Function uploadToTransparencyLog

acceptance/image/image.go:305–341

uploadToTransparencyLog uploads a signature to the transparency log and returns the bundle along with the raw tlog entry (needed for creating protobuf bundles).

(ctx context.Context, payload []byte, rawSignature []byte, signer signature.SignerVerifier)

// uploadToTransparencyLog uploads a signature to the transparency log and returns the bundle
// along with the raw tlog entry (needed for creating protobuf bundles).
func uploadToTransparencyLog(ctx context.Context, payload []byte, rawSignature []byte, signer signature.SignerVerifier) (*bundle.RekorBundle, *models.LogEntryAnon, error) {
	// Get public key or cert for transparency log upload
	pkoc, err := getPublicKeyOrCert(signer)
	if err != nil {
		return nil, nil, fmt.Errorf("failed to get public key or cert: %w", err)
	}

	// Get Rekor URL
	rekorURL, err := rekor.StubRekor(ctx)
	if err != nil {
		return nil, nil, fmt.Errorf("failed to get stub rekor URL: %w", err)
	}

	rekorClient, err := rc.GetRekorClient(rekorURL)
	if err != nil {
		return nil, nil, fmt.Errorf("failed to get rekor client: %w", err)
	}

	// Compute payload checksum
	checksum := sha256.New()
	if _, err := checksum.Write(payload); err != nil {
		return nil, nil, fmt.Errorf("error checksuming payload: %w", err)
	}

	tlogEntry, err := cosign.TLogUpload(ctx, rekorClient, rawSignature, checksum, pkoc)
	if err != nil {
		return nil, nil, fmt.Errorf("failed to upload to transparency log: %w", err)
	}

	// Create bundle from the actual transparency log entry
	rekorBundle := bundle.EntryToBundle(tlogEntry)
	if rekorBundle == nil {
		return nil, nil, fmt.Errorf("rekorBundle is nil after EntryToBundle")
	}

	return rekorBundle, tlogEntry, nil
}

// getImageDigestAndRef returns the image, its digest, and digest reference for signing
func getImageDigestAndRef(ctx context.Context, imageName string) (v1.Image, v1.Hash, name.Digest, error) {