Subject names for attestations #3070
Conversation
| } | ||
| for _, name := range names { | ||
| statements[i].Subject = append(statements[i].Subject, intoto.Subject{ | ||
| Name: name, |
There was a problem hiding this comment.
Should this be converted to https://github.com/package-url/purl-spec ?
There was a problem hiding this comment.
Maybe. I'm not entirely sure, in-toto doesn't require it, so it's up to us. I do think we want to make sure that the platform is present in the name though (to ensure uniqueness), since then we'll have a 1-to-1 relationship between digests and names.
So maybe PURL would be the right choice here, with the version field containing the image tag, and the image repository location and architecture/os data in the qualifiers? Not sure whether we should use the sha256: in the name though, since that would be duplicated.
There was a problem hiding this comment.
Have cherry-picked your PURL util package (with a fixup to use reference for the distribution reference package, like we have in the other parts of the codebase).
jedevc
force-pushed
the
attestation-subject-name
branch
2 times, most recently
from
f4726f9
to
cacd12d
Compare
| @@ -4,8 +4,8 @@ import ( | |||
| "strings" | |||
|
|
|||
| "github.com/containerd/containerd/platforms" | |||
| distreference "github.com/docker/distribution/reference" | |||
| "github.com/opencontainers/go-digest" | |||
| "github.com/docker/distribution/reference" | |||
There was a problem hiding this comment.
btw, the reason I used the specific name was that there is also
https://github.com/containerd/containerd/tree/main/reference and
https://github.com/moby/moby/tree/master/reference
There was a problem hiding this comment.
Yeah that makes sense, I think we should make that change everywhere then at some point, instead of just here.
There was a problem hiding this comment.
Happy to do that in a follow-up, if this is a blocker 馃憤
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Use convention of importing docker/distribution/reference as reference. Signed-off-by: Justin Chadwell <me@jedevc.com>
Signed-off-by: Justin Chadwell <me@jedevc.com>
tonistiigi
force-pushed
the
attestation-subject-name
branch
2 times, most recently
from
2684b24
to
406f036
Compare
Signed-off-by: Justin Chadwell <me@jedevc.com> Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
tonistiigi
force-pushed
the
attestation-subject-name
branch
from
406f036
to
d80b59f
Compare
|
@tonistiigi LGTM - good catch on |
Follow up to #2935.
From conversation with @tonistiigi: