Skip to content

Commit 37d5e8b

Browse files
tonistiigitonistiigi
committed
add OCI artifact version of attestation manifest
This adds a new exporter option oci-artifact. If set then it changes the attestation manifest to be exported with following changes: - subject field is added to attestation manifest - config uses empty descriptor instead of fake image config - artifactType property is set The intention is to change this behavior from opt-in to opt-out in some future release when target is OCI image. Signed-off-by: Tonis Tiigi <[email protected]>
1 parent 409f7b4 commit 37d5e8b

File tree

4 files changed

+67
-26
lines changed

4 files changed

+67
-26
lines changed

‎client/client_test.go‎

Lines changed: 30 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -192,7 +192,8 @@ var allTests = []func(t *testing.T, sb integration.Sandbox){
192192
testPullWithLayerLimit,
193193
testExportAnnotations,
194194
testExportAnnotationsMediaTypes,
195-
testExportAttestations,
195+
testExportAttestationsOCIArtifact,
196+
testExportAttestationsImageManifest,
196197
testExportedImageLabels,
197198
testAttestationDefaultSubject,
198199
testSourceDateEpochLayerTimestamps,
@@ -8725,7 +8726,15 @@ func testExportAnnotationsMediaTypes(t *testing.T, sb integration.Sandbox) {
87258726
require.Equal(t, ocispecs.MediaTypeImageIndex, imgs2.Index.MediaType)
87268727
}
87278728

8728-
func testExportAttestations(t *testing.T, sb integration.Sandbox) {
8729+
func testExportAttestationsOCIArtifact(t *testing.T, sb integration.Sandbox) {
8730+
testExportAttestations(t, sb, true)
8731+
}
8732+
8733+
func testExportAttestationsImageManifest(t *testing.T, sb integration.Sandbox) {
8734+
testExportAttestations(t, sb, false)
8735+
}
8736+
8737+
func testExportAttestations(t *testing.T, sb integration.Sandbox, ociArtifact bool) {
87298738
workers.CheckFeatureCompat(t, sb, workers.FeatureDirectPush)
87308739
requiresLinux(t)
87318740
c, err := New(sb.Context(), sb.Address())
@@ -8845,8 +8854,9 @@ func testExportAttestations(t *testing.T, sb integration.Sandbox) {
88458854
{
88468855
Type: ExporterImage,
88478856
Attrs: map[string]string{
8848-
"name": strings.Join(targets, ","),
8849-
"push": "true",
8857+
"name": strings.Join(targets, ","),
8858+
"push": "true",
8859+
"oci-artifact": strconv.FormatBool(ociArtifact),
88508860
},
88518861
},
88528862
},
@@ -8876,12 +8886,25 @@ func testExportAttestations(t *testing.T, sb integration.Sandbox) {
88768886
for i, att := range atts.Images {
88778887
require.Equal(t, ocispecs.MediaTypeImageManifest, att.Desc.MediaType)
88788888
require.Equal(t, "unknown/unknown", platforms.Format(*att.Desc.Platform))
8879-
require.Equal(t, "unknown/unknown", att.Img.OS+"/"+att.Img.Architecture)
88808889
require.Equal(t, attestation.DockerAnnotationReferenceTypeDefault, att.Desc.Annotations[attestation.DockerAnnotationReferenceType])
88818890
require.Equal(t, bases[i].Desc.Digest.String(), att.Desc.Annotations[attestation.DockerAnnotationReferenceDigest])
88828891
require.Equal(t, 2, len(att.Layers))
8883-
require.Equal(t, len(att.Layers), len(att.Img.RootFS.DiffIDs))
8884-
require.Equal(t, 0, len(att.Img.History))
8892+
8893+
if ociArtifact {
8894+
subject := att.Manifest.Subject
8895+
require.NotNil(t, subject)
8896+
require.Equal(t, bases[i].Desc, *subject)
8897+
require.Equal(t, "application/vnd.docker.attestation.manifest.v1+json", att.Manifest.ArtifactType)
8898+
require.Equal(t, ocispecs.DescriptorEmptyJSON, att.Manifest.Config)
8899+
} else {
8900+
require.Nil(t, att.Manifest.Subject)
8901+
require.Empty(t, att.Manifest.ArtifactType)
8902+
8903+
// image config is not included in the OCI artifact
8904+
require.Equal(t, "unknown/unknown", att.Img.OS+"/"+att.Img.Architecture)
8905+
require.Equal(t, len(att.Layers), len(att.Img.RootFS.DiffIDs))
8906+
require.Equal(t, 0, len(att.Img.History))
8907+
}
88858908

