feat: add attest sign/verify

pkg/attestation/types.go

@@ -1,10 +1,18 @@
 package attestation
 
-import "encoding/base64"
+import (
+	"encoding/base64"
+	"fmt"
+
+	intoto "github.com/in-toto/in-toto-golang/in_toto"
+	v02 "github.com/in-toto/in-toto-golang/in_toto/slsa_provenance/v0.2"
+	ociv1 "github.com/opencontainers/image-spec/specs-go/v1"
+)
 
 const (
-	DockerDsseExtKind = "application/vnd.docker.attestation-verification.v1+json"
-	RekorTlExtKind    = "Rekor"
+	DockerDsseExtKind             = "application/vnd.docker.attestation-verification.v1+json"
+	RekorTlExtKind                = "Rekor"
+	OCIDescriptorDSSEMediaType    = ociv1.MediaTypeDescriptor + "+dsse"
 )
 
 var base64Encoding = base64.StdEncoding.Strict()
@@ -33,3 +41,20 @@ type DockerTlExtension struct {
 	Kind string `json:"kind"`
 	Data any    `json:"data"`
 }
+
+func DSSEMediaType(predicateType string) (string, error) {
+	var predicateName string
+	switch predicateType {
+	case v02.PredicateSLSAProvenance:
+		predicateName = "provenance"
+	case intoto.PredicateSPDX:
+		predicateName = "spdx"
+	case VSAPredicateType:
+		predicateName = "verification_summary"
+
+	default:
+		return "", fmt.Errorf("unknown predicate type %q", predicateType)
+	}
+
+	return fmt.Sprintf("application/vnd.in-toto.%s+dsse", predicateName), nil
+}

pkg/attestation/vsa.go

@@ -0,0 +1,55 @@
+package attestation
+
+import (
+	"fmt"
+
+	intoto "github.com/in-toto/in-toto-golang/in_toto"
+	"github.com/package-url/packageurl-go"
+)
+
+const (
+	VSAPredicateType = "https://slsa.dev/verification_summary/v1"
+)
+
+type VSAPredicate struct {
+	Verifier           VSAVerifier           `json:"verifier"`
+	TimeVerified       string                `json:"timeVerified"`
+	ResourceUri        string                `json:"resourceUri"`
+	Policy             VSAPolicy             `json:"policy"`
+	InputAttestations  []VSAInputAttestation `json:"inputAttestations"`
+	VerificationResult string                `json:"verificationResult"`
+	VerifiedLevels     []string              `json:"verifiedLevels"`
+}
+
+type VSAVerifier struct {
+	ID string `json:"id"`
+}
+
+type VSAPolicy struct {
+	URI string `json:"uri"`
+}
+
+type VSAInputAttestation struct {
+	Digest    map[string]string `json:"digest"`
+	MediaType string            `json:"mediaType"`
+}
+
+type VSAOptions struct {
+	BuildLevel string
+	PolicyURI  string
+	VerifierID string
+}
+
+func ToVSAResourceURI(sub intoto.Subject) (string, error) {
+	//parse purl
+	purl, err := packageurl.FromString(sub.Name)
+	if err != nil {
+		return "", fmt.Errorf("failed to parse package url: %w", err)
+	}
+	quals := purl.Qualifiers.Map()
+	if quals["digest"] == "" {
+		quals["digest"] = "sha256:" + sub.Digest["sha256"]
+	}
+	purl.Qualifiers = packageurl.QualifiersFromMap(quals)
+	return purl.String(), nil
+}