TEP 0122: complete build instuctions: adding taskspec to buildConfig

This PR introduces a new format `slsa/v2` which contains the complete
build instructions as designed in TEP0122.

docs/config.md

@@ -51,7 +51,7 @@ Supported keys include:
 
 | Key | Description | Supported Values | Default |
 | :--- | :--- | :--- | :--- |
-| `artifacts.taskrun.format` | The format to store `TaskRun` payloads in. | `in-toto`, `slsa/v1`| `in-toto` |
+| `artifacts.taskrun.format` | The format to store `TaskRun` payloads in. | `in-toto`, `slsa/v1`, `slsa/v2`| `in-toto` |
 | `artifacts.taskrun.storage` | The storage backend to store `TaskRun` signatures in. Multiple backends can be specified with comma-separated list ("tekton,oci"). To disable the `TaskRun` artifact input an empty string ("").  | `tekton`, `oci`, `gcs`, `docdb`, `grafeas` | `tekton` |
 | `artifacts.taskrun.signer` | The signature backend to sign `TaskRun` payloads with. | `x509`, `kms` | `x509` |
 
@@ -61,7 +61,7 @@ Supported keys include:
 
 | Key | Description | Supported Values | Default |
 | :--- | :--- | :--- | :--- |
-| `artifacts.pipelinerun.format` | The format to store `PipelineRun` payloads in. | `in-toto`, `slsa/v1`| `in-toto` |
+| `artifacts.pipelinerun.format` | The format to store `PipelineRun` payloads in. | `in-toto`, `slsa/v1`, `slsa/v2`| `in-toto` |
 | `artifacts.pipelinerun.storage` | The storage backend to store `PipelineRun` signatures in. Multiple backends can be specified with comma-separated list ("tekton,oci"). To disable the `PipelineRun` artifact input an empty string ("").  | `tekton`, `oci`, `gcs`, `docdb`, `grafeas` | `tekton` |
 | `artifacts.pipelinerun.signer` | The signature backend to sign `PipelineRun` payloads with. | `x509`, `kms` | `x509` |
 

examples/taskruns/task-output-image.yaml

@@ -62,4 +62,4 @@ spec:
         type: image
         params:
         - name: url
-          value: gcr.io/foo/bar
+          value: gcr.io/foo/bar

pkg/chains/formats/all/all.go

@@ -17,4 +17,5 @@ package all
 import (
 	_ "github.com/tektoncd/chains/pkg/chains/formats/simple"
 	_ "github.com/tektoncd/chains/pkg/chains/formats/slsa/v1"
+	_ "github.com/tektoncd/chains/pkg/chains/formats/slsa/v2"
 )

pkg/chains/formats/format.go

@@ -32,6 +32,7 @@ const (
 	PayloadTypeSimpleSigning config.PayloadType = "simplesigning"
 	PayloadTypeInTotoIte6    config.PayloadType = "in-toto"
 	PayloadTypeSlsav1        config.PayloadType = "slsa/v1"
+	PayloadTypeSlsav2        config.PayloadType = "slsa/v2"
 )
 
 var (

pkg/chains/formats/slsa/v1/taskrun/material.go → pkg/chains/formats/slsa/internal/material/material.go

@@ -1,5 +1,5 @@
 /*
-Copyright 2022 The Tekton Authors
+Copyright 2023 The Tekton Authors
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -14,16 +14,16 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package taskrun
+package material
 
 import (
+	"encoding/json"
 	"fmt"
 	"strings"
 
 	slsa "github.com/in-toto/in-toto-golang/in_toto/slsa_provenance/v0.2"
 	"github.com/tektoncd/chains/pkg/artifacts"
 	"github.com/tektoncd/chains/pkg/chains/formats/slsa/attest"
-	"github.com/tektoncd/chains/pkg/chains/formats/slsa/v1/internal/material"
 	"github.com/tektoncd/chains/pkg/chains/objects"
 	"github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1"
 	"github.com/tektoncd/pipeline/pkg/apis/resource/v1alpha1"
@@ -78,8 +78,8 @@ func AddImageIDToMaterials(imageID string, mats *[]slsa.ProvenanceMaterial) erro
 	return nil
 }
 
-// materials constructs `predicate.materials` section by collecting all the artifacts that influence a taskrun such as source code repo and step&sidecar base images.
-func materials(tro *objects.TaskRunObject, logger *zap.SugaredLogger) ([]slsa.ProvenanceMaterial, error) {
+// Materials constructs `predicate.materials` section by collecting all the artifacts that influence a taskrun such as source code repo and step&sidecar base images.
+func Materials(tro *objects.TaskRunObject, logger *zap.SugaredLogger) ([]slsa.ProvenanceMaterial, error) {
 	var mats []slsa.ProvenanceMaterial
 
