grab attestation media type and predicate type from attestation bundle

dist/index.js

@@ -106812,7 +106812,6 @@ class Client {
     manifestEndpoint(repository, version) {
         return new URL(`v2/${repository}/manifests/${version}`, this._registry).toString();
     }
-    // TODO: Add retries with backoff
     async fetchWithDebug(url, config = {}) {
         core.debug(`Request from ${url} with config: ${JSON.stringify(config)}`);
         try {
@@ -106962,10 +106961,10 @@ async function run() {
         const ghcrClient = new ghcr.Client(options.token, options.containerRegistryUrl);
         // Attestations are not supported in GHES.
         if (!options.isEnterprise) {
-            const { bundle, bundleDigest } = await generateAttestation(manifestDigest, semverTag.raw, options);
+            const { bundle, bundleDigest, bundleMediaType, bundlePredicateType } = await generateAttestation(manifestDigest, semverTag.raw, options);
             const attestationCreated = new Date();
-            const attestationManifest = ociContainer.createSigstoreAttestationManifest(bundle.length, bundleDigest, ociContainer.sizeInBytes(manifest), manifestDigest, attestationCreated);
-            const referrerIndexManifest = ociContainer.createReferrerTagManifest(ociContainer.sha256Digest(attestationManifest), ociContainer.sizeInBytes(attestationManifest), attestationCreated);
+            const attestationManifest = ociContainer.createSigstoreAttestationManifest(bundle.length, bundleDigest, bundleMediaType, bundlePredicateType, ociContainer.sizeInBytes(manifest), manifestDigest, attestationCreated);
+            const referrerIndexManifest = ociContainer.createReferrerTagManifest(ociContainer.sha256Digest(attestationManifest), ociContainer.sizeInBytes(attestationManifest), bundleMediaType, bundlePredicateType, attestationCreated);
             const { attestationSHA, referrerIndexSHA } = await publishAttestation(ghcrClient, options.nameWithOwner, bundle, bundleDigest, manifest, attestationManifest, referrerIndexManifest);
             if (attestationSHA !== undefined) {
                 core.info(`Uploaded attestation ${attestationSHA}`);
@@ -107039,7 +107038,22 @@ async function generateAttestation(manifestDigest, semverTag, options) {
     const hash = crypto.createHash('sha256');
     hash.update(bundleArtifact);
     const bundleSHA = hash.digest('hex');
-    return { bundle: bundleArtifact, bundleDigest: `sha256:${bundleSHA}` };
+    // We must base64 decode the dsse envelope to grab the predicate type
+    const dsseEnvelopeArtifact = attestation.bundle.dsseEnvelope;
+    if (dsseEnvelopeArtifact === undefined) {
+        throw new Error('Attestation bundle is missing dsseEnvelope artifact');
+    }
+    const dsseEnvelope = JSON.parse(Buffer.from(dsseEnvelopeArtifact.payload, 'base64').toString('utf-8'));
+    const predicateType = dsseEnvelope.predicateType;
+    if (predicateType === undefined) {
+        throw new Error('Attestation bundle is missing predicateType');
+    }
+    return {
+        bundle: bundleArtifact,
+        bundleDigest: `sha256:${bundleSHA}`,
+        bundleMediaType: attestation.bundle.mediaType,
+        bundlePredicateType: predicateType
+    };
 }
 function removePrefix(str, prefix) {
     if (str.startsWith(prefix)) {
@@ -107080,7 +107094,7 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.emptyConfigSha = exports.emptyConfigSize = exports.ociEmptyMediaType = exports.actionPackageReferrerTagAnnotationValue = exports.actionPackageAttestationAnnotationValue = exports.actionPackageAnnotationValue = exports.sigstoreBundleMediaType = exports.actionsPackageZipLayerMediaType = exports.actionsPackageTarLayerMediaType = exports.actionsPackageMediaType = exports.imageManifestMediaType = exports.imageIndexMediaType = void 0;
