Skip to content

Commit

Permalink
Handle duplicates in subjects and materials consistently
Browse files Browse the repository at this point in the history
Fixes #925

Prior, deduplication handling for subjects and materials is different.

Now, we use consistent approach to handle the deduplication.

Signed-off-by: Chuang Wang <[email protected]>
  • Loading branch information
chuangw6 committed Sep 15, 2023
1 parent 659b32b commit a1a6b6e
Show file tree
Hide file tree
Showing 5 changed files with 471 additions and 232 deletions.
53 changes: 7 additions & 46 deletions pkg/chains/formats/slsa/extract/extract.go
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,7 @@ import (
"github.com/in-toto/in-toto-golang/in_toto/slsa_provenance/common"
"github.com/tektoncd/chains/internal/backport"
"github.com/tektoncd/chains/pkg/artifacts"
"github.com/tektoncd/chains/pkg/chains/formats/slsa/internal/artifact"
"github.com/tektoncd/chains/pkg/chains/formats/slsa/internal/slsaconfig"
"github.com/tektoncd/chains/pkg/chains/objects"
"github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1"
Expand Down Expand Up @@ -80,64 +81,24 @@ func subjectsFromPipelineRun(ctx context.Context, obj objects.TektonObject, slsa
}

trSubjects := subjectsFromTektonObject(ctx, tr)
for _, s := range trSubjects {
result = addSubject(result, s)
}
result = artifact.AppendSubjects(result, trSubjects...)
}
}

// also add subjects observed from pipelinerun level with duplication removed
for _, s := range prSubjects {
result = addSubject(result, s)
}
result = artifact.AppendSubjects(result, prSubjects...)

return result
}

// addSubject adds a new subject item to the original slice.
func addSubject(original []intoto.Subject, item intoto.Subject) []intoto.Subject {

for i, s := range original {
// if there is an equivalent entry in the original slice, merge item's DigestSet
// into the existing entry's DigestSet.
if subjectEqual(s, item) {
mergeMaps(original[i].Digest, item.Digest)
return original
}
}

original = append(original, item)
return original
}

// two subjects are equal if and only if they have same name and have at least
// one common algorithm and hex value.
func subjectEqual(x, y intoto.Subject) bool {
if x.Name != y.Name {
return false
}
for algo, hex := range x.Digest {
if y.Digest[algo] == hex {
return true
}
}
return false
}

func mergeMaps(m1 map[string]string, m2 map[string]string) {
for k, v := range m2 {
m1[k] = v
}
}

func subjectsFromTektonObject(ctx context.Context, obj objects.TektonObject) []intoto.Subject {
logger := logging.FromContext(ctx)
var subjects []intoto.Subject

imgs := artifacts.ExtractOCIImagesFromResults(ctx, obj)
for _, i := range imgs {
if d, ok := i.(name.Digest); ok {
subjects = append(subjects, intoto.Subject{
subjects = artifact.AppendSubjects(subjects, intoto.Subject{
Name: d.Repository.Name(),
Digest: common.DigestSet{
"sha256": strings.TrimPrefix(d.DigestStr(), "sha256:"),
Expand All @@ -153,7 +114,7 @@ func subjectsFromTektonObject(ctx context.Context, obj objects.TektonObject) []i
logger.Errorf("Digest %s should be in the format of: algorthm:abc", obj.Digest)
continue
}
subjects = append(subjects, intoto.Subject{
subjects = artifact.AppendSubjects(subjects, intoto.Subject{
Name: obj.URI,
Digest: common.DigestSet{
splits[0]: splits[1],
Expand All @@ -166,7 +127,7 @@ func subjectsFromTektonObject(ctx context.Context, obj objects.TektonObject) []i
splits := strings.Split(s.Digest, ":")
alg := splits[0]
digest := splits[1]
subjects = append(subjects, intoto.Subject{
subjects = artifact.AppendSubjects(subjects, intoto.Subject{
Name: s.URI,
Digest: common.DigestSet{
alg: digest,
Expand Down Expand Up @@ -204,7 +165,7 @@ func subjectsFromTektonObject(ctx context.Context, obj objects.TektonObject) []i
}
}
}
subjects = append(subjects, intoto.Subject{
subjects = artifact.AppendSubjects(subjects, intoto.Subject{
Name: url,
Digest: common.DigestSet{
"sha256": strings.TrimPrefix(digest, "sha256:"),
Expand Down
126 changes: 126 additions & 0 deletions pkg/chains/formats/slsa/internal/artifact/append.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,126 @@
/*
Copyright 2023 The Tekton Authors
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package artifact

import (
intoto "github.com/in-toto/in-toto-golang/in_toto"
"github.com/in-toto/in-toto-golang/in_toto/slsa_provenance/common"
)

// AppendSubjects adds a new subject entry to the original slice with duplicates removed/merged
func AppendSubjects(original []intoto.Subject, items ...intoto.Subject) []intoto.Subject {
var artifacts []artifact
for _, s := range original {
artifacts = append(artifacts, subjectToArtifact(s))
}

for _, s := range items {
artifacts = addArtifact(artifacts, subjectToArtifact(s))
}

var result []intoto.Subject
for _, a := range artifacts {
result = append(result, artifactToSubject(a))
}
return result
}

// AppendMaterials adds new material(s) to the original slice with duplicates removed/merged
func AppendMaterials(original []common.ProvenanceMaterial, items ...common.ProvenanceMaterial) []common.ProvenanceMaterial {
var artifacts []artifact
for _, m := range original {
artifacts = append(artifacts, materialToArtifact(m))
}

for _, m := range items {
artifacts = addArtifact(artifacts, materialToArtifact(m))
}

var result []common.ProvenanceMaterial
for _, a := range artifacts {
result = append(result, artifactToMaterial(a))
}
return result
}

type artifact struct {
name string
digestSet map[string]string
}

// AddArtifact adds a new artifact item to the original slice.
func addArtifact(original []artifact, item artifact) []artifact {

for i, a := range original {
// if there is an equivalent entry in the original slice, merge the
// artifact's DigestSet into the existing entry's DigestSet.
if artifactEqual(a, item) {
mergeMaps(original[i].digestSet, item.digestSet)
return original
}
}

original = append(original, item)
return original
}

// two artifacts are equal if and only if they have same name and have at least
// one common algorithm and hex value.
func artifactEqual(x, y artifact) bool {
if x.name != y.name {
return false
}
for algo, hex := range x.digestSet {
if y.digestSet[algo] == hex {
return true
}
}
return false
}

func mergeMaps(m1 map[string]string, m2 map[string]string) {
for k, v := range m2 {
m1[k] = v
}
}

func subjectToArtifact(s intoto.Subject) artifact {
return artifact{
name: s.Name,
digestSet: s.Digest,
}
}

func artifactToSubject(a artifact) intoto.Subject {
return intoto.Subject{
Name: a.name,
Digest: a.digestSet,
}
}

func materialToArtifact(m common.ProvenanceMaterial) artifact {
return artifact{
name: m.URI,
digestSet: m.Digest,
}
}

func artifactToMaterial(a artifact) common.ProvenanceMaterial {
return common.ProvenanceMaterial{
URI: a.name,
Digest: a.digestSet,
}
}
Loading

0 comments on commit a1a6b6e

Please sign in to comment.