 	// add step images
@@ -95,7 +95,7 @@ func materials(tro *objects.TaskRunObject, logger *zap.SugaredLogger) ([]slsa.Pr
 	// remove duplicate materials
 	// TODO : move this logic to the very end after removing
 	// the intermediate return statements below in a followup PR.
-	mats, err := material.RemoveDuplicateMaterials(mats)
+	mats, err := RemoveDuplicateMaterials(mats)
 	if err != nil {
 		return mats, err
 	}
@@ -196,3 +196,21 @@ func gitInfo(tro *objects.TaskRunObject) (commit string, url string) {
 	url = attest.SPDXGit(url, "")
 	return
 }
+
+// RemoveDuplicateMaterials removes duplicate materials from the slice of materials
+func RemoveDuplicateMaterials(mats []slsa.ProvenanceMaterial) ([]slsa.ProvenanceMaterial, error) {
+	// make materialMap to store unique materials
+	materialMap := map[string]slsa.ProvenanceMaterial{}
+	for _, mat := range mats {
+		m, err := json.Marshal(mat)
+		if err != nil {
+			return nil, err
+		}
+		materialMap[string(m)] = mat
+	}
+	distinctMaterials := make([]slsa.ProvenanceMaterial, 0, len(materialMap))
+	for _, mat := range materialMap {
+		distinctMaterials = append(distinctMaterials, mat)
+	}
+	return distinctMaterials, nil
+}

pkg/chains/formats/slsa/v1/taskrun/material_test.go → pkg/chains/formats/slsa/internal/material/material_test.go

@@ -1,5 +1,5 @@
 /*
-Copyright 2022 The Tekton Authors
+Copyright 2023 The Tekton Authors
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package taskrun
+package material
 
 import (
 	"fmt"
@@ -33,6 +33,8 @@ import (
 	logtesting "knative.dev/pkg/logging/testing"
 )
 
+const digest = "sha256:05f95b26ed10668b7183c1e2da98610e91372fa9f510046d4ce5812addad86b7"
+
 func TestMaterialsWithTaskRunResults(t *testing.T) {
 	// make sure this works with Git resources
 	taskrun := `apiVersion: tekton.dev/v1beta1
@@ -64,7 +66,7 @@ status:
 		},
 	}
 
