Skip to content

Modernize provenance pkg to use the new intoto libraries #598

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
k8s-ci-robot merged 5 commits into from
Feb 7, 2026
Merged

Modernize provenance pkg to use the new intoto libraries #598

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
d8d6e09
Rework the provenance package with intoto.Att
puerco Feb 7, 2026
86f02b8
Update provenance pkg tests
puerco Feb 7, 2026
0ff0e8d
Update fakes
puerco Feb 7, 2026
ad70ebc
Update SPDX>SLSA exporter to new provenance
puerco Feb 7, 2026
c6f9105
go mod tidy
puerco Feb 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 2 additions & 4 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ require (
github.com/google/go-containerregistry v0.20.7
github.com/google/licenseclassifier/v2 v2.0.0
github.com/google/uuid v1.6.0
github.com/in-toto/in-toto-golang v0.9.0
github.com/in-toto/attestation v1.1.2
github.com/knqyf263/go-rpmdb v0.1.1
github.com/nozzle/throttler v0.0.0-20180817012639-2ea982251481
github.com/sirupsen/logrus v1.9.4
Expand All @@ -19,6 +19,7 @@ require (
gitlab.alpinelinux.org/alpine/go v0.10.1
golang.org/x/mod v0.32.0
golang.org/x/term v0.39.0
google.golang.org/protobuf v1.36.6
sigs.k8s.io/release-utils v0.12.3
sigs.k8s.io/yaml v1.6.0
)
Expand Down Expand Up @@ -61,13 +62,10 @@ require (
github.com/package-url/packageurl-go v0.1.3
github.com/pmezard/go-difflib v1.0.0 // indirect
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
github.com/secure-systems-lab/go-securesystemslib v0.6.0 // indirect
github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 // indirect
github.com/shibumi/go-pathspec v1.3.0 // indirect
github.com/spf13/pflag v1.0.9 // indirect
github.com/vbatts/tar-split v0.12.2 // indirect
go.yaml.in/yaml/v2 v2.4.2 // indirect
golang.org/x/crypto v0.46.0 // indirect
golang.org/x/net v0.48.0 // indirect
golang.org/x/sync v0.19.0
golang.org/x/sys v0.40.0 // indirect
Expand Down
14 changes: 4 additions & 10 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,8 +12,6 @@ github.com/clipperhouse/stringish v0.1.1 h1:+NSqMOr3GR6k1FdRhhnXrLfztGzuG+VuFDfa
github.com/clipperhouse/stringish v0.1.1/go.mod h1:v/WhFtE1q0ovMta2+m+UbpZ+2/HEXNWYXQgCt4hdOzA=
github.com/clipperhouse/uax29/v2 v2.3.0 h1:SNdx9DVUqMoBuBoW3iLOj4FQv3dN5mDtuqwuhIGpJy4=
github.com/clipperhouse/uax29/v2 v2.3.0/go.mod h1:Wn1g7MK6OoeDT0vL+Q0SQLDz/KpfsVRgg6W7ihQeh4g=
github.com/codahale/rfc6979 v0.0.0-20141003034818-6a90f24967eb h1:EDmT6Q9Zs+SbUoc7Ik9EfrFqcylYqgPZ9ANSbTAntnE=
github.com/codahale/rfc6979 v0.0.0-20141003034818-6a90f24967eb/go.mod h1:ZjrT6AXHbDs86ZSdt/osfBi5qfexBrKUdONk989Wnk4=
github.com/common-nighthawk/go-figure v0.0.0-20210622060536-734e95fb86be h1:J5BL2kskAlV9ckgEsNQXscjIaLiOYiZ75d4e94E6dcQ=
github.com/common-nighthawk/go-figure v0.0.0-20210622060536-734e95fb86be/go.mod h1:mk5IQ+Y0ZeO87b858TlA645sVcEcbiX6YqP98kt+7+w=
