers},
OriginalDescriptor: &remoteDescriptor.Descriptor,
SubjectName: image,
SubjectDescriptor: subjectDescriptor,

5
pkg/oci/registry_test.go
View File

@@ -25,10 +25,7 @@ func TestRegistry(t *testing.T) {
u, err := url.Parse(server.URL)
require.NoError(t, err)
opts := &attestation.SigningOptions{
Replace: true,
SkipSubject: true,
}
opts := &attestation.SigningOptions{}
attIdx, err := oci.IndexFromPath(oci.UnsignedTestImage)
require.NoError(t, err)
signedManifests, err := attest.SignStatements(ctx, attIdx.Index, signer, opts)