diff --git a/evidence/cli/command_build.go b/evidence/cli/command_build.go index bcac636..3c387b4 100644 --- a/evidence/cli/command_build.go +++ b/evidence/cli/command_build.go @@ -29,6 +29,7 @@ func (ebc *evidenceBuildCommand) CreateEvidence(ctx *components.Context, serverD serverDetails, ebc.ctx.GetStringFlagValue(predicate), ebc.ctx.GetStringFlagValue(predicateType), + ebc.ctx.GetStringFlagValue(markdown), ebc.ctx.GetStringFlagValue(key), ebc.ctx.GetStringFlagValue(keyAlias), ebc.ctx.GetStringFlagValue(project), diff --git a/evidence/cli/command_custom.go b/evidence/cli/command_custom.go index 87fd0a8..de8a449 100644 --- a/evidence/cli/command_custom.go +++ b/evidence/cli/command_custom.go @@ -22,6 +22,7 @@ func (ecc *evidenceCustomCommand) CreateEvidence(_ *components.Context, serverDe serverDetails, ecc.ctx.GetStringFlagValue(predicate), ecc.ctx.GetStringFlagValue(predicateType), + ecc.ctx.GetStringFlagValue(markdown), ecc.ctx.GetStringFlagValue(key), ecc.ctx.GetStringFlagValue(keyAlias), ecc.ctx.GetStringFlagValue(subjectRepoPath), diff --git a/evidence/cli/command_package.go b/evidence/cli/command_package.go index 73e937a..c01d569 100644 --- a/evidence/cli/command_package.go +++ b/evidence/cli/command_package.go @@ -29,6 +29,7 @@ func (epc *evidencePackageCommand) CreateEvidence(ctx *components.Context, serve serverDetails, epc.ctx.GetStringFlagValue(predicate), epc.ctx.GetStringFlagValue(predicateType), + epc.ctx.GetStringFlagValue(markdown), epc.ctx.GetStringFlagValue(key), epc.ctx.GetStringFlagValue(keyAlias), epc.ctx.GetStringFlagValue(packageName), diff --git a/evidence/cli/command_relesae_bundle.go b/evidence/cli/command_relesae_bundle.go index 3c5e34d..32c8922 100644 --- a/evidence/cli/command_relesae_bundle.go +++ b/evidence/cli/command_relesae_bundle.go @@ -29,6 +29,7 @@ func (erc *evidenceReleaseBundleCommand) CreateEvidence(ctx *components.Context, serverDetails, erc.ctx.GetStringFlagValue(predicate), erc.ctx.GetStringFlagValue(predicateType), + erc.ctx.GetStringFlagValue(markdown), erc.ctx.GetStringFlagValue(key), erc.ctx.GetStringFlagValue(keyAlias), erc.ctx.GetStringFlagValue(project), diff --git a/evidence/cli/flags.go b/evidence/cli/flags.go index 98f9b14..03b3917 100644 --- a/evidence/cli/flags.go +++ b/evidence/cli/flags.go @@ -30,6 +30,7 @@ const ( // Unique evidence flags predicate = "predicate" predicateType = "predicate-type" + markdown = "markdown" subjectRepoPath = "subject-repo-path" subjectSha256 = "subject-sha256" key = "key" @@ -61,6 +62,7 @@ var flagsMap = map[string]components.Flag{ predicate: components.NewStringFlag(predicate, "Path to the predicate, arbitrary JSON.", func(f *components.StringFlag) { f.Mandatory = true }), predicateType: components.NewStringFlag(predicateType, "Type of the predicate.", func(f *components.StringFlag) { f.Mandatory = true }), + markdown: components.NewStringFlag(markdown, "Markdown of the predicate.", func(f *components.StringFlag) { f.Mandatory = false }), subjectRepoPath: components.NewStringFlag(subjectRepoPath, "Full path to some subject' location.", func(f *components.StringFlag) { f.Mandatory = false }), subjectSha256: components.NewStringFlag(subjectSha256, "Subject checksum sha256.", func(f *components.StringFlag) { f.Mandatory = false }), key: components.NewStringFlag(key, "Path to a private key that will sign the DSSE. Supported keys: 'ecdsa','rsa' and 'ed25519'.", func(f *components.StringFlag) { f.Mandatory = false }), @@ -83,6 +85,7 @@ var commandFlags = map[string][]string{ packageRepoName, predicate, predicateType, + markdown, subjectRepoPath, subjectSha256, key, diff --git a/evidence/create_base.go b/evidence/create_base.go index 80b4bf9..5f5f090 100644 --- a/evidence/create_base.go +++ b/evidence/create_base.go @@ -22,6 +22,7 @@ type createEvidenceBase struct { serverDetails *config.ServerDetails predicateFilePath string predicateType string + markdownFilePath string key string keyId string } @@ -58,6 +59,11 @@ func (c *createEvidenceBase) buildIntotoStatementJson(subject, subjectSha256 str } statement := intoto.NewStatement(predicate, c.predicateType, c.serverDetails.User) + err = c.setMarkdown(statement) + if err != nil { + return nil, err + } + err = statement.SetSubject(artifactoryClient, subject, subjectSha256) if err != nil { return nil, err @@ -70,6 +76,21 @@ func (c *createEvidenceBase) buildIntotoStatementJson(subject, subjectSha256 str return statementJson, nil } +func (c *createEvidenceBase) setMarkdown(statement *intoto.Statement) error { + if