1a7897a052
* Start of richer results from verification * Pull out VSA code from signing * Expose attestation signing fns * Add VSA test * Notes for policy result * Require separate policy for VSA creation * Load test signing key from tests * Return rich object from policy * Add result object schema and fix tests * Ensure example test runs * Remove data.yaml files from mock policies * Don't run example - TUF policy isn't compatible * Add attestation to manifests for all subjects * Ensure adding attestation doesn't touch statements * Don't export sign function * Remove attestations from VerificationResult * Change bool to Outcome enum in result * Use outputLayout directly * Make clearer that Outcome strings are for VSA * Return multiple SLSA levels from policy * Fix unmarshalling of policy-id (#39) * Rename function * Rename policy.VerificationResult -> policy.Result * Re-add test for canonical input --------- Co-authored-by: James Carnegie <james.carnegie@docker.com> Co-authored-by: James Carnegie <kipz@users.noreply.github.com>
50 lines
1.3 KiB
Go
50 lines
1.3 KiB
Go
package attestation
|
|
|
|
import (
|
|
"fmt"
|
|
|
|
intoto "github.com/in-toto/in-toto-golang/in_toto"
|
|
"github.com/package-url/packageurl-go"
|
|
)
|
|
|
|
const (
|
|
VSAPredicateType = "https://slsa.dev/verification_summary/v1"
|
|
)
|
|
|
|
type VSAPredicate struct {
|
|
Verifier VSAVerifier `json:"verifier"`
|
|
TimeVerified string `json:"timeVerified"`
|
|
ResourceUri string `json:"resourceUri"`
|
|
Policy VSAPolicy `json:"policy"`
|
|
InputAttestations []VSAInputAttestation `json:"inputAttestations"`
|
|
VerificationResult string `json:"verificationResult"`
|
|
VerifiedLevels []string `json:"verifiedLevels"`
|
|
}
|
|
|
|
type VSAVerifier struct {
|
|
ID string `json:"id"`
|
|
}
|
|
|
|
type VSAPolicy struct {
|
|
URI string `json:"uri"`
|
|
}
|
|
|
|
type VSAInputAttestation struct {
|
|
Digest map[string]string `json:"digest"`
|
|
MediaType string `json:"mediaType"`
|
|
}
|
|
|
|
func ToVSAResourceURI(sub intoto.Subject) (string, error) {
|
|
//parse purl
|
|
purl, err := packageurl.FromString(sub.Name)
|
|
if err != nil {
|
|
return "", fmt.Errorf("failed to parse package url: %w", err)
|
|
}
|
|
quals := purl.Qualifiers.Map()
|
|
if quals["digest"] == "" {
|
|
quals["digest"] = "sha256:" + sub.Digest["sha256"]
|
|
}
|
|
purl.Qualifiers = packageurl.QualifiersFromMap(quals)
|
|
return purl.String(), nil
|
|
}
|