Skip to content

Commit 9dbd5b6

Browse files
author
Mikhail Swift
authored
feat: add ability to pass headers when making requests to archivista (#600)
Signed-off-by: Mikhail Swift <mikhail@testifysec.com>
1 parent bd820bb commit 9dbd5b6

11 files changed

Lines changed: 181 additions & 102 deletions

File tree

‎cmd/run.go‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,6 @@ import (
2121

2222
"github.com/gobwas/glob"
2323
witness "github.com/in-toto/go-witness"
24-
"github.com/in-toto/go-witness/archivista"
2524
"github.com/in-toto/go-witness/attestation"
2625
"github.com/in-toto/go-witness/attestation/commandrun"
2726
"github.com/in-toto/go-witness/attestation/material"
@@ -181,7 +180,11 @@ func runRun(ctx context.Context, ro options.RunOptions, args []string, signers .
181180
}
182181

183182
if ro.ArchivistaOptions.Enable {
184-
archivistaClient := archivista.New(ro.ArchivistaOptions.Url)
183+
archivistaClient, err := ro.ArchivistaOptions.Client()
184+
if err != nil {
185+
return fmt.Errorf("failed to create archivista client: %w", err)
186+
}
187+
185188
if gitoid, err := archivistaClient.Store(ctx, result.SignedEnvelope); err != nil {
186189
return fmt.Errorf("failed to store artifact in archivista: %w", err)
187190
} else {

‎cmd/verify.go‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,6 @@ import (
2828
"github.com/in-toto/go-witness/log"
2929
"github.com/in-toto/go-witness/source"
3030
"github.com/in-toto/go-witness/timestamp"
31-
archivista_client "github.com/in-toto/witness/internal/archivista"
3231
"github.com/in-toto/witness/internal/policy"
3332
"github.com/in-toto/witness/options"
3433
"github.com/spf13/cobra"
@@ -78,7 +77,11 @@ func runVerify(ctx context.Context, vo options.VerifyOptions, verifiers ...crypt
7877

7978
collectionSource = memSource
8079
if vo.ArchivistaOptions.Enable {
81-
archivistaClient = archivista.New(vo.ArchivistaOptions.Url)
80+
archivistaClient, err := vo.ArchivistaOptions.Client()
81+
if err != nil {
82+
return fmt.Errorf("failed to create archivista client: %w", err)
83+
}
84+
8285
collectionSource = source.NewMultiSource(collectionSource, source.NewArchvistSource(archivistaClient))
8386
}
8487

@@ -161,7 +164,7 @@ func runVerify(ctx context.Context, vo options.VerifyOptions, verifiers ...crypt
161164
}
162165
}
163166

164-
policyEnvelope, err := policy.LoadPolicy(ctx, vo.PolicyFilePath, archivista_client.NewArchivistaClient(vo.ArchivistaOptions.Url, archivistaClient))
167+
policyEnvelope, err := policy.LoadPolicy(ctx, vo.PolicyFilePath, archivistaClient)
165168
if err != nil {
166169
return fmt.Errorf("failed to open policy file: %w", err)
167170
}

‎docs/attestors/k8smanifest.json‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,15 @@
6565
"nodes"
6666
]
6767
},
68+
"NodeSwapStatus": {
69+
"properties": {
70+
"capacity": {
71+
"type": "integer"
72+
}
73+
},
74+
"additionalProperties": false,
75+
"type": "object"
76+
},
6877
"NodeSystemInfo": {
6978
"properties": {
7079
"machineID": {
@@ -96,6 +105,9 @@
96105
},
97106
"architecture": {
98107
"type": "string"
108+
},
109+
"swap": {
110+
"$ref": "#/$defs/NodeSwapStatus"
99111
}
100112
},
101113
"additionalProperties": false,

‎docs/attestors/k8smanifest.md‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,15 @@
6767
"nodes"
6868
]
6969
},
70+
"NodeSwapStatus": {
71+
"properties": {
72+
"capacity": {
73+
"type": "integer"
74+
}
75+
},
76+
"additionalProperties": false,
77+
"type": "object"
78+
},
7079
"NodeSystemInfo": {
7180
"properties": {
7281
"machineID": {
@@ -98,6 +107,9 @@
98107
},
99108
"architecture": {
100109
"type": "string"
110+
},
111+
"swap": {
112+
"$ref": "#/$defs/NodeSwapStatus"
101113
}
102114
},
103115
"additionalProperties": false,

