grab attestation media type and predicate type from attestation bundle

src/ghcr-client.ts

@@ -238,7 +238,6 @@ export class Client {
     ).toString()
   }
 
-  // TODO: Add retries with backoff
   private async fetchWithDebug(
     url: string,
     config: RequestInit = {}

src/main.ts

@@ -60,24 +60,26 @@ export async function run(): Promise<void> {
 
     // Attestations are not supported in GHES.
     if (!options.isEnterprise) {
-      const { bundle, bundleDigest } = await generateAttestation(
-        manifestDigest,
-        semverTag.raw,
-        options
-      )
+      const { bundle, bundleDigest, bundleMediaType, bundlePredicateType } =
+        await generateAttestation(manifestDigest, semverTag.raw, options)
 
       const attestationCreated = new Date()
       const attestationManifest =
         ociContainer.createSigstoreAttestationManifest(
           bundle.length,
           bundleDigest,
+          bundleMediaType,
+          bundlePredicateType,
           ociContainer.sizeInBytes(manifest),
           manifestDigest,
           attestationCreated
         )
+
       const referrerIndexManifest = ociContainer.createReferrerTagManifest(
         ociContainer.sha256Digest(attestationManifest),
         ociContainer.sizeInBytes(attestationManifest),
+        bundleMediaType,
+        bundlePredicateType,
         attestationCreated
       )
 
@@ -221,6 +223,8 @@ async function generateAttestation(
 ): Promise<{
   bundle: Buffer
   bundleDigest: string
+  bundleMediaType: string
+  bundlePredicateType: string
 }> {
   const subjectName = `${options.nameWithOwner}@${semverTag}`
   const subjectDigest = removePrefix(manifestDigest, 'sha256:')
@@ -241,7 +245,26 @@ async function generateAttestation(
   hash.update(bundleArtifact)
   const bundleSHA = hash.digest('hex')
 
-  return { bundle: bundleArtifact, bundleDigest: `sha256:${bundleSHA}` }
+  // We must base64 decode the dsse envelope to grab the predicate type
+  const dsseEnvelopeArtifact = attestation.bundle.dsseEnvelope
+  if (dsseEnvelopeArtifact === undefined) {
+    throw new Error('Attestation bundle is missing dsseEnvelope artifact')
+  }
+
+  const dsseEnvelope = JSON.parse(
+    Buffer.from(dsseEnvelopeArtifact.payload, 'base64').toString('utf-8')
+  )
+  const predicateType = dsseEnvelope.predicateType
+  if (predicateType === undefined) {
+    throw new Error('Attestation bundle is missing predicateType')
+  }
+
+  return {
+    bundle: bundleArtifact,
+    bundleDigest: `sha256:${bundleSHA}`,
+    bundleMediaType: attestation.bundle.mediaType,
+    bundlePredicateType: predicateType
+  }
 }
 
 function removePrefix(str: string, prefix: string): string {

src/oci-container.ts

@@ -10,8 +10,6 @@ export const actionsPackageTarLayerMediaType =
   'application/vnd.github.actions.package.layer.v1.tar+gzip'
 export const actionsPackageZipLayerMediaType =
   'application/vnd.github.actions.package.layer.v1.zip'
-export const sigstoreBundleMediaType =
-  'application/vnd.dev.sigstore.bundle.v0.3+json'
 
 export const actionPackageAnnotationValue = 'actions_oci_pkg'
 export const actionPackageAttestationAnnotationValue =
@@ -89,6 +87,8 @@ export function createActionPackageManifest(
 export function createSigstoreAttestationManifest(
   bundleSize: number,
   bundleDigest: string,
+  bundleMediaType: string,
+  bundlePredicateType: string,
   subjectSize: number,
   subjectDigest: string,
   created: Date = new Date()
@@ -96,7 +96,7 @@ export function createSigstoreAttestationManifest(
   const configLayer = createEmptyConfigLayer()
 
   const sigstoreAttestationLayer: Descriptor = {
-    mediaType: sigstoreBundleMediaType,
+    mediaType: bundleMediaType,
     size: bundleSize,
     digest: bundleDigest
   }
@@ -110,14 +110,14 @@ export function createSigstoreAttestationManifest(
   const manifest: OCIImageManifest = {
     schemaVersion: 2,
     mediaType: imageManifestMediaType,
-    artifactType: sigstoreBundleMediaType,
+    artifactType: bundleMediaType,
     config: configLayer,
     layers: [sigstoreAttestationLayer],
     subject,
 
     annotations: {
       'dev.sigstore.bundle.content': 'dsse-envelope',
-      'dev.sigstore.bundle.predicateType': 'https://slsa.dev/provenance/v1',
+      'dev.sigstore.bundle.predicateType': bundlePredicateType,
       'com.github.package.type': actionPackageAttestationAnnotationValue,
       'org.opencontainers.image.created': created.toISOString()
     }
@@ -129,6 +129,8 @@ export function createSigstoreAttestationManifest(
 export function createReferrerTagManifest(
   attestationDigest: string,
   attestationSize: number,
+  bundleMediaType: string,
+  bundlePredicateType: string,
   attestationCreated: Date,
   created: Date = new Date()
 ): OCIIndexManifest {
@@ -138,14 +140,14 @@ export function createReferrerTagManifest(
     manifests: [
       {
         mediaType: imageManifestMediaType,
-        artifactType: sigstoreBundleMediaType,
+        artifactType: bundleMediaType,
         size: attestationSize,
         digest: attestationDigest,
         annotations: {
           'com.github.package.type': actionPackageAttestationAnnotationValue,
           'org.opencontainers.image.created': attestationCreated.toISOString(),
           'dev.sigstore.bundle.content': 'dsse-envelope',
-          'dev.sigstore.bundle.predicateType': 'https://slsa.dev/provenance/v1'
+          'dev.sigstore.bundle.predicateType': bundlePredicateType
         }
       }
     ],