Migrate to in-toto v1

[cdupuis]

No description provided.

[jedevc]

So looks like upstream has moved from https://github.com/in-toto/in-toto-golang to https://github.com/in-toto/attestation, and importantly, they've switching to generating using gRPC (yayyy).

After digging into this some more, protojson strikes again - the new upstream implementation looks like:

buildkit/vendor/github.com/in-toto/attestation/go/v1/statement.pb.go

Lines 27 to 37 in 2c19066

	type Statement struct {
	state protoimpl.MessageState
	sizeCache protoimpl.SizeCache
	unknownFields protoimpl.UnknownFields
	// Expected to always be "https://in-toto.io/Statement/v1"
	Type string `protobuf:"bytes,1,opt,name=type,json=_type,proto3" json:"type,omitempty"`
	Subject []*ResourceDescriptor `protobuf:"bytes,2,rep,name=subject,proto3" json:"subject,omitempty"`
	PredicateType string `protobuf:"bytes,3,opt,name=predicate_type,json=predicateType,proto3" json:"predicate_type,omitempty"`
	Predicate *structpb.Struct `protobuf:"bytes,4,opt,name=predicate,proto3" json:"predicate,omitempty"`
	}

So we need to use protojson everywhere we marshal/unmarshal into these structs... which is a lot of places. They are used all over the tests for this, as well as in:

• buildkit/exporter/attestation/unbundle.go

  Lines 139 to 151 in 36c5550

  	dec := json.NewDecoder(f)
  	var stmt intoto.Statement
  	if err := dec.Decode(&stmt); err != nil {
  	return nil, errors.Wrap(err, "cannot decode in-toto statement")
  	}
  	if bundle.InToto.PredicateType != "" && stmt.PredicateType != bundle.InToto.PredicateType {
  	return nil, errors.Errorf("bundle entry %s does not match required predicate type %s", stmt.PredicateType, bundle.InToto.PredicateType)
  	}
  	predicate, err := json.Marshal(stmt.Predicate)
  	if err != nil {
  	return nil, err
  	}

• buildkit/exporter/attestation/make.go

  Lines 129 to 136 in 36c5550

  	stmt := intoto.Statement{
  	StatementHeader: intoto.StatementHeader{
  	Type: intoto.StatementInTotoV01,
  	PredicateType: attestation.InToto.PredicateType,
  	Subject: subjects,
  	},
  	Predicate: json.RawMessage(content),
  	}

• buildkit/exporter/containerimage/writer.go

  Lines 499 to 502 in 36c5550

  	data, err := json.Marshal(statement)
  	if err != nil {
  	return nil, errors.Wrap(err, "failed to marshal attestation")
  	}

• buildkit/exporter/local/fs.go

  Lines 183 to 186 in 36c5550

  	dt, err := json.MarshalIndent(stmt, "", " ")
  	if err != nil {
  	return nil, nil, errors.Wrap(err, "failed to marshal attestation")
  	}

• And probably lots more.

Updating all these is gonna be a lot of fun - as discussed with @cdupuis, I'll take a look at this when I get a moment, but if anyone else fancies a try, they're welcome to 😄

cc @jsternberg (since you were looking into protojson stuff in #4381)

[jsternberg]

Short comment because I'm not at my computer, but I suspect it would be better to implement the marshaler interface from encoding/json rather than try to do this at the places where the marshaling happens.

This should work for marshaling. I marshaling is a bit more difficult but that can be left to clients to figure out.

[kipz]

@cdupuis this PR does not add the DSSE wrapper as described by the spec: https://github.com/in-toto/attestation/blob/main/spec/v1/envelope.md

I think we'd need to add that to become v1 compliant.

[cdupuis]

Closing this PR as I'm not working on this anymore and it wasn't working anyways.

@kipz DSSE is for when you have signed content which isn't the case there, that's why this wasn't added. Once those attestations get signed, we need to introduce the envelope I believe.

From the DSSE spec:

The following fields are REQUIRED and MUST be set, even if empty: payload, payloadType, signature, signature.sig.

Without signed content, buildkit can't add signature etc.