github.com/containerd/stargz-snapshotter/estargz v0.18.1 h1:cy2/lpgBXDA3cDKSyEfNOFMA/c10O1axL69EU7iirO8=
Expand Down Expand Up @@ -51,8 +49,8 @@ github.com/google/pprof v0.0.0-20221118152302-e6195bd50e26 h1:Xim43kblpZXfIBQsbu
github.com/google/pprof v0.0.0-20221118152302-e6195bd50e26/go.mod h1:dDKJzRmX4S37WGHujM7tX//fmj1uioxKzKxz3lo4HJo=
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
github.com/in-toto/in-toto-golang v0.9.0 h1:tHny7ac4KgtsfrG6ybU8gVOZux2H8jN05AXJ9EBM1XU=
github.com/in-toto/in-toto-golang v0.9.0/go.mod h1:xsBVrVsHNsB61++S6Dy2vWosKhuA3lUTQd+eF9HdeMo=
github.com/in-toto/attestation v1.1.2 h1:MBFn6lsMq6dptQZJBhalXTcWMb/aJy3V+GX3VYj/V1E=
github.com/in-toto/attestation v1.1.2/go.mod h1:gYFddHMZj3DiQ0b62ltNi1Vj5rC879bTmBbrv9CRHpM=
github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
Expand Down Expand Up @@ -110,13 +108,9 @@ github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7
github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
github.com/sclevine/spec v1.4.0 h1:z/Q9idDcay5m5irkZ28M7PtQM4aOISzOpj4bUPkDee8=
github.com/sclevine/spec v1.4.0/go.mod h1:LvpgJaFyvQzRvc1kaDs0bulYwzC70PbiYjC4QnFHkOM=
github.com/secure-systems-lab/go-securesystemslib v0.6.0 h1:T65atpAVCJQK14UA57LMdZGpHi4QYSH/9FZyNGqMYIA=
github.com/secure-systems-lab/go-securesystemslib v0.6.0/go.mod h1:8Mtpo9JKks/qhPG4HGZ2LGMvrPbzuxwfz/f/zLfEWkk=
github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 h1:n661drycOFuPLCN3Uc8sB6B/s6Z4t2xvBgU1htSHuq8=
github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
github.com/shibumi/go-pathspec v1.3.0 h1:QUyMZhFo0Md5B8zV8x2tesohbb5kfbpTi9rBnKh5dkI=
github.com/shibumi/go-pathspec v1.3.0/go.mod h1:Xutfslp817l2I1cZvgcfeMQJG5QnU2lh5tVaaMCl3jE=
github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
Expand All @@ -137,8 +131,6 @@ go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
golang.org/x/crypto v0.46.0 h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU=
golang.org/x/crypto v0.46.0/go.mod h1:Evb/oLKmMraqjZ2iQTwDwvCtJkczlDuTmdJXoZVzqU0=
golang.org/x/mod v0.32.0 h1:9F4d3PHLljb6x//jOyokMv3eX+YDeepZSEo3mFJy93c=
golang.org/x/mod v0.32.0/go.mod h1:SgipZ/3h2Ci89DlEtEXWUk/HteuRin+HHhN+WbNhguU=
golang.org/x/net v0.48.0 h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU=
Expand All @@ -158,6 +150,8 @@ golang.org/x/tools v0.40.0/go.mod h1:Ik/tzLRlbscWpqqMRjyWYDisX8bG13FrdXp3o4Sr9lc
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 h1:+cNy6SZtPcJQH3LJVLOSmiC7MMxXNOb3PU/VUEz+EhU=
golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028/go.mod h1:NDW/Ps6MPRej6fsCIbMTohpP40sJ/P/vI1MoTEGwX90=
google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
Expand Down
42 changes: 10 additions & 32 deletions pkg/license/licensefakes/fake_downloader_implementation.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

28 changes: 0 additions & 28 deletions pkg/license/licensefakes/fake_reader_implementation.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

