Skip to content
This repository was archived by the owner on Dec 3, 2024. It is now read-only.

Commit f1ece68

Browse files
authored
Merge branch 'main' into dependabot/go_modules/github.com/sigstore/sigstore/pkg/signature/kms/gcp-1.8.8
2 parents 6d0a6de + 116b9ea commit f1ece68

17 files changed

+232
-190
lines changed

go.mod

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -28,8 +28,8 @@ require (
2828
sigs.k8s.io/yaml v1.4.0
2929
)
3030

31-
// fork of a fork (in case it goes away) with changes to support ArtifactType (https://github.com/google/go-containerregistry/pull/1931)
32-
replace github.com/google/go-containerregistry => github.com/kipz/go-containerregistry v0.0.0-20240722163910-ebe90246535d
31+
// fork with changes to support ArtifactType (https://github.com/google/go-containerregistry/pull/1931)
32+
replace github.com/google/go-containerregistry => github.com/docker/go-containerregistry v0.0.0-20240808132857-c8bfc44af7c8
3333

3434
require (
3535
cloud.google.com/go v0.115.0 // indirect
@@ -75,7 +75,7 @@ require (
7575
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
7676
github.com/digitorus/pkcs7 v0.0.0-20230818184609-3a137a874352 // indirect
7777
github.com/digitorus/timestamp v0.0.0-20231217203849-220c5c2851b7 // indirect
78-
github.com/docker/cli v26.1.3+incompatible // indirect
78+
github.com/docker/cli v27.1.1+incompatible // indirect
7979
github.com/docker/distribution v2.8.3+incompatible // indirect
8080
github.com/docker/docker v27.1.0+incompatible // indirect
8181
github.com/docker/docker-credential-helpers v0.8.1 // indirect

go.sum

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -218,8 +218,8 @@ github.com/dimchansky/utfbom v1.1.1 h1:vV6w1AhK4VMnhBno/TPVCoK9U/LP0PkLCS9tbxHdi
218218
github.com/dimchansky/utfbom v1.1.1/go.mod h1:SxdoEBH5qIqFocHMyGOXVAybYJdr71b1Q/j0mACtrfE=
219219
github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
220220
github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
221-
github.com/docker/cli v26.1.3+incompatible h1:bUpXT/N0kDE3VUHI2r5VMsYQgi38kYuoC0oL9yt3lqc=
222-
github.com/docker/cli v26.1.3+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
221+
github.com/docker/cli v27.1.1+incompatible h1:goaZxOqs4QKxznZjjBWKONQci/MywhtRv2oNn0GkeZE=
222+
github.com/docker/cli v27.1.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
223223
github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
224224
github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
225225
github.com/docker/docker v27.1.0+incompatible h1:rEHVQc4GZ0MIQKifQPHSFGV/dVgaZafgRf8fCPtDYBs=
@@ -228,6 +228,8 @@ github.com/docker/docker-credential-helpers v0.8.1 h1:j/eKUktUltBtMzKqmfLB0PAgqY
228228
github.com/docker/docker-credential-helpers v0.8.1/go.mod h1:P3ci7E3lwkZg6XiHdRKft1KckHiO9a2rNtyFbZ/ry9M=
229229
github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
230230
github.com/docker/go-connections v0.5.0/go.mod h1:ov60Kzw0kKElRwhNs9UlUHAE/F9Fe6GLaXnqyDdmEXc=
231+
github.com/docker/go-containerregistry v0.0.0-20240808132857-c8bfc44af7c8 h1:T/wutVfQ1Oj4H5tbP5IZL5l6PZqzvapVJ5cB4Wy4Ucc=
232+
github.com/docker/go-containerregistry v0.0.0-20240808132857-c8bfc44af7c8/go.mod h1:z38EKdKh4h7IP2gSfUUqEvalZBqs6AoLeWfUy34nQC8=
231233
github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
232234
github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
233235
github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
@@ -417,8 +419,6 @@ github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8Hm
417419
github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
418420
github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
419421
github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
420-
github.com/kipz/go-containerregistry v0.0.0-20240722163910-ebe90246535d h1:5QaWAwKhslfqxEyMZY0ofvsbMJkMLcx5E30JFufMVj8=
421-
github.com/kipz/go-containerregistry v0.0.0-20240722163910-ebe90246535d/go.mod h1:YCMFNQeeXeLF+dnhhWkqDItx/JSkH01j1Kis4PsjzFI=
422422
github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
423423
github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
424424
github.com/klauspost/compress v1.17.8 h1:YcnTYrq7MikUT7k0Yb5eceMmALQPYBW/Xltxn0NAMnU=

