docker/attest
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add input atts to result summary

Browse Source
This commit is contained in:
mrjoelkamp
2024-10-07 13:36:30 -05:00
parent d58ce0c600
commit a686de72fd
6 changed files with 30 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
attestation/types.go
View File

@@ -69,13 +69,13 @@ type Extension struct {
type EnvelopeReference struct { type EnvelopeReference struct {
*Envelope *Envelope
ResourceDescriptor *ResourceDescriptor ResourceDescriptor *ResourceDescriptor `json:"resourceDescriptor"`
} }
type ResourceDescriptor struct { type ResourceDescriptor struct {
MediaType string `json:"mediaType"` MediaType string `json:"mediaType"`
Digest map[string]string `json:"digest"` Digest map[string]string `json:"digest"`
URI string `json:"uri"` URI string `json:"uri,omitempty"`
} }
type AnnotatedStatement struct { type AnnotatedStatement struct {

19
attestation/vsa.go
View File

@@ -12,13 +12,13 @@ const (
) )
type VSAPredicate struct { type VSAPredicate struct {
Verifier VSAVerifier `json:"verifier"` Verifier VSAVerifier `json:"verifier"`
TimeVerified string `json:"timeVerified"` TimeVerified string `json:"timeVerified"`
ResourceURI string `json:"resourceUri"` ResourceURI string `json:"resourceUri"`
Policy VSAPolicy `json:"policy"` Policy VSAPolicy `json:"policy"`
InputAttestations []VSAInputAttestation `json:"inputAttestations,omitempty"` InputAttestations []ResourceDescriptor `json:"inputAttestations,omitempty"`
VerificationResult string `json:"verificationResult"` VerificationResult string `json:"verificationResult"`
VerifiedLevels []string `json:"verifiedLevels"` VerifiedLevels []string `json:"verifiedLevels"`
} }
type VSAVerifier struct { type VSAVerifier struct {
@@ -31,11 +31,6 @@ type VSAPolicy struct {
DownloadLocation string `json:"downloadLocation,omitempty"` DownloadLocation string `json:"downloadLocation,omitempty"`
} }
type VSAInputAttestation struct {
Digest map[string]string `json:"digest"`
MediaType string `json:"mediaType"`
}
func ToVSAResourceURI(sub intoto.Subject) (string, error) { func ToVSAResourceURI(sub intoto.Subject) (string, error) {
// parse purl // parse purl
purl, err := packageurl.FromString(sub.Name) purl, err := packageurl.FromString(sub.Name)

9
policy/types.go
View File

@@ -8,10 +8,11 @@ import (
) )
type Summary struct { type Summary struct {
Subjects []intoto.Subject `json:"subjects"` Subjects []intoto.Subject `json:"subjects"`
SLSALevels []string `json:"slsa_levels"` Inputs []attestation.ResourceDescriptor `json:"input_attestations"`
Verifier string `json:"verifier"` SLSALevels []string `json:"slsa_levels"`
PolicyURI string `json:"policy_uri"` Verifier string `json:"verifier"`
PolicyURI string `json:"policy_uri"`
} }
type Violation struct { type Violation struct {

6
test/testdata/local-policy-pass/policy.rego vendored
View File

@@ -37,11 +37,17 @@ subjects contains subject if {
some subject in statement.subject some subject in statement.subject
} }
inputs contains desc if {
some att in atts
desc := att.resourceDescriptor
}
result := { result := {
"success": true, "success": true,
"violations": set(), "violations": set(),
"summary": { "summary": {
"subjects": subjects, "subjects": subjects,
"input_attestations": inputs,
"slsa_levels": ["SLSA_BUILD_LEVEL_3"], "slsa_levels": ["SLSA_BUILD_LEVEL_3"],
"verifier": "docker-official-images", "verifier": "docker-official-images",
"policy_uri": "https://docker.com/official/policy/v0.1", "policy_uri": "https://docker.com/official/policy/v0.1",

1
verify.go
View File

@@ -189,6 +189,7 @@ func toVerificationResult(p *policy.Policy, input *policy.Input, result *policy.
Policy: vsaPolicy, Policy: vsaPolicy,
VerificationResult: outcomeStr, VerificationResult: outcomeStr,
VerifiedLevels: result.Summary.SLSALevels, VerifiedLevels: result.Summary.SLSALevels,
InputAttestations: result.Summary.Inputs,
}, },
}, },
}, nil }, nil

10
verify_test.go
View File

@@ -124,7 +124,15 @@ func TestVSA(t *testing.T) {
assert.Equal(t, PassPolicyDir+"/policy.rego", attestationPredicate.Policy.DownloadLocation) assert.Equal(t, PassPolicyDir+"/policy.rego", attestationPredicate.Policy.DownloadLocation)
assert.Equal(t, "https://docker.com/official/policy/v0.1", attestationPredicate.Policy.URI) assert.Equal(t, "https://docker.com/official/policy/v0.1", attestationPredicate.Policy.URI)
// this is the digest of the policy file // this is the digest of the policy file
assert.Equal(t, map[string]string{"sha256": "ae71defe3b9ecebdf4f939a396b68884d0cba3c2c9d78ce5e64146d9487b0ade"}, attestationPredicate.Policy.Digest) assert.Equal(t, map[string]string{"sha256": "fe1d4973f3521009a3adec206946e12aae935a2aceeb1e01f52b5d4cb9de79a5"}, attestationPredicate.Policy.Digest)
assert.Greater(t, len(attestationPredicate.InputAttestations), 0)
for _, input := range attestationPredicate.InputAttestations {
require.NotEmpty(t, input.Digest)
digest, ok := input.Digest["sha256"]
assert.True(t, ok)
assert.NotEmpty(t, digest)
assert.Contains(t, []string{"application/vnd.in-toto.provenance+dsse", "application/vnd.in-toto.spdx+dsse"}, input.MediaType)
}
} }
func TestVerificationFailure(t *testing.T) { func TestVerificationFailure(t *testing.T) {