grafeas/kritis

Support GenericSignedAttestation

Offen

#412 geöffnet am 16.10.2019

 (8 Kommentare) (3 Reaktionen) (1 zugewiesene Person)Go (135 Forks)auto 404
enhancementhelp wanted

Repository-Metriken

Stars
 (710 Sterne)
PR-Merge-Metriken
 (Keine gemergten PRs in 30 T)

Beschreibung

Is your feature request related to a problem? Please describe. gcloud creates attestations using the genericSignedAttestation rather than pgpSignedAttestation (docs). Kritis doesn't seem to support these attestation as there's no mention of in the repo.

Command to create such attestation:

gcloud --project="${ATTESTOR_PROJECT_ID}" beta container binauthz attestations create
    --artifact-url="${image}" \
    --attestor="projects/${ATTESTOR_PROJECT_ID}/attestors/${ATTESTOR_ID}" \
    --signature-file="${gpg_signed_payload.pgp" \
    --pgp-key-fingerprint="${pgp_key_fingerprint}"

Which produces:

[
  {
    "attestation": {
      "attestation": {
        "genericSignedAttestation": {
          "contentType": "SIMPLE_SIGNING_JSON",
          "serializedPayload": "ewogICJjcml0aWNhbCI6IHsKICAgICJpZGVudGl0eSI6IHsKICAgICAgImRvY2tlci1yZWZlcmVuY2UiOiAiZ2NyLmlvL2dvb2dsZS1zYW1wbGVzL2hlbGxvLWFwcCIKICAgIH0sCiAgICAiaW1hZ2UiOiB7CiAgICAgICJkb2NrZXItbWFuaWZlc3QtZGlnZXN0IjogInNoYTI1NjpjNjJlYWQ1YjhjMTVjMjMxZjllNzg2MjUwYjA3OTA5ZGFmNmMyNjZkMGZjZGRkOTNmZWE4ODJlYjcyMmMzYmU0IgogICAgfSwKICAgICJ0eXBlIjogIkdvb2dsZSBjbG91ZCBiaW5hdXRoeiBjb250YWluZXIgc2lnbmF0dXJlIgogIH0KfQo=",
          "signatures": [
            {
              "publicKeyId": "redacted",
              "signature": "redacted"
            }
          ]
        }
      }
    },
    "createTime": "2019-10-16T11:39:38.639322Z",
    "kind": "ATTESTATION",
    "name": "projects/tm-ginfra-project/occurrences/20ee9b9b-3afe-4d7a-96af-37973ad91a58",
    "noteName": "projects/tm-ginfra-project/notes/build-attest-note",
    "resource": {
      "uri": "https://gcr.io/google-samples/hello-app@sha256:c62ead5b8c15c231f9e786250b07909daf6c266d0fcddd93fea882eb722c3be4"
    }
  }
]

Describe the solution you'd like Kritis should switch to supporting these attestations too. I would also suggest that attestations Kritis creates use the new format.

Describe alternatives you've considered

Additional context The protobufs are also out of date, this might need solving first

gcloud -v
Google Cloud SDK 267.0.0
alpha 2019.10.15
beta 2019.10.15
bq 2.0.49
core 2019.10.15
gsutil 4.44
kubectl 2019.10.15

Contributor Guide