[TEP 109] Add feature to extract structured signable targets and store them in subjects and materials in intoto provenance #491

ywluogg · 2022-07-15T20:12:36Z

Implementation of TEP 109.
Example usage for Maven packages:

results:
        - name: img_1-ARTIFACT_INPUTS
           value:
               uri: gcr.io/foo/bar
               digest: sha123@qwe
        - name: mvn1_pkg-ARTIFACT_OUTPUTS
           value:
               uri: maven-test-0.0.1.jar
               digest: sha256@abc
        - name: mvn1_pom-ARTIFACT_OUTPUTS
           value:
               uri: maven-test-0.0.1.pom
               digest: sha256@def
        - name: mvn1_src-ARTIFACT_OUTPUTS
           value:
               uri: maven-test-0.0.1-sources.jar
               digest: sha256@xyz

From this, we will generate subjects in intoto provenence:

{"name": "maven-test-0.0.1.jar", "digest": {"sha256": "abc"}}
{"name": "maven-test-0.0.1.pom", "digest": {"sha256": "def"}}
{"name": "maven-test-0.0.1-sources.jar", "digest": {"sha256": "xyz"}}

In materials:

{"uri": "gcr.io/foo/bar", "digest": {"sha123": "qwe"}}

The feature requires Pipeline v0.38 or later.

Submitter Checklist

As the author of this PR, please check off the items in this checklist:

Has Docs included if any changes are user facing
Has Tests included if any functionality added or changed
Follows the commit message standard
Meets the Tekton contributor standards (including functionality, content, code)
Release notes block below has been updated with any user facing changes (API changes, bug fixes, changes requiring upgrade notices or deprecation warnings)
Release notes contains the string "action required" if the change requires additional action from users switching to the new release

Release Notes

Added structured results provenance retrieval for both TaskRun and PipelineRun. (TEP 109 implementation)

ywluogg · 2022-07-15T20:13:02Z

/draft

tekton-robot · 2022-07-15T20:16:57Z

The following is the coverage report on the affected files.
Say /test pull-tekton-chains-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/artifacts/signable.go	75.3%	76.8%	1.5
pkg/chains/formats/intotoite6/intotoite6.go	88.6%	89.7%	1.1

ywluogg · 2022-07-18T14:44:54Z

/open

ywluogg · 2022-07-18T14:45:11Z

/assign wlynch

tekton-robot · 2022-07-18T14:52:05Z

The following is the coverage report on the affected files.
Say /test pull-tekton-chains-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/artifacts/signable.go	75.3%	76.8%	1.5
pkg/chains/formats/intotoite6/intotoite6.go	88.6%	89.7%	1.1

tekton-robot · 2022-10-03T20:29:53Z

The following is the coverage report on the affected files.
Say /test pull-tekton-chains-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/artifacts/signable.go	68.9%	70.5%	1.6
pkg/chains/formats/intotoite6/taskrun/taskrun.go	74.6%	76.7%	2.1

ywluogg · 2022-10-03T23:45:07Z

/retest

ywluogg · 2022-10-04T14:37:58Z

@wlynch Hi Billy, do you mind reviewing this PR? Thanks!

pkg/artifacts/signable.go

chuangw6

Thanks @ywluogg!

pkg/artifacts/signable.go

pkg/chains/formats/intotoite6/taskrun/taskrun.go

tekton-robot · 2022-10-17T16:16:27Z

The following is the coverage report on the affected files.
Say /test pull-tekton-chains-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/artifacts/signable.go	68.9%	73.8%	4.8
pkg/chains/formats/intotoite6/pipelinerun/pipelinerun.go	76.7%	77.3%	0.5
pkg/chains/formats/intotoite6/taskrun/taskrun.go	74.6%	75.4%	0.7

ywluogg · 2022-10-17T16:19:39Z

@wlynch I'm curious if I should add a user doc for this midland solution? I talked to the teams that are interested in adopting to this method, their main concern for adopting to the artifacts field in status is that they need to change a lot in their pipeline, and this current midland solution can help them migrating to a structured result, but the integration effort is not large comparing to the future solution that Prakash is working on.

