Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 4f81bcb

Browse files
jsternbergjsternberg
committed
bake: implement composable attributes for attestations
Signed-off-by: Jonathan A. Sternberg <[email protected]>
1 parent 3771fe2 commit 4f81bcb

5 files changed

Lines changed: 316 additions & 44 deletions

File tree

‎bake/bake.go‎

Lines changed: 13 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -699,16 +699,16 @@ type Target struct {
699699
Inherits []string `json:"inherits,omitempty" hcl:"inherits,optional" cty:"inherits"`
700700

701701
Annotations []string `json:"annotations,omitempty" hcl:"annotations,optional" cty:"annotations"`
702-
Attest []string `json:"attest,omitempty" hcl:"attest,optional" cty:"attest"`
702+
Attest buildflags.Attests `json:"attest,omitempty" hcl:"attest,optional" cty:"attest"`
703703
Context *string `json:"context,omitempty" hcl:"context,optional" cty:"context"`
704704
Contexts map[string]string `json:"contexts,omitempty" hcl:"contexts,optional" cty:"contexts"`
705705
Dockerfile *string `json:"dockerfile,omitempty" hcl:"dockerfile,optional" cty:"dockerfile"`
706706
DockerfileInline *string `json:"dockerfile-inline,omitempty" hcl:"dockerfile-inline,optional" cty:"dockerfile-inline"`
707707
Args map[string]*string `json:"args,omitempty" hcl:"args,optional" cty:"args"`
708708
Labels map[string]*string `json:"labels,omitempty" hcl:"labels,optional" cty:"labels"`
709709
Tags []string `json:"tags,omitempty" hcl:"tags,optional" cty:"tags"`
710-
CacheFrom buildflags.CacheOptions `json:"cache-from,omitempty" hcl:"cache-from,optional" cty:"cache-from"`
711-
CacheTo buildflags.CacheOptions `json:"cache-to,omitempty" hcl:"cache-to,optional" cty:"cache-to"`
710+
CacheFrom buildflags.CacheOptions `json:"cache-from,omitempty" hcl:"cache-from,optional" cty:"cache-from"`
711+
CacheTo buildflags.CacheOptions `json:"cache-to,omitempty" hcl:"cache-to,optional" cty:"cache-to"`
712712
Target *string `json:"target,omitempty" hcl:"target,optional" cty:"target"`
713713
Secrets buildflags.Secrets `json:"secret,omitempty" hcl:"secret,optional" cty:"secret"`
714714
SSH buildflags.SSHKeys `json:"ssh,omitempty" hcl:"ssh,optional" cty:"ssh"`
@@ -718,8 +718,8 @@ type Target struct {
718718
NoCache *bool `json:"no-cache,omitempty" hcl:"no-cache,optional" cty:"no-cache"`
719719
NetworkMode *string `json:"network,omitempty" hcl:"network,optional" cty:"network"`
720720
NoCacheFilter []string `json:"no-cache-filter,omitempty" hcl:"no-cache-filter,optional" cty:"no-cache-filter"`
721-
ShmSize *string `json:"shm-size,omitempty" hcl:"shm-size,optional"`
722-
Ulimits []string `json:"ulimits,omitempty" hcl:"ulimits,optional"`
721+
ShmSize *string `json:"shm-size,omitempty" hcl:"shm-size,optional" cty:"shm-size"`
722+
Ulimits []string `json:"ulimits,omitempty" hcl:"ulimits,optional" cty:"ulimits"`
723723
Call *string `json:"call,omitempty" hcl:"call,optional" cty:"call"`
724724
Entitlements []string `json:"entitlements,omitempty" hcl:"entitlements,optional" cty:"entitlements"`
725725
// IMPORTANT: if you add more fields here, do not forget to update newOverrides/AddOverrides and docs/bake-reference.md.
@@ -737,7 +737,7 @@ var (
737737

