Attestations refactoring

client/client_test.go

@@ -38,6 +38,7 @@ import (
 	"github.com/moby/buildkit/client/llb"
 	"github.com/moby/buildkit/exporter/containerimage/exptypes"
 	gateway "github.com/moby/buildkit/frontend/gateway/client"
+	gatewaypb "github.com/moby/buildkit/frontend/gateway/pb"
 	"github.com/moby/buildkit/identity"
 	"github.com/moby/buildkit/session"
 	"github.com/moby/buildkit/session/secrets/secretsprovider"
@@ -173,6 +174,7 @@ func TestIntegration(t *testing.T) {
 		testExportAnnotations,
 		testExportAnnotationsMediaTypes,
 		testExportAttestations,
+		testAttestationDefaultSubject,
 	)
 	tests = append(tests, diffOpTestCases()...)
 	integration.Run(t, tests, mirrors)
@@ -6488,25 +6490,28 @@ func testExportAttestations(t *testing.T, sb integration.Sandbox) {
 			if err != nil {
 				return nil, err
 			}
-			res.AddAttestation(pk, &result.InTotoAttestation{
-				PredicateRefKey: "foo",
-				PredicatePath:   "/attestation.json",
-				PredicateType:   "https://example.com/attestations/v1.0",
-				Subjects: []result.InTotoSubject{
-					&result.InTotoSubjectSelf{},
+			res.AddAttestation(pk, result.Attestation{
+				Kind: gatewaypb.AttestationKindInToto,
+				Path: "/attestation.json",
+				InToto: result.InTotoAttestation{
+					PredicateType: "https://example.com/attestations/v1.0",
+					Subjects: []result.InTotoSubject{{
+						Kind: gatewaypb.InTotoSubjectKindSelf,
+					}},
 				},
-			}, map[string]gateway.Reference{"foo": refAttest})
-			res.AddAttestation(pk, &result.InTotoAttestation{
-				PredicateRefKey: "bar",
-				PredicatePath:   "/attestation2.json",
-				PredicateType:   "https://example.com/attestations2/v1.0",
-				Subjects: []result.InTotoSubject{
-					&result.InTotoSubjectRaw{
+			}, refAttest)
+			res.AddAttestation(pk, result.Attestation{
+				Kind: gatewaypb.AttestationKindInToto,
+				Path: "/attestation2.json",
+				InToto: result.InTotoAttestation{
+					PredicateType: "https://example.com/attestations2/v1.0",
+					Subjects: []result.InTotoSubject{{
+						Kind:   gatewaypb.InTotoSubjectKindRaw,
 						Name:   "/attestation.json",
 						Digest: []digest.Digest{successDigest},
-					},
+					}},
 				},
-			}, map[string]gateway.Reference{"bar": refAttest})
+			}, refAttest)
 		}
 
 		dt, err := json.Marshal(expPlatforms)
@@ -6606,6 +6611,138 @@ func testExportAttestations(t *testing.T, sb integration.Sandbox) {
 	checkAllReleasable(t, c, sb, true)
 }
 