88868909
var attest intoto.Statement
88878910
require.NoError(t, json.Unmarshal(att.LayersRaw[0], &attest))

‎exporter/containerimage/exptypes/keys.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,9 @@ var (
4444
// Value: bool <true|false>
4545
OptKeyOCITypes ImageExporterOptKey = "oci-mediatypes"
4646

47+
// Use OCI artifact format for the attestation manifest.
48+
OptKeyOCIArtifact ImageExporterOptKey = "oci-artifact"
49+
4750
// Force attestation to be attached.
4851
// Value: bool <true|false>
4952
OptKeyForceInlineAttestations ImageExporterOptKey = "attestation-inline"

‎exporter/containerimage/opts.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ type ImageCommitOpts struct {
1717
ImageName string
1818
RefCfg cacheconfig.RefConfig
1919
OCITypes bool
20+
OCIArtifact bool
2021
Annotations AnnotationsGroup
2122
Epoch *time.Time
2223

@@ -49,6 +50,8 @@ func (c *ImageCommitOpts) Load(ctx context.Context, opt map[string]string) (map[
4950
c.ImageName = v
5051
case exptypes.OptKeyOCITypes:
5152
err = parseBoolWithDefault(&c.OCITypes, k, v, true)
53+
case exptypes.OptKeyOCIArtifact:
54+
err = parseBool(&c.OCIArtifact, k, v)
5255
case exptypes.OptKeyForceInlineAttestations:
5356
err = parseBool(&c.ForceInlineAttestations, k, v)
5457
case exptypes.OptKeyPreferNondistLayers:
@@ -67,6 +70,9 @@ func (c *ImageCommitOpts) Load(ctx context.Context, opt map[string]string) (map[
6770
if c.RefCfg.Compression.Type.OnlySupportOCITypes() {
6871
c.EnableOCITypes(ctx, c.RefCfg.Compression.Type.String())
6972
}
73+
if c.OCIArtifact && !c.OCITypes {
74+
c.EnableOCITypes(ctx, "oci-artifact")
75+
}
7076

7177
c.Annotations = c.Annotations.Merge(as)
7278

‎exporter/containerimage/writer.go‎

Lines changed: 28 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,8 @@ import (
4646
"golang.org/x/sync/errgroup"
4747
)
4848

49+
const attestationManifestArtifactType = "application/vnd.docker.attestation.manifest.v1+json"
50+
4951
type WriterOpt struct {
5052
Snapshotter snapshot.Snapshotter
5153
ContentStore content.Store
@@ -312,7 +314,7 @@ func (ic *ImageWriter) Commit(ctx context.Context, inp *exporter.Source, session
312314
return nil, err
313315
}
314316

315-
desc, err := ic.commitAttestationsManifest(ctx, opts, desc.Digest.String(), stmts)
317+
desc, err := ic.commitAttestationsManifest(ctx, opts, *desc, stmts, opts.OCIArtifact)
316318
if err != nil {
317319
return nil, err
318320
}
@@ -553,7 +555,7 @@ func (ic *ImageWriter) commitDistributionManifest(ctx context.Context, opts *Ima
553555
}, &configDesc, nil
554556
}
555557

