fix pipelunerun provenance when multiple tasks have the same name (ca…

pkg/chains/formats/slsa/extract/extract.go

@@ -80,15 +80,20 @@ func subjectsFromPipelineRun(ctx context.Context, obj objects.TektonObject, slsa
 		pipelineTasks := pSpec.Tasks
 		pipelineTasks = append(pipelineTasks, pSpec.Finally...)
 		for _, t := range pipelineTasks {
-			tr := pro.GetTaskRunFromTask(t.Name)
-			// Ignore Tasks that did not execute during the PipelineRun.
-			if tr == nil || tr.Status.CompletionTime == nil {
-				logger.Infof("taskrun status not found for task %s", t.Name)
+			taskRuns := pro.GetTaskRunsFromTask(t.Name)
+			if len(taskRuns) == 0 {
+				logger.Infof("no taskruns found for task %s", t.Name)
 				continue
 			}
-
-			trSubjects := subjectsFromTektonObject(ctx, tr)
-			result = artifact.AppendSubjects(result, trSubjects...)
+			for _, tr := range taskRuns {
+				// Ignore Tasks that did not execute during the PipelineRun.
+				if tr == nil || tr.Status.CompletionTime == nil {
+					logger.Infof("taskrun status not found for task %s", t.Name)
+					continue
+				}
+				trSubjects := subjectsFromTektonObject(ctx, tr)
+				result = artifact.AppendSubjects(result, trSubjects...)
+			}
 		}
 	}
 

pkg/chains/formats/slsa/extract/v1beta1/extract.go

@@ -74,14 +74,20 @@ func SubjectsFromPipelineRunV1Beta1(ctx context.Context, obj objects.TektonObjec
 	if pSpec != nil {
 		pipelineTasks := append(pSpec.Tasks, pSpec.Finally...)
 		for _, t := range pipelineTasks {
-			tr := pro.GetTaskRunFromTask(t.Name)
-			// Ignore Tasks that did not execute during the PipelineRun.
-			if tr == nil || tr.Status.CompletionTime == nil {
-				logger.Infof("taskrun status not found for task %s", t.Name)
+			taskRuns := pro.GetTaskRunsFromTask(t.Name)
+			if len(taskRuns) == 0 {
+				logger.Infof("no taskruns found for task %s", t.Name)
 				continue
 			}
-			trSubjects := SubjectsFromTektonObjectV1Beta1(ctx, tr)
-			result = artifact.AppendSubjects(result, trSubjects...)
+			for _, tr := range taskRuns {
+				// Ignore Tasks that did not execute during the PipelineRun.
+				if tr == nil || tr.Status.CompletionTime == nil {
+					logger.Infof("taskrun status not found for task %s", t.Name)
+					continue
+				}
+				trSubjects := SubjectsFromTektonObjectV1Beta1(ctx, tr)
+				result = artifact.AppendSubjects(result, trSubjects...)
+			}
 		}
 	}
 