+func testAttestationDefaultSubject(t *testing.T, sb integration.Sandbox) {
+	requiresLinux(t)
+	c, err := New(sb.Context(), sb.Address())
+	require.NoError(t, err)
+
+	registry, err := sb.NewRegistry()
+	if errors.Is(err, integration.ErrRequirements) {
+		t.Skip(err.Error())
+	}
+
+	ps := []ocispecs.Platform{
+		platforms.MustParse("linux/amd64"),
+	}
+
+	success := []byte(`{"success": true}`)
+
+	frontend := func(ctx context.Context, c gateway.Client) (*gateway.Result, error) {
+		res := gateway.NewResult()
+		expPlatforms := &exptypes.Platforms{}
+
+		for _, p := range ps {
+			pk := platforms.Format(p)
+			expPlatforms.Platforms = append(expPlatforms.Platforms, exptypes.Platform{ID: pk, Platform: p})
+
+			// build image
+			st := llb.Scratch().File(
+				llb.Mkfile("/greeting", 0600, []byte(fmt.Sprintf("hello %s!", pk))),
+			)
+			def, err := st.Marshal(ctx)
+			if err != nil {
+				return nil, err
+			}
+			r, err := c.Solve(ctx, gateway.SolveRequest{
+				Definition: def.ToPB(),
+			})
+			if err != nil {
+				return nil, err
+			}
+			ref, err := r.SingleRef()
+			if err != nil {
+				return nil, err
+			}
+			_, err = ref.ToState()
+			if err != nil {
+				return nil, err
+			}
+			res.AddRef(pk, ref)
+
+			// build attestations
+			st = llb.Scratch().File(llb.Mkfile("/attestation.json", 0600, success))
+			def, err = st.Marshal(ctx)
+			if err != nil {
+				return nil, err
+			}
+			r, err = c.Solve(ctx, gateway.SolveRequest{
+				Definition: def.ToPB(),
+			})
+			if err != nil {
+				return nil, err
+			}
+			refAttest, err := r.SingleRef()
+			if err != nil {
+				return nil, err
+			}
+			_, err = ref.ToState()
+			if err != nil {
+				return nil, err
+			}
+			res.AddAttestation(pk, result.Attestation{
+				Kind: gatewaypb.AttestationKindInToto,
+				Path: "/attestation.json",
+				InToto: result.InTotoAttestation{
+					PredicateType: "https://example.com/attestations/v1.0",
+				},
+			}, refAttest)
+		}
+
+		dt, err := json.Marshal(expPlatforms)
+		if err != nil {
+			return nil, err
+		}
+		res.AddMeta(exptypes.ExporterPlatformsKey, dt)
+
+		return res, nil
+	}
+
+	target := registry + "/buildkit/testattestationsemptysubject:latest"
+	_, err = c.Build(sb.Context(), SolveOpt{
+		Exports: []ExportEntry{
+			{
+				Type: ExporterImage,
+				Attrs: map[string]string{
+					"name": target,
+					"push": "true",
+				},
+			},
+		},
+	}, "", frontend, nil)
+	require.NoError(t, err)
+
+	desc, provider, err := contentutil.ProviderFromRef(target)
+	require.NoError(t, err)
+
+	imgs, err := testutil.ReadImages(sb.Context(), provider, desc)
+	require.NoError(t, err)
+	require.Equal(t, len(ps)*2, len(imgs.Images))
+
+	var bases []*testutil.ImageInfo
+	for _, p := range ps {
+		pk := platforms.Format(p)
+		bases = append(bases, imgs.Find(pk))
+	}
+
+	atts := imgs.Filter("unknown/unknown")
+	require.Equal(t, len(ps), len(atts.Images))
+	for i, att := range atts.Images {
+		var attest intoto.Statement
+		require.NoError(t, json.Unmarshal(att.LayersRaw[0], &attest))
+
+		require.Equal(t, "https://in-toto.io/Statement/v0.1", attest.Type)
+		require.Equal(t, "https://example.com/attestations/v1.0", attest.PredicateType)
+		require.Equal(t, map[string]interface{}{"success": true}, attest.Predicate)
+		subjects := []intoto.Subject{{
+			Name: "_",
+			Digest: map[string]string{
+				"sha256": bases[i].Desc.Digest.Encoded(),
+			},
+		}}
+		require.Equal(t, subjects, attest.Subject)
+	}
+}
+
 func makeSSHAgentSock(t *testing.T, agent agent.Agent) (p string, err error) {
 	tmpDir, err := integration.Tmpdir(t)
 	if err != nil {

