|
| 1 | +// |
| 2 | +// Copyright 2023 The Chainloop Authors. |
| 3 | +// |
| 4 | +// Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | +// you may not use this file except in compliance with the License. |
| 6 | +// You may obtain a copy of the License at |
| 7 | +// |
| 8 | +// http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | +// |
| 10 | +// Unless required by applicable law or agreed to in writing, software |
| 11 | +// distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | +// See the License for the specific language governing permissions and |
| 14 | +// limitations under the License. |
| 15 | + |
| 16 | +package ociregistry |
| 17 | + |
| 18 | +import ( |
| 19 | + "bytes" |
| 20 | + "context" |
| 21 | + "encoding/json" |
| 22 | + "errors" |
| 23 | + "fmt" |
| 24 | + |
| 25 | + v1 "github.com/chainloop-dev/chainloop/app/artifact-cas/api/cas/v1" |
| 26 | + "github.com/chainloop-dev/chainloop/app/controlplane/extensions/sdk/v1" |
| 27 | + "github.com/chainloop-dev/chainloop/internal/blobmanager/oci" |
| 28 | + "github.com/chainloop-dev/chainloop/internal/ociauth" |
| 29 | + "github.com/go-kratos/kratos/v2/log" |
| 30 | + cr_v1 "github.com/google/go-containerregistry/pkg/v1" |
| 31 | +) |
| 32 | + |
| 33 | +type Integration struct { |
| 34 | + *sdk.FanOutIntegration |
| 35 | +} |
| 36 | + |
| 37 | +// 1 - API schema definitions |
| 38 | +type registrationRequest struct { |
| 39 | + // Repository is not fully URI compliant and hence can not be validated with jsonschema |
| 40 | + Repository string `json:"repository" jsonschema:"minLength=1,description=OCI repository uri and path"` |
| 41 | + Username string `json:"username" jsonschema:"minLength=1,description=OCI repository username"` |
| 42 | + Password string `json:"password" jsonschema:"minLength=1,description=OCI repository password"` |
| 43 | +} |
| 44 | + |
| 45 | +type attachmentRequest struct { |
| 46 | + Prefix string `json:"prefix,omitempty" jsonschema:"minLength=1,description=OCI images name prefix (default chainloop)"` |
| 47 | +} |
| 48 | + |
| 49 | +// 2 - Configuration state |
| 50 | +type registrationState struct { |
| 51 | + Repository string `json:"repository"` |
| 52 | +} |
| 53 | + |
| 54 | +type attachmentState struct { |
| 55 | + Prefix string `json:"prefix"` |
| 56 | +} |
| 57 | + |
| 58 | +func New(l log.Logger) (sdk.FanOut, error) { |
| 59 | + base, err := sdk.NewFanOut( |
| 60 | + &sdk.NewParams{ |
| 61 | + ID: "oci-registry", |
| 62 | + Version: "0.1", |
| 63 | + Description: "Send attestations to a compatible OCI registry", |
| 64 | + Logger: l, |
| 65 | + InputSchema: &sdk.InputSchema{ |
| 66 | + Registration: ®istrationRequest{}, |
| 67 | + Attachment: &attachmentRequest{}, |
| 68 | + }, |
| 69 | + }, |
| 70 | + sdk.WithEnvelope(), |
| 71 | + ) |
| 72 | + |
| 73 | + if err != nil { |
| 74 | + return nil, err |
| 75 | + } |
| 76 | + |
| 77 | + return &Integration{base}, nil |
| 78 | +} |
| 79 | + |
| 80 | +// Register is executed when a operator wants to register a specific instance of this integration with their Chainloop organization |
| 81 | +func (i *Integration) Register(_ context.Context, req *sdk.RegistrationRequest) (*sdk.RegistrationResponse, error) { |
| 82 | + i.Logger.Info("registration requested") |
| 83 | + |
| 84 | + // Extract request payload |
| 85 | + var request *registrationRequest |
| 86 | + if err := sdk.FromConfig(req.Payload, &request); err != nil { |
| 87 | + return nil, fmt.Errorf("invalid registration request: %w", err) |
| 88 | + } |
| 89 | + |
| 90 | + // Create and validate OCI credentials |
| 91 | + k, err := ociauth.NewCredentials(request.Repository, request.Username, request.Password) |
| 92 | + if err != nil { |
| 93 | + return nil, fmt.Errorf("the provided credentials are invalid") |
| 94 | + } |
| 95 | + |
| 96 | + // Check write permissions |
| 97 | + b, err := oci.NewBackend(request.Repository, &oci.RegistryOptions{Keychain: k}) |
| 98 | + if err != nil { |
| 99 | + return nil, fmt.Errorf("the provided credentials are invalid") |
| 100 | + } |
| 101 | + |
| 102 | + if err := b.CheckWritePermissions(context.TODO()); err != nil { |
| 103 | + return nil, fmt.Errorf("the provided credentials don't have write permissions") |
| 104 | + } |
| 105 | + |
| 106 | + // They seem valid, let's store them in the configuration and credentials state |
| 107 | + response := &sdk.RegistrationResponse{} |
| 108 | + |
| 109 | + // a) Configuration State |
| 110 | + rawConfig, err := sdk.ToConfig(®istrationState{ |
| 111 | + Repository: request.Repository, |
| 112 | + }) |
| 113 | + if err != nil { |
| 114 | + return nil, fmt.Errorf("marshalling configuration: %w", err) |
| 115 | + } |
| 116 | + |
| 117 | + response.Configuration = rawConfig |
| 118 | + |
