Update GenAccessoryArt API to generate valid accessory for SBOM (goha…

…rbor#20214)

Signed-off-by: stonezdj <[email protected]>
Co-authored-by: stonezdj <[email protected]>

src/pkg/scan/util.go

@@ -34,8 +34,10 @@ import (
 	v1sq "github.com/goharbor/harbor/src/pkg/scan/rest/v1"
 )
 
+// Insecure ...
 type Insecure bool
 
+// RemoteOptions ...
 func (i Insecure) RemoteOptions() []remote.Option {
 	tr := http.DefaultTransport.(*http.Transport).Clone()
 	tr.TLSClientConfig = &tls.Config{InsecureSkipVerify: bool(i)}
@@ -76,20 +78,20 @@ func GenAccessoryArt(sq v1sq.ScanRequest, accData []byte, accAnnotations map[str
 	// https://github.com/google/go-containerregistry/issues/1832
 	accArt = mutate.MediaType(accArt, ocispec.MediaTypeImageManifest)
 	accArt = mutate.ConfigMediaType(accArt, types.MediaType(mediaType))
-	accArt = mutate.Subject(accArt, *accSubArt).(v1.Image)
 	accArt = mutate.Annotations(accArt, accAnnotations).(v1.Image)
+	accArt = mutate.Subject(accArt, *accSubArt).(v1.Image)
 
-	digest, err := accArt.Digest()
+	dgst, err := accArt.Digest()
 	if err != nil {
 		return "", err
 	}
-	accRef, err := name.ParseReference(fmt.Sprintf("%s/%s@%s", sq.Registry.URL, sq.Artifact.Repository, digest.String()))
+	accRef, err := name.ParseReference(fmt.Sprintf("%s/%s@%s", sq.Registry.URL, sq.Artifact.Repository, dgst.String()))
 	if err != nil {
 		return "", err
 	}
 	opts := append(referrer{Insecure: true}.RemoteOptions(), remote.WithAuth(&authn.Basic{Username: robot.Name, Password: robot.Secret}))
 	if err := remote.Write(accRef, accArt, opts...); err != nil {
 		return "", err
 	}
-	return digest.String(), nil
+	return dgst.String(), nil
 }

src/pkg/scan/util_test.go

@@ -60,5 +60,5 @@ func TestGenAccessoryArt(t *testing.T) {
 	}
 	s, err := GenAccessoryArt(sq, []byte(`{"name": "harborAccTest", "version": "1.0"}`), annotations, "application/vnd.goharbor.harbor.main.v1", r)
 	assert.Nil(t, err)
-	assert.Equal(t, "sha256:8de6104b79deca0253ff8667692f03e34753494c77ec81f631b45aad69223c18", s)
+	assert.Equal(t, "sha256:a39c6456d3cd1d87b7ee5706f67133d7a6d27a2dbc9ed66d50e504ff8920efc3", s)
 }