c.markdownFilePath != "" { + if !strings.HasSuffix(c.markdownFilePath, ".md") { + return fmt.Errorf("file '%s' does not have a .md extension", c.markdownFilePath) + } + markdown, err := os.ReadFile(c.markdownFilePath) + if err != nil { + log.Warn(fmt.Sprintf("failed to read markdown file '%s'", c.markdownFilePath)) + return err + } + statement.SetMarkdown(markdown) + } + return nil +} + func (c *createEvidenceBase) uploadEvidence(envelope []byte, repoPath string) error { evidenceManager, err := utils.CreateEvidenceServiceManager(c.serverDetails, false) if err != nil { diff --git a/evidence/create_build.go b/evidence/create_build.go index ee88ef7..7fc3127 100644 --- a/evidence/create_build.go +++ b/evidence/create_build.go @@ -19,12 +19,13 @@ type createEvidenceBuild struct { } func NewCreateEvidenceBuild(serverDetails *coreConfig.ServerDetails, - predicateFilePath, predicateType, key, keyId, project, buildName, buildNumber string) Command { + predicateFilePath, predicateType, markdownFilePath, key, keyId, project, buildName, buildNumber string) Command { return &createEvidenceBuild{ createEvidenceBase: createEvidenceBase{ serverDetails: serverDetails, predicateFilePath: predicateFilePath, predicateType: predicateType, + markdownFilePath: markdownFilePath, key: key, keyId: keyId, }, diff --git a/evidence/create_custom.go b/evidence/create_custom.go index 68b9b64..314e736 100644 --- a/evidence/create_custom.go +++ b/evidence/create_custom.go @@ -11,13 +11,14 @@ type createEvidenceCustom struct { subjectSha256 string } -func NewCreateEvidenceCustom(serverDetails *coreConfig.ServerDetails, predicateFilePath, predicateType, key, keyId, subjectRepoPath, +func NewCreateEvidenceCustom(serverDetails *coreConfig.ServerDetails, predicateFilePath, predicateType, markdownFilePath, key, keyId, subjectRepoPath, subjectSha256 string) Command { return &createEvidenceCustom{ createEvidenceBase: createEvidenceBase{ serverDetails: serverDetails, predicateFilePath: predicateFilePath, predicateType: predicateType, + markdownFilePath: markdownFilePath, key: key, keyId: keyId, }, diff --git a/evidence/create_package.go b/evidence/create_package.go index b8f670d..a043466 100644 --- a/evidence/create_package.go +++ b/evidence/create_package.go @@ -26,13 +26,14 @@ type createEvidencePackage struct { packageRepoName string } -func NewCreateEvidencePackage(serverDetails *coreConfig.ServerDetails, predicateFilePath, predicateType, key, keyId, packageName, +func NewCreateEvidencePackage(serverDetails *coreConfig.ServerDetails, predicateFilePath, predicateType, markdownFilePath, key, keyId, packageName, packageVersion, packageRepoName string) Command { return &createEvidencePackage{ createEvidenceBase: createEvidenceBase{ serverDetails: serverDetails, predicateFilePath: predicateFilePath, predicateType: predicateType, + markdownFilePath: markdownFilePath, key: key, keyId: keyId, }, diff --git a/evidence/create_release_bundle.go b/evidence/create_release_bundle.go index ea76cd6..627d9b4 100644 --- a/evidence/create_release_bundle.go +++ b/evidence/create_release_bundle.go @@ -15,13 +15,14 @@ type createEvidenceReleaseBundle struct { releaseBundleVersion string } -func NewCreateEvidenceReleaseBundle(serverDetails *coreConfig.ServerDetails, predicateFilePath, predicateType, key, keyId, project, releaseBundle, +func NewCreateEvidenceReleaseBundle(serverDetails *coreConfig.ServerDetails, predicateFilePath, predicateType, markdownFilePath, key, keyId, project, releaseBundle, releaseBundleVersion string) Command { return &createEvidenceReleaseBundle{ createEvidenceBase: createEvidenceBase{ serverDetails: serverDetails, predicateFilePath: predicateFilePath, predicateType: predicateType, + markdownFilePath: markdownFilePath, key: key, keyId: keyId, }, diff --git a/evidence/intoto/intoto_statement_v1.go b/evidence/intoto/intoto_statement_v1.go index cb60c81..b5b2c8c 100644 --- a/evidence/intoto/intoto_statement_v1.go +++ b/evidence/intoto/intoto_statement_v1.go @@ -21,6 +21,7 @@ type Statement struct { Predicate json.RawMessage `json:"predicate"` CreatedAt string `json:"createdAt"` CreatedBy string `json:"createdBy"` + Markdown string `json:"markdown,omitempty"` } type ResourceDescriptor struct { @@ -54,6 +55,10 @@ func (s *Statement) SetSubject(servicesManager artifactory.ArtifactoryServicesMa return nil } +func (s *Statement) SetMarkdown(markdown []byte) { + s.Markdown = string(markdown) +} + func (s *Statement) Marshal() ([]byte, error) { intotoJson, err := json.Marshal(s) if err != nil {