738738
func (t *Target) normalize() {
739739
t.Annotations = removeDupesStr(t.Annotations)
740-
t.Attest = removeAttestDupes(t.Attest)
740+
t.Attest = t.Attest.Normalize()
741741
t.Tags = removeDupesStr(t.Tags)
742742
t.Secrets = t.Secrets.Normalize()
743743
t.SSH = t.SSH.Normalize()
@@ -811,8 +811,7 @@ func (t *Target) Merge(t2 *Target) {
811811
t.Annotations = append(t.Annotations, t2.Annotations...)
812812
}
813813
if t2.Attest != nil { // merge
814-
t.Attest = append(t.Attest, t2.Attest...)
815-
t.Attest = removeAttestDupes(t.Attest)
814+
t.Attest = t.Attest.Merge(t2.Attest)
816815
}
817816
if t2.Secrets != nil { // merge
818817
t.Secrets = t.Secrets.Merge(t2.Secrets)
@@ -969,7 +968,11 @@ func (t *Target) AddOverrides(overrides map[string]Override, ent *EntitlementCon
969968
case "annotations":
970969
t.Annotations = append(t.Annotations, o.ArrValue...)
971970
case "attest":
972-
t.Attest = append(t.Attest, o.ArrValue...)
971+
attest, err := parseArrValue[buildflags.Attest](o.ArrValue)
972+
if err != nil {
973+
return errors.Wrap(err, "invalid value for attest")
974+
}
975+
t.Attest = t.Attest.Merge(attest)
973976
case "no-cache":
974977
noCache, err := strconv.ParseBool(value)
975978
if err != nil {
@@ -1383,11 +1386,7 @@ func toBuildOpt(t *Target, inp *Input) (*build.Options, error) {
13831386
}
13841387
}
13851388

1386-
attests, err := buildflags.ParseAttests(t.Attest)
1387-
if err != nil {
1388-
return nil, err
1389-
}
1390-
bo.Attests = controllerapi.CreateAttestations(attests)
1389+
bo.Attests = controllerapi.CreateAttestations(t.Attest.ToPB())
13911390

13921391
bo.SourcePolicy, err = build.ReadSourcePolicy()
13931392
if err != nil {
@@ -1430,26 +1429,6 @@ func removeDupesStr(s []string) []string {
14301429
return s[:i]
14311430
}
14321431

1433-
func removeAttestDupes(s []string) []string {
1434-
res := []string{}
1435-
m := map[string]int{}
1436-
for _, v := range s {
1437-
att, err := buildflags.ParseAttest(v)
1438-
if err != nil {
1439-
res = append(res, v)
1440-
continue
1441-
}
1442-
1443-
if i, ok := m[att.Type]; ok {
1444-
res[i] = v
1445-
} else {
1446-
m[att.Type] = len(res)
1447-
res = append(res, v)
1448-
}
1449-
}
1450-
return res
1451-
}
1452-
14531432
func setPushOverride(outputs []*buildflags.ExportEntry, push bool) []*buildflags.ExportEntry {
14541433
if !push {
14551434
// Disable push for any relevant export types

‎bake/bake_test.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1688,7 +1688,7 @@ func TestAttestDuplicates(t *testing.T) {
16881688
ctx := context.TODO()
16891689

16901690
m, _, err := ReadTargets(ctx, []File{fp}, []string{"default"}, nil, nil, &EntitlementConf{})
1691-
require.Equal(t, []string{"type=sbom,foo=bar", "type=provenance,mode=max"}, m["default"].Attest)
1691+
require.Equal(t, []string{"type=provenance,mode=max", "type=sbom,foo=bar"}, stringify(m["default"].Attest))
16921692
require.NoError(t, err)
16931693

16941694
opts, err := TargetsToBuildOpt(m, &Input{})
@@ -1699,7 +1699,7 @@ func TestAttestDuplicates(t *testing.T) {
16991699
}, opts["default"].Attests)
17001700

17011701
m, _, err = ReadTargets(ctx, []File{fp}, []string{"default"}, []string{"*.attest=type=sbom,disabled=true"}, nil, &EntitlementConf{})
1702-
require.Equal(t, []string{"type=sbom,disabled=true", "type=provenance,mode=max"}, m["default"].Attest)
1702+
require.Equal(t, []string{"type=provenance,mode=max", "type=sbom,disabled=true"}, stringify(m["default"].Attest))
17031703
require.NoError(t, err)
17041704

17051705
opts, err = TargetsToBuildOpt(m, &Input{})

