Function CreateAndPushImageSignatureReferrer

acceptance/image/image.go:377–427

CreateAndPushImageSignatureReferrer creates a signature for a named image using OCI Referrers API

(ctx context.Context, imageName string, keyName string)

// CreateAndPushImageSignatureReferrer creates a signature for a named image using OCI Referrers API
func CreateAndPushImageSignatureReferrer(ctx context.Context, imageName string, keyName string) (context.Context, error) {
	var state *imageState
	ctx, err := testenv.SetupState(ctx, &state)
	if err != nil {
		return ctx, err
	}

	if _, ok := state.ReferrerSignatures[imageName]; ok {
		// we already created the referrer signature
		return ctx, nil
	}

	_, digest, digestImage, err := getImageDigestAndRef(ctx, imageName)
	if err != nil {
		return ctx, err
	}

	signer, err := crypto.SignerWithKey(ctx, keyName)
	if err != nil {
		return ctx, err
	}

	sigData, err := createSignatureData(ctx, imageName, digestImage, signer)
	if err != nil {
		return ctx, err
	}

	digestRef, err := getDigestRefForImage(ctx, imageName, digest)
	if err != nil {
		return ctx, err
	}

	// Attach signature using OCI Referrers API
	err = cosignRemote.WriteReferrer(
		digestRef,
		"application/vnd.dev.cosign.simplesigning.v1+json",
		[]v1.Layer{sigData.signatureLayer},
		sigData.annotations,
		cosignRemote.WithRemoteOptions(remote.WithContext(ctx)),
	)
	if err != nil {
		return ctx, fmt.Errorf("failed to write signature referrer: %w", err)
	}

	// NOTE: We store the subject image digest here for deduplication purposes only.
	// This is NOT the referrer artifact's digest.
	state.ReferrerSignatures[imageName] = digestRef.String()
	state.ReferrerImageSignatures[imageName] = sigData.signatureStruct

	return ctx, nil
}

// CreateAndPushAttestation for a named image in the Context creates an attestation
// image, same as `cosign attest` or Tekton Chains would, and pushes it to the stub