| 119 | + // b) Credentials state |
| 120 | + response.Credentials = &sdk.Credentials{Password: request.Password, Username: request.Username} |
| 121 | + |
| 122 | + return response, nil |
| 123 | +} |
| 124 | + |
| 125 | +// Attachment is executed when to attach a registered instance of this integration to a specific workflow |
| 126 | +func (i *Integration) Attach(_ context.Context, req *sdk.AttachmentRequest) (*sdk.AttachmentResponse, error) { |
| 127 | + // Extract request payload |
| 128 | + var request *attachmentRequest |
| 129 | + if err := sdk.FromConfig(req.Payload, &request); err != nil { |
| 130 | + return nil, fmt.Errorf("invalid registration request: %w", err) |
| 131 | + } |
| 132 | + |
| 133 | + // Define the state to be stored |
| 134 | + config, err := sdk.ToConfig(&attachmentState{Prefix: request.Prefix}) |
| 135 | + if err != nil { |
| 136 | + return nil, fmt.Errorf("marshalling configuration: %w", err) |
| 137 | + } |
| 138 | + |
| 139 | + return &sdk.AttachmentResponse{Configuration: config}, nil |
| 140 | +} |
| 141 | + |
| 142 | +func (i *Integration) Execute(ctx context.Context, req *sdk.ExecutionRequest) error { |
| 143 | + i.Logger.Info("execution requested") |
| 144 | + |
| 145 | + if err := validateExecuteRequest(req); err != nil { |
| 146 | + return fmt.Errorf("running validation: %w", err) |
| 147 | + } |
| 148 | + |
| 149 | + // Extract registration configuration and credentials |
| 150 | + var registrationConfig *registrationState |
| 151 | + if err := sdk.FromConfig(req.RegistrationInfo.Configuration, ®istrationConfig); err != nil { |
| 152 | + return fmt.Errorf("invalid registration configuration %w", err) |
| 153 | + } |
| 154 | + |
| 155 | + // Extract attachment configuration |
| 156 | + var attachmentConfig *attachmentState |
| 157 | + if err := sdk.FromConfig(req.AttachmentInfo.Configuration, &attachmentConfig); err != nil { |
| 158 | + return fmt.Errorf("invalid attachment configuration %w", err) |
| 159 | + } |
| 160 | + |
| 161 | + // Create OCI backend client |
| 162 | + credentials := req.RegistrationInfo.Credentials |
| 163 | + k, err := ociauth.NewCredentials(registrationConfig.Repository, credentials.Username, credentials.Password) |
| 164 | + if err != nil { |
| 165 | + return fmt.Errorf("setting up the keychain: %w", err) |
| 166 | + } |
| 167 | + |
| 168 | + // Add prefix if provided |
| 169 | + var opts = make([]oci.NewBackendOpt, 0) |
| 170 | + if attachmentConfig.Prefix != "" { |
| 171 | + opts = append(opts, oci.WithPrefix(attachmentConfig.Prefix)) |
| 172 | + } |
| 173 | + |
| 174 | + ociClient, err := oci.NewBackend(registrationConfig.Repository, &oci.RegistryOptions{Keychain: k}, opts...) |
| 175 | + if err != nil { |
| 176 | + return fmt.Errorf("creating OCI backend %w", err) |
| 177 | + } |
| 178 | + |
| 179 | + i.Logger.Infow("msg", "Uploading attestation", "repo", registrationConfig.Repository, "workflowID", req.WorkflowID) |
| 180 | + |
| 181 | + // Perform the upload of the json marshalled attestation |
| 182 | + jsonContent, err := json.Marshal(req.Input.DSSEnvelope) |
| 183 | + if err != nil { |
| 184 | + return fmt.Errorf("marshaling the envelope: %w", err) |
| 185 | + } |
| 186 | + |
| 187 | + // Calculate digest since it will be used as CAS reference |
| 188 | + h, _, err := cr_v1.SHA256(bytes.NewBuffer(jsonContent)) |
| 189 | + if err != nil { |
| 190 | + return fmt.Errorf("calculating the digest: %w", err) |
| 191 | + } |
| 192 | + |
| 193 | + if err := ociClient.Upload(ctx, bytes.NewBuffer(jsonContent), &v1.CASResource{Digest: h.Hex, FileName: "attestation.json"}); err != nil { |
| 194 | + return fmt.Errorf("uploading the attestation: %w", err) |
| 195 | + } |
| 196 | + |
| 197 | + i.Logger.Infow("msg", "Attestation uploaded", "repo", registrationConfig.Repository, "workflowID", req.WorkflowID) |
| 198 | + |
| 199 | + return nil |
| 200 | +} |
| 201 | + |
| 202 | +// Validate that we are receiving an envelope |
| 203 | +// and the credentials and state from the registration stage |
| 204 | +func validateExecuteRequest(req *sdk.ExecutionRequest) error { |
| 205 | + if req == nil || req.Input == nil { |
| 206 | + return errors.New("execution input not received") |
| 207 | + } |
| 208 | + |
| 209 | + if req.Input.DSSEnvelope == nil { |
| 210 | + return errors.New("execution input invalid, the envelope is empty") |
| 211 | + } |
| 212 | + |
| 213 | + if req.RegistrationInfo == nil || req.RegistrationInfo.Configuration == nil { |
| 214 | + return errors.New("missing registration configuration") |
| 215 | + } |
| 216 | + |
| 217 | + if req.RegistrationInfo.Credentials == nil { |
| 218 | + return errors.New("missing credentials") |
| 219 | + } |
| 220 | + |
| 221 | + return nil |
| 222 | +} |
0 commit comments