pkg/attest/example_sign_test.go

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@ import (
55

66
"github.com/docker/attest/pkg/attest"
77
"github.com/docker/attest/pkg/attestation"
8-
"github.com/docker/attest/pkg/mirror"
98
"github.com/docker/attest/pkg/oci"
109
"github.com/docker/attest/pkg/signerverifier"
1110
v1 "github.com/google/go-containerregistry/pkg/v1"
@@ -55,7 +54,7 @@ func ExampleSignStatements_remote() {
5554
}
5655

5756
// push image index with signed attestation-manifests
58-
err = mirror.PushIndexToRegistry(signedIndex, ref)
57+
err = oci.PushIndexToRegistry(signedIndex, ref)
5958
if err != nil {
6059
panic(err)
6160
}
@@ -70,7 +69,7 @@ func ExampleSignStatements_remote() {
7069
},
7170
},
7271
})
73-
err = mirror.SaveIndexAsOCILayout(idx, path)
72+
err = oci.SaveIndexAsOCILayout(idx, path)
7473
if err != nil {
7574
panic(err)
7675
}

pkg/attest/sign_test.go

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,6 @@ import (
1010

1111
"github.com/docker/attest/internal/test"
1212
"github.com/docker/attest/pkg/attestation"
13-
"github.com/docker/attest/pkg/mirror"
1413
"github.com/docker/attest/pkg/oci"
1514
"github.com/docker/attest/pkg/policy"
1615
"github.com/google/go-containerregistry/pkg/registry"
@@ -65,7 +64,7 @@ func TestSignVerifyOCILayout(t *testing.T) {
6564
require.NoError(t, err)
6665
spec, err := oci.ParseImageSpec(oci.LocalPrefix + outputLayout)
6766
require.NoError(t, err)
68-
err = mirror.SaveIndex([]*oci.ImageSpec{spec}, signedIndex, attIdx.Name)
67+
err = oci.SaveIndex([]*oci.ImageSpec{spec}, signedIndex, attIdx.Name)
6968
require.NoError(t, err)
7069
policy, err := Verify(ctx, spec, policyOpts)
7170
require.NoError(t, err)
@@ -226,7 +225,7 @@ func TestSimpleStatementSigning(t *testing.T) {
226225
indexName := fmt.Sprintf("%s/repo:root", u.Host)
227226
output, err := oci.ParseImageSpecs(indexName)
228227
require.NoError(t, err)
229-
err = mirror.SaveReferrers(manifest, output)
228+
err = oci.SaveReferrers(manifest, output)
230229
require.NoError(t, err)
231230
})
232231
}

pkg/attest/verify_test.go

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,6 @@ import (
1111
"github.com/docker/attest/internal/test"
1212
"github.com/docker/attest/pkg/attestation"
1313
"github.com/docker/attest/pkg/config"
14-
"github.com/docker/attest/pkg/mirror"
1514
"github.com/docker/attest/pkg/oci"
1615
"github.com/docker/attest/pkg/policy"
1716
intoto "github.com/in-toto/in-toto-golang/in_toto"
@@ -84,7 +83,7 @@ func TestVSA(t *testing.T) {
8483
// output signed attestations
8584
spec, err := oci.ParseImageSpec(oci.LocalPrefix+outputLayout, oci.WithPlatform(LinuxAMD64))
8685
require.NoError(t, err)
87-
err = mirror.SaveIndex([]*oci.ImageSpec{spec}, signedIndex, attIdx.Name)
86+
err = oci.SaveIndex([]*oci.ImageSpec{spec}, signedIndex, attIdx.Name)
8887
assert.NoError(t, err)
8988

9089
// mocked vsa query should pass
@@ -134,7 +133,7 @@ func TestVerificationFailure(t *testing.T) {
134133
// output signed attestations
135134
spec, err := oci.ParseImageSpec(oci.LocalPrefix+outputLayout, oci.WithPlatform(LinuxAMD64))
136135
require.NoError(t, err)
137-
err = mirror.SaveIndex([]*oci.ImageSpec{spec}, signedIndex, attIdx.Name)
136+
err = oci.SaveIndex([]*oci.ImageSpec{spec}, signedIndex, attIdx.Name)
138137
assert.NoError(t, err)
139138

