Merge pull request #20204 from mlschroe/master

BSConSign, BSRekor: prepare for spdx v3

Author: mlschroe

src/backend/BSConSign.pm

@@ -36,6 +36,7 @@ our $mt_intoto = 'application/vnd.in-toto+json';
 our $mt_cosign_bundle = 'application/vnd.dev.sigstore.bundle.v0.3+json';
 
 our $intoto_predicate_spdx      = 'https://spdx.dev/Document';
+our $intoto_predicate_spdx_v3   = 'https://spdx.dev/Document/v3';
 our $intoto_predicate_cyclonedx = 'https://cyclonedx.org/bom';
 our $intoto_predicate_cosign_sign_v1 = 'https://sigstore.dev/cosign/sign/v1';
 our $intoto_stmt_v01            = 'https://in-toto.io/Statement/v0.1';
@@ -198,6 +199,7 @@ sub fixup_intoto_attestation {
     my $predicate_type;
     # autodetect predicate type
     $predicate_type = $intoto_predicate_spdx if $attestation->{'spdxVersion'};
+    $predicate_type = $intoto_predicate_spdx_v3 if $attestation->{'@context'} && $attestation->{'@context'} =~ /\/3\.\d+\.\d+\/spdx-context.jsonld$/;
     $predicate_type = $intoto_predicate_cyclonedx if ($attestation->{'bomFormat'} || '') eq 'CycloneDX';
     # wrap into an in-toto v0.1 attestation
     $attestation = { '_type' => $intoto_stmt_v01, 'predicateType' => $predicate_type, 'predicate' => $attestation } if $predicate_type;

src/backend/BSRekor.pm

@@ -33,6 +33,7 @@ our $intoto_slsav_v01 = "https://slsa.dev/provenance/v0.1";
 our $intoto_slsav_v02 = "https://slsa.dev/provenance/v0.2";
 our $intoto_slsa_v1   = "https://slsa.dev/provenance/v1";
 our $intoto_spdx      = "https://spdx.dev/Document";
+our $intoto_spdx_v3   = "https://spdx.dev/Document/v3";
 our $intoto_link_v1   = "https://in-toto.io/Link/v1";
 our $intoto_cosign_v1 = "cosign.sigstore.dev/attestation/v1";
 our $intoto_vuln_v1   = "cosign.sigstore.dev/attestation/vuln/v1";