feat: write subjects to file in docker-based builder binary

internal/builders/docker/README.md

@@ -20,7 +20,7 @@ go run *.go  dry-run \
   --build-config-path testdata/config.toml \
   --build-definition-path bd.json \
   --builder-image bash@sha256:9e2ba52487d \
-  --git-commit-hash sha1:9b5f98310dbbad675834474fa68c37d880687cb9 \
+  --git-commit-digest sha1:9b5f98310dbbad675834474fa68c37d880687cb9 \
   --source-repo git+https://github.com/project-oak/transparent-release
 ```
 
@@ -38,10 +38,11 @@ The following is an example:
 go run *.go build \
   --build-config-path internal/builders/docker/testdata/config.toml \
   --builder-image bash@sha256:9e2ba52487d945504d250de186cb4fe2e3ba023ed2921dd6ac8b97ed43e76af9 \
-  --git-commit-hash sha1:cf5804b5c6f1a4b2a0b03401a487dfdfbe3a5f00 \
+  --git-commit-digest sha1:cf5804b5c6f1a4b2a0b03401a487dfdfbe3a5f00 \
   --source-repo git+https://github.com/slsa-framework/slsa-github-generator \
+  --subjects-path subjects.json \
   --force-checkout
 ```
 
-If the build is successful, this command will generate and output a list of
-generated artifacts and their SHA256 digests.
+If the build is successful, this command will generate `subjects.json`
+containing a JSON-encoded list of generated artifacts and their SHA256 digests.

internal/builders/docker/commands.go

@@ -20,11 +20,13 @@ package main
 import (
 	"encoding/json"
 	"fmt"
-	"log"
+	"io"
 	"os"
 
-	"github.com/slsa-framework/slsa-github-generator/internal/builders/docker/pkg"
 	"github.com/spf13/cobra"
+
+	"github.com/slsa-framework/slsa-github-generator/internal/builders/docker/pkg"
+	"github.com/slsa-framework/slsa-github-generator/internal/utils"
 )
 
 // DryRunCmd returns a new *cobra.Command that validates the input flags, and
@@ -37,11 +39,14 @@ func DryRunCmd(check func(error)) *cobra.Command {
 		Use:   "dry-run [FLAGS]",
 		Short: "Generates and stores a JSON-formatted BuildDefinition based on the input arguments.",
 		Run: func(cmd *cobra.Command, args []string) {
+			w, err := utils.CreateNewFileUnderCurrentDirectory(buildDefinitionPath, os.O_WRONLY)
+			check(err)
+
 			config, err := pkg.NewDockerBuildConfig(io)
 			check(err)
 
 			bd := pkg.CreateBuildDefinition(config)
-			check(writeBuildDefinitionToFile(*bd, buildDefinitionPath))
+			check(writeToFile(*bd, w))
 		},
 	}
 
@@ -53,28 +58,19 @@ func DryRunCmd(check func(error)) *cobra.Command {
 	return cmd
 }
 
-func writeBuildDefinitionToFile(bd pkg.BuildDefinition, path string) error {
-	bytes, err := json.Marshal(bd)
-	if err != nil {
-		return fmt.Errorf("couldn't marshal the BuildDefinition: %v", err)
-	}
-
-	if err := os.WriteFile(path, bytes, 0o600); err != nil {
-		return fmt.Errorf("couldn't write BuildDefinition to file: %v", err)
-	}
-	return nil
-}
-
 // BuildCmd returns a new *cobra.Command that builds the artifacts using the
 // input flags, and prints out their digests, or terminates with an error.
 func BuildCmd(check func(error)) *cobra.Command {
 	io := &pkg.InputOptions{}
 	var forceCheckout bool
+	var subjectsPath string
 
 	cmd := &cobra.Command{
 		Use:   "build [FLAGS]",
 		Short: "Builds the artifacts using the build config, source repo, and the builder image.",
 		Run: func(cmd *cobra.Command, args []string) {
+			w, err := utils.CreateNewFileUnderCurrentDirectory(subjectsPath, os.O_WRONLY)
+			check(err)
 			config, err := pkg.NewDockerBuildConfig(io)
 			check(err)
 
@@ -86,17 +82,29 @@ func BuildCmd(check func(error)) *cobra.Command {
 			defer db.RepoInfo.Cleanup()
 			check(err)
 
-			artifacts, err := db.BuildArtifact()
+			artifacts, err := db.BuildArtifacts()
 			check(err)
-
-			log.Printf("Generated artifacts are: %v\n", artifacts)
-			// TODO(#1191): Write subjects to a file.
+			check(writeToFile(artifacts, w))
 		},
 	}
 
 	io.AddFlags(cmd)
 	cmd.Flags().BoolVarP(&forceCheckout, "force-checkout", "f", false,
 		"Optional - Forces checking out the source code from the given Git repo.")
+	cmd.Flags().StringVarP(&subjectsPath, "subjects-path", "o", "",
+		"Required - Path to store a JSON-encoded array of subjects of the generated artifacts.")
 
 	return cmd
 }
+
+func writeToFile[T any](obj T, w io.Writer) error {
+	bytes, err := json.Marshal(obj)
+	if err != nil {
+		return fmt.Errorf("marshaling the object failed: %w", err)
+	}
+
+	if _, err := w.Write(bytes); err != nil {
+		return fmt.Errorf("writing to file failed: %w", err)
+	}
+	return nil
+}

internal/builders/docker/pkg/builder.go

@@ -146,9 +146,9 @@ func (b *Builder) SetUpBuildState() (*DockerBuild, error) {
 	return db, nil
 }
 
-// BuildArtifact builds the artifacts based on the user-provided inputs, and
+// BuildArtifacts builds the artifacts based on the user-provided inputs, and
 // returns the names and SHA256 digests of the generated artifacts.
-func (db *DockerBuild) BuildArtifact() ([]intoto.Subject, error) {
+func (db *DockerBuild) BuildArtifacts() ([]intoto.Subject, error) {
 	if err := runDockerRun(db); err != nil {
 		return nil, fmt.Errorf("running `docker run` failed: %v", err)
 	}

internal/builders/docker/pkg/options.go

@@ -32,9 +32,9 @@ func (io *InputOptions) AddFlags(cmd *cobra.Command) {
 	cmd.Flags().StringVarP(&io.SourceRepo, "source-repo", "s", "",
 		"Required - URL of the source repo.")
 
-	cmd.Flags().StringVarP(&io.GitCommitHash, "git-commit-hash", "g", "",
+	cmd.Flags().StringVarP(&io.GitCommitHash, "git-commit-digest", "d", "",
 		"Required - SHA1 Git commit digest of the revision of the source code to build the artefact from.")
 
-	cmd.Flags().StringVarP(&io.BuilderImage, "builder-image", "b", "",
+	cmd.Flags().StringVarP(&io.BuilderImage, "builder-image", "i", "",
 		"Required - URL indicating the Docker builder image, including a URI and image digest.")
 }