Function createAndPushAttestationInternal

acceptance/image/image.go:447–597

createAndPushAttestationInternal is the internal implementation that supports both SLSA v0.2 and v1

(ctx context.Context, imageName, keyName string, patches *godog.Table, useV1 bool)

// createAndPushAttestationInternal is the internal implementation that supports both SLSA v0.2 and v1
func createAndPushAttestationInternal(ctx context.Context, imageName, keyName string, patches *godog.Table, useV1 bool) (context.Context, error) {
	var state *imageState
	ctx, err := testenv.SetupState(ctx, &state)
	if err != nil {
		return ctx, err
	}

	if state.Attestations[imageName] != "" {
		// we already created the attestation
		return ctx, nil
	}

	image, digest, _, err := getImageDigestAndRef(ctx, imageName)
	if err != nil {
		return ctx, err
	}

	var statement any

	if useV1 {
		// SLSA v1.0
		statement, err = attestation.CreateV1StatementFor(imageName, image)
		if err != nil {
			return ctx, err
		}
	} else {
		// SLSA v0.2
		v02Statement, err := attestation.CreateStatementFor(imageName, image)
		if err != nil {
			return ctx, err
		}

		statement, err = applyPatches(v02Statement, patches)
		if err != nil {
			return ctx, err
		}
	}

	signedAttestation, err := attestation.SignStatement(ctx, keyName, statement)
	if err != nil {
		return ctx, err
	}

	// Extract signature information from the signed attestation
	var sig *cosign.Signatures
	sig, err = unmarshallSignatures(signedAttestation)
	if err != nil {
		return ctx, err
	}
	if sig == nil {
		return ctx, fmt.Errorf("failed to extract signature from attestation: no signatures found")
	}

	state.AttestationSignatures[imageName] = Signature{
		KeyID:     sig.KeyID,
		Signature: sig.Sig,
	}