‎docs/commands.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@ witness run [cmd] [flags]
4242
### Options
4343

4444
```
45+
--archivista-headers stringArray Headers to provide to the Archivista client when making requests
4546
--archivista-server string URL of the Archivista server to store or retrieve attestations (default "https://archivista.testifysec.io")
4647
-a, --attestations strings Attestations to record ('product' and 'material' are always recorded) (default [environment,git])
4748
--attestor-k8smanifest-context string The kubernetes context that this step applies to (if not set in the kubeconfig)
@@ -194,6 +195,7 @@ witness verify [flags]
194195
### Options
195196

196197
```
198+
--archivista-headers stringArray Headers to provide to the Archivista client when making requests
197199
--archivista-server string URL of the Archivista server to store or retrieve attestations (default "https://archivista.testifysec.io")
198200
-f, --artifactfile string Path to the artifact subject to verify
199201
-a, --attestations strings Attestation files to test against the policy

‎go.mod‎

Lines changed: 31 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ toolchain go1.24.1
66

77
require (
88
github.com/gobwas/glob v0.2.3
9-
github.com/in-toto/go-witness v0.8.4
9+
github.com/in-toto/go-witness v0.8.6
1010
github.com/invopop/jsonschema v0.13.0
1111
github.com/olekukonko/tablewriter v0.0.5
1212
github.com/sigstore/fulcio v1.7.1
@@ -15,7 +15,7 @@ require (
1515
github.com/spf13/pflag v1.0.6
1616
github.com/spf13/viper v1.20.1
1717
github.com/stretchr/testify v1.10.0
18-
k8s.io/apimachinery v0.33.0
18+
k8s.io/apimachinery v0.33.1
1919
)
2020

2121
require (
@@ -26,7 +26,7 @@ require (
2626
github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 // indirect
2727
github.com/spiffe/go-spiffe/v2 v2.5.0 // indirect
2828
github.com/zclconf/go-cty v1.16.2 // indirect
29-
golang.org/x/oauth2 v0.29.0 // indirect
29+
golang.org/x/oauth2 v0.30.0 // indirect
3030
)
3131