89 changes: 55 additions & 34 deletions pkg/provenance/predicate.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,47 +17,79 @@ limitations under the License.
package provenance

import (
"encoding/json"
"fmt"
"os"

"github.com/in-toto/in-toto-golang/in_toto/slsa_provenance/common"
slsa "github.com/in-toto/in-toto-golang/in_toto/slsa_provenance/v0.2"
slsa02 "github.com/in-toto/attestation/go/predicates/provenance/v02"
intoto "github.com/in-toto/attestation/go/v1"
"google.golang.org/protobuf/encoding/protojson"
"google.golang.org/protobuf/proto"
)

type Predicate struct {
slsa.ProvenancePredicate
impl PredicateImplementation
type PredicateContent proto.Message

type Builder interface {
GetId() string
}

// setImplementation sets the predicate implementation.
func (p *Predicate) SetImplementation(impl PredicateImplementation) {
p.impl = impl
type Predicate struct {
PredicateContent
}

// AddMaterial adds an entry to the listo of materials.
func (p *Predicate) AddMaterial(uri string, ds common.DigestSet) {
p.impl.AddMaterial(p, uri, ds)
func (p *Predicate) AddMaterial(rs *intoto.ResourceDescriptor) {
switch v := p.PredicateContent.(type) {
case *slsa02.Provenance:
mat := &slsa02.Material{
Uri: rs.GetUri(),
Digest: rs.GetDigest(),
}
v.Materials = append(v.Materials, mat)
default:
return
}
}

// Write outputs the predicate as JSON to a file.
func (p *Predicate) Write(path string) error {
return p.impl.Write(p, path)
func (p *Predicate) GetMaterials() []*intoto.ResourceDescriptor {
ret := []*intoto.ResourceDescriptor{}
//nolint:gocritic // We'll add more formats
switch v := p.PredicateContent.(type) {
case *slsa02.Provenance:
for _, m := range v.GetMaterials() {
ret = append(ret, &intoto.ResourceDescriptor{
Uri: m.GetUri(),
Digest: m.GetDigest(),
})
}
}
return ret
}

//counterfeiter:generate . PredicateImplementation
type PredicateImplementation interface {
AddMaterial(*Predicate, string, common.DigestSet)
Write(*Predicate, string) error
func (p *Predicate) SetBuilderID(id string) {
//nolint:gocritic // We'll add more formats
switch v := p.PredicateContent.(type) {
case *slsa02.Provenance:
if v.GetBuilder() == nil {
v.Builder = &slsa02.Builder{}
}
v.Builder.Id = id
}
}

type defaultPredicateImplementation struct{}
func (p *Predicate) GetBuilder() Builder {
switch v := p.PredicateContent.(type) {
case *slsa02.Provenance:
return v.GetBuilder()
default:
return nil
}
}

// Write dumps the predicate data into a JSON file.
func (pi *defaultPredicateImplementation) Write(p *Predicate, path string) error {
jsonData, err := json.Marshal(p)
// Write outputs the predicate as JSON to a file.
func (p *Predicate) Write(path string) error {
jsonData, err := protojson.MarshalOptions{}.Marshal(p)
if err != nil {
return fmt.Errorf("marshalling predicate to json: %w", err)
return fmt.Errorf("marshaling predicate to json: %w", err)
}

if err := os.WriteFile(path, jsonData, os.FileMode(0o644)); err != nil {
Expand All @@ -66,14 +98,3 @@ func (pi *defaultPredicateImplementation) Write(p *Predicate, path string) error

return nil
}

// AddMaterial adds a material to the entry.
func (pi *defaultPredicateImplementation) AddMaterial(p *Predicate, uri string, ds common.DigestSet) {
if p.Materials == nil {
p.Materials = []common.ProvenanceMaterial{}
}
p.Materials = append(p.Materials, common.ProvenanceMaterial{
URI: uri,
Digest: ds,
})
}
Loading