feat(materials): Helm Chart material support

Signed-off-by: Javier Rodriguez <javier@chainloop.dev>

Author: javirln

README.md

@@ -130,6 +130,7 @@ Chainloop supports the collection of the following pieces of evidence types:
 - [OpenVEX](https://github.com/openvex)
 - [SARIF](https://docs.oasis-open.org/sarif/sarif/v2.1.0/)
 - [JUnit](https://www.ibm.com/docs/en/developer-for-zos/14.1?topic=formats-junit-xml-format)
+- [Helm Charts](https://helm.sh/docs/topics/charts/)
 - Generic Artifact Types
 - Key-Value metadata pairs
 

app/controlplane/api/gen/frontend/workflowcontract/v1/crafting_schema.ts

@@ -83,6 +83,7 @@ message CraftingSchema {
       // Static analysis output format
       // https://github.com/microsoft/sarif-tutorials/blob/main/docs/1-Introduction.md
       SARIF = 9;
+      HELM_CHART = 10;
     }
   }
 }

app/controlplane/api/workflowcontract/v1/crafting_schema.pb.go

@@ -310,7 +310,7 @@ require (
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20240401170217-c3f982113cda // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
-	gopkg.in/yaml.v2 v2.4.0 // indirect
+	gopkg.in/yaml.v2 v2.4.0
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	k8s.io/api v0.28.3 // indirect
 	k8s.io/apimachinery v0.28.3

app/controlplane/api/workflowcontract/v1/crafting_schema.proto

@@ -0,0 +1,128 @@
+//
+// Copyright 2024 The Chainloop Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package materials
+
+import (
+	"archive/tar"
+	"compress/gzip"
+	"context"
+	"fmt"
+	"io"
+	"os"
+	"strings"
+
+	schemaapi "github.com/chainloop-dev/chainloop/app/controlplane/api/workflowcontract/v1"
+	api "github.com/chainloop-dev/chainloop/internal/attestation/crafter/api/attestation/v1"
+	"github.com/chainloop-dev/chainloop/internal/casclient"
+	"github.com/rs/zerolog"
+	"gopkg.in/yaml.v2"
+)
+
+const (
+	ChartFileName      = "Chart.yaml"
+	ValuesYamlFileName = "values.yaml"
+)
+
+type HelmChartCrafter struct {
+	backend *casclient.CASBackend
+	*crafterCommon
+}
+
+func NewHelmChartCrafter(materialSchema *schemaapi.CraftingSchema_Material, backend *casclient.CASBackend,
+	l *zerolog.Logger) (*HelmChartCrafter, error) {
+	if materialSchema.Type != schemaapi.CraftingSchema_Material_HELM_CHART {
+		return nil, fmt.Errorf("material type is not HELM_CHART format")
+	}
+
+	return &HelmChartCrafter{
+		backend:       backend,
+		crafterCommon: &crafterCommon{logger: l, input: materialSchema},
+	}, nil
+}
+
+func (c *HelmChartCrafter) Craft(ctx context.Context, filepath string) (*api.Attestation_Material, error) {
+	// Open the helm chart tar file
+	f, err := os.Open(filepath)
+	if err != nil {
+		return nil, fmt.Errorf("can't open the file: %w", err)
+	}
+	defer f.Close()
+
+	// Decompress the file if possible
+	uncompressedStream, err := gzip.NewReader(f)
+	if err != nil {
+		return nil, fmt.Errorf("can't uncompress file, unexpected material type: %w", err)
+	}
+
+	// Create a tar reader
+	tarReader := tar.NewReader(uncompressedStream)
+
+	// Flags to track whether required files are found
+	chartFileValid, chartValuesValid := false, false
+
+	// Iterate through the files in the tar archive
+	for {
+		header, err := tarReader.Next()
+		if err == io.EOF {
+			// Reached the end of tar archive
+			break
+		}
+		if err != nil {
+			return nil, fmt.Errorf("error reading tar file: %w", err)
+		}
+
+		// Check if the file is a regular file
+		if header.Typeflag != tar.TypeReg {
+			continue // Skip if it's not a regular file
+		}
+
+		// Validate Chart.yaml and values.yaml files
+		if strings.Contains(header.Name, ChartFileName) {
+			if err := validateYamlFile(tarReader); err != nil {
+				return nil, fmt.Errorf("invalid Chart.yaml file: %w", err)
+			}
+			chartFileValid = true
+		} else if strings.Contains(header.Name, ValuesYamlFileName) {
+			if err := validateYamlFile(tarReader); err != nil {
+				return nil, fmt.Errorf("invalid values.yaml file: %w", err)
+			}
+			chartValuesValid = true
+		}
+
+		// Stop iterating if both files are found
+		if chartValuesValid && chartFileValid {
+			break
+		}
+	}
+
+	// If the chart.yaml and values.yaml files are not found, return an error
+	if !chartFileValid || !chartValuesValid {
+		return nil, fmt.Errorf("missing required files in the helm chart: Chart.yaml and values.yaml")
+	}
+
+	// Upload and craft the chart
+	return uploadAndCraft(ctx, c.input, c.backend, filepath, c.logger)
+}
+
+// validateYamlFile validates the YAML file just by trying to unmarshal it
+func validateYamlFile(r io.Reader) error {
+	v := make(map[string]interface{})
+	if err := yaml.NewDecoder(r).Decode(v); err != nil {
+		return fmt.Errorf("failed to unmarshal YAML file: %w", err)
+	}
+
+	return nil
+}