I can add a user doc, but have a warning that we are doing a new design and implementation

pkg/artifacts/signable.go

pkg/artifacts/signable_test.go

pkg/artifacts/signable.go

tekton-robot · 2022-10-18T15:03:10Z

The following is the coverage report on the affected files.
Say /test pull-tekton-chains-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/artifacts/signable.go	68.9%	73.8%	4.8
pkg/chains/formats/intotoite6/pipelinerun/pipelinerun.go	76.7%	77.3%	0.5
pkg/chains/formats/intotoite6/taskrun/taskrun.go	74.6%	75.4%	0.7

tekton-robot · 2022-10-18T15:08:55Z

The following is the coverage report on the affected files.
Say /test pull-tekton-chains-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/artifacts/signable.go	68.9%	72.9%	4.0
pkg/chains/formats/intotoite6/pipelinerun/pipelinerun.go	76.7%	77.3%	0.5
pkg/chains/formats/intotoite6/taskrun/taskrun.go	74.6%	75.4%	0.7

tekton-robot · 2022-10-18T15:14:27Z

The following is the coverage report on the affected files.
Say /test pull-tekton-chains-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/artifacts/signable.go	68.9%	72.9%	4.0
pkg/chains/formats/intotoite6/pipelinerun/pipelinerun.go	76.7%	77.3%	0.5
pkg/chains/formats/intotoite6/taskrun/taskrun.go	74.6%	75.4%	0.7

wlynch · 2022-10-18T17:56:06Z

@wlynch I'm curious if I should add a user doc for this midland solution? I talked to the teams that are interested in adopting to this method, their main concern for adopting to the artifacts field in status is that they need to change a lot in their pipeline, and this current midland solution can help them migrating to a structured result, but the integration effort is not large comparing to the future solution that Prakash is working on.

I can add a user doc, but have a warning that we are doing a new design and implementation

Yes please! 🙏

wlynch

Almost there. Few more instances of the diff change + waiting on docs.

pkg/artifacts/signable_test.go

pkg/chains/formats/intotoite6/pipelinerun/provenance_test.go

pkg/artifacts/signable_test.go

tekton-robot · 2022-10-18T19:01:55Z

The following is the coverage report on the affected files.
Say /test pull-tekton-chains-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/chains/formats/intotoite6/taskrun/taskrun.go	74.6%	75.4%	0.7

ywluogg · 2022-10-18T19:27:32Z

@wlynch the doc is added. PTAL

tekton-robot · 2022-10-18T19:30:50Z

The following is the coverage report on the affected files.
Say /test pull-tekton-chains-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/chains/formats/intotoite6/taskrun/taskrun.go	74.6%	75.4%	0.7

…argets

tekton-robot · 2022-10-18T19:47:04Z

The following is the coverage report on the affected files.
Say /test pull-tekton-chains-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/artifacts/signable.go	64.0%	69.1%	5.1
pkg/chains/formats/intotoite6/pipelinerun/pipelinerun.go	76.7%	77.3%	0.5
pkg/chains/formats/intotoite6/taskrun/taskrun.go	74.6%	75.4%	0.7

ywluogg · 2022-10-18T21:19:48Z

/unhold

wlynch

/lgtm

tekton-robot · 2022-10-20T01:28:42Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: wlynch

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [wlynch]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

ywluogg · 2022-10-20T17:20:57Z

/milestone v0.13.0

tekton-robot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Jul 15, 2022

tekton-robot requested review from mattmoor and mpeters July 15, 2022 20:12

ywluogg marked this pull request as draft July 15, 2022 20:13

tekton-robot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 15, 2022

ywluogg force-pushed the main branch from a3a0674 to d2f409a Compare July 15, 2022 20:15

ywluogg force-pushed the main branch from d2f409a to 0a1f970 Compare July 18, 2022 14:42

ywluogg marked this pull request as ready for review July 18, 2022 14:45

tekton-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 18, 2022

tekton-robot requested a review from dlorenc July 18, 2022 14:45

tekton-robot assigned wlynch Jul 18, 2022

tekton-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Sep 20, 2022

ywluogg force-pushed the main branch from 0a1f970 to 6ebbbda Compare October 3, 2022 18:31

tekton-robot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Oct 3, 2022

ywluogg force-pushed the main branch from 6ebbbda to e024af0 Compare October 3, 2022 20:25

tekton-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Oct 3, 2022

ywluogg force-pushed the main branch from e024af0 to 2ae3d63 Compare October 3, 2022 20:26

chuangw6 reviewed Oct 4, 2022

View reviewed changes

pkg/artifacts/signable.go Outdated Show resolved Hide resolved

chuangw6 reviewed Oct 4, 2022

View reviewed changes

pkg/artifacts/signable.go Outdated Show resolved Hide resolved

pkg/artifacts/signable.go Outdated Show resolved Hide resolved

pkg/chains/formats/intotoite6/taskrun/taskrun.go Outdated Show resolved Hide resolved