pkg/chains/formats/slsa/internal/material/material.go

@@ -81,33 +81,37 @@ func PipelineMaterials(ctx context.Context, pro *objects.PipelineRunObjectV1, sl
 	if pSpec != nil {
 		pipelineTasks := append(pSpec.Tasks, pSpec.Finally...)
 		for _, t := range pipelineTasks {
-			tr := pro.GetTaskRunFromTask(t.Name)
-			// Ignore Tasks that did not execute during the PipelineRun.
-			if tr == nil || tr.Status.CompletionTime == nil {
-				logger.Infof("taskrun status not found for task %s", t.Name)
+			taskRuns := pro.GetTaskRunsFromTask(t.Name)
+			if len(taskRuns) == 0 {
+				logger.Infof("no taskruns found for task %s", t.Name)
 				continue
 			}
-
-			stepMaterials, err := FromStepImages(tr)
-			if err != nil {
-				return mats, err
-			}
-			mats = artifact.AppendMaterials(mats, stepMaterials...)
-
-			// add sidecar images
-			sidecarMaterials, err := FromSidecarImages(tr)
-			if err != nil {
-				return nil, err
-			}
-			mats = artifact.AppendMaterials(mats, sidecarMaterials...)
-
-			// add remote task configsource information in materials
-			if tr.Status.Provenance != nil && tr.Status.Provenance.RefSource != nil {
-				m := common.ProvenanceMaterial{
-					URI:    tr.Status.Provenance.RefSource.URI,
-					Digest: tr.Status.Provenance.RefSource.Digest,
+			for _, tr := range taskRuns {
+				// Ignore Tasks that did not execute during the PipelineRun.
+				if tr == nil || tr.Status.CompletionTime == nil {
+					logger.Infof("taskrun status not found for task %s", t.Name)
+					continue
+				}
+				stepMaterials, err := FromStepImages(tr)
+				if err != nil {
+					return mats, err
+				}
+				mats = artifact.AppendMaterials(mats, stepMaterials...)
+				// add sidecar images
+				sidecarMaterials, err := FromSidecarImages(tr)
+				if err != nil {
+					return nil, err
+				}
+				mats = artifact.AppendMaterials(mats, sidecarMaterials...)
+
+				// add remote task configsource information in materials
+				if tr.Status.Provenance != nil && tr.Status.Provenance.RefSource != nil {
+					m := common.ProvenanceMaterial{
+						URI:    tr.Status.Provenance.RefSource.URI,
+						Digest: tr.Status.Provenance.RefSource.Digest,
+					}
+					mats = artifact.AppendMaterials(mats, m)
 				}
-				mats = artifact.AppendMaterials(mats, m)
 			}
 		}
 	}
@@ -304,14 +308,20 @@ func FromPipelineParamsAndResults(ctx context.Context, pro *objects.PipelineRunO
 			logger := logging.FromContext(ctx)
 			pipelineTasks := append(pSpec.Tasks, pSpec.Finally...)
 			for _, t := range pipelineTasks {
-				tr := pro.GetTaskRunFromTask(t.Name)
-				// Ignore Tasks that did not execute during the PipelineRun.
-				if tr == nil || tr.Status.CompletionTime == nil {
-					logger.Infof("taskrun is not found or not completed for the task %s", t.Name)
+				taskRuns := pro.GetTaskRunsFromTask(t.Name)
+				if len(taskRuns) == 0 {
+					logger.Infof("no taskruns found for task %s", t.Name)
 					continue
 				}
-				materialsFromTasks := FromTaskParamsAndResults(ctx, tr)
-				mats = artifact.AppendMaterials(mats, materialsFromTasks...)
+				for _, tr := range taskRuns {
+					// Ignore Tasks that did not execute during the PipelineRun.
+					if tr == nil || tr.Status.CompletionTime == nil {
+						logger.Infof("taskrun is not found or not completed for the task %s", t.Name)
+						continue
+					}
+					materialsFromTasks := FromTaskParamsAndResults(ctx, tr)
+					mats = artifact.AppendMaterials(mats, materialsFromTasks...)
+				}
 			}
 		}
 

pkg/chains/formats/slsa/internal/material/v1beta1/material.go

@@ -77,33 +77,38 @@ func PipelineMaterials(ctx context.Context, pro *objects.PipelineRunObjectV1Beta
 		pipelineTasks := pSpec.Tasks
 		pipelineTasks = append(pipelineTasks, pSpec.Finally...)
 		for _, t := range pipelineTasks {
-			tr := pro.GetTaskRunFromTask(t.Name)
-			// Ignore Tasks that did not execute during the PipelineRun.
-			if tr == nil || tr.Status.CompletionTime == nil {
-				logger.Infof("taskrun status not found for task %s", t.Name)
+			taskRuns := pro.GetTaskRunsFromTask(t.Name)
+			if len(taskRuns) == 0 {
+				logger.Infof("no taskruns found for task %s", t.Name)
 				continue
 			}
+			for _, tr := range taskRuns {
+				// Ignore Tasks that did not execute during the PipelineRun.
+				if tr == nil || tr.Status.CompletionTime == nil {
+					logger.Infof("taskrun status not found for task %s", t.Name)
+					continue
+				}
+				stepMaterials, err := FromStepImages(tr)
+				if err != nil {
+					return mats, err
+				}
+				mats = artifact.AppendMaterials(mats, stepMaterials...)
 