go.mod

@@ -0,0 +1,137 @@
+//
+// Copyright 2024 The Chainloop Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package materials_test
+
+import (
+	"context"
+	"testing"
+
+	contractAPI "github.com/chainloop-dev/chainloop/app/controlplane/api/workflowcontract/v1"
+	attestationApi "github.com/chainloop-dev/chainloop/internal/attestation/crafter/api/attestation/v1"
+	"github.com/chainloop-dev/chainloop/internal/attestation/crafter/materials"
+	"github.com/chainloop-dev/chainloop/internal/casclient"
+	mUploader "github.com/chainloop-dev/chainloop/internal/casclient/mocks"
+	"github.com/rs/zerolog"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestNewHelmChartCrafter(t *testing.T) {
+	testCases := []struct {
+		name    string
+		input   *contractAPI.CraftingSchema_Material
+		wantErr bool
+	}{
+		{
+			name: "happy path",
+			input: &contractAPI.CraftingSchema_Material{
+				Type: contractAPI.CraftingSchema_Material_HELM_CHART,
+			},
+		},
+		{
+			name: "wrong type",
+			input: &contractAPI.CraftingSchema_Material{
+				Type: contractAPI.CraftingSchema_Material_CONTAINER_IMAGE,
+			},
+			wantErr: true,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			_, err := materials.NewHelmChartCrafter(tc.input, nil, nil)
+			if tc.wantErr {
+				assert.Error(t, err)
+				return
+			}
+
+			assert.NoError(t, err)
+		})
+	}
+}
+
+func TestHelmChartCraft(t *testing.T) {
+	testCases := []struct {
+		name         string
+		filePath     string
+		wantErr      string
+		wantFilename string
+		wantDigest   string
+	}{
+		{
+			name:     "invalid path",
+			filePath: "./testdata/non-existing.json",
+			wantErr:  "no such file or directory",
+		},
+		{
+			name:     "missing Chart.yaml file",
+			filePath: "./testdata/missing-chartyaml.tgz",
+			wantErr:  "missing required files in the helm chart: Chart.yaml and values.yaml",
+		},
+		{
+			name:     "missing values.yaml file",
+			filePath: "./testdata/missing-valuesyaml.tgz",
+			wantErr:  "missing required files in the helm chart: Chart.yaml and values.yaml",
+		},
+		{
+			name:     "invalid artifact type",
+			filePath: "./testdata/simple.txt",
+			wantErr:  "unexpected material type",
+		},
+		{
+			name:         "valid artifact type",
+			filePath:     "./testdata/valid-chart.tgz",
+			wantDigest:   "sha256:08a46a850789938ede61d6a53552f48cb8ba74c4e17dcf30c9c50e5783ca6a13",
+			wantFilename: "valid-chart.tgz",
+		},
+	}
+
+	assert := assert.New(t)
+	schema := &contractAPI.CraftingSchema_Material{
+		Name: "test",
+		Type: contractAPI.CraftingSchema_Material_HELM_CHART,
+	}
+	l := zerolog.Nop()
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			// Mock uploader
+			uploader := mUploader.NewUploader(t)
+			if tc.wantErr == "" {
+				uploader.On("UploadFile", context.TODO(), tc.filePath).
+					Return(&casclient.UpDownStatus{}, nil)
+			}
+
+			backend := &casclient.CASBackend{Uploader: uploader}
+			crafter, err := materials.NewHelmChartCrafter(schema, backend, &l)
+			require.NoError(t, err)
+
+			got, err := crafter.Craft(context.TODO(), tc.filePath)
+			if tc.wantErr != "" {
+				assert.ErrorContains(err, tc.wantErr)
+				return
+			}
+
+			require.NoError(t, err)
+			assert.Equal(contractAPI.CraftingSchema_Material_HELM_CHART.String(), got.MaterialType.String())
+			assert.True(got.UploadedToCas)
+
+			// The result includes the digest reference
+			assert.Equal(&attestationApi.Attestation_Material_Artifact{
+				Id: "test", Digest: tc.wantDigest, Name: tc.wantFilename,
+			}, got.GetArtifact())
+		})
+	}
+}