add new OCI manifests for attestations

2024-08-22 18:13:15 +01:00
parent c11354f432
commit e44432d3e5
6 changed files with 377 additions and 106 deletions
@@ -182,7 +182,7 @@ function configureFetchMock(
  )
 }

-const testManifest: ociContainer.Manifest = {
+const testManifest: ociContainer.OCIImageManifest = {
  schemaVersion: 2,
  mediaType: 'application/vnd.oci.image.manifest.v1+json',
  artifactType: 'application/vnd.oci.image.manifest.v1+json',
@@ -526,8 +526,10 @@ function validateRequestConfig(url: string, config: any): void {
  }
 }

-function cloneLayers(layers: ociContainer.Layer[]): ociContainer.Layer[] {
-  const result: ociContainer.Layer[] = []
+function cloneLayers(
+  layers: ociContainer.Descriptor[]
+): ociContainer.Descriptor[] {
+  const result: ociContainer.Descriptor[] = []
  for (const layer of layers) {
    result.push({ ...layer }) // this is _NOT_ a deep clone
  }
@@ -1,36 +1,19 @@
-import { createActionPackageManifest, sha256Digest } from '../src/oci-container'
+import {
+  createActionPackageManifest,
+  sha256Digest,
+  sizeInBytes,
+  OCIImageManifest,
+  createSigstoreAttestationManifest,
+  OCIIndexManifest,
+  createReferrerTagManifest
+} from '../src/oci-container'
 import { FileMetadata } from '../src/fs-helper'

+const createdTimestamp = '2021-01-01T00:00:00.000Z'
+
 describe('sha256Digest', () => {
  it('calculates the SHA256 digest of the provided manifest', () => {
-    const date = new Date('2021-01-01T00:00:00Z')
-    const repo = 'test-org/test-repo'
-    const version = '1.2.3'
-    const repoId = '123'
-    const ownerId = '456'
-    const sourceCommit = 'abc'
-    const tarFile: FileMetadata = {
-      path: '/test/test/test.tar.gz',
-      sha256: 'tarSha',
-      size: 123
-    }
-    const zipFile: FileMetadata = {
-      path: '/test/test/test.zip',
-      sha256: 'zipSha',
-      size: 456
-    }
-
-    const manifest = createActionPackageManifest(
-      tarFile,
-      zipFile,
-      repo,
-      repoId,
-      ownerId,
-      sourceCommit,
-      version,
-      date
-    )
-
+    const { manifest } = testActionPackageManifest()
    const digest = sha256Digest(manifest)
    const expectedDigest =
      'sha256:dd8537ef913cf87e25064a074973ed2c62699f1dbd74d0dd78e85d394a5758b5'
@@ -39,25 +22,17 @@ describe('sha256Digest', () => {
  })
 })

+describe('size', () => {
+  it('returns the total size of the provided manifest', () => {
+    const { manifest } = testActionPackageManifest()
+    const size = sizeInBytes(manifest)
+    expect(size).toBe(1133)
+  })
+})
+
 describe('createActionPackageManifest', () => {
  it('creates a manifest containing the provided information', () => {
-    const date = new Date()
-    const repo = 'test-org/test-repo'
-    const sanitizedRepo = 'test-org-test-repo'
-    const version = '1.2.3'
-    const repoId = '123'
-    const ownerId = '456'
-    const sourceCommit = 'abc'
-    const tarFile: FileMetadata = {
-      path: '/test/test/test.tar.gz',
-      sha256: 'tarSha',
-      size: 123
-    }
-    const zipFile: FileMetadata = {
-      path: '/test/test/test.zip',
-      sha256: 'zipSha',
-      size: 456
-    }
+    const { manifest, zipFile, tarFile } = testActionPackageManifest()

    const expectedJSON = `{
            "schemaVersion": 2,
@@ -79,7 +54,7 @@ describe('createActionPackageManifest', () => {
                    "size":${tarFile.size},
                    "digest":"${tarFile.sha256}",
                    "annotations":{
-                        "org.opencontainers.image.title":"${sanitizedRepo}_${version}.tar.gz"
+                        "org.opencontainers.image.title":"test-org-test-repo_1.2.3.tar.gz"
                    }
                },
                {
@@ -87,12 +62,12 @@ describe('createActionPackageManifest', () => {
                    "size":${zipFile.size},
                    "digest":"${zipFile.sha256}",
                    "annotations":{
-                        "org.opencontainers.image.title":"${sanitizedRepo}_${version}.zip"
+                        "org.opencontainers.image.title":"test-org-test-repo_1.2.3.zip"
                    }
                }
            ],
            "annotations":{
-                "org.opencontainers.image.created":"${date.toISOString()}",
+                "org.opencontainers.image.created":"${createdTimestamp}",
                "action.tar.gz.digest":"${tarFile.sha256}",
                "action.zip.digest":"${zipFile.sha256}",
                "com.github.package.type":"actions_oci_pkg",
@@ -103,26 +78,141 @@ describe('createActionPackageManifest', () => {
            }
        }`

