Skip to content

Commit

Permalink
provide support for multiple buildTypes. The initial types are to
Browse files Browse the repository at this point in the history
support more general slsa verifiers and provide more verbose output for
tekton verifiers. This implementation will default to the slsa
buildType.
  • Loading branch information
joejstuart committed Sep 15, 2023
1 parent 94d0d16 commit 639fce9
Show file tree
Hide file tree
Showing 17 changed files with 1,205 additions and 637 deletions.
2 changes: 2 additions & 0 deletions pkg/chains/formats/slsa/internal/slsaconfig/slsaconfig.go
Original file line number Diff line number Diff line change
Expand Up @@ -20,4 +20,6 @@ type SlsaConfig struct {
BuilderID string
// DeepInspectionEnabled configures whether to dive into child taskruns in a pipelinerun
DeepInspectionEnabled bool
// The buildType for the build definition
BuildType string
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
/*
Copyright 2023 The Tekton Authors
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package buildtypes

const (
SlsaBuildType = "https://tekton.dev/chains/v2/slsa"
TektonBuildType = "https://tekton.dev/chains/v2/slsa-tekton"
)
Original file line number Diff line number Diff line change
@@ -0,0 +1,60 @@
/*
Copyright 2023 The Tekton Authors
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package externalparameters

import (
"fmt"

"github.com/tektoncd/chains/pkg/chains/objects"
"github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1"
)

func buildConfigSource(provenance *v1beta1.Provenance) map[string]string {
ref := ""
for alg, hex := range provenance.RefSource.Digest {
ref = fmt.Sprintf("%s:%s", alg, hex)
break
}
buildConfigSource := map[string]string{
"ref": ref,
"repository": provenance.RefSource.URI,
"path": provenance.RefSource.EntryPoint,
}
return buildConfigSource
}

// PipelineRun adds the pipeline run spec and provenance if available
func PipelineRun(pro *objects.PipelineRunObject) map[string]any {
externalParams := make(map[string]any)

if provenance := pro.GetRemoteProvenance(); provenance != nil {
externalParams["buildConfigSource"] = buildConfigSource(provenance)
}
externalParams["runSpec"] = pro.Spec
return externalParams
}

// TaskRun adds the task run spec and provenance if available
func TaskRun(tro *objects.TaskRunObject) map[string]any {
externalParams := make(map[string]any)

if provenance := tro.GetRemoteProvenance(); provenance != nil {
externalParams["buildConfigSource"] = buildConfigSource(provenance)
}
externalParams["runSpec"] = tro.Spec
return externalParams
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,113 @@
/*
Copyright 2023 The Tekton Authors
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package externalparameters

import (
"testing"

"github.com/google/go-cmp/cmp"
"github.com/tektoncd/chains/pkg/chains/objects"
"github.com/tektoncd/chains/pkg/internal/objectloader"
"github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1"
)

func TestBuildConfigSource(t *testing.T) {
provenance := &v1beta1.Provenance{
RefSource: &v1beta1.RefSource{
Digest: map[string]string{"alg1": "hex1", "alg2": "hex2"},
URI: "https://tekton.com",
EntryPoint: "/path/to/entry",
},
}

want := map[string]string{
"ref": "alg1:hex1",
"repository": "https://tekton.com",
"path": "/path/to/entry",
}

got := buildConfigSource(provenance)

if diff := cmp.Diff(want, got); diff != "" {
t.Errorf("buildConfigSource(): -want +got: %s", diff)
}
}
func createPro(path string) *objects.PipelineRunObject {
pr, err := objectloader.PipelineRunFromFile(path)
if err != nil {
panic(err)
}
tr1, err := objectloader.TaskRunFromFile("../../../testdata/v2alpha2/taskrun1.json")
if err != nil {
panic(err)
}
tr2, err := objectloader.TaskRunFromFile("../../../testdata/v2alpha2/taskrun2.json")
if err != nil {
panic(err)
}
p := objects.NewPipelineRunObject(pr)
p.AppendTaskRun(tr1)
p.AppendTaskRun(tr2)
return p
}

func TestPipelineRun(t *testing.T) {
pro := createPro("../../../testdata/v2alpha2/pipelinerun1.json")

got := PipelineRun(pro)