140139
// mocked vsa query should fail
@@ -208,7 +207,7 @@ func TestSignVerify(t *testing.T) {
208207
// output signed attestations
209208
spec, err := oci.ParseImageSpec(oci.LocalPrefix+outputLayout, oci.WithPlatform(LinuxAMD64))
210209
require.NoError(t, err)
211-
err = mirror.SaveIndex([]*oci.ImageSpec{spec}, signedIndex, imageName)
210+
err = oci.SaveIndex([]*oci.ImageSpec{spec}, signedIndex, imageName)
212211
require.NoError(t, err)
213212

214213
policyOpts := &policy.Options{

pkg/attestation/attestation.go

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
package attestation
22

33
import (
4+
"bytes"
45
"context"
56
"encoding/json"
67
"fmt"
@@ -249,7 +250,7 @@ func (manifest *Manifest) BuildReferringArtifacts() ([]v1.Image, error) {
249250
return images, nil
250251
}
251252

252-
// build and image containing only layers.
253+
// build an image containing only layers.
253254
func buildImage(layers []*Layer, manifest *v1.Descriptor, subject *v1.Descriptor, opts *ManifestImageOptions) (v1.Image, error) {
254255
newImg := empty.Image
255256
var err error
@@ -329,3 +330,12 @@ func (i *EmptyConfigImage) RawManifest() ([]byte, error) {
329330
}
330331
return json.Marshal(mf)
331332
}
333+
334+
func (i *EmptyConfigImage) Digest() (v1.Hash, error) {
335+
mb, err := i.RawManifest()
336+
if err != nil {
337+
return v1.Hash{}, err
338+
}
339+
digest, _, err := v1.SHA256(bytes.NewReader(mb))
340+
return digest, err
341+
}

pkg/attestation/example_attestation_manifest_test.go

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@ import (
66

77
"github.com/docker/attest/pkg/attest"
88
"github.com/docker/attest/pkg/attestation"
9-
"github.com/docker/attest/pkg/mirror"
109
"github.com/docker/attest/pkg/oci"
1110
"github.com/docker/attest/pkg/signerverifier"
1211
v1 "github.com/google/go-containerregistry/pkg/v1"
@@ -80,7 +79,7 @@ func ExampleManifest() {
8079
}
8180

8281
// save the manifest to the registry as a referrers artifact
83-
err = mirror.SaveReferrers(manifest, output)
82+
err = oci.SaveReferrers(manifest, output)
8483
if err != nil {
8584
panic(err)
8685
}

pkg/attestation/referrers_test.go

Lines changed: 21 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -8,14 +8,15 @@ import (
88
"testing"
99

1010
"github.com/docker/attest/internal/test"
11+
"github.com/docker/attest/internal/util"
1112
"github.com/docker/attest/pkg/attest"
1213
"github.com/docker/attest/pkg/attestation"
1314
"github.com/docker/attest/pkg/config"
14-
"github.com/docker/attest/pkg/mirror"
1515
"github.com/docker/attest/pkg/oci"
1616
"github.com/docker/attest/pkg/policy"
1717
"github.com/google/go-containerregistry/pkg/name"
1818
"github.com/google/go-containerregistry/pkg/registry"
19+
"github.com/google/go-containerregistry/pkg/v1/empty"
1920
"github.com/google/go-containerregistry/pkg/v1/remote"
2021
"github.com/stretchr/testify/assert"
2122
"github.com/stretchr/testify/require"
@@ -112,14 +113,14 @@ func TestAttestationReferenceTypes(t *testing.T) {
112113

113114
// push subject image so that it can be resolved
114115
require.NoError(t, err)
115-
err = mirror.PushIndexToRegistry(attIdx.Index, indexName)
116+
err = oci.PushIndexToRegistry(attIdx.Index, indexName)
116117
require.NoError(t, err)
117118

118119
// upload referrers
119120
output, err := oci.ParseImageSpec(outputRepo)
120121
require.NoError(t, err)
121122
for _, attIdx := range signedManifests {
122-
err = mirror.SaveReferrers(attIdx, []*oci.ImageSpec{output})
123+
err = oci.SaveReferrers(attIdx, []*oci.ImageSpec{output})
123124
require.NoError(t, err)
124125
}
125126

@@ -216,7 +217,7 @@ func TestReferencesInDifferentRepo(t *testing.T) {
216217
require.NoError(t, err)
217218