exporter/containerimage/writer.go

@@ -19,6 +19,7 @@ import (
 	cacheconfig "github.com/moby/buildkit/cache/config"
 	"github.com/moby/buildkit/exporter"
 	"github.com/moby/buildkit/exporter/containerimage/exptypes"
+	gatewaypb "github.com/moby/buildkit/frontend/gateway/pb"
 	"github.com/moby/buildkit/session"
 	"github.com/moby/buildkit/snapshot"
 	"github.com/moby/buildkit/solver"
@@ -104,7 +105,7 @@ func (ic *ImageWriter) Commit(ctx context.Context, inp *exporter.Source, session
 		attestCount += len(attests)
 	}
 	if count := attestCount + len(p.Platforms); count != len(inp.Refs) {
-		return nil, errors.Errorf("number of required refs does not match references %d %d", count, len(inp.Refs))
+		return nil, errors.Errorf("number of required refs (%d) does not match number of references (%d)", count, len(inp.Refs))
 	}
 
 	if attestCount > 0 {
@@ -264,11 +265,11 @@ func (ic *ImageWriter) extractAttestations(ctx context.Context, s session.Group,
 	for i, att := range attestations {
 		i, att := i, att
 		eg.Go(func() error {
-			switch att := att.(type) {
-			case *result.InTotoAttestation:
-				ref, ok := refs[att.PredicateRefKey]
+			switch att.Kind {
+			case gatewaypb.AttestationKindInToto:
+				ref, ok := refs[att.Ref]
 				if !ok {
-					return errors.Errorf("key %s not found in refs map", att.PredicateRefKey)
+					return errors.Errorf("key %s not found in refs map", att.Ref)
 				}
 
 				mount, err := ref.Mount(ctx, true, s)
@@ -282,7 +283,7 @@ func (ic *ImageWriter) extractAttestations(ctx context.Context, s session.Group,
 					return err
 				}
 				defer lm.Unmount()
-				predicate, err := os.ReadFile(path.Join(src, att.PredicatePath))
+				predicate, err := os.ReadFile(path.Join(src, att.Path))
 				if err != nil {
 					return err
 				}
@@ -292,24 +293,30 @@ func (ic *ImageWriter) extractAttestations(ctx context.Context, s session.Group,
 				statements[i] = intoto.Statement{
 					StatementHeader: intoto.StatementHeader{
 						Type:          intoto.StatementInTotoV01,
-						PredicateType: att.PredicateType,
+						PredicateType: att.InToto.PredicateType,
 					},
 					Predicate: json.RawMessage(predicate),
 				}
-				for _, subject := range att.Subjects {
-					switch subject2 := subject.(type) {
-					case *result.InTotoSubjectSelf:
-						statements[i].Subject = append(statements[i].Subject, intoto.Subject{
-							Name:   "_",
-							Digest: result.DigestToDigestMap(desc.Digest),
-						})
-					case *result.InTotoSubjectRaw:
-						statements[i].Subject = append(statements[i].Subject, intoto.Subject{
-							Name:   subject2.Name,
-							Digest: subject2.DigestMap(),
-						})
+
+				if len(att.InToto.Subjects) == 0 {
+					att.InToto.Subjects = []result.InTotoSubject{{
+						Kind: gatewaypb.InTotoSubjectKindSelf,
+					}}
+				}
+
+				statements[i].Subject = make([]intoto.Subject, len(att.InToto.Subjects))
+				for j, subject := range att.InToto.Subjects {
+					statements[i].Subject[j].Name = "_"
+					if subject.Name != "" {
+						statements[i].Subject[j].Name = subject.Name
+					}
+					switch subject.Kind {
+					case gatewaypb.InTotoSubjectKindSelf:
+						statements[i].Subject[j].Digest = result.DigestMap(desc.Digest)
+					case gatewaypb.InTotoSubjectKindRaw:
+						statements[i].Subject[j].Digest = result.DigestMap(subject.Digest...)
 					default:
-						return errors.Errorf("unknown attestation subject type %T", subject)
+						return errors.Errorf("unknown attestation subject kind %q", subject.Kind)
 					}
 				}
 			}