want := map[string]any{
"runSpec": v1beta1.PipelineRunSpec{
PipelineRef: &v1beta1.PipelineRef{Name: "test-pipeline"},
Params: v1beta1.Params{
{
Name: "IMAGE",
Value: v1beta1.ParamValue{Type: "string", StringVal: "test.io/test/image"},
},
},
ServiceAccountName: "pipeline",
},
}

if diff := cmp.Diff(want, got); diff != "" {
t.Errorf("PipelineRun(): -want +got: %s", diff)
}
}

func TestTaskRun(t *testing.T) {
tr, err := objectloader.TaskRunFromFile("../../../testdata/v2alpha2/taskrun1.json")
if err != nil {
t.Fatal(err)
}
got := TaskRun(objects.NewTaskRunObject(tr))

want := map[string]any{
"runSpec": v1beta1.TaskRunSpec{
Params: v1beta1.Params{
{Name: "IMAGE", Value: v1beta1.ParamValue{Type: "string", StringVal: "test.io/test/image"}},
{Name: "CHAINS-GIT_COMMIT", Value: v1beta1.ParamValue{Type: "string", StringVal: "taskrun"}},
{Name: "CHAINS-GIT_URL", Value: v1beta1.ParamValue{Type: "string", StringVal: "https://git.test.com"}},
},
ServiceAccountName: "default",
TaskRef: &v1beta1.TaskRef{Name: "build", Kind: "Task"},
},
}

if diff := cmp.Diff(want, got); diff != "" {
t.Errorf("TaskRun(): -want +got: %s", diff)
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,42 @@
/*
Copyright 2023 The Tekton Authors
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package internalparameters

import (
"github.com/tektoncd/chains/pkg/chains/objects"
"github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1"
)

// SLSAInternalParameters provides the chains config as internalparameters
func SLSAInternalParameters(tko objects.TektonObject) map[string]any {
internalParams := make(map[string]any)
if provenance := tko.GetProvenance(); provenance != (*v1beta1.Provenance)(nil) && provenance.FeatureFlags != nil {
internalParams["tekton-pipelines-feature-flags"] = *provenance.FeatureFlags
}
return internalParams
}

// TektonInternalParameters provides the chains config as well as annotations and labels
func TektonInternalParameters(tko objects.TektonObject) map[string]any {
internalParams := make(map[string]any)
if provenance := tko.GetProvenance(); provenance != (*v1beta1.Provenance)(nil) && provenance.FeatureFlags != nil {
internalParams["tekton-pipelines-feature-flags"] = *provenance.FeatureFlags
}
internalParams["labels"] = tko.GetLabels()
internalParams["annotations"] = tko.GetAnnotations()
return internalParams
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,60 @@
/*
Copyright 2023 The Tekton Authors
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package internalparameters

import (
"testing"

"github.com/google/go-cmp/cmp"
"github.com/tektoncd/chains/pkg/chains/objects"
"github.com/tektoncd/chains/pkg/internal/objectloader"
"github.com/tektoncd/pipeline/pkg/apis/config"
)

func TestTektonInternalParameters(t *testing.T) {
tr, err := objectloader.TaskRunFromFile("../../../testdata/v2alpha2/taskrun1.json")
if err != nil {
t.Fatal(err)
}
tro := objects.NewTaskRunObject(tr)
got := TektonInternalParameters(tro)
want := map[string]any{
"labels": tro.GetLabels(),
"annotations": tro.GetAnnotations(),
"tekton-pipelines-feature-flags": config.FeatureFlags{EnableAPIFields: "beta", ResultExtractionMethod: "termination-message"},
}

if diff := cmp.Diff(want, got); diff != "" {
t.Errorf("TaskRun(): -want +got: %s", diff)
}
}

func TestSLSAInternalParameters(t *testing.T) {
tr, err := objectloader.TaskRunFromFile("../../../testdata/v2alpha2/taskrun1.json")
if err != nil {
t.Fatal(err)
}
tro := objects.NewTaskRunObject(tr)
got := SLSAInternalParameters(tro)
want := map[string]any{
"tekton-pipelines-feature-flags": config.FeatureFlags{EnableAPIFields: "beta", ResultExtractionMethod: "termination-message"},
}

if diff := cmp.Diff(want, got); diff != "" {
t.Errorf("TaskRun(): -want +got: %s", diff)
}
}
Loading

0 comments on commit 639fce9

Please sign in to comment.