mirror of
https://github.com/hashicorp/packer.git
synced 2026-09-28 18:54:07 -04:00
Tanmay Jain
0211ed7d4c
Add internal/provenance for deriving in-toto subjects from Packer artifacts, building SLSA Provenance v1 predicates, wrapping in-toto statements, and best-effort git/CI source detection. Add internal/attestation for DSSE envelope handling and a pluggable Signer/Verifier backend supporting key (local PEM), kms (aws/gcp/ azure/hashivault), and keyless (Sigstore Fulcio) modes, plus Sigstore bundle handling and DSSE/policy verification. Add the supporting module dependencies in go.mod/go.sum.
23 lines
636 B
Go
23 lines
636 B
Go
// Copyright IBM Corp. 2024, 2025
|
|
// SPDX-License-Identifier: BUSL-1.1
|
|
|
|
package attestation
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
)
|
|
|
|
type bundleSigner interface {
|
|
SignBundle(ctx context.Context, payloadType string, payload []byte, cfg BackendConfig) (Envelope, []byte, error)
|
|
}
|
|
|
|
func BuildBundleForSigner(ctx context.Context, signer Signer, cfg BackendConfig, payloadType string, payload []byte) (Envelope, []byte, error) {
|
|
bundler, ok := signer.(bundleSigner)
|
|
if !ok {
|
|
return Envelope{}, nil, fmt.Errorf("signing_mode %q does not support Sigstore bundle emission", cfg.Mode)
|
|
}
|
|
|
|
return bundler.SignBundle(ctx, payloadType, payload, cfg)
|
|
}
|