-    const manifest = createActionPackageManifest(
-      {
-        path: 'test.tar.gz',
-        size: tarFile.size,
-        sha256: tarFile.sha256
-      },
-      {
-        path: 'test.zip',
-        size: zipFile.size,
-        sha256: zipFile.sha256
-      },
-      repo,
-      repoId,
-      ownerId,
-      sourceCommit,
-      version,
-      date
-    )
-
    const manifestJSON = JSON.stringify(manifest)
    expect(manifestJSON).toEqual(expectedJSON.replace(/\s/g, ''))
  })
 })
+
+describe('createSigstoreAttestationManifest', () => {
+  it('creates a manifest containing the provided information', () => {
+    const manifest = testAttestationManifest()
+
+    const expectedJSON = `{
+  "schemaVersion": 2,
+  "mediaType": "application/vnd.oci.image.manifest.v1+json",
+  "artifactType": "application/vnd.dev.sigstore.bundle.v0.3+json",
+  "config": {
+    "mediaType": "application/vnd.oci.empty.v1+json",
+    "size": 2,
+    "digest": "sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a"
+  },
+  "layers": [
+    {
+      "mediaType": "application/vnd.dev.sigstore.bundle.v0.3+json",
+      "size": 10,
+      "digest": "bundleDigest"
+    }
+  ],
+  "subject": {
+    "mediaType": "application/vnd.oci.image.manifest.v1+json",
+    "size": 100,
+    "digest": "subjectDigest"
+  },
+  "annotations": {
+    "dev.sigstore.bundle.content": "dsse-envelope",
+    "dev.sigstore.bundle.predicateType": "https://slsa.dev/provenance/v1",
+    "com.github.package.type": "actions_oci_pkg_attestation",
+    "org.opencontainers.image.created": "2021-01-01T00:00:00.000Z"
+  }
+}
+`
+
+    const manifestJSON = JSON.stringify(manifest)
+
+    expect(manifestJSON).toEqual(expectedJSON.replace(/\s/g, ''))
+  })
+})
+
+describe('createReferrerIndexManifest', () => {
+  it('creates a manifest containing the provided information', () => {
+    const manifest = testReferrerIndexManifest()
+
+    const expectedJSON = `
+{
+  "schemaVersion": 2,
+  "mediaType": "application/vnd.oci.image.index.v1+json",
+  "manifests": [
+    {
+      "mediaType": "application/vnd.oci.image.manifest.v1+json",
+      "artifactType": "application/vnd.dev.sigstore.bundle.v0.3+json",
+      "size": 100,
+      "digest": "attDigest",
+      "annotations": {
+        "com.github.package.type": "actions_oci_pkg_attestation",
+        "org.opencontainers.image.created": "2021-01-01T00:00:00.000Z",
+        "dev.sigstore.bundle.content": "dsse-envelope",
+        "dev.sigstore.bundle.predicateType": "https://slsa.dev/provenance/v1"
+      }
+    }
+  ],
+  "annotations": {
+    "com.github.package.type": "actions_oci_pkg_referrer_tag",
+    "org.opencontainers.image.created": "2021-01-01T00:00:00.000Z"
+  }
+}
+            `
+
+    const manifestJSON = JSON.stringify(manifest)
+
+    expect(manifestJSON).toEqual(expectedJSON.replace(/\s/g, ''))
+  })
+})
+
+function testActionPackageManifest(): {
+  manifest: OCIImageManifest
+  tarFile: FileMetadata
+  zipFile: FileMetadata
+} {
+  const date = new Date('2021-01-01T00:00:00Z')
+  const repo = 'test-org/test-repo'
+  const version = '1.2.3'
+  const repoId = '123'
+  const ownerId = '456'
+  const sourceCommit = 'abc'
+  const tarFile: FileMetadata = {
+    path: '/test/test/test.tar.gz',
+    sha256: 'tarSha',
+    size: 123
+  }
+  const zipFile: FileMetadata = {
+    path: '/test/test/test.zip',
+    sha256: 'zipSha',
+    size: 456
+  }
+
+  const manifest = createActionPackageManifest(
+    tarFile,
+    zipFile,
+    repo,
+    repoId,
+    ownerId,
+    sourceCommit,
+    version,
+    date
+  )
+
+  return {
+    manifest,
+    tarFile,
+    zipFile
+  }
+}
+
+function testAttestationManifest(): OCIImageManifest {
+  return createSigstoreAttestationManifest(
+    10,
+    'bundleDigest',
+    100,
+    'subjectDigest',
+    new Date(createdTimestamp)
+  )
+}
+
+function testReferrerIndexManifest(): OCIIndexManifest {
+  return createReferrerTagManifest(
+    'attDigest',
+    100,
+    new Date(createdTimestamp),
+    new Date(createdTimestamp)
+  )
+}