-
Notifications
You must be signed in to change notification settings - Fork 4
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Refactor SCAI generator APIs into pkg/ (#38)
* Refactor SCAI generator APIs into pkg/ Signed-off-by: Marcela Melara <[email protected]> * Add docstrings, address review comments Signed-off-by: Marcela Melara <[email protected]> --------- Signed-off-by: Marcela Melara <[email protected]>
- Loading branch information
1 parent
51fc87b
commit 78eb564
Showing
16 changed files
with
169 additions
and
93 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,43 @@ | ||
| package generators | ||
|
|
||
| import ( | ||
| "fmt" | ||
|
|
||
| scai "github.com/in-toto/attestation/go/predicates/scai/v0" | ||
| ita "github.com/in-toto/attestation/go/v1" | ||
| "google.golang.org/protobuf/types/known/structpb" | ||
| ) | ||
|
|
||
| // Generates a SCAI v0 AttributeAssertion struct. | ||
| // Throws an error if the resulting AttributeAssertion does not meet the spec. | ||
| func NewSCAIAssertion(attribute string, target *ita.ResourceDescriptor, conditions *structpb.Struct, evidence *ita.ResourceDescriptor) (*scai.AttributeAssertion, error) { | ||
| aa := &scai.AttributeAssertion{ | ||
| Attribute: attribute, | ||
| Target: target, | ||
| Conditions: conditions, | ||
| Evidence: evidence, | ||
| } | ||
|
|
||
| err := aa.Validate() | ||
| if err != nil { | ||
| return nil, fmt.Errorf("invalid SCAI attribute assertion: %w", err) | ||
| } | ||
|
|
||
| return aa, nil | ||
| } | ||
|
|
||
| // Generates a SCAI v0 AttributeReport struct to be used as an in-toto attestation predicate. | ||
| // Throws an error if the resulting AttributeReport does not meet the spec. | ||
| func NewSCAIReport(attrAssertions []*scai.AttributeAssertion, producer *ita.ResourceDescriptor) (*scai.AttributeReport, error) { | ||
| ar := &scai.AttributeReport{ | ||
| Attributes: attrAssertions, | ||
| Producer: producer, | ||
| } | ||
|
|
||
| err := ar.Validate() | ||
| if err != nil { | ||
| return nil, fmt.Errorf("invalid SCAI attribute report: %w", err) | ||
| } | ||
|
|
||
| return ar, nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,101 @@ | ||
| package generators | ||
|
|
||
| import ( | ||
| "encoding/hex" | ||
| "fmt" | ||
| "os" | ||
| "strings" | ||
|
|
||
| "github.com/in-toto/scai-demos/scai-gen/pkg/policy" | ||
|
|
||
| ita "github.com/in-toto/attestation/go/v1" | ||
| "google.golang.org/protobuf/types/known/structpb" | ||
| ) | ||
|
|
||
| // Generates an in-toto Attestation Framework v1 ResourceDescriptor for a local file, including its digest (default sha256). | ||
| // Throws an error if the resulting ResourceDescriptor does not meet the spec. | ||
| func NewRdForFile(filename, name, uri, hashAlg string, withContent bool, mediaType, downloadLocation string, annotations *structpb.Struct) (*ita.ResourceDescriptor, error) { | ||
| fileBytes, err := os.ReadFile(filename) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("error reading resource file: %w", err) | ||
| } | ||
|
|
||
| var content []byte | ||
| if withContent { | ||
| content = fileBytes | ||
| } | ||
|
|
||
| var digest string | ||
| var alg string | ||
| if hashAlg == "sha256" || hashAlg == "" { | ||
| digest = hex.EncodeToString(policy.GenSHA256(fileBytes)) | ||
| alg = "sha256" | ||
| } else { | ||
| return nil, fmt.Errorf("hash algorithm %s not supported", hashAlg) | ||
| } | ||
|
|
||
| rdName := filename | ||
| if len(name) > 0 { | ||
| rdName = name | ||
| } | ||
|
|
||
| rd := &ita.ResourceDescriptor{ | ||
| Name: rdName, | ||
| Uri: uri, | ||
| Digest: map[string]string{alg: strings.ToLower(digest)}, | ||
| Content: content, | ||
| DownloadLocation: downloadLocation, | ||
| MediaType: mediaType, | ||
| Annotations: annotations, | ||
| } | ||
|
|
||
| err = rd.Validate() | ||
| if err != nil { | ||
| return nil, fmt.Errorf("invalid resource descriptor: %w", err) | ||
| } | ||
|
|
||
| return rd, nil | ||
| } | ||
|
|
||
| // Generates an in-toto Attestation Framework v1 ResourceDescriptor for a remote resource identified by a name or URI). | ||
| // Does not check if the URI resolves to a valid remote location. | ||
| // Throws an error if the resulting ResourceDescriptor does not meet the spec. | ||
| func NewRdForRemote(name, uri, hashAlg, digest, downloadLocation string, annotations *structpb.Struct) (*ita.ResourceDescriptor, error) { | ||
| digestSet := make(map[string]string) | ||
| if len(hashAlg) > 0 && len(digest) > 0 { | ||
| digestSet = map[string]string{hashAlg: strings.ToLower(digest)} | ||
| } | ||
|
|
||
| rd := &ita.ResourceDescriptor{ | ||
| Name: name, | ||
| Uri: uri, | ||
| Digest: digestSet, | ||
| DownloadLocation: downloadLocation, | ||
| Annotations: annotations, | ||
| } | ||
|
|
||
| err := rd.Validate() | ||
| if err != nil { | ||
| return nil, fmt.Errorf("invalid resource descriptor: %w", err) | ||
| } | ||
|
|
||
| return rd, nil | ||
| } | ||
|
|
||
| // Generates an in-toto Attestation Framework v1 Statement including a given predicate. | ||
| // Throws an error if the resulting Statement does not meet the spec. | ||
| func NewStatement(subjects []*ita.ResourceDescriptor, predicateType string, predicate *structpb.Struct) (*ita.Statement, error) { | ||
| statement := &ita.Statement{ | ||
| Type: ita.StatementTypeUri, | ||
| Subject: subjects, | ||
| PredicateType: predicateType, | ||
| Predicate: predicate, | ||
| } | ||
|
|
||
| err := statement.Validate() | ||
| if err != nil { | ||
| return nil, fmt.Errorf("invalid in-toto Statement: %w", err) | ||
| } | ||
|
|
||
| return statement, nil | ||
| } |
File renamed without changes.
File renamed without changes.
File renamed without changes.