mirror of
https://github.com/hashicorp/packer.git
synced 2026-09-28 18:54:07 -04:00
Tanmay Jain
014f8d1bbe
* feat(provenance): add SLSA provenance and attestation signing libraries Add internal/provenance for deriving in-toto subjects from Packer artifacts, building SLSA Provenance v1 predicates, wrapping in-toto statements, and best-effort git/CI source detection. Add internal/attestation for DSSE envelope handling and a pluggable Signer/Verifier backend supporting key (local PEM), kms (aws/gcp/ azure/hashivault), and keyless (Sigstore Fulcio) modes, plus Sigstore bundle handling and DSSE/policy verification. Add the supporting module dependencies in go.mod/go.sum. * feat(provenance): add provenance post-processor Add the opt-in "provenance" post-processor that runs after a build, derives subjects from the artifact, emits DSSE-wrapped SLSA provenance (and optional SBOM) attestations, signs them via the configured signing backend, and writes sidecar files (including *.sigstore.json bundles in keyless mode). Register it in the core post-processor set. The provenance enable flag is a tri-state so an unset value stays enabled through HCL2 decoding instead of being silently disabled. * feat(provenance): add verify-attestation command Add "packer verify-attestation" to verify signed DSSE attestations against key, KMS, and keyless policy inputs, including optional Sigstore bundle checks for Rekor and timestamp evidence. Register the command in the CLI. * docs(provenance): add reference CI workflows and changelog Add reference GitHub Actions workflows under examples/ci for SLSA L2 keyless signing and L3-compatible delegated signing * fix: lint and tests * Added docs for Provenance PostProcessor
27 lines
733 B
Go
27 lines
733 B
Go
// Copyright IBM Corp. 2024, 2025
|
|
// SPDX-License-Identifier: BUSL-1.1
|
|
|
|
package provenance
|
|
|
|
import "testing"
|
|
|
|
func TestWrapInToto(t *testing.T) {
|
|
statement := WrapInToto(
|
|
[]Subject{{Name: "artifact.bin", Digest: DigestSet{"sha256": "abc123"}}},
|
|
SLSAProvenanceV1PredicateType,
|
|
BuildSLSAPredicate(PredicateInput{}),
|
|
)
|
|
|
|
if got, want := statement.Type, StatementType; got != want {
|
|
t.Fatalf("unexpected statement type %q, want %q", got, want)
|
|
}
|
|
|
|
if got, want := statement.PredicateType, SLSAProvenanceV1PredicateType; got != want {
|
|
t.Fatalf("unexpected predicate type %q, want %q", got, want)
|
|
}
|
|
|
|
if got, want := len(statement.Subject), 1; got != want {
|
|
t.Fatalf("unexpected subject count %d, want %d", got, want)
|
|
}
|
|
}
|