()
| 35 | const NotSet = "[NOT SET]" |
| 36 | |
| 37 | func newAttestationAddCmd() *cobra.Command { |
| 38 | var name, value, kind string |
| 39 | var artifactCASConn *grpc.ClientConn |
| 40 | var annotationsFlag []string |
| 41 | var noStrictValidation bool |
| 42 | var policyInputFromFileFlag []string |
| 43 | |
| 44 | // OCI registry credentials can be passed as flags or environment variables |
| 45 | var registryServer, registryUsername, registryPassword string |
| 46 | const ( |
| 47 | registryServerEnvVarName = "CHAINLOOP_REGISTRY_SERVER" |
| 48 | registryUsernameEnvVarName = "CHAINLOOP_REGISTRY_USERNAME" |
| 49 | // nolint: gosec |
| 50 | registryPasswordEnvVarName = "CHAINLOOP_REGISTRY_PASSWORD" |
| 51 | ) |
| 52 | |
| 53 | cmd := &cobra.Command{ |
| 54 | Use: "add", |
| 55 | Short: "add a material to the attestation", |
| 56 | Annotations: map[string]string{ |
| 57 | useAPIToken: "true", |
| 58 | supportsFederatedAuthAnnotation: "true", |
| 59 | }, |
| 60 | Example: ` # Add a material to the attestation that is defined in the contract |
| 61 | chainloop attestation add --name <material-name> --value <material-value> |
| 62 | |
| 63 | # Add a material to the attestation that is not defined in the contract but you know the kind |
| 64 | chainloop attestation add --kind <material-kind> --value <material-value> |
| 65 | |
| 66 | # Add a material to the attestation without specifying neither kind nor name enables automatic detection |
| 67 | chainloop attestation add --value <material-value> |
| 68 | |
| 69 | # Add a material by also providing a URL pointing to the material. It will be downloaded to a temporary folder first |
| 70 | chainloop attestation add --value https://example.com/sbom.json |
| 71 | |
| 72 | # Feed a policy input from a column of a CSV/JSON file (e.g. the ignored_paths exclusion list for the sigcheck binary-signing policies). |
| 73 | # The :column suffix selects the column; it defaults to the input name when omitted. The file is also recorded as EVIDENCE. |
| 74 | chainloop attestation add --name sigcheck --value sigcheckResult.csv --kind SYSINTERNALS_SIGCHECK \ |
| 75 | --policy-input-from-file ignored_paths=exception.csv:Path |
| 76 | |
| 77 | # Scope an input to a specific policy with a <policy>: prefix so it only applies to that policy attachment. |
| 78 | chainloop attestation add --name sigcheck --value sigcheckResult.csv --kind SYSINTERNALS_SIGCHECK \ |
| 79 | --policy-input-from-file trusted-binaries-signed:ignored_paths=exception.csv:Path \ |
| 80 | --policy-input-from-file trusted-binaries-vendor-keys:third_party_paths=exception.csv:Path`, |
| 81 | RunE: func(cmd *cobra.Command, _ []string) error { |
| 82 | a, err := action.NewAttestationAdd( |
| 83 | &action.AttestationAddOpts{ |
| 84 | ActionsOpts: ActionOpts, |
| 85 | CASURI: viper.GetString(confOptions.CASAPI.viperKey), |
| 86 | CASCAPath: viper.GetString(confOptions.CASCA.viperKey), |
| 87 | ConnectionInsecure: apiInsecure(), |
| 88 | RegistryServer: registryServer, |
| 89 | RegistryUsername: registryUsername, |
| 90 | RegistryPassword: registryPassword, |
| 91 | LocalStatePath: attestationLocalStatePath, |
| 92 | NoStrictValidation: noStrictValidation, |
| 93 | }, |
| 94 | ) |
no test coverage detected