Issue 642: predicate.materials needs to record more information (#649)

This PR addressed issue #642
by adding step and sidecar image uri and digest information to
`predicate.materials` for a `TaskRun`. A follow-up PR will be created to address materials for `PipelineRun`.

pkg/chains/formats/intotoite6/internal/material/material.go

@@ -0,0 +1,41 @@
+/*
+Copyright 2022 The Tekton Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package material
+
+import (
+ "encoding/json"
+
+ slsa "github.com/in-toto/in-toto-golang/in_toto/slsa_provenance/v0.2"
+)
+
+// RemoveDuplicateMaterials removes duplicate materials from the slice of materials
+func RemoveDuplicateMaterials(mats []slsa.ProvenanceMaterial) ([]slsa.ProvenanceMaterial, error) {
+ // make materialMap to store unique materials
+ materialMap := map[string]slsa.ProvenanceMaterial{}
+ for _, mat := range mats {
+ m, err := json.Marshal(mat)
+ if err != nil {
+ return nil, err
+ }
+ materialMap[string(m)] = mat
+ }
+ distinctMaterials := make([]slsa.ProvenanceMaterial, 0, len(materialMap))
+ for _, mat := range materialMap {
+ distinctMaterials = append(distinctMaterials, mat)
+ }
+ return distinctMaterials, nil
+}

pkg/chains/formats/intotoite6/internal/material/material_test.go

@@ -0,0 +1,131 @@
+/*
+Copyright 2022 The Tekton Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package material
+
+import (
+ "testing"
+
+ "github.com/google/go-cmp/cmp"
+ slsa "github.com/in-toto/in-toto-golang/in_toto/slsa_provenance/v0.2"
+ "github.com/tektoncd/chains/test"
+)
+
+func TestRemoveDuplicates(t *testing.T) {
+ tests := []struct {
+ name string
+ mats []slsa.ProvenanceMaterial
+ want []slsa.ProvenanceMaterial
+ }{{
+ name: "no duplicate materials",
+ mats: []slsa.ProvenanceMaterial{
+ {
+ URI: "gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/git-init",
+ Digest: slsa.DigestSet{
+ "sha256": "b963f6e7a69617db57b685893256f978436277094c21d43b153994acd8a01247",
+ },
+ }, {
+ URI: "gcr.io/cloud-marketplace-containers/google/bazel",
+ Digest: slsa.DigestSet{
+ "sha256": "010a1ecd1a8c3610f12039a25b823e3a17bd3e8ae455a53e340dcfdd37a49964",
+ },
+ }, {
+ URI: "gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/sidecar-git-init",
+ Digest: slsa.DigestSet{
+ "sha256": "a1234f6e7a69617db57b685893256f978436277094c21d43b153994acd8a09567",
+ },
+ },
+ },
+ want: []slsa.ProvenanceMaterial{
+ {
+ URI: "gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/git-init",
+ Digest: slsa.DigestSet{
+ "sha256": "b963f6e7a69617db57b685893256f978436277094c21d43b153994acd8a01247",
+ },
+ }, {
+ URI: "gcr.io/cloud-marketplace-containers/google/bazel",
+ Digest: slsa.DigestSet{
+ "sha256": "010a1ecd1a8c3610f12039a25b823e3a17bd3e8ae455a53e340dcfdd37a49964",
+ },
+ }, {
+ URI: "gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/sidecar-git-init",
+ Digest: slsa.DigestSet{
+ "sha256": "a1234f6e7a69617db57b685893256f978436277094c21d43b153994acd8a09567",
+ },
+ },
+ },
+ }, {
+ name: "same uri and digest",
+ mats: []slsa.ProvenanceMaterial{
+ {
+ URI: "gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/git-init",
+ Digest: slsa.DigestSet{
+ "sha256": "b963f6e7a69617db57b685893256f978436277094c21d43b153994acd8a01247",
+ },
+ }, {
+ URI: "gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/git-init",
+ Digest: slsa.DigestSet{
+ "sha256": "b963f6e7a69617db57b685893256f978436277094c21d43b153994acd8a01247",
+ },
+ },
+ },
+ want: []slsa.ProvenanceMaterial{
+ {
+ URI: "gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/git-init",
+ Digest: slsa.DigestSet{
+ "sha256": "b963f6e7a69617db57b685893256f978436277094c21d43b153994acd8a01247",
+ },
+ },
+ },
+ }, {
+ name: "same uri but different digest",
+ mats: []slsa.ProvenanceMaterial{
+ {
+ URI: "gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/git-init",
+ Digest: slsa.DigestSet{
+ "sha256": "b963f6e7a69617db57b685893256f978436277094c21d43b153994acd8a01247",
+ },
+ }, {
+ URI: "gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/git-init",
+ Digest: slsa.DigestSet{
+ "sha256": "b963f6e7a69617db57b685893256f978436277094c21d43b153994acd8a01248",
+ },
+ },
+ },
+ want: []slsa.ProvenanceMaterial{
+ {
+ URI: "gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/git-init",
+ Digest: slsa.DigestSet{
+ "sha256": "b963f6e7a69617db57b685893256f978436277094c21d43b153994acd8a01247",
+ },
+ }, {
+ URI: "gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/git-init",
+ Digest: slsa.DigestSet{
+ "sha256": "b963f6e7a69617db57b685893256f978436277094c21d43b153994acd8a01248",
+ },
+ },
+ },
+ }}
+ for _, tc := range tests {
+ mat, err := RemoveDuplicateMaterials(tc.mats)
+ if err != nil {
+ t.Fatalf("Did not expect an error but got %v", err)
+ }
+ if diff := cmp.Diff(tc.want, mat, test.OptSortMaterial); diff != "" {
+ t.Errorf("materials(): -want +got: %s", diff)
+ }
+ }
+}

