remove imageRef param from Upload funcs

* This commit removes the imageRef param
  from the Upload functions used by our
  backends (Rekor and Local).
* This is because we were using imageRef
  only to differentiate between Component
  and Snapshot VSA types, specifically for
  Local backend, so users can differentiate
  between the local files for these VSAs.
* Now, we won't need to differentiate since
  we're already writing the correctly-named
  VSA files to the disk for any backend.

resolves: EC-1309

Author: dheerajodha

cmd/validate/image.go

@@ -503,17 +503,21 @@ func validateImageCmd(validate imageValidationFunc) *cobra.Command {
 
 						// Upload component VSA envelopes
 						for imageRef, envelopePath := range vsaResult.ComponentEnvelopes {
-							uploadErr := vsa.UploadVSAEnvelope(cmd.Context(), envelopePath, imageRef, data.vsaUpload, signer)
+							uploadErr := vsa.UploadVSAEnvelope(cmd.Context(), envelopePath, data.vsaUpload, signer)
 							if uploadErr != nil {
 								log.Errorf("[VSA] Upload failed for component %s: %v", imageRef, uploadErr)
+							} else {
+								log.Infof("[VSA] Uploaded Component VSA")
 							}
 						}
 
 						// Upload snapshot VSA envelope if it exists
 						if vsaResult.SnapshotEnvelope != "" {
-							uploadErr := vsa.UploadVSAEnvelope(cmd.Context(), vsaResult.SnapshotEnvelope, "", data.vsaUpload, signer)
+							uploadErr := vsa.UploadVSAEnvelope(cmd.Context(), vsaResult.SnapshotEnvelope, data.vsaUpload, signer)
 							if uploadErr != nil {
 								log.Errorf("[VSA] Upload failed for snapshot: %v", uploadErr)
+							} else {
+								log.Infof("[VSA] Uploaded Snapshot VSA")
 							}
 						}
 					} else {

internal/validate/vsa/storage.go

@@ -29,14 +29,14 @@ import (
 // StorageBackend defines the interface for VSA storage implementations
 type StorageBackend interface {
 	Name() string
-	Upload(ctx context.Context, envelopeContent []byte, imageRef string) error
+	Upload(ctx context.Context, envelopeContent []byte) error
 }
 
 // SignerAwareUploader extends StorageBackend for backends that need access to the signer
 // (e.g., Rekor backend needs the public key for transparency log upload)
 type SignerAwareUploader interface {
 	StorageBackend
-	UploadWithSigner(ctx context.Context, envelopeContent []byte, imageRef string, signer *Signer) error
+	UploadWithSigner(ctx context.Context, envelopeContent []byte, signer *Signer) error
 }
 
 // StorageConfig represents parsed storage configuration
@@ -141,8 +141,7 @@ func CreateStorageBackend(config *StorageConfig) (StorageBackend, error) {
 }
 
 // UploadVSAEnvelope uploads a VSA envelope to the configured storage backends
-// imageRef should be the full container image reference for component VSAs, or empty string for snapshot VSAs
-func UploadVSAEnvelope(ctx context.Context, envelopePath string, imageRef string, storageConfigs []string, signer *Signer) error {
+func UploadVSAEnvelope(ctx context.Context, envelopePath string, storageConfigs []string, signer *Signer) error {
 	if len(storageConfigs) == 0 {
 		log.Infof("[VSA] No storage backends configured, skipping upload")
 		return nil
@@ -171,9 +170,9 @@ func UploadVSAEnvelope(ctx context.Context, envelopePath string, imageRef string
 		// Upload using the appropriate method
 		var uploadErr error
 		if signerAwareUploader, ok := backend.(SignerAwareUploader); ok && signer != nil {
-			uploadErr = signerAwareUploader.UploadWithSigner(ctx, envelopeContent, imageRef, signer)
+			uploadErr = signerAwareUploader.UploadWithSigner(ctx, envelopeContent, signer)
 		} else {
-			uploadErr = backend.Upload(ctx, envelopeContent, imageRef)
+			uploadErr = backend.Upload(ctx, envelopeContent)
 		}
 
 		if uploadErr != nil {

internal/validate/vsa/storage_local.go

@@ -65,24 +65,16 @@ func (l *LocalBackend) Name() string {
 }
 
 // Upload saves the VSA envelope to a local file
-func (l *LocalBackend) Upload(ctx context.Context, envelopeContent []byte, imageRef string) error {
+func (l *LocalBackend) Upload(ctx context.Context, envelopeContent []byte) error {
 	// Create directory if it doesn't exist
 	if err := os.MkdirAