Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

@actions/attest Support multiple subjects #1749

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion packages/attest/__tests__/intoto.test.ts
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ describe('buildIntotoStatement', () => {
}

it('returns an intoto statement', () => {
const statement = buildIntotoStatement(subject, predicate)
const statement = buildIntotoStatement([subject], predicate)
expect(statement).toMatchSnapshot()
})
})
20 changes: 18 additions & 2 deletions packages/attest/__tests__/provenance.test.ts
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ import nock from 'nock'
import {MockAgent, setGlobalDispatcher} from 'undici'
import {SIGSTORE_PUBLIC_GOOD, signingEndpoints} from '../src/endpoints'
import {attestProvenance, buildSLSAProvenancePredicate} from '../src/provenance'
import type {Subject} from '../src/shared.types'

describe('provenance functions', () => {
const originalEnv = process.env
Expand Down Expand Up @@ -79,6 +80,22 @@ describe('provenance functions', () => {
sha256: '7d070f6b64d9bcc530fe99cc21eaaa4b3c364e0b2d367d7735671fa202a03b32'
}

const subjects: Subject[] = [
{
name: 'subjective',
digest: {
sha256:
'7d070f6b64d9bcc530fe99cc21eaaa4b3c364e0b2d367d7735671fa202a03b32'
}
},
{
name: 'subject_two',
digest: {
gitcommit: 'c6b487124a61d7dc6c7bd6ea0208368af3513a6e'
}
}
]

// Fake an OIDC token
const oidcPayload = {sub: 'foo@bar.com', iss: ''}
const oidcToken = `.${Buffer.from(JSON.stringify(oidcPayload)).toString(
Expand Down Expand Up @@ -114,8 +131,7 @@ describe('provenance functions', () => {
describe('when the sigstore instance is explicitly set', () => {
it('attests provenance', async () => {
const attestation = await attestProvenance({
subjectName,
subjectDigest,
subjects,
token: 'token',
sigstore: 'github',
issuer
Expand Down
24 changes: 19 additions & 5 deletions packages/attest/src/attest.ts
Original file line number Diff line number Diff line change
Expand Up @@ -15,10 +15,16 @@ const INTOTO_PAYLOAD_TYPE = 'application/vnd.in-toto+json'
*/
export type AttestOptions = {
// The name of the subject to be attested.
subjectName: string
// @deprecated see 'subjects'
subjectName?: string
// The digest of the subject to be attested. Should be a map of digest
// algorithms to their hex-encoded values.
subjectDigest: Record<string, string>
// @deprecated see 'subjects'
subjectDigest?: Record<string, string>
// The subjects to be attested
// Includes the digest(s) of the subject to be attested. Should be a map of digest
// algorithms to their hex-encoded values.
subjects?: Subject[]
// Content type of the predicate being attested.
predicateType: string
// Predicate to be attested.
Expand All @@ -40,10 +46,18 @@ export type AttestOptions = {
* @returns A promise that resolves to the attestation.
*/
export async function attest(options: AttestOptions): Promise<Attestation> {
const subject: Subject = {
name: options.subjectName,
digest: options.subjectDigest
let subject = [] as Subject[]
if (options.subjects && options.subjects.length > 0) {
subject = options.subjects
} else if (options.subjectName && options.subjectDigest) {
subject = [
{
name: options.subjectName,
digest: options.subjectDigest
}
]
}

const predicate: Predicate = {
type: options.predicateType,
params: options.predicate
Expand Down
4 changes: 2 additions & 2 deletions packages/attest/src/intoto.ts
Original file line number Diff line number Diff line change
Expand Up @@ -20,12 +20,12 @@ export type InTotoStatement = {
* @returns The constructed in-toto statement.
*/
export const buildIntotoStatement = (
subject: Subject,
subject: Subject[],
predicate: Predicate
): InTotoStatement => {
return {
_type: INTOTO_STATEMENT_V1_TYPE,
subject: [subject],
subject,
predicateType: predicate.type,
predicate: predicate.params
}
Expand Down