3232
require (
@@ -35,9 +35,9 @@ require (
3535
cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
3636
cloud.google.com/go/compute/metadata v0.6.0 // indirect
3737
cloud.google.com/go/iam v1.5.0 // indirect
38-
cloud.google.com/go/kms v1.21.1 // indirect
38+
cloud.google.com/go/kms v1.21.2 // indirect
3939
cloud.google.com/go/longrunning v0.6.6 // indirect
40-
dario.cat/mergo v1.0.1 // indirect
40+
dario.cat/mergo v1.0.2 // indirect
4141
github.com/BobuSumisu/aho-corasick v1.0.3 // indirect
4242
github.com/CycloneDX/cyclonedx-go v0.9.2 // indirect
4343
github.com/Masterminds/goutils v1.1.1 // indirect
@@ -69,10 +69,11 @@ require (
6969
github.com/beorn7/perks v1.0.1 // indirect
7070
github.com/blang/semver v3.5.1+incompatible // indirect
7171
github.com/buger/jsonparser v1.1.1 // indirect
72+
github.com/cenkalti/backoff/v5 v5.0.2 // indirect
7273
github.com/cespare/xxhash/v2 v2.3.0 // indirect
7374
github.com/charmbracelet/colorprofile v0.3.1 // indirect
7475
github.com/charmbracelet/lipgloss v1.1.0 // indirect
75-
github.com/charmbracelet/x/ansi v0.8.0 // indirect
76+
github.com/charmbracelet/x/ansi v0.9.2 // indirect
7677
github.com/charmbracelet/x/cellbuf v0.0.13 // indirect
7778
github.com/charmbracelet/x/term v0.2.1 // indirect
7879
github.com/cloudflare/circl v1.6.1 // indirect
@@ -117,7 +118,7 @@ require (
117118
github.com/go-viper/mapstructure/v2 v2.2.1 // indirect
118119
github.com/gogo/protobuf v1.3.2 // indirect
119120
github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
120-
github.com/google/certificate-transparency-go v1.3.1 // indirect
121+
github.com/google/certificate-transparency-go v1.3.2-0.20250507091337-0eddb39e94f8 // indirect
121122
github.com/google/go-containerregistry v0.20.4-0.20250225234217-098045d5e61f // indirect
122123
github.com/google/s2a-go v0.1.9 // indirect
123124
github.com/google/uuid v1.6.0 // indirect
@@ -127,7 +128,7 @@ require (
127128
github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 // indirect
128129
github.com/h2non/filetype v1.1.3 // indirect
129130
github.com/huandu/xstrings v1.5.0 // indirect
130-
github.com/in-toto/archivista v0.9.1 // indirect
131+
github.com/in-toto/archivista v0.9.3 // indirect
131132
github.com/in-toto/attestation v1.1.1 // indirect
132133
github.com/in-toto/in-toto-golang v0.9.0 // indirect
133134
github.com/inconshreveable/mousetrap v1.1.0 // indirect
@@ -138,7 +139,7 @@ require (
138139
github.com/json-iterator/go v1.1.12 // indirect
139140
github.com/kevinburke/ssh_config v1.2.0 // indirect
140141
github.com/klauspost/compress v1.18.0 // indirect
141-
github.com/letsencrypt/boulder v0.0.0-20250428151438-1274878d5e10 // indirect
142+
github.com/letsencrypt/boulder v0.0.0-20250515192130-bef73f3c8b9e // indirect
142143
github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
143144
github.com/mailru/easyjson v0.9.0 // indirect
144145
github.com/mattn/go-colorable v0.1.14 // indirect
@@ -154,7 +155,7 @@ require (
154155
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
155156
github.com/oklog/ulid v1.3.1 // indirect
156157
github.com/omnibor/omnibor-go v0.0.0-20230521145532-a77de61a16cd // indirect
157-
github.com/open-policy-agent/opa v1.4.0 // indirect
158+
github.com/open-policy-agent/opa v1.4.2 // indirect
158159
github.com/opencontainers/image-spec v1.1.1 // indirect
159160
github.com/opentracing/opentracing-go v1.2.0 // indirect
160161
github.com/openvex/go-vex v0.2.5 // indirect
@@ -166,7 +167,7 @@ require (
166167
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
167168
github.com/prometheus/client_golang v1.22.0 // indirect
168169
github.com/prometheus/client_model v0.6.2 // indirect
169-
github.com/prometheus/common v0.63.0 // indirect
170+
github.com/prometheus/common v0.64.0 // indirect
170171
github.com/prometheus/procfs v0.16.1 // indirect
171172
github.com/rcrowley/go-metrics v0.0.0-20250401214520-65e299d6c5c9 // indirect
172173
github.com/rivo/uniseg v0.4.7 // indirect
@@ -179,22 +180,22 @@ require (
179180
github.com/shibumi/go-pathspec v1.3.0 // indirect
180181
github.com/shopspring/decimal v1.4.0 // indirect
181182
github.com/sigstore/cosign/v2 v2.5.0 // indirect
182-