frontend/gateway/client/attestation.go

@@ -0,0 +1,46 @@
+package client
+
+import (
+	pb "github.com/moby/buildkit/frontend/gateway/pb"
+	"github.com/moby/buildkit/solver/result"
+)
+
+func AttestationToPB(a *result.Attestation) (*pb.Attestation, error) {
+	subjects := make([]*pb.InTotoSubject, len(a.InToto.Subjects))
+	for i, subject := range a.InToto.Subjects {
+		subjects[i] = &pb.InTotoSubject{
+			Kind:   subject.Kind,
+			Name:   subject.Name,
+			Digest: subject.Digest,
+		}
+	}
+
+	return &pb.Attestation{
+		Kind:                a.Kind,
+		Path:                a.Path,
+		Ref:                 a.Ref,
+		InTotoPredicateType: a.InToto.PredicateType,
+		InTotoSubjects:      subjects,
+	}, nil
+}
+
+func AttestationFromPB(a *pb.Attestation) (*result.Attestation, error) {
+	subjects := make([]result.InTotoSubject, len(a.InTotoSubjects))
+	for i, subject := range a.InTotoSubjects {
+		subjects[i] = result.InTotoSubject{
+			Kind:   subject.Kind,
+			Name:   subject.Name,
+			Digest: subject.Digest,
+		}
+	}
+
+	return &result.Attestation{
+		Kind: a.Kind,
+		Path: a.Path,
+		Ref:  a.Ref,
+		InToto: result.InTotoAttestation{
+			PredicateType: a.InTotoPredicateType,
+			Subjects:      subjects,
+		},
+	}, nil
+}

frontend/gateway/gateway.go

@@ -709,7 +709,7 @@ func (lbf *llbBridgeForwarder) Solve(ctx context.Context, req *pb.SolveRequest)
 		pbRes.Attestations = map[string]*pb.Attestations{}
 		for k, atts := range res.Attestations {
 			for _, att := range atts {
-				pbAtt, err := pb.ToAttestationPB(att)
+				pbAtt, err := gwclient.AttestationToPB(&att)
 				if err != nil {
 					return nil, err
 				}
@@ -916,11 +916,11 @@ func (lbf *llbBridgeForwarder) Return(ctx context.Context, in *pb.ReturnRequest)
 	if in.Result.Attestations != nil {
 		for k, pbAtts := range in.Result.Attestations {
 			for _, pbAtt := range pbAtts.Attestation {
-				att, err := pb.FromAttestationPB(pbAtt)
+				att, err := gwclient.AttestationFromPB(pbAtt)
 				if err != nil {
 					return nil, err
 				}
-				r.AddAttestation(k, att, nil)
+				r.AddAttestation(k, *att, nil)
 			}
 		}
 	}

frontend/gateway/grpcclient/client.go

@@ -165,7 +165,7 @@ func (c *grpcClient) Run(ctx context.Context, f client.BuildFunc) (retError erro
 					attestations := map[string]*pb.Attestations{}
 					for k, as := range res.Attestations {
 						for _, a := range as {
-							pbAtt, err := pb.ToAttestationPB(a)
+							pbAtt, err := client.AttestationToPB(&a)
 							if err != nil {
 								retError = err
 								continue
@@ -466,11 +466,11 @@ func (c *grpcClient) Solve(ctx context.Context, creq client.SolveRequest) (res *
 		if resp.Result.Attestations != nil {
 			for p, as := range resp.Result.Attestations {
 				for _, a := range as.Attestation {
-					att, err := pb.FromAttestationPB(a)
+					att, err := client.AttestationFromPB(a)
 					if err != nil {
 						return nil, err
 					}
-					res.AddAttestation(p, att, nil)
+					res.AddAttestation(p, *att, nil)
 				}
 			}
 		}