feat(backend): ATTESTATION material type

[jiparis]

This PR adds a new ATTESTATION material type to allow cross-linking different workflow runs using existing attestations.

This is what the logic do:

• check that the attestation is valid (valid DSSE envelope, valid in-toto attestation and chainloop predicate).
• re-marshall the envelope to mitigate possible digest unmatches with existing previously uploaded attestations
• Some refactor to reuse common code in CLI and backend.

References #719

[jiparis]

Marking as draft, as I still want to add some tests for the digests.

[migmartri]

looking good!

Just added some comments so far with some of my concerns, will do a more complete review soon.

Thank you!!

[migmartri]

We could merge this but right after this, we could do a follow up to handle these kind of attestations to make sure they are not injected in the graph.

That said, it's not trivial and not worth being added in this patch.

[migmartri]

I have mixed feelings about changing the upload calls but there is nothing wrong with it.

I left some comments to get your take, if you want, feel free to merge. Thanks!

[migmartri]

why of this specific digest? which one does it correspond?

[migmartri]

update: I understand now, this is because now we are using upload not upload file

For this, since you do not care about the case when the upload fails, you can just add mock.anything in the digest arg.

[migmartri]

I am not 100% about these changes. Especially the fact that the content and the ahs are now separate. I am wondering if an alternative less optimal, but that will require less changes would have been to store the content in a temporary file. Not sure, I'd love to get your take

[migmartri]

Taking into account that the grunt of these changes are because of we want to provide some modified versions of a provided file, an alternative, would have been to during the attestation material craft, take the resulted marshalled data and store it in a temporary file and use that one instead.

Then, the rest of the code wouldn't have changed.

[jiparis]

Yes, cleaner for sure. Let me refactor a little bit the change.

[migmartri]

btw, have you tested this and see what's the result in the index?

For future PRs, it would be great if you could add some snippets, demos of the functionality when possible.

Thanks!

[migmartri]

I am having some issues while running it locally

cat /tmp/att.json                                                        
{
   "payloadType": "application/vnd.in-toto+json",
   "payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoiY2hhaW5sb29wLndvcmtmbG93LnRlc3QyIiwiZGlnZXN0Ijp7InNoYTI1NiI6IjE1MTAwMzA1OWJmOTRiMTViZTMzNTBiZTc5MGM5MGEyYzE5MzBjOWU0Y2ZkYzQwOTEyYmMxY2UzM2Y3YzFmZGQifX0seyJuYW1lIjoiZ2l0LmhlYWQiLCJkaWdlc3QiOnsic2hhMSI6IjM1MTBkZDE1YzJiYTRmMWFkMDk0YjVlNTI3ZjNjYTAxNjVhNjk2MDAifSwiYW5ub3RhdGlvbnMiOnsiYXV0aG9yLmVtYWlsIjoibWlndWVsQGNoYWlubG9vcC5kZXYiLCJhdXRob3IubmFtZSI6Ik1pZ3VlbCBNYXJ0aW5leiBUcml2aW5vIiwiZGF0ZSI6IjIwMjQtMDQtMzBUMDY6Mjg6NDZaIiwibWVzc2FnZSI6ImZlYXQoY2xpKTogYWRkIGpzb24gb3V0cHV0IHRvIGF0dGVzdGF0aW9uIHB1c2hcblxuU2lnbmVkLW9mZi1ieTogTWlndWVsIE1hcnRpbmV6IFRyaXZpbm8gPG1pZ3VlbEBjaGFpbmxvb3AuZGV2PlxuIiwicmVtb3RlcyI6W3sibmFtZSI6Im9yaWdpbiIsInVybCI6ImdpdEBnaXRodWIuY29tOm1pZ21hcnRyaS9jaGFpbmxvb3AuZ2l0In0seyJuYW1lIjoidXBzdHJlYW0iLCJ1cmwiOiJnaXRAZ2l0aHViLmNvbTpjaGFpbmxvb3AtZGV2L2NoYWlubG9vcC5naXQifSx7Im5hbWUiOiJ0ZXN0LXRva2VuIiwidXJsIjoiaHR0cHM6Ly9naXRsYWItY2ktdG9rZW46Z2xjYnQtNjVfNVg2dUR6SlZSeDlyU3pnZFdES1pAZ2l0aHViLmNvbS9jaGFpbmxvb3AtZGV2L2NoYWlubG9vcC5naXQifV19fV0sInByZWRpY2F0ZVR5cGUiOiJjaGFpbmxvb3AuZGV2L2F0dGVzdGF0aW9uL3YwLjIiLCJwcmVkaWNhdGUiOnsiYnVpbGRUeXBlIjoiY2hhaW5sb29wLmRldi93b3JrZmxvd3J1bi92MC4xIiwiYnVpbGRlciI6eyJpZCI6ImNoYWlubG9vcC5kZXYvY2xpL2RldkBzaGEyNTY6MmE0ZGE4MGU5Y2IzZDJkZTU5YmVjZTAwNmEwOWZlOGNlN2RiZmJmYWQ3MDQ2MTcyMDIzYzY5N2VjMTc4MDcyMCJ9LCJtZXRhZGF0YSI6eyJmaW5pc2hlZEF0IjoiMjAyNC0wNC0zMFQwNjozMjoxOC41NjEwOTA2MzhaIiwiaW5pdGlhbGl6ZWRBdCI6IjIwMjQtMDQtMzBUMDY6MzI6MTEuNjkyOTUyOTk0WiIsIm5hbWUiOiJ0ZXN0MiIsIm9yZ2FuaXphdGlvbiI6ImZvbyIsInByb2plY3QiOiJiYXIiLCJ0ZWFtIjoiIiwid29ya2Zsb3dJRCI6IjY1MmRkMmExLTE0NjItNGFhMC05OTVmLTFlMjg2NWFkMjY3NiIsIndvcmtmbG93UnVuSUQiOiJiYzE2NzhlYy1iMGIzLTQxYWYtYmVhZC1lNzViYzBjNTRiMmMifSwicnVubmVyVHlwZSI6IlJVTk5FUl9UWVBFX1VOU1BFQ0lGSUVEIn19",
   "signatures": [
      {
         "keyid": "",
         "sig": "MEUCIDGBc8J4tpGaSyTcdHecnZOa725Tja4tozwtXNr6jSz7AiEA8xOts32aCmDs3TaUTyV8Tiv461gblt+ysfCT2OH9DFU="
      }
   ]
}

go run main.go --insecure att add --name deployment --value /tmp/att.json
WRN API contacted in insecure mode
ERR adding material: crafting material: uploading material: decoding digest: cannot parse hash: "att.json"

[migmartri]

See my latest comment.

[jiparis]

Thanks, @migmartri. Fixed!