pkg/chains/formats/intotoite6/intotoite6_test.go

@@ -27,6 +27,7 @@ import (
  "github.com/tektoncd/chains/pkg/chains/objects"
  "github.com/tektoncd/chains/pkg/config"
  "github.com/tektoncd/chains/pkg/internal/objectloader"
+ "github.com/tektoncd/chains/test"
 
  "github.com/google/go-cmp/cmp"
  "github.com/in-toto/in-toto-golang/in_toto"
@@ -70,6 +71,18 @@ func TestTaskRunCreatePayload1(t *testing.T) {
  BuildFinishedOn: &e1BuildFinished,
  },
  Materials: []slsa.ProvenanceMaterial{
+ {
+ URI: "docker-pullable://gcr.io/test1/test1",
+ Digest: slsa.DigestSet{"sha256": "d4b63d3e24d6eef04a6dc0795cf8a73470688803d97c52cffa3c8d4efd3397b6"},
+ },
+ {
+ URI: "docker-pullable://gcr.io/test2/test2",
+ Digest: slsa.DigestSet{"sha256": "4d6dd704ef58cb214dd826519929e92a978a57cdee43693006139c0080fd6fac"},
+ },
+ {
+ URI: "docker-pullable://gcr.io/test3/test3",
+ Digest: slsa.DigestSet{"sha256": "f1a8b8549c179f41e27ff3db0fe1a1793e4b109da46586501a8343637b1d0478"},
+ },
  {URI: "git+https://git.test.com.git", Digest: slsa.DigestSet{"sha1": "sha:taskrun"}},
  },
  Invocation: slsa.ProvenanceInvocation{
@@ -122,7 +135,8 @@ func TestTaskRunCreatePayload1(t *testing.T) {
  if err != nil {
  t.Errorf("unexpected error: %s", err.Error())
  }
- if diff := cmp.Diff(expected, got); diff != "" {
+
+ if diff := cmp.Diff(expected, got, test.OptSortMaterial); diff != "" {
  t.Errorf("InTotoIte6.CreatePayload(): -want +got: %s", diff)
  }
 }
@@ -553,6 +567,10 @@ func TestTaskRunCreatePayload2(t *testing.T) {
  ID: "test_builder-2",
  },
  Materials: []slsa.ProvenanceMaterial{
+ {
+ URI: "docker-pullable://gcr.io/test1/test1",
+ Digest: slsa.DigestSet{"sha256": "d4b63d3e24d6eef04a6dc0795cf8a73470688803d97c52cffa3c8d4efd3397b6"},
+ },
  {URI: "git+https://git.test.com.git", Digest: slsa.DigestSet{"sha1": "sha:taskdefault"}},
  },
  Invocation: slsa.ProvenanceInvocation{
@@ -631,6 +649,12 @@ func TestMultipleSubjects(t *testing.T) {
  Builder: slsa.ProvenanceBuilder{
  ID: "test_builder-multiple",
  },
+ Materials: []slsa.ProvenanceMaterial{
+ {
+ URI: "docker-pullable://gcr.io/test1/test1",
+ Digest: slsa.DigestSet{"sha256": "d4b63d3e24d6eef04a6dc0795cf8a73470688803d97c52cffa3c8d4efd3397b6"},
+ },
+ },
  Invocation: slsa.ProvenanceInvocation{
  Parameters: map[string]v1beta1.ArrayOrString{},
  },