github.com/sigstore/protobuf-specs v0.4.1 // indirect
183+
github.com/sigstore/protobuf-specs v0.4.2 // indirect
183184
github.com/sigstore/rekor v1.3.10 // indirect
184185
github.com/sigstore/sigstore v1.9.4 // indirect
185-
github.com/sigstore/sigstore-go v0.7.2 // indirect
186-
github.com/sigstore/timestamp-authority v1.2.6 // indirect
186+
github.com/sigstore/sigstore-go v1.0.0 // indirect
187+
github.com/sigstore/timestamp-authority v1.2.7 // indirect
187188
github.com/skeema/knownhosts v1.3.1 // indirect
188189
github.com/sourcegraph/conc v0.3.0 // indirect
189190
github.com/spdx/tools-golang v0.5.5 // indirect
190191
github.com/spf13/afero v1.14.0 // indirect
191-
github.com/spf13/cast v1.7.1 // indirect
192+
github.com/spf13/cast v1.8.0 // indirect
192193
github.com/stretchr/objx v0.5.2 // indirect
193194
github.com/subosito/gotenv v1.6.0 // indirect
194195
github.com/tchap/go-patricia/v2 v2.3.2 // indirect
195196
github.com/tetratelabs/wazero v1.9.0 // indirect
196197
github.com/theupdateframework/go-tuf v0.7.0 // indirect
197-
github.com/theupdateframework/go-tuf/v2 v2.0.2 // indirect
198+
github.com/theupdateframework/go-tuf/v2 v2.1.1 // indirect
198199
github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 // indirect
199200
github.com/transparency-dev/merkle v0.0.2 // indirect
200201
github.com/vbatts/tar-split v0.12.1 // indirect
@@ -208,7 +209,7 @@ require (
208209
github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
209210
github.com/yashtewari/glob-intersection v0.2.0 // indirect
210211
github.com/zeebo/errs v1.4.0 // indirect
211-
github.com/zricethezav/gitleaks/v8 v8.24.3 // indirect
212+
github.com/zricethezav/gitleaks/v8 v8.26.0 // indirect
212213
go.mongodb.org/mongo-driver v1.17.3 // indirect
213214
go.opentelemetry.io/auto/sdk v1.1.0 // indirect
214215
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0 // indirect
@@ -219,29 +220,29 @@ require (
219220
go.opentelemetry.io/otel/trace v1.35.0 // indirect
220221
go.uber.org/multierr v1.11.0 // indirect
221222
go.uber.org/zap v1.27.0 // indirect
222-
golang.org/x/crypto v0.37.0 // indirect
223-
golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0 // indirect
223+
golang.org/x/crypto v0.38.0 // indirect
224+
golang.org/x/exp v0.0.0-20250506013437-ce4c2cf36ca6 // indirect
224225
golang.org/x/mod v0.24.0 // indirect
225-
golang.org/x/net v0.39.0 // indirect
226-
golang.org/x/sync v0.13.0 // indirect
227-
golang.org/x/sys v0.32.0 // indirect
228-
golang.org/x/term v0.31.0 // indirect
229-
golang.org/x/text v0.24.0 // indirect
226+
golang.org/x/net v0.40.0 // indirect
227+
golang.org/x/sync v0.14.0 // indirect
228+
golang.org/x/sys v0.33.0 // indirect
229+
golang.org/x/term v0.32.0 // indirect
230+
golang.org/x/text v0.25.0 // indirect
230231
golang.org/x/time v0.11.0 // indirect
231232
google.golang.org/api v0.230.0 // indirect
232233
google.golang.org/genproto v0.0.0-20250303144028-a0af3efb3deb // indirect
233-
google.golang.org/genproto/googleapis/api v0.0.0-20250428153025-10db94c68c34 // indirect
234-
google.golang.org/genproto/googleapis/rpc v0.0.0-20250428153025-10db94c68c34 // indirect
235-
google.golang.org/grpc v1.72.0 // indirect
234+
google.golang.org/genproto/googleapis/api v0.0.0-20250512202823-5a2f75b736a9 // indirect
235+
google.golang.org/genproto/googleapis/rpc v0.0.0-20250512202823-5a2f75b736a9 // indirect
236+
google.golang.org/grpc v1.72.1 // indirect
236237
google.golang.org/protobuf v1.36.6 // indirect
237238
gopkg.in/go-jose/go-jose.v2 v2.6.3 // indirect
238239
gopkg.in/inf.v0 v0.9.1 // indirect
239240
gopkg.in/warnings.v0 v0.1.2 // indirect
240241
gopkg.in/yaml.v3 v3.0.1 // indirect
241-
k8s.io/api v0.33.0 // indirect
242-
k8s.io/client-go v0.33.0 // indirect
242+
k8s.io/api v0.33.1 // indirect
243+
k8s.io/client-go v0.33.1 // indirect
243244
k8s.io/klog/v2 v2.130.1 // indirect
244-
k8s.io/utils v0.0.0-20250321185631-1f6e0b77f77e // indirect
245+
k8s.io/utils v0.0.0-20250502105355-0f33e8f1c979 // indirect
245246
sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
246247
sigs.k8s.io/randfill v1.0.0 // indirect
247248
sigs.k8s.io/structured-merge-diff/v4 v4.7.0 // indirect

0 commit comments

Comments
 (0)