-
Notifications
You must be signed in to change notification settings - Fork 2.5k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat(sbom): add support for scanning a sbom attestation #2652
Merged
Merged
Changes from 6 commits
Commits
Show all changes
24 commits
Select commit
Hold shift + click to select a range
ae0862b
feat(sbom): add support for scanning a sbom attestation
otms61 6a9cfb6
chore: excecute go mod tidy
otms61 8f38112
fix: fix goimports lint errors
otms61 c8e2a6b
feat: support for detecting attest xml
otms61 50727bb
refactor: move the predicate data access logic to attestation package
otms61 87b2d21
refacotr: rename cosign predicate data field
otms61 173b381
refactor: define our own Statement structure and remove the support f…
otms61 8e3d190
Merge branch 'main' into scan_sbom_attest
otms61 1be389e
refactor: fix the comment for Decode function
otms61 f461112
refactor: wrap the error by xerrors
otms61 b6cf89f
test: add a test for Decode attestaions
otms61 0921717
test: add a test for Inspect an SBOM attestation
otms61 031dd8f
refactor(cyclonedx): implement json.Unmarshaler
knqyf263 3e3438e
Merge branch 'refactor_sbom' into scan_sbom_attest
knqyf263 5838440
test(attestation): fix expected
knqyf263 e2b9200
Merge branch 'main' into scan_sbom_attest
knqyf263 5db9da3
refactor: remove cruft
knqyf263 03ae38e
test: add an integration test for scanning a sbom
otms61 bf6f0aa
docs: add a descrition for scanning sbom attestation
otms61 7219892
docs: update the cosign --type option
otms61 26cce23
refactor: use .intoto.jsonl extension
otms61 a0a8cf4
docs: use .intoto.jsonl extension
otms61 2393a0e
docs: respond to PR feedback
otms61 661b0eb
refactor: rename TestDecode to TestStatement_UnmarshalJSON
otms61 File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,49 @@ | ||
| package attestation | ||
|
|
||
| import ( | ||
| "bytes" | ||
| "encoding/base64" | ||
| "encoding/json" | ||
| "io" | ||
|
|
||
| "github.com/in-toto/in-toto-golang/in_toto" | ||
| "github.com/secure-systems-lab/go-securesystemslib/dsse" | ||
| "golang.org/x/xerrors" | ||
| ) | ||
|
|
||
| type Statement struct { | ||
| in_toto.Statement | ||
| CosignPredicateData interface{} `json:"-"` | ||
| } | ||
|
|
||
| // Decode returns the in-toto statement from the in-toto attestation. | ||
| func Decode(r io.Reader) (Statement, error) { | ||
|
|
||
| var envelope dsse.Envelope | ||
| err := json.NewDecoder(r).Decode(&envelope) | ||
| if err != nil { | ||
| return Statement{}, xerrors.Errorf("failed to decode as a dsse envelope: %w", err) | ||
| } | ||
| if envelope.PayloadType != in_toto.PayloadType { | ||
| return Statement{}, xerrors.Errorf("invalid attestation payload type: %s", envelope.PayloadType) | ||
| } | ||
|
|
||
| decoded, err := base64.StdEncoding.DecodeString(envelope.Payload) | ||
| if err != nil { | ||
| return Statement{}, xerrors.Errorf("failed to decode attestation payload: %w", err) | ||
| } | ||
|
|
||
| var st Statement | ||
| err = json.NewDecoder(bytes.NewReader(decoded)).Decode(&st) | ||
| if err != nil { | ||
| return Statement{}, xerrors.Errorf("failed to decode attestation payload as in-toto statement: %w", err) | ||
| } | ||
|
|
||
| // When cosign creates an SBOM attestation, it stores the predicate under a "Data" key. | ||
| // https://github.com/sigstore/cosign/blob/938ad43f84aa183850014c8cc6d999f4b7ec5e8d/pkg/cosign/attestation/attestation.go#L39-L43 | ||
| if _, found := st.Predicate.(map[string]interface{})["Data"]; found { | ||
| st.CosignPredicateData = st.Predicate.(map[string]interface{})["Data"] | ||
| } | ||
|
|
||
| return st, nil | ||
| } | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,43 @@ | ||
| package attestation | ||
|
|
||
| import ( | ||
| "bytes" | ||
| "encoding/json" | ||
| "io" | ||
|
|
||
| "golang.org/x/xerrors" | ||
|
|
||
| "github.com/aquasecurity/trivy/pkg/attestation" | ||
| "github.com/aquasecurity/trivy/pkg/sbom" | ||
| ) | ||
|
|
||
| type Unmarshaler struct { | ||
| predicateUnmarshaler sbom.Unmarshaler | ||
| } | ||
|
|
||
| func (u Unmarshaler) Unmarshal(r io.Reader) (sbom.SBOM, error) { | ||
| attest, err := attestation.Decode(r) | ||
| if err != nil { | ||
| return sbom.SBOM{}, xerrors.Errorf("failed to decode attestation: %w", err) | ||
| } | ||
|
|
||
| var predicateByte []byte | ||
|
|
||
| switch attest.CosignPredicateData.(type) { | ||
| case map[string]interface{}: | ||
| predicateByte, err = json.Marshal(attest.CosignPredicateData) | ||
| if err != nil { | ||
| return sbom.SBOM{}, xerrors.Errorf("failed to marshal predicate: %w", err) | ||
| } | ||
| case string: | ||
| predicateByte = []byte(attest.CosignPredicateData.(string)) | ||
| } | ||
|
|
||
| return u.predicateUnmarshaler.Unmarshal(bytes.NewReader(predicateByte)) | ||
| } | ||
|
|
||
| func NewUnmarshaler(predicateUnmarshaler sbom.Unmarshaler) sbom.Unmarshaler { | ||
| return &Unmarshaler{ | ||
| predicateUnmarshaler: predicateUnmarshaler, | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It causes panic if the type assertion fails. Can we make sure the assertion works beforehand?
Also, we can define our own struct only with needed fields so that we will not have to go back and forth for marshaling/unmarshaling. We can pass
json.RawMessageto the SBOM unmarshaler.trivy/pkg/sbom/attestation/attestation.go
Lines 28 to 31 in 87b2d21
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Great idea! It will simplify the code!