diff --git a/pkg/cmd/attestation/api/mock_client.go b/pkg/cmd/attestation/api/mock_client.go index 39232cdae6a..08468d8500c 100644 --- a/pkg/cmd/attestation/api/mock_client.go +++ b/pkg/cmd/attestation/api/mock_client.go @@ -41,8 +41,10 @@ func OnGetByDigestSuccess(params FetchParams) ([]*Attestation, error) { att3 := makeTestReleaseAttestation() attestations := []*Attestation{&att1, &att2} if params.PredicateType != "" { - if params.PredicateType == "https://in-toto.io/attestation/release/v0.1" { - attestations = append(attestations, &att3) + // "release" is a sentinel value that returns all release attestations (v0.1, v0.2, etc.) + // This mimics the GitHub API behavior which handles this server-side + if params.PredicateType == "release" { + return []*Attestation{&att3}, nil } return FilterAttestations(params.PredicateType, attestations) } diff --git a/pkg/cmd/release/shared/attestation.go b/pkg/cmd/release/shared/attestation.go index 29b804533be..65990290b67 100644 --- a/pkg/cmd/release/shared/attestation.go +++ b/pkg/cmd/release/shared/attestation.go @@ -17,8 +17,6 @@ import ( "google.golang.org/protobuf/encoding/protojson" ) -const ReleasePredicateType = "https://in-toto.io/attestation/release/v0.1" - type Verifier interface { // VerifyAttestation verifies the attestation for a given artifact VerifyAttestation(art *artifact.DigestedArtifact, att *api.Attestation) (*verification.AttestationProcessingResult, error) diff --git a/pkg/cmd/release/verify-asset/verify_asset.go b/pkg/cmd/release/verify-asset/verify_asset.go index 43cdec9905c..acd8a134e8e 100644 --- a/pkg/cmd/release/verify-asset/verify_asset.go +++ b/pkg/cmd/release/verify-asset/verify_asset.go @@ -147,7 +147,7 @@ func verifyAssetRun(config *VerifyAssetConfig) error { // Find attestations for the release tag SHA attestations, err := config.AttClient.GetByDigest(api.FetchParams{ Digest: releaseRefDigest.DigestWithAlg(), - PredicateType: shared.ReleasePredicateType, + PredicateType: "release", Owner: baseRepo.RepoOwner(), Repo: baseRepo.RepoOwner() + "/" + baseRepo.RepoName(), // TODO: Allow this value to be set via a flag. diff --git a/pkg/cmd/release/verify/verify.go b/pkg/cmd/release/verify/verify.go index 2654977f79e..65516764ebe 100644 --- a/pkg/cmd/release/verify/verify.go +++ b/pkg/cmd/release/verify/verify.go @@ -135,7 +135,7 @@ func verifyRun(config *VerifyConfig) error { // Find all the attestations for the release tag SHA attestations, err := config.AttClient.GetByDigest(api.FetchParams{ Digest: releaseRefDigest.DigestWithAlg(), - PredicateType: shared.ReleasePredicateType, + PredicateType: "release", Owner: baseRepo.RepoOwner(), Repo: baseRepo.RepoOwner() + "/" + baseRepo.RepoName(), Initiator: "github",