feat(referrers): API endpoint

[migmartri]

Continuation of #415

• gRPC and REST API endpoint for referrer discovery by content digest
• basic (preview) CLI implementation

Business logic

The API will look for the referrers that are part of an organization to which the logged_in user has access.

Consumption examples

CLI

The CLI currently returns JSON

$ chainloop discover -d sha256:29da604ade4ddc9e35f675c7b7fc6355d0b381ca23fab5d1a0614a8ea10ea425

{
  "digest": "sha256:29da604ade4ddc9e35f675c7b7fc6355d0b381ca23fab5d1a0614a8ea10ea425",
  "kind": "ATTESTATION",
  "downloadable": true,
  "createdAt": "2023-11-09T10:46:50.497831Z",
  "references": [
    {
      "digest": "sha1:cb798c19caec6932684aa97e279318dc64265c98",
      "kind": "GIT_HEAD_COMMIT",
      "downloadable": false,
      "createdAt": "2023-11-09T10:45:14.354807Z",
      "references": []
    },
    {
      "digest": "sha256:a23fb6ede2e10cbce94cdecbf6091848ffeb76cfe62d53dd90af6fd908fa23b8",
      "kind": "CONTAINER_IMAGE",
      "downloadable": false,
      "createdAt": "2023-11-09T10:45:14.356221Z",
      "references": []
    },
    {
      "digest": "sha256:ebe2e6ffab93f4b2e2743d3557bd094427ea059adc78cfe2cd330a72f61731e8",
      "kind": "SBOM_CYCLONEDX_JSON",
      "downloadable": false,
      "createdAt": "2023-11-09T10:45:14.353328Z",
      "references": []
    }
  ]
}

gRPC endpoint (controlplane.v1.ReferrerService.Discover)

grpcurl -H "authorization: Bearer $TOKEN_S" -d '{"digest": "sha256:29da604ade4ddc9e35f675c7b7fc6355d0b381ca23fab5d1a0614a8ea10ea425"}' localhost:9000 controlplane.v1.ReferrerService.Discover

{
  "result": {
    "digest": "sha256:29da604ade4ddc9e35f675c7b7fc6355d0b381ca23fab5d1a0614a8ea10ea425",
    "kind": "ATTESTATION",
    "downloadable": true,
    "references": [
      {
        "digest": "sha1:cb798c19caec6932684aa97e279318dc64265c98",
        "kind": "GIT_HEAD_COMMIT",
        "createdAt": "2023-11-09T10:45:14.354807Z"
      },
      {
        "digest": "sha256:a23fb6ede2e10cbce94cdecbf6091848ffeb76cfe62d53dd90af6fd908fa23b8",
        "kind": "CONTAINER_IMAGE",
        "createdAt": "2023-11-09T10:45:14.356221Z"
      },
      {
        "digest": "sha256:ebe2e6ffab93f4b2e2743d3557bd094427ea059adc78cfe2cd330a72f61731e8",
        "kind": "SBOM_CYCLONEDX_JSON",
        "createdAt": "2023-11-09T10:45:14.353328Z"
      }
    ],
    "createdAt": "2023-11-09T10:46:50.497831Z"
  }
}

HTTP endpoint (/discover/[digest])

$ curl -s -H "Authorization: Bearer $TOKEN_S" http://localhost:8000/discover/sha256:29da604ade4ddc9e35f675c7b7fc6355d0b381ca23fab5d1a0614a8ea10ea425 

{
  "result": {
    "digest": "sha256:29da604ade4ddc9e35f675c7b7fc6355d0b381ca23fab5d1a0614a8ea10ea425",
    "kind": "ATTESTATION",
    "downloadable": true,
    "references": [
      {
        "digest": "sha1:cb798c19caec6932684aa97e279318dc64265c98",
        "kind": "GIT_HEAD_COMMIT",
        "downloadable": false,
        "references": [],
        "createdAt": "2023-11-09T10:45:14.354807Z"
      },
      {
        "digest": "sha256:a23fb6ede2e10cbce94cdecbf6091848ffeb76cfe62d53dd90af6fd908fa23b8",
        "kind": "CONTAINER_IMAGE",
        "downloadable": false,
        "references": [],
        "createdAt": "2023-11-09T10:45:14.356221Z"
      },
      {
        "digest": "sha256:ebe2e6ffab93f4b2e2743d3557bd094427ea059adc78cfe2cd330a72f61731e8",
        "kind": "SBOM_CYCLONEDX_JSON",
        "downloadable": false,
        "references": [],
        "createdAt": "2023-11-09T10:45:14.353328Z"
      }
    ],
    "createdAt": "2023-11-09T10:46:50.497831Z"
  }
}

Ask for a given piece of evidence

You can for example find all the attestations associated with a given commit ID

chainloop discover -d sha1:cb798c19caec6932684aa97e279318dc64265c98                          

{
  "digest": "sha1:cb798c19caec6932684aa97e279318dc64265c98",
  "kind": "GIT_HEAD_COMMIT",
  "downloadable": false,
  "createdAt": "2023-11-09T10:45:14.354807Z",
  "references": [
    {
      "digest": "sha256:165a6baf2eaaa8a7aab40d2a691bdcf4fa5502c9c1a7a2d0853b9bdead89cdf3",
      "kind": "ATTESTATION",
      "downloadable": true,
      "createdAt": "2023-11-09T10:46:02.815334Z",
      "references": []
    },
    {
      "digest": "sha256:29da604ade4ddc9e35f675c7b7fc6355d0b381ca23fab5d1a0614a8ea10ea425",
      "kind": "ATTESTATION",
      "downloadable": true,
      "createdAt": "2023-11-09T10:46:50.497831Z",
      "references": []
    },
    {
      "digest": "sha256:3970baaaa13318fd96836bc06d49be243804de3fdeeeed2712ab5dcbbe6d041a",
      "kind": "ATTESTATION",
      "downloadable": true,
      "createdAt": "2023-11-09T10:45:14.355553Z",
      "references": []
    },
    {
      "digest": "sha256:aa5758666b2a00f1dd8c2a7afd2455370e416c5b1044c35827c9d0ce8131f866",
      "kind": "ATTESTATION",
      "downloadable": true,
      "createdAt": "2023-11-09T10:45:42.929311Z",
      "references": []
    }
  ]

[migmartri]

cc/ @jotadrilo

[danlishka]

LGTM. This is a great start. What I still need is to get attestation by providing she. I will need to use chainloop download and parse the file. We get attestations today via workflow run id.

[migmartri]

LGTM. This is a great start. What I still need is to get attestation by providing she. I will need to use chainloop download and parse the file. We get attestations today via workflow run id.

Added here #425