+exports.emptyConfigSha = exports.emptyConfigSize = exports.ociEmptyMediaType = exports.actionPackageReferrerTagAnnotationValue = exports.actionPackageAttestationAnnotationValue = exports.actionPackageAnnotationValue = exports.actionsPackageZipLayerMediaType = exports.actionsPackageTarLayerMediaType = exports.actionsPackageMediaType = exports.imageManifestMediaType = exports.imageIndexMediaType = void 0;
 exports.createActionPackageManifest = createActionPackageManifest;
 exports.createSigstoreAttestationManifest = createSigstoreAttestationManifest;
 exports.createReferrerTagManifest = createReferrerTagManifest;
@@ -107093,7 +107107,6 @@ exports.imageManifestMediaType = 'application/vnd.oci.image.manifest.v1+json';
 exports.actionsPackageMediaType = 'application/vnd.github.actions.package.v1+json';
 exports.actionsPackageTarLayerMediaType = 'application/vnd.github.actions.package.layer.v1.tar+gzip';
 exports.actionsPackageZipLayerMediaType = 'application/vnd.github.actions.package.layer.v1.zip';
-exports.sigstoreBundleMediaType = 'application/vnd.dev.sigstore.bundle.v0.3+json';
 exports.actionPackageAnnotationValue = 'actions_oci_pkg';
 exports.actionPackageAttestationAnnotationValue = 'actions_oci_pkg_attestation';
 exports.actionPackageReferrerTagAnnotationValue = 'actions_oci_pkg_referrer_index';
@@ -107125,10 +107138,10 @@ function createActionPackageManifest(tarFile, zipFile, repository, repoId, owner
     };
     return manifest;
 }
-function createSigstoreAttestationManifest(bundleSize, bundleDigest, subjectSize, subjectDigest, created = new Date()) {
+function createSigstoreAttestationManifest(bundleSize, bundleDigest, bundleMediaType, bundlePredicateType, subjectSize, subjectDigest, created = new Date()) {
     const configLayer = createEmptyConfigLayer();
     const sigstoreAttestationLayer = {
-        mediaType: exports.sigstoreBundleMediaType,
+        mediaType: bundleMediaType,
         size: bundleSize,
         digest: bundleDigest
     };
@@ -107140,34 +107153,34 @@ function createSigstoreAttestationManifest(bundleSize, bundleDigest, subjectSize
     const manifest = {
         schemaVersion: 2,
         mediaType: exports.imageManifestMediaType,
-        artifactType: exports.sigstoreBundleMediaType,
+        artifactType: bundleMediaType,
         config: configLayer,
         layers: [sigstoreAttestationLayer],
         subject,
         annotations: {
             'dev.sigstore.bundle.content': 'dsse-envelope',
-            'dev.sigstore.bundle.predicateType': 'https://slsa.dev/provenance/v1',
+            'dev.sigstore.bundle.predicateType': bundlePredicateType,
             'com.github.package.type': exports.actionPackageAttestationAnnotationValue,
             'org.opencontainers.image.created': created.toISOString()
         }
     };
     return manifest;
 }
-function createReferrerTagManifest(attestationDigest, attestationSize, attestationCreated, created = new Date()) {
+function createReferrerTagManifest(attestationDigest, attestationSize, bundleMediaType, bundlePredicateType, attestationCreated, created = new Date()) {
     const manifest = {
         schemaVersion: 2,
         mediaType: exports.imageIndexMediaType,
         manifests: [
             {
                 mediaType: exports.imageManifestMediaType,
-                artifactType: exports.sigstoreBundleMediaType,
+                artifactType: bundleMediaType,
                 size: attestationSize,
                 digest: attestationDigest,
                 annotations: {
                     'com.github.package.type': exports.actionPackageAttestationAnnotationValue,
                     'org.opencontainers.image.created': attestationCreated.toISOString(),
                     'dev.sigstore.bundle.content': 'dsse-envelope',
-                    'dev.sigstore.bundle.predicateType': 'https://slsa.dev/provenance/v1'
+                    'dev.sigstore.bundle.predicateType': bundlePredicateType
                 }
             }
         ],