Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix default params in attestation invocation #449

Merged
merged 2 commits into from
Jun 23, 2022
Merged

Fix default params in attestation invocation #449

merged 2 commits into from
Jun 23, 2022

Conversation

lcarva
Copy link
Contributor

@lcarva lcarva commented May 16, 2022

Default parameters should always be overwritten by values from the
taskrun spec. This is how Tekton Pipelines behaves. The attestation
should also follow the same rule.

This also fixes zero-value default value representation, i.e. an empty
string or an empty array.

The representation of parameter values is now also consistent. Prior to
this commit, %v on the Param was used for default values while
.StringVal or .ArrayVal was used for non-default values.

Signed-off-by: Luiz Carvalho lucarval@redhat.com

@tekton-robot tekton-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels May 16, 2022
@tekton-robot
Copy link

Hi @lcarva. Thanks for your PR.

I'm waiting for a tektoncd member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@priyawadhwa
Copy link
Contributor

/ok-to-test

@tekton-robot tekton-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels May 17, 2022
@tekton-robot
Copy link

The following is the coverage report on the affected files.
Say /test pull-tekton-chains-go-coverage to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/chains/formats/intotoite6/intotoite6.go 86.4% 90.4% 4.1

lcarva
lcarva commented May 17, 2022
View reviewed changes
pkg/chains/formats/intotoite6/intotoite6.go Outdated
if ts := tr.Status.TaskSpec; ts != nil {
for _, p := range ts.Params {
if p.Default != nil {
v := p.Default.StringVal
if v == "" {
// TODO: Consider using p.Default.MarshalJSON()
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@priyawadhwa, should I just do this now?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok, I added a commit to do this. Let me know what you think. I can easily drop it if necessary.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@priyawadhwa, please take a look when you have a chance 🙏

@tekton-robot
Copy link

The following is the coverage report on the affected files.
Say /test pull-tekton-chains-go-coverage to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/chains/formats/intotoite6/intotoite6.go 86.4% 87.7% 1.4

@tekton-robot
Copy link

The following is the coverage report on the affected files.
Say /test pull-tekton-chains-go-coverage to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/chains/formats/intotoite6/intotoite6.go 86.4% 87.0% 0.6

@lcarva
Copy link
Contributor Author

lcarva commented May 17, 2022

/retest

@lcarva
Copy link
Contributor Author

lcarva commented May 31, 2022

@priyawadhwa, @wlynch ptal 🙏

wlynch
wlynch reviewed Jun 6, 2022
View reviewed changes
Copy link
Member

@wlynch wlynch left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overall looks good! Few small things.

pkg/chains/formats/intotoite6/intotoite6.go Outdated Show resolved Hide resolved
pkg/chains/formats/intotoite6/intotoite6_test.go Outdated
@@ -66,10 +66,10 @@ func TestCreatePayload1(t *testing.T) {
},
Invocation: slsa.ProvenanceInvocation{
Parameters: map[string]string{
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wonder if we should use map[string]ArrayOrString (https://pkg.go.dev/github.com/tektoncd/pipeline@v0.36.0/pkg/apis/pipeline/v1beta1#ArrayOrString) here instead and not bother with the string encoding. 🤔 wdyt?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, that's a better approach. I'll give that a shot.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done. Here's an example from a dummy task I used:

🐚 cosign download attestation quay.io/lucarval/minimal-container:latest | jq '.payload | @base64d | fromjson | .predicate.invocation.parameters'
{
  "BUILDER_IMAGE": "quay.io/buildah/stable:v1.18.0",
  "BUILD_EXTRA_ARGS": "",
  "CONTEXT": ".",
  "DOCKERFILE": "./Dockerfile",
  "FORMAT": "oci",
  "IMAGE": "quay.io/lucarval/minimal-container:latest",
  "PUSH_EXTRA_ARGS": "",
  "SKIP_PUSH": "false",
  "STORAGE_DRIVER": "vfs",
  "SUPER_ARRAY": [
    "hello",
    "array"
  ],
  "TLSVERIFY": "true"
}

@lcarva
Fix default params in attestation invocation
3ffe3f4 
Default parameters should always be overwritten by values from the
taskrun spec. This is how Tekton Pipelines behaves. The attestation
should also follow the same rule.

This also fixes zero-value default value representation, i.e. an empty
string or an empty array.

The representation of parameter values is now also consistent. Prior to
this commit, %v on the Param was used for default values while
.StringVal or .ArrayVal was used for non-default values.

Signed-off-by: Luiz Carvalho <lucarval@redhat.com>
@lcarva
Use ArrayOrString invocation params
2dafdfc 
Tekton Pipeline allows two different types of parameters, string and
array of strings. Represent the correct data type in the attestation.

Signed-off-by: Luiz Carvalho <lucarval@redhat.com>
@tekton-robot
Copy link

The following is the coverage report on the affected files.
Say /test pull-tekton-chains-go-coverage to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/chains/formats/intotoite6/intotoite6.go 86.4% 89.7% 3.4

@wlynch
Copy link
Member

wlynch commented Jun 23, 2022

/lgtm

@tekton-robot tekton-robot added the lgtm Indicates that a PR is ready to be merged. label Jun 23, 2022
@lcarva
Copy link
Contributor Author

lcarva commented Jun 23, 2022

@priyawadhwa, need an approval now 🙏

priyawadhwa
priyawadhwa approved these changes Jun 23, 2022
View reviewed changes
Copy link
Contributor

@priyawadhwa priyawadhwa left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@tekton-robot
Copy link

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: priyawadhwa

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@tekton-robot tekton-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 23, 2022
@tekton-robot tekton-robot merged commit bf1b223 into tektoncd:main Jun 23, 2022
@lcarva lcarva mentioned this pull request Aug 17, 2022
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@wlynch wlynch wlynch left review comments

@priyawadhwa priyawadhwa priyawadhwa approved these changes

@mattmoor mattmoor Awaiting requested review from mattmoor

@mpeters mpeters Awaiting requested review from mpeters

Assignees

@wlynch wlynch

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. lgtm Indicates that a PR is ready to be merged. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. size/M Denotes a PR that changes 30-99 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@lcarva @tekton-robot @priyawadhwa @wlynch