‎bake/hcl_test.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -604,6 +604,11 @@ func TestHCLAttrsCustomType(t *testing.T) {
604604
func TestHCLAttrsCapsuleType(t *testing.T) {
605605
dt := []byte(`
606606
target "app" {
607+
attest = [
608+
{ type = "provenance", mode = "max" },
609+
"type=sbom,disabled=true",
610+
]
611+
607612
cache-from = [
608613
{ type = "registry", ref = "user/app:cache" },
609614
"type=local,src=path/to/cache",
@@ -634,6 +639,7 @@ func TestHCLAttrsCapsuleType(t *testing.T) {
634639
require.NoError(t, err)
635640

636641
require.Equal(t, 1, len(c.Targets))
642+
require.Equal(t, []string{"type=provenance,mode=max", "type=sbom,disabled=true"}, stringify(c.Targets[0].Attest))
637643
require.Equal(t, []string{"type=local,dest=../out", "type=oci,dest=../out.tar"}, stringify(c.Targets[0].Outputs))
638644
require.Equal(t, []string{"type=local,src=path/to/cache", "user/app:cache"}, stringify(c.Targets[0].CacheFrom))
639645
require.Equal(t, []string{"type=local,dest=path/to/cache"}, stringify(c.Targets[0].CacheTo))

‎util/buildflags/attests.go‎

Lines changed: 198 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,9 @@
11
package buildflags
22

33
import (
4+
"encoding/json"
45
"fmt"
6+
"maps"
57
"strconv"
68
"strings"
79

@@ -10,6 +12,167 @@ import (
1012
"github.com/tonistiigi/go-csvvalue"
1113
)
1214

15+
type Attests []*Attest
16+
17+
func (a Attests) Merge(other Attests) Attests {
18+
if other == nil {
19+
a.Normalize()
20+
return a
21+
} else if a == nil {
22+
other.Normalize()
23+
return other
24+
}
25+
26+
return append(a, other...).Normalize()
27+
}
28+
29+
func (a Attests) Normalize() Attests {
30+
if len(a) == 0 {
31+
return nil
32+
}
33+
return removeAttestDupes(a)
34+
}
35+
36+
func (a Attests) ToPB() []*controllerapi.Attest {
37+
if len(a) == 0 {
38+
return nil
39+
}
40+
41+
entries := make([]*controllerapi.Attest, len(a))
42+
for i, entry := range a {
43+
entries[i] = entry.ToPB()
44+
}
45+
return entries
46+
}
47+
48+
type Attest struct {
49+
Type string `json:"type"`
50+
Disabled bool `json:"disabled,omitempty"`
51+
Attrs map[string]string `json:"attrs,omitempty"`
52+
}
53+
54+
func (a *Attest) Equal(other *Attest) bool {
55+
if a.Type != other.Type || a.Disabled != other.Disabled {
56+
return false
57+
}
58+
return maps.Equal(a.Attrs, other.Attrs)
59+
}
60+
61+
func (a *Attest) String() string {
62+
var b csvBuilder
63+
if a.Type != "" {
64+
b.Write("type", a.Type)
65+
}
66+
if a.Disabled {
67+
b.Write("disabled", "true")
68+
}
69+
if len(a.Attrs) > 0 {
70+
b.WriteAttributes(a.Attrs)
71+
}
72+
return b.String()
73+
}
74+
75+
func (a *Attest) ToPB() *controllerapi.Attest {
76+
var b csvBuilder
77+
if a.Type != "" {
78+
b.Write("type", a.Type)
79+
}
80+
if a.Disabled {
81+
b.Write("disabled", "true")
82+
}
83+
b.WriteAttributes(a.Attrs)
84+
85+
return &controllerapi.Attest{
86+
Type: a.Type,
87+
Disabled: a.Disabled,
88+
Attrs: b.String(),
89+
}
90+
}
91+
92+
func (a *Attest) MarshalJSON() ([]byte, error) {
93+
m := make(map[string]interface{}, len(a.Attrs)+2)
94+
for k, v := range m {
95+
m[k] = v
96+
}
97+
m["type"] = a.Type
98+
if a.Disabled {
99+
m["disabled"] = true
100+
}
101+
return json.Marshal(m)
102+
}
103+
104+
func (a *Attest) UnmarshalJSON(data []byte) error {
105+
var m map[string]interface{}
106+
if err := json.Unmarshal(data, &m); err != nil {
107+
return err
108+
}
109+
110+
if typ, ok := m["type"]; ok {
111+
a.Type, ok = typ.(string)
112+
if !ok {
113+
return errors.Errorf("attest type must be a string")
114+
}
115+
delete(m, "type")
116+
}
117+
118+
if disabled, ok := m["disabled"]; ok {
119+
a.Disabled, ok = disabled.(bool)
120+
if !ok {
121+
return errors.Errorf("attest disabled attribute must be a boolean")
122+
}
123+
delete(m, "disabled")
124+
}
125+
126+
attrs := make(map[string]string, len(m))
127+
for k, v := range m {
128+
s, ok := v.(string)
129+
if !ok {
130+
return errors.Errorf("attest attribute %q must be a string", k)
131+
}
132+
attrs[k] = s
133+
}
134+
a.Attrs = attrs
135+
return nil
136+
}
137+
138+
func (a *Attest) UnmarshalText(text []byte) error {
139+
in := string(text)
140+
fields, err := csvvalue.Fields(in, nil)
141+
if err != nil {
142+
return err
143+
}
144+
145+
a.Attrs = map[string]string{}
146+
for _, field := range fields {
147+
key, value, ok := strings.Cut(field, "=")
148+
if !ok {
149+
return errors.Errorf("invalid value %s", field)
150+
}
151+
key = strings.TrimSpace(strings.ToLower(key))
152+
153+
switch key {
154+
case "type":
155+
a.Type = value
156+
case "disabled":
157+
disabled, err := strconv.ParseBool(value)
158+
if err != nil {
159+
return errors.Wrapf(err, "invalid value %s", field)
160+
}
161+
a.Disabled = disabled
162+
default:
163+
a.Attrs[key] = value
164+
}
165+
}
166+
return a.validate()
167+
}
168+
169+
func (a *Attest) validate() error {
170+
if a.Type == "" {
171+
return errors.Errorf("attestation type not specified")
172+
}
173+
return nil
174+
}
175+
13176
func CanonicalizeAttest(attestType string, in string) string {
14177
if in == "" {
15178
return ""
@@ -21,21 +184,34 @@ func CanonicalizeAttest(attestType string, in string) string {
21184
}
22185