wlynch requested changes Oct 18, 2022

View reviewed changes

pkg/artifacts/signable.go Show resolved Hide resolved

pkg/artifacts/signable_test.go Outdated Show resolved Hide resolved

pkg/artifacts/signable.go Show resolved Hide resolved

pkg/artifacts/signable.go Outdated Show resolved Hide resolved

ywluogg force-pushed the main branch from 125d06a to 1afce3e Compare October 18, 2022 14:59

ywluogg force-pushed the main branch from 1afce3e to dc436e5 Compare October 18, 2022 15:03

ywluogg requested a review from wlynch October 18, 2022 15:06

ywluogg force-pushed the main branch from dc436e5 to 022046a Compare October 18, 2022 15:09

wlynch requested changes Oct 18, 2022

View reviewed changes

ywluogg force-pushed the main branch 3 times, most recently from a98291d to 85ce20b Compare October 18, 2022 19:26

TEP 109 implementation: add function to extract structured signable t…

5d906d5

…argets

ywluogg force-pushed the main branch from 85ce20b to 5d906d5 Compare October 18, 2022 19:42

ywluogg requested a review from wlynch October 18, 2022 20:49

tekton-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Oct 18, 2022

wlynch approved these changes Oct 20, 2022

View reviewed changes

tekton-robot added the lgtm Indicates that a PR is ready to be merged. label Oct 20, 2022

tekton-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Oct 20, 2022

tekton-robot merged commit 015ff9a into tektoncd:main Oct 20, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[TEP 109] Add feature to extract structured signable targets and store them in subjects and materials in intoto provenance #491

[TEP 109] Add feature to extract structured signable targets and store them in subjects and materials in intoto provenance #491

ywluogg commented Jul 15, 2022 •

edited

Loading

ywluogg commented Jul 15, 2022

tekton-robot commented Jul 15, 2022

ywluogg commented Jul 18, 2022

ywluogg commented Jul 18, 2022

tekton-robot commented Jul 18, 2022

tekton-robot commented Oct 3, 2022

ywluogg commented Oct 3, 2022

ywluogg commented Oct 4, 2022

chuangw6 left a comment

tekton-robot commented Oct 17, 2022

ywluogg commented Oct 17, 2022

tekton-robot commented Oct 18, 2022

tekton-robot commented Oct 18, 2022

tekton-robot commented Oct 18, 2022

wlynch commented Oct 18, 2022

wlynch left a comment

tekton-robot commented Oct 18, 2022

ywluogg commented Oct 18, 2022

tekton-robot commented Oct 18, 2022

tekton-robot commented Oct 18, 2022

ywluogg commented Oct 18, 2022

wlynch left a comment

tekton-robot commented Oct 20, 2022

ywluogg commented Oct 20, 2022

[TEP 109] Add feature to extract structured signable targets and store them in subjects and materials in intoto provenance #491

[TEP 109] Add feature to extract structured signable targets and store them in subjects and materials in intoto provenance #491

Conversation

ywluogg commented Jul 15, 2022 • edited Loading

Submitter Checklist

Release Notes

ywluogg commented Jul 15, 2022

tekton-robot commented Jul 15, 2022

ywluogg commented Jul 18, 2022

ywluogg commented Jul 18, 2022

tekton-robot commented Jul 18, 2022

tekton-robot commented Oct 3, 2022

ywluogg commented Oct 3, 2022

ywluogg commented Oct 4, 2022

chuangw6 left a comment

Choose a reason for hiding this comment

tekton-robot commented Oct 17, 2022

ywluogg commented Oct 17, 2022

tekton-robot commented Oct 18, 2022

tekton-robot commented Oct 18, 2022

tekton-robot commented Oct 18, 2022

wlynch commented Oct 18, 2022

wlynch left a comment

Choose a reason for hiding this comment

tekton-robot commented Oct 18, 2022

ywluogg commented Oct 18, 2022

tekton-robot commented Oct 18, 2022

tekton-robot commented Oct 18, 2022

ywluogg commented Oct 18, 2022

wlynch left a comment

Choose a reason for hiding this comment

tekton-robot commented Oct 20, 2022

ywluogg commented Oct 20, 2022

ywluogg commented Jul 15, 2022 •

edited

Loading