Function createSignatureData

acceptance/image/image.go:174–244

createSignatureData creates and signs the image signature with bundle information

(ctx context.Context, imageName string, digestImage name.Digest, signer signature.SignerVerifier)

// createSignatureData creates and signs the image signature with bundle information
func createSignatureData(ctx context.Context, imageName string, digestImage name.Digest, signer signature.SignerVerifier) (*signatureData, error) {
	// Create the cosign signature payload and sign it
	payload, rawSignature, err := signature.SignImage(signer, digestImage, map[string]interface{}{})
	if err != nil {
		return nil, err
	}

	signatureBase64 := base64.StdEncoding.EncodeToString(rawSignature)

	// Create the signature structure for the stub rekor entry
	signatureStruct := Signature{
		KeyID:     "",
		Signature: signatureBase64,
	}

	signatureJSON, err := json.Marshal(signatureStruct)
	if err != nil {
		return nil, fmt.Errorf("failed to marshal signature structure: %w", err)
	}

	// Get the public key from the signer for hashedrekord validation
	publicKey, err := signer.PublicKey()
	if err != nil {
		return nil, fmt.Errorf("failed to get public key: %w", err)
	}

	publicKeyBytes, err := cryptoutils.MarshalPublicKeyToPEM(publicKey)
	if err != nil {
		return nil, fmt.Errorf("failed to marshal public key: %w", err)
	}

	// Create stubs for both Rekor entry signature creation and retrieval endpoints
	err = rekor.StubRekorEntryCreationForSignature(ctx, payload, rawSignature, signatureJSON, publicKeyBytes)
	if err != nil {
		return nil, fmt.Errorf("error stubbing rekor endpoints: %w", err)
	}

	// Upload to transparency log to get bundle information like Tekton Chains does
	rekorBundle, _, err := uploadToTransparencyLog(ctx, payload, rawSignature, signer)
	if err != nil {
		return nil, err
	}

	// Create the signature layer with bundle information using static.WithBundle
	signatureLayer, err := static.NewSignature(payload, signatureBase64, static.WithBundle(rekorBundle))
	if err != nil {
		return nil, err
	}

	// Extract bundle information from signatureLayer to include in annotations
	annotations := map[string]string{
		static.SignatureAnnotationKey: signatureBase64,
	}

	// Add bundle annotation if bundle information exists
	bundleJSON, err := json.Marshal(rekorBundle)
	if err != nil {
		return nil, fmt.Errorf("failed to marshal bundle for annotation: %w", err)