23186
func ParseAttests(in []string) ([]*controllerapi.Attest, error) {
24-
var out []*controllerapi.Attest
25-
found := map[string]struct{}{}
26-
for _, in := range in {
27-
in := in
28-
attest, err := ParseAttest(in)
29-
if err != nil {
187+
var outs []*Attest
188+
for _, s := range in {
189+
var out Attest
190+
if err := out.UnmarshalText([]byte(s)); err != nil {
30191
return nil, err
31192
}
193+
outs = append(outs, &out)
194+
}
195+
return ConvertAttests(outs)
196+
}
32197

198+
// ConvertAttests converts Attestations for the controller API from
199+
// the ones in this package.
200+
//
201+
// Attestations of the same type will cause an error. Some tools,
202+
// like bake, remove the duplicates before calling this function.
203+
func ConvertAttests(in []*Attest) ([]*controllerapi.Attest, error) {
204+
out := make([]*controllerapi.Attest, 0, len(in))
205+
206+
// Check for dupplicate attestations while we convert them
207+
// to the controller API.
208+
found := map[string]struct{}{}
209+
for _, attest := range in {
33210
if _, ok := found[attest.Type]; ok {
34211
return nil, errors.Errorf("duplicate attestation field %s", attest.Type)
35212
}
36213
found[attest.Type] = struct{}{}
37-
38-
out = append(out, attest)
214+
out = append(out, attest.ToPB())
39215
}
40216
return out, nil
41217
}
@@ -77,3 +253,17 @@ func ParseAttest(in string) (*controllerapi.Attest, error) {
77253

78254
return &attest, nil
79255
}
256+
257+
func removeAttestDupes(s []*Attest) []*Attest {
258+
res := []*Attest{}
259+
m := map[string]int{}
260+
for _, att := range s {
261+
if i, ok := m[att.Type]; ok {
262+
res[i] = att
263+
} else {
264+
m[att.Type] = len(res)
265+
res = append(res, att)
266+
}
267+
}
268+
return res
269+
}

0 commit comments

Comments
 (0)