218219
indexName := fmt.Sprintf("%s/%s:latest", serverURL.Host, repoName)
219-
err = mirror.PushIndexToRegistry(attIdx.Index, indexName)
220+
err = oci.PushIndexToRegistry(attIdx.Index, indexName)
220221
require.NoError(t, err)
221222

222223
signedManifests, err := attest.SignStatements(ctx, attIdx.Index, signer, opts)
@@ -227,7 +228,7 @@ func TestReferencesInDifferentRepo(t *testing.T) {
227228
// push references using subject-digest.att convention
228229
image, err := signedManifest.BuildAttestationImage()
229230
require.NoError(t, err)
230-
err = mirror.PushImageToRegistry(image, fmt.Sprintf("%s/%s:tag-does-not-matter", refServerURL.Host, repoName))
231+
err = oci.PushImageToRegistry(image, fmt.Sprintf("%s/%s:tag-does-not-matter", refServerURL.Host, repoName))
231232
require.NoError(t, err)
232233

233234
refServer := tc.refServer
@@ -242,7 +243,7 @@ func TestReferencesInDifferentRepo(t *testing.T) {
242243
require.NoError(t, err)
243244

244245
indexName := fmt.Sprintf("%s/%s:latest", serverURL.Host, repoName)
245-
err = mirror.PushIndexToRegistry(attIdx.Index, indexName)
246+
err = oci.PushIndexToRegistry(attIdx.Index, indexName)
246247
require.NoError(t, err)
247248

248249
signedManifests, err := attest.SignStatements(ctx, attIdx.Index, signer, opts)
@@ -254,7 +255,7 @@ func TestReferencesInDifferentRepo(t *testing.T) {
254255
imgs, err := mf.BuildReferringArtifacts()
255256
require.NoError(t, err)
256257
for _, img := range imgs {
257-
err = mirror.PushImageToRegistry(img, fmt.Sprintf("%s/%s:tag-does-not-matter", refServerURL.Host, repoName))
258+
err = oci.PushImageToRegistry(img, fmt.Sprintf("%s/%s:tag-does-not-matter", refServerURL.Host, repoName))
258259
require.NoError(t, err)
259260
}
260261
}
@@ -297,7 +298,7 @@ func TestCorrectArtifactTypeInTagFallback(t *testing.T) {
297298
require.NoError(t, err)
298299

299300
indexName := fmt.Sprintf("%s/%s:latest", serverURL.Host, repoName)
300-
err = mirror.PushIndexToRegistry(attIdx.Index, indexName)
301+
err = oci.PushIndexToRegistry(attIdx.Index, indexName)
301302
require.NoError(t, err)
302303

303304
signedManifests, err := attest.SignStatements(ctx, attIdx.Index, signer, opts)
@@ -308,7 +309,7 @@ func TestCorrectArtifactTypeInTagFallback(t *testing.T) {
308309
imgs, err := mf.BuildReferringArtifacts()
309310
require.NoError(t, err)
310311
for _, img := range imgs {
311-
err = mirror.PushImageToRegistry(img, fmt.Sprintf("%s/%s:tag-does-not-matter", serverURL.Host, repoName))
312+
err = oci.PushImageToRegistry(img, fmt.Sprintf("%s/%s:tag-does-not-matter", serverURL.Host, repoName))
312313
require.NoError(t, err)
313314
mf, err := img.Manifest()
314315
require.NoError(t, err)
@@ -326,3 +327,14 @@ func TestCorrectArtifactTypeInTagFallback(t *testing.T) {
326327
}
327328
}
328329
}
330+
331+
func TestEmptyConfigImageDigest(t *testing.T) {
332+
empty := empty.Image
333+
img := attestation.EmptyConfigImage{empty}
334+
mf, err := img.RawManifest()
335+
require.NoError(t, err)
336+
hash := util.SHA256Hex(mf)
337+
digest, err := img.Digest()
338+
require.NoError(t, err)
339+
assert.Equal(t, digest.Hex, hash)
340+
}

pkg/mirror/authn_test.go

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@ import (
66
"path/filepath"
77
"testing"
88