-			stepMaterials, err := FromStepImages(tr)
-			if err != nil {
-				return mats, err
-			}
-			mats = artifact.AppendMaterials(mats, stepMaterials...)
-
-			// add sidecar images
-			sidecarMaterials, err := FromSidecarImages(tr)
-			if err != nil {
-				return nil, err
-			}
-			mats = artifact.AppendMaterials(mats, sidecarMaterials...)
-
-			// add remote task configsource information in materials
-			if tr.Status.Provenance != nil && tr.Status.Provenance.RefSource != nil {
-				m := common.ProvenanceMaterial{
-					URI:    tr.Status.Provenance.RefSource.URI,
-					Digest: tr.Status.Provenance.RefSource.Digest,
+				// add sidecar images
+				sidecarMaterials, err := FromSidecarImages(tr)
+				if err != nil {
+					return nil, err
+				}
+				mats = artifact.AppendMaterials(mats, sidecarMaterials...)
+
+				// add remote task configsource information in materials
+				if tr.Status.Provenance != nil && tr.Status.Provenance.RefSource != nil {
+					m := common.ProvenanceMaterial{
+						URI:    tr.Status.Provenance.RefSource.URI,
+						Digest: tr.Status.Provenance.RefSource.Digest,
+					}
+					mats = artifact.AppendMaterials(mats, m)
 				}
-				mats = artifact.AppendMaterials(mats, m)
 			}
 		}
 	}
@@ -273,14 +278,20 @@ func FromPipelineParamsAndResults(ctx context.Context, pro *objects.PipelineRunO
 			pipelineTasks := pSpec.Tasks
 			pipelineTasks = append(pipelineTasks, pSpec.Finally...)
 			for _, t := range pipelineTasks {
-				tr := pro.GetTaskRunFromTask(t.Name)
-				// Ignore Tasks that did not execute during the PipelineRun.
-				if tr == nil || tr.Status.CompletionTime == nil {
-					logger.Infof("taskrun is not found or not completed for the task %s", t.Name)
+				taskRuns := pro.GetTaskRunsFromTask(t.Name)
+				if len(taskRuns) == 0 {
+					logger.Infof("no taskruns found for task %s", t.Name)
 					continue
 				}
-				materialsFromTasks := FromTaskParamsAndResults(ctx, tr)
-				mats = artifact.AppendMaterials(mats, materialsFromTasks...)
+				for _, tr := range taskRuns {
+					// Ignore Tasks that did not execute during the PipelineRun.
+					if tr == nil || tr.Status.CompletionTime == nil {
+						logger.Infof("taskrun is not found or not completed for the task %s", t.Name)
+						continue
+					}
+					materialsFromTasks := FromTaskParamsAndResults(ctx, tr)
+					mats = artifact.AppendMaterials(mats, materialsFromTasks...)
+				}
 			}
 		}
 

pkg/chains/formats/slsa/internal/resolved_dependencies/resolved_dependencies.go

@@ -150,40 +150,46 @@ func fromPipelineTask(logger *zap.SugaredLogger, pro *objects.PipelineRunObjectV
 		pipelineTasks := pSpec.Tasks
 		pipelineTasks = append(pipelineTasks, pSpec.Finally...)
 		for _, t := range pipelineTasks {
-			tr := pro.GetTaskRunFromTask(t.Name)
-			// Ignore Tasks that did not execute during the PipelineRun.
-			if tr == nil || tr.Status.CompletionTime == nil {
-				logger.Infof("taskrun status not found for task %s", t.Name)
+			taskRuns := pro.GetTaskRunsFromTask(t.Name)
+			if len(taskRuns) == 0 {
+				logger.Infof("no taskruns found for task %s", t.Name)
 				continue
 			}
-			rd, err := addTasks(tr)
-			if err != nil {
-				logger.Errorf("error storing taskRun %s, error: %s", t.Name, err)
-				continue
-			}
-
-			if rd != nil {
-				resolvedDependencies = append(resolvedDependencies, rd)
-			}
+			for _, tr := range taskRuns {
+				// Ignore Tasks that did not execute during the PipelineRun.
+				if tr == nil || tr.Status.CompletionTime == nil {
+					logger.Infof("taskrun status not found for task %s", t.Name)
+					continue
+				}
+				rd, err := addTasks(tr)
+				if err != nil {
+					logger.Errorf("error storing taskRun %s, error: %s", t.Name, err)
+					continue
+				}
+				if rd != nil {
+					resolvedDependencies = append(resolvedDependencies, rd)
+				}
+
+				mats := []common.ProvenanceMaterial{}
+
+				// add step images
+				stepMaterials, err := material.FromStepImages(tr)
+				if err != nil {
+					return nil, err
+				}
+				mats = append(mats, stepMaterials...)
+
+				// add sidecar images
+				sidecarMaterials, err := material.FromSidecarImages(tr)
+				if err != nil {
+					return nil, err
+				}
+				mats = append(mats, sidecarMaterials...)
+
+				// convert materials to resolved dependencies
+				resolvedDependencies = append(resolvedDependencies, ConvertMaterialsToResolvedDependencies(mats, "")...)
 
-			mats := []common.ProvenanceMaterial{}
-
-			// add step images
-			stepMaterials, err := material.FromStepImages(tr)
-			if err != nil {
-				return nil, err
-			}
-			mats = append(mats, stepMaterials...)
-
-			// add sidecar images
-			sidecarMaterials, err := material.FromSidecarImages(tr)
-			if err != nil {
-				return nil, err
 			}
-			mats = append(mats, sidecarMaterials...)
-
-			// convert materials to resolved dependencies
-			resolvedDependencies = append(resolvedDependencies, ConvertMaterialsToResolvedDependencies(mats, "")...)
 		}
 	}
 	return resolvedDependencies, nil

pkg/chains/formats/slsa/testdata/pipeline-v1beta1/pipelinerun-childrefs.json

@@ -121,7 +121,7 @@
             {
                 "apiVersion": "tekton.dev/v1beta1",
                 "kind": "TaskRun",
-                "name": "taskrun-build",
+                "name": "taskrun-build-0",
                 "pipelineTaskName": "build"
             }
         ]