Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Improved attestation inspect #1498

Merged
merged 5 commits into from
Jan 9, 2023
Merged

Improved attestation inspect #1498

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
19d16aa
inspect: break after first matching attestation
jedevc Jan 9, 2023
e68c566
inspect: parse sbom and provenance into json structs
jedevc Jan 9, 2023
3ce17b0
inspect: provide access to multiple spdx documents
jedevc Jan 9, 2023
484823c
inspect: change additional spdxs to not have duplicates
jedevc Jan 9, 2023
9818055
docs: update with new inspect output
jedevc Jan 9, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 27 additions & 13 deletions util/imagetools/loader.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,9 +46,9 @@ type index struct {
}

type asset struct {
config *ocispec.Image
sbom *sbomStub
slsa *slsaStub
config *ocispec.Image
sbom *sbomStub
provenance *provenanceStub
}

type result struct {
Expand Down Expand Up @@ -255,7 +255,7 @@ func (l *loader) scanConfig(ctx context.Context, fetcher remotes.Fetcher, desc o
}

type sbomStub struct {
SPDX json.RawMessage `json:",omitempty"`
SPDX interface{} `json:",omitempty"`
}

func (l *loader) scanSBOM(ctx context.Context, fetcher remotes.Fetcher, r *result, refs []digest.Digest, as *asset) error {
Expand All @@ -275,17 +275,24 @@ func (l *loader) scanSBOM(ctx context.Context, fetcher remotes.Fetcher, r *resul
if err != nil {
return err
}
var spdx struct {
Predicate interface{} `json:"predicate"`
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bit concerned that there isn't any way to extract the actual attestation. But I guess we can add some special case/command for that later.

}
if err := json.Unmarshal(dt, &spdx); err != nil {
return err
}
as.sbom = &sbomStub{
SPDX: dt,
SPDX: spdx.Predicate,
}
break
}
}
}
return nil
}

type slsaStub struct {
Provenance json.RawMessage `json:",omitempty"`
type provenanceStub struct {
SLSA interface{} `json:",omitempty"`
}
Comment on lines +298 to 300
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Provenance > SLSA? I thought it was SLSA > Provenance to keep common denominator first? Like in the future we can have SLSA > VSA.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it makes sense to have Type > Format. We have SBOM > SPDX, so I think it makes sense to have Provenance > SLSA.

VSA isn't provenance, so we'd have another "type" for that I think.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Makes sense 👍


func (l *loader) scanProvenance(ctx context.Context, fetcher remotes.Fetcher, r *result, refs []digest.Digest, as *asset) error {
Expand All @@ -305,9 +312,16 @@ func (l *loader) scanProvenance(ctx context.Context, fetcher remotes.Fetcher, r
if err != nil {
return err
}
as.slsa = &slsaStub{
Provenance: dt,
var slsa struct {
Predicate interface{} `json:"predicate"`
}
if err := json.Unmarshal(dt, &slsa); err != nil {
return err
}
as.provenance = &provenanceStub{
SLSA: slsa.Predicate,
}
break
}
}
}
Expand All @@ -328,16 +342,16 @@ func (r *result) Configs() map[string]*ocispec.Image {
return res
}

func (r *result) SLSA() map[string]slsaStub {
func (r *result) Provenance() map[string]provenanceStub {
if len(r.assets) == 0 {
return nil
}
res := make(map[string]slsaStub)
res := make(map[string]provenanceStub)
for p, a := range r.assets {
if a.slsa == nil {
if a.provenance == nil {
continue
}
res[p] = *a.slsa
res[p] = *a.provenance
}
return res
}
Expand Down
48 changes: 24 additions & 24 deletions util/imagetools/printers.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,7 +99,7 @@ func (p *Printer) Print(raw bool, out io.Writer) error {
}

imageconfigs := res.Configs()
slsas := res.SLSA()
provenances := res.Provenance()
sboms := res.SBOM()
format := tpl.Root.String()

Expand Down Expand Up @@ -143,43 +143,43 @@ func (p *Printer) Print(raw bool, out io.Writer) error {
default:
if len(res.platforms) > 1 {
return tpl.Execute(out, struct {
Name string `json:"name,omitempty"`
Manifest interface{} `json:"manifest,omitempty"`
Image map[string]*ocispecs.Image `json:"image,omitempty"`
SLSA map[string]slsaStub `json:"SLSA,omitempty"`
SBOM map[string]sbomStub `json:"SBOM,omitempty"`
Name string `json:"name,omitempty"`
Manifest interface{} `json:"manifest,omitempty"`
Image map[string]*ocispecs.Image `json:"image,omitempty"`
Provenance map[string]provenanceStub `json:"Provenance,omitempty"`
SBOM map[string]sbomStub `json:"SBOM,omitempty"`
}{
Name: p.name,
Manifest: mfst,
Image: imageconfigs,
SLSA: slsas,
SBOM: sboms,
Name: p.name,
Manifest: mfst,
Image: imageconfigs,
Provenance: provenances,
SBOM: sboms,
})
}
var ic *ocispecs.Image
for _, v := range imageconfigs {
ic = v
}
var slsa slsaStub
for _, v := range slsas {
slsa = v
var provenance provenanceStub
for _, v := range provenances {
provenance = v
}
var sbom sbomStub
for _, v := range sboms {
sbom = v
}
return tpl.Execute(out, struct {
Name string `json:"name,omitempty"`
Manifest interface{} `json:"manifest,omitempty"`
Image *ocispecs.Image `json:"image,omitempty"`
SLSA slsaStub `json:"SLSA,omitempty"`
SBOM sbomStub `json:"SBOM,omitempty"`
Name string `json:"name,omitempty"`
Manifest interface{} `json:"manifest,omitempty"`
Image *ocispecs.Image `json:"image,omitempty"`
Provenance provenanceStub `json:"Provenance,omitempty"`
SBOM sbomStub `json:"SBOM,omitempty"`
}{
Name: p.name,
Manifest: mfst,
Image: ic,
SLSA: slsa,
SBOM: sbom,
Name: p.name,
Manifest: mfst,
Image: ic,
Provenance: provenance,
SBOM: sbom,
})
}

Expand Down