9-
"github.com/docker/attest/pkg/mirror"
109
"github.com/docker/attest/pkg/oci"
1110
"github.com/stretchr/testify/require"
1211
)
@@ -25,7 +24,7 @@ func TestRegistryAuth(t *testing.T) {
2524
}
2625
for _, tc := range testCases {
2726
t.Run(tc.Image, func(t *testing.T) {
28-
err := mirror.PushIndexToRegistry(attIdx.Index, tc.Image)
27+
err := oci.PushIndexToRegistry(attIdx.Index, tc.Image)
2928
require.NoError(t, err)
3029
_, err = oci.IndexFromRemote(tc.Image)
3130
require.NoError(t, err)

pkg/mirror/example_mirror_test.go

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ import (
88

99
"github.com/docker/attest/internal/embed"
1010
"github.com/docker/attest/pkg/mirror"
11+
"github.com/docker/attest/pkg/oci"
1112
"github.com/docker/attest/pkg/tuf"
1213
v1 "github.com/google/go-containerregistry/pkg/v1"
1314
)
@@ -80,7 +81,7 @@ func ExampleNewTUFMirror() {
8081
func mirrorToRegistry(o *TufMirrorOutput) error {
8182
// push metadata to registry
8283
metadataRepo := "registry-1.docker.io/docker/tuf-metadata:latest"
83-
err := mirror.PushImageToRegistry(o.metadata, metadataRepo)
84+
err := oci.PushImageToRegistry(o.metadata, metadataRepo)
8485
if err != nil {
8586
return err
8687
}
@@ -91,7 +92,7 @@ func mirrorToRegistry(o *TufMirrorOutput) error {
9192
return fmt.Errorf("failed to get repo without tag: %s", metadataRepo)
9293
}
9394
imageName := fmt.Sprintf("%s:%s", repo, metadata.Tag)
94-
err = mirror.PushImageToRegistry(metadata.Image, imageName)
95+
err = oci.PushImageToRegistry(metadata.Image, imageName)
9596
if err != nil {
9697
return err
9798
}
@@ -101,15 +102,15 @@ func mirrorToRegistry(o *TufMirrorOutput) error {
101102
targetsRepo := "registry-1.docker.io/docker/tuf-targets"
102103
for _, target := range o.targets {
103104
imageName := fmt.Sprintf("%s:%s", targetsRepo, target.Tag)
104-
err = mirror.PushImageToRegistry(target.Image, imageName)
105+
err = oci.PushImageToRegistry(target.Image, imageName)
105106
if err != nil {
106107
return err
107108
}
108109
}
109110
// push delegated targets to registry
110111
for _, target := range o.delegatedTargets {
111112
imageName := fmt.Sprintf("%s:%s", targetsRepo, target.Tag)
112-
err = mirror.PushIndexToRegistry(target.Index, imageName)
113+
err = oci.PushIndexToRegistry(target.Index, imageName)
113114
if err != nil {
114115
return err
115116
}
@@ -119,14 +120,14 @@ func mirrorToRegistry(o *TufMirrorOutput) error {
119120

120121
func mirrorToLocal(o *TufMirrorOutput, outputPath string) error {
121122
// output metadata to local directory
122-
err := mirror.SaveImageAsOCILayout(o.metadata, outputPath)
123+
err := oci.SaveImageAsOCILayout(o.metadata, outputPath)
123124
if err != nil {
124125
return err
125126
}
126127
// output delegated metadata to local directory
127128
for _, metadata := range o.delegatedMetadata {
128129
path := filepath.Join(outputPath, metadata.Tag)
129-
err = mirror.SaveImageAsOCILayout(metadata.Image, path)
130+
err = oci.SaveImageAsOCILayout(metadata.Image, path)
130131
if err != nil {
131132
return err
132133
}
@@ -135,15 +136,15 @@ func mirrorToLocal(o *TufMirrorOutput, outputPath string) error {
135136
// output top-level targets to local directory
136137
for _, target := range o.targets {
137138
path := filepath.Join(outputPath, target.Tag)
138-
err = mirror.SaveImageAsOCILayout(target.Image, path)
139+
err = oci.SaveImageAsOCILayout(target.Image, path)
139140
if err != nil {
140141
return err
141142
}
142143
}
143144
// output delegated targets to local directory
144145
for _, target := range o.delegatedTargets {
145146
path := filepath.Join(outputPath, target.Tag)
146-
err = mirror.SaveIndexAsOCILayout(target.Index, path)
147+
err = oci.SaveIndexAsOCILayout(target.Index, path)
147148
if err != nil {
148149
return err
149150
}

0 commit comments

Comments
 (0)