-	got, err := materials(objects.NewTaskRunObject(taskRun), logtesting.TestLogger(t))
+	got, err := Materials(objects.NewTaskRunObject(taskRun), logtesting.TestLogger(t))
 	if err != nil {
 		t.Fatalf("Did not expect an error but got %v", err)
 	}
@@ -109,7 +111,7 @@ func TestMaterials(t *testing.T) {
 							Name: "img1_input" + "-" + artifacts.ArtifactsInputsResultName,
 							Value: *v1beta1.NewObject(map[string]string{
 								"uri":    "gcr.io/foo/bar",
-								"digest": digest3,
+								"digest": digest,
 							}),
 						},
 					},
@@ -131,7 +133,7 @@ func TestMaterials(t *testing.T) {
 			{
 				URI: "gcr.io/foo/bar",
 				Digest: slsa.DigestSet{
-					"sha256": strings.TrimPrefix(digest3, "sha256:"),
+					"sha256": strings.TrimPrefix(digest, "sha256:"),
 				},
 			},
 			{
@@ -236,7 +238,7 @@ func TestMaterials(t *testing.T) {
 		},
 	}}
 	for _, tc := range tests {
-		mat, err := materials(objects.NewTaskRunObject(tc.taskRun), logtesting.TestLogger(t))
+		mat, err := Materials(objects.NewTaskRunObject(tc.taskRun), logtesting.TestLogger(t))
 		if err != nil {
 			t.Fatalf("Did not expect an error but got %v", err)
 		}
@@ -310,7 +312,7 @@ func TestAddStepImagesToMaterials(t *testing.T) {
 		}
 		if tc.wantError == nil {
 			if diff := cmp.Diff(tc.want, mat, test.OptSortMaterial); diff != "" {
-				t.Errorf("materials(): -want +got: %s", diff)
+				t.Errorf("Materials(): -want +got: %s", diff)
 			}
 		}
 	}
@@ -380,7 +382,7 @@ func TestAddSidecarImagesToMaterials(t *testing.T) {
 		}
 		if tc.wantError == nil {
 			if diff := cmp.Diff(tc.want, mat, test.OptSortMaterial); diff != "" {
-				t.Errorf("materials(): -want +got: %s", diff)
+				t.Errorf("Materials(): -want +got: %s", diff)
 			}
 		}
 	}
@@ -418,8 +420,114 @@ func TestAddImageIDToMaterials(t *testing.T) {
 		}
 		if tc.wantError == nil {
 			if diff := cmp.Diff(tc.want, mat, test.OptSortMaterial); diff != "" {
-				t.Errorf("materials(): -want +got: %s", diff)
+				t.Errorf("Materials(): -want +got: %s", diff)
 			}
 		}
 	}
 }
+
+func TestRemoveDuplicates(t *testing.T) {
+	tests := []struct {
+		name string
+		mats []slsa.ProvenanceMaterial
+		want []slsa.ProvenanceMaterial
+	}{{
+		name: "no duplicate materials",
+		mats: []slsa.ProvenanceMaterial{
+			{
+				URI: "gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/git-init",
+				Digest: slsa.DigestSet{
+					"sha256": "b963f6e7a69617db57b685893256f978436277094c21d43b153994acd8a01247",
+				},
+			}, {
+				URI: "gcr.io/cloud-marketplace-containers/google/bazel",
+				Digest: slsa.DigestSet{
+					"sha256": "010a1ecd1a8c3610f12039a25b823e3a17bd3e8ae455a53e340dcfdd37a49964",
+				},
+			}, {
+				URI: "gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/sidecar-git-init",
+				Digest: slsa.DigestSet{
+					"sha256": "a1234f6e7a69617db57b685893256f978436277094c21d43b153994acd8a09567",
+				},
+			},
+		},
+		want: []slsa.ProvenanceMaterial{
+			{
+				URI: "gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/git-init",
+				Digest: slsa.DigestSet{
+					"sha256": "b963f6e7a69617db57b685893256f978436277094c21d43b153994acd8a01247",
+				},
+			}, {
+				URI: "gcr.io/cloud-marketplace-containers/google/bazel",
+				Digest: slsa.DigestSet{
+					"sha256": "010a1ecd1a8c3610f12039a25b823e3a17bd3e8ae455a53e340dcfdd37a49964",
+				},
+			}, {
+				URI: "gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/sidecar-git-init",
+				Digest: slsa.DigestSet{
+					"sha256": "a1234f6e7a69617db57b685893256f978436277094c21d43b153994acd8a09567",
+				},
+			},
+		},
+	}, {
+		name: "same uri and digest",
+		mats: []slsa.ProvenanceMaterial{
+			{
+				URI: "gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/git-init",
+				Digest: slsa.DigestSet{
+					"sha256": "b963f6e7a69617db57b685893256f978436277094c21d43b153994acd8a01247",
+				},
+			}, {
+				URI: "gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/git-init",
+				Digest: slsa.DigestSet{
+					"sha256": "b963f6e7a69617db57b685893256f978436277094c21d43b153994acd8a01247",
+				},
+			},
+		},
+		want: []slsa.ProvenanceMaterial{
+			{
+				URI: "gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/git-init",
+				Digest: slsa.DigestSet{
+					"sha256": "b963f6e7a69617db57b685893256f978436277094c21d43b153994acd8a01247",
+				},
+			},
+		},
+	}, {
+		name: "same uri but different digest",
+		mats: []slsa.ProvenanceMaterial{
+			{
+				URI: "gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/git-init",
+				Digest: slsa.DigestSet{
+					"sha256": "b963f6e7a69617db57b685893256f978436277094c21d43b153994acd8a01247",
+				},
+			}, {
+				URI: "gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/git-init",
+				Digest: slsa.DigestSet{
+					"sha256": "b963f6e7a69617db57b685893256f978436277094c21d43b153994acd8a01248",
+				},
+			},
+		},
+		want: []slsa.ProvenanceMaterial{
+			{
+				URI: "gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/git-init",
+				Digest: slsa.DigestSet{
+					"sha256": "b963f6e7a69617db57b685893256f978436277094c21d43b153994acd8a01247",
+				},
+			}, {
+				URI: "gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/git-init",
+				Digest: slsa.DigestSet{
+					"sha256": "b963f6e7a69617db57b685893256f978436277094c21d43b153994acd8a01248",
+				},
+			},
+		},
+	}}
+	for _, tc := range tests {
+		mat, err := RemoveDuplicateMaterials(tc.mats)
+		if err != nil {
+			t.Fatalf("Did not expect an error but got %v", err)
+		}
+		if diff := cmp.Diff(tc.want, mat, test.OptSortMaterial); diff != "" {
+			t.Errorf("materials(): -want +got: %s", diff)
+		}
+	}
+}