556-
func (ic *ImageWriter) commitAttestationsManifest(ctx context.Context, opts *ImageCommitOpts, target string, statements []intoto.Statement) (*ocispecs.Descriptor, error) {
558+
func (ic *ImageWriter) commitAttestationsManifest(ctx context.Context, opts *ImageCommitOpts, target ocispecs.Descriptor, statements []intoto.Statement, ociArtifact bool) (*ocispecs.Descriptor, error) {
557559
var (
558560
manifestType = ocispecs.MediaTypeImageManifest
559561
configType = ocispecs.MediaTypeImageConfig
@@ -588,31 +590,38 @@ func (ic *ImageWriter) commitAttestationsManifest(ctx context.Context, opts *Ima
588590
layers[i] = desc
589591
}
590592

591-
config, err := attestationsConfig(layers)
592-
if err != nil {
593-
return nil, err
594-
}
595-
configDigest := digest.FromBytes(config)
596-
configDesc := ocispecs.Descriptor{
597-
Digest: configDigest,
598-
Size: int64(len(config)),
599-
MediaType: configType,
593+
configDesc := ocispecs.DescriptorEmptyJSON
594+
config := configDesc.Data
595+
596+
if !ociArtifact {
597+
var err error
598+
config, err = attestationsConfig(layers)
599+
if err != nil {
600+
return nil, err
601+
}
602+
configDigest := digest.FromBytes(config)
603+
configDesc = ocispecs.Descriptor{
604+
Digest: configDigest,
605+
Size: int64(len(config)),
606+
MediaType: configType,
607+
}
600608
}
601609

602610
mfst := ocispecs.Manifest{
603611
MediaType: manifestType,
604612
Versioned: specs.Versioned{
605613
SchemaVersion: 2,
606614
},
607-
Config: ocispecs.Descriptor{
608-
Digest: configDigest,
609-
Size: int64(len(config)),
610-
MediaType: configType,
611-
},
615+
Config: configDesc,
616+
}
617+
618+
if ociArtifact {
619+
mfst.ArtifactType = attestationManifestArtifactType
620+
mfst.Subject = &target
612621
}
613622

614623
labels := map[string]string{
615-
"containerd.io/gc.ref.content.0": configDigest.String(),
624+
"containerd.io/gc.ref.content.0": configDesc.Digest.String(),
616625
}
617626
for i, desc := range layers {
618627
desc.Annotations = RemoveInternalLayerAnnotations(desc.Annotations, opts.OCITypes)
@@ -635,7 +644,7 @@ func (ic *ImageWriter) commitAttestationsManifest(ctx context.Context, opts *Ima
635644
if err := content.WriteBlob(ctx, ic.opt.ContentStore, mfstDigest.String(), bytes.NewReader(mfstJSON), mfstDesc, content.WithLabels((labels))); err != nil {
636645
return nil, done(errors.Wrapf(err, "error writing manifest blob %s", mfstDigest))
637646
}
638-
if err := content.WriteBlob(ctx, ic.opt.ContentStore, configDigest.String(), bytes.NewReader(config), configDesc); err != nil {
647+
if err := content.WriteBlob(ctx, ic.opt.ContentStore, configDesc.Digest.String(), bytes.NewReader(config), configDesc); err != nil {
639648
return nil, done(errors.Wrap(err, "error writing config blob"))
640649
}
641650
done(nil)
@@ -646,7 +655,7 @@ func (ic *ImageWriter) commitAttestationsManifest(ctx context.Context, opts *Ima
646655
MediaType: manifestType,
647656
Annotations: map[string]string{
648657
attestationTypes.DockerAnnotationReferenceType: attestationTypes.DockerAnnotationReferenceTypeDefault,
649-
attestationTypes.DockerAnnotationReferenceDigest: target,
658+
attestationTypes.DockerAnnotationReferenceDigest: string(target.Digest),
650659
},
651660
}, nil
652661
}

0 commit comments

Comments
 (0)