()
| 31 | ) |
| 32 | |
| 33 | func newAttestationPushCmd() *cobra.Command { |
| 34 | var ( |
| 35 | pkPath, bundle string |
| 36 | annotationsFlag []string |
| 37 | signServerCAPath string |
| 38 | // Client certificate and passphrase for SignServer auth |
| 39 | signServerAuthCertPath string |
| 40 | signServerAuthCertPass string |
| 41 | bypassPolicyCheck bool |
| 42 | deactivateCIReport bool |
| 43 | ) |
| 44 | |
| 45 | cmd := &cobra.Command{ |
| 46 | Use: "push", |
| 47 | Short: "generate and push the attestation to the control plane", |
| 48 | Example: ` chainloop attestation push --key <key path>|<env://VAR_NAME> --token [chainloop-token] --annotation key=value,key2=val2 |
| 49 | |
| 50 | # sign the resulting attestation using a cosign key present in the filesystem and stdin for the passphrase |
| 51 | # NOTE that the --token flag can be replaced by having the CHAINLOOP_TOKEN env variable |
| 52 | chainloop attestation push --key cosign.key --token [chainloop-token] |
| 53 | |
| 54 | # or retrieve the key from an environment variable containing the private key |
| 55 | chainloop attestation push --key env://[ENV_VAR] |
| 56 | |
| 57 | # The passphrase can be retrieved from a well-known environment variable |
| 58 | export CHAINLOOP_SIGNING_PASSWORD="my cosign key passphrase" |
| 59 | chainloop attestation push --key cosign.key |
| 60 | |
| 61 | # You can provide values for the annotations that have previously defined in the contract for example |
| 62 | chainloop attestation push --annotation key=value --annotation key2=value2 |
| 63 | # Or alternatively |
| 64 | chainloop attestation push --annotation key=value,key2=value2`, |
| 65 | Annotations: map[string]string{ |
| 66 | useAPIToken: "true", |
| 67 | supportsFederatedAuthAnnotation: "true", |
| 68 | }, |
| 69 | RunE: func(cmd *cobra.Command, _ []string) error { |
| 70 | info, err := executableInfo() |
| 71 | if err != nil { |
| 72 | return fmt.Errorf("getting executable information: %w", err) |
| 73 | } |
| 74 | a, err := action.NewAttestationPush(&action.AttestationPushOpts{ |
| 75 | ActionsOpts: ActionOpts, |
| 76 | KeyPath: pkPath, |
| 77 | BundlePath: bundle, |
| 78 | CLIVersion: info.Version, |
| 79 | CLIDigest: info.Digest, |
| 80 | CASURI: viper.GetString(confOptions.CASAPI.viperKey), |
| 81 | CASCAPath: viper.GetString(confOptions.CASCA.viperKey), |
| 82 | ConnectionInsecure: apiInsecure(), |
| 83 | LocalStatePath: attestationLocalStatePath, |
| 84 | SignServerOpts: &action.SignServerOpts{ |
| 85 | CAPath: signServerCAPath, |
| 86 | AuthClientCertPath: signServerAuthCertPath, |
| 87 | AuthClientCertPass: signServerAuthCertPass, |
| 88 | }, |
| 89 | }) |
| 90 | if err != nil { |
no test coverage detected