Add predicate capturing results of test runs

[adityasaky]

No description provided.

[TomHennen]

FYI one of my colleagues who has done work in this area is going to take a look and provide some comments. Stay tuned.

[TomHennen]

Thanks Aditya!

[adityasaky]

Thanks for the reviews! I've squashed my commits now.

[joshuagl]

This looks useful. I had a few questions (inline) about this predicate specifically, and a couple of higher-level questions: one about the relationship between in-toto attestations and the broader in-toto spec, and one about inclusion of attestation framework parsing rules in each predicate.

The higher level questions can be addressed separately and should not block this PR.

[joshuagl]

This is the first predicate to reference an inspection, should we be avoiding in-toto specification terms in the attestations repository (which aims to be policy engine agnostic)?

[adityasaky]

I think it's okay to mention them in use cases. I can clarify that it's with in-toto layouts / policy engine. We could similarly add a non in-toto verifier and how it'd do something...

[adityasaky]

I've updated with an "if using with in-toto..." conditional, lmk if this is fine.

[marcelamelara]

Thanks @adityasaky !! I really like the simplicity of this predicate. I have several questions/requests for updates to improve clarity.

[adityasaky]

Does it make more sense for the schema to be as follows? Since testRun is now required because of the configuration, we can remove that intermediate field.

{
    "_type": "https://in-toto.io/Statement/v1",
    "subject": [{...}],
    "predicateType": "https://in-toto.io/attestation/test-result/v0.1",
    "predicate": {
        "result": "pass|fail",
        "url": "<URL>",
        "configuration": ["<ResourceDescriptor>", ...],
        "passedTests": ["<TEST_NAME>", ...],
        "warnedTests": ["<TEST_NAME>", ...],
        "failedTests": ["<TEST_NAME>", ...]
    }
}

[adityasaky]

nit: I'll reorder the fields to move required ones up. Configuration should be first since it's now required.

[marcelamelara]

Thanks for the edits, @adityasaky . LGTM.