Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for DSSE envelope for attestation in imagetools #2194

Merged
merged 2 commits into from
Feb 29, 2024
Merged

Add support for DSSE envelope for attestation in imagetools #2194

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b748185
Add support for DSSE envelope for attestation and provenance in image…
LaurentGoderre Jan 15, 2024
dcdcce6
imagetools: supress warnings for dsse mediatypes
tonistiigi Feb 29, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
63 changes: 59 additions & 4 deletions util/imagetools/loader.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,9 @@ package imagetools

import (
"context"
"encoding/base64"
"encoding/json"
"regexp"
"sort"
"strings"
"sync"
Expand All @@ -21,6 +23,12 @@ import (
"golang.org/x/sync/errgroup"
)

const (
inTotoGenericMime = "application/vnd.in-toto+json"
inTotoSPDXDSSEMime = "application/vnd.in-toto.spdx+dsse"
inTotoProvenanceDSSEMime = "application/vnd.in-toto.provenance+dsse"
)

var (
annotationReferences = []string{
"com.docker.reference.digest",
Expand Down Expand Up @@ -274,7 +282,7 @@ type sbomStub struct {
}

func (l *loader) scanSBOM(ctx context.Context, fetcher remotes.Fetcher, r *result, refs []digest.Digest, as *asset) error {
ctx = remotes.WithMediaTypeKeyPrefix(ctx, "application/vnd.in-toto+json", "intoto")
ctx = withIntotoMediaTypes(ctx)
as.deferredSbom = func() (*sbomStub, error) {
var sbom *sbomStub
for _, dgst := range refs {
Expand All @@ -283,7 +291,8 @@ func (l *loader) scanSBOM(ctx context.Context, fetcher remotes.Fetcher, r *resul
return nil, errors.Errorf("referenced image %s not found", dgst)
}
for _, layer := range mfst.manifest.Layers {
if layer.MediaType == "application/vnd.in-toto+json" && layer.Annotations["in-toto.io/predicate-type"] == "https://spdx.dev/Document" {
if (layer.MediaType == inTotoGenericMime || isInTotoDSSE(layer.MediaType)) &&
layer.Annotations["in-toto.io/predicate-type"] == "https://spdx.dev/Document" {
_, err := remotes.FetchHandler(l.cache, fetcher)(ctx, layer)
if err != nil {
return nil, err
Expand All @@ -292,6 +301,12 @@ func (l *loader) scanSBOM(ctx context.Context, fetcher remotes.Fetcher, r *resul
if err != nil {
return nil, err
}

dt, err = decodeDSSE(dt, layer.MediaType)
if err != nil {
return nil, err
}

var spdx struct {
Predicate interface{} `json:"predicate"`
}
Expand All @@ -318,7 +333,7 @@ type provenanceStub struct {
}

func (l *loader) scanProvenance(ctx context.Context, fetcher remotes.Fetcher, r *result, refs []digest.Digest, as *asset) error {
ctx = remotes.WithMediaTypeKeyPrefix(ctx, "application/vnd.in-toto+json", "intoto")
ctx = withIntotoMediaTypes(ctx)
as.deferredProvenance = func() (*provenanceStub, error) {
var provenance *provenanceStub
for _, dgst := range refs {
Expand All @@ -327,7 +342,8 @@ func (l *loader) scanProvenance(ctx context.Context, fetcher remotes.Fetcher, r
return nil, errors.Errorf("referenced image %s not found", dgst)
}
for _, layer := range mfst.manifest.Layers {
if layer.MediaType == "application/vnd.in-toto+json" && strings.HasPrefix(layer.Annotations["in-toto.io/predicate-type"], "https://slsa.dev/provenance/") {
if (layer.MediaType == inTotoGenericMime || isInTotoDSSE(layer.MediaType)) &&
strings.HasPrefix(layer.Annotations["in-toto.io/predicate-type"], "https://slsa.dev/provenance/") {
_, err := remotes.FetchHandler(l.cache, fetcher)(ctx, layer)
if err != nil {
return nil, err
Expand All @@ -336,6 +352,12 @@ func (l *loader) scanProvenance(ctx context.Context, fetcher remotes.Fetcher, r
if err != nil {
return nil, err
}

dt, err = decodeDSSE(dt, layer.MediaType)
if err != nil {
return nil, err
}

var slsa struct {
Predicate interface{} `json:"predicate"`
}
Expand Down Expand Up @@ -415,3 +437,36 @@ func (r *result) SBOM() (map[string]sbomStub, error) {
}
return res, nil
}

func isInTotoDSSE(mime string) bool {
isDSSE, _ := regexp.MatchString("application/vnd\\.in-toto\\..*\\+dsse", mime)

return isDSSE
}

func decodeDSSE(dt []byte, mime string) ([]byte, error) {
if isInTotoDSSE(mime) {
var dsse struct {
Payload string `json:"payload"`
}
if err := json.Unmarshal(dt, &dsse); err != nil {
return nil, err
}

decoded, err := base64.StdEncoding.DecodeString(dsse.Payload)
if err != nil {
return nil, err
}

dt = decoded
}

return dt, nil
}

func withIntotoMediaTypes(ctx context.Context) context.Context {
for _, mime := range []string{inTotoGenericMime, inTotoSPDXDSSEMime, inTotoProvenanceDSSEMime} {
ctx = remotes.WithMediaTypeKeyPrefix(ctx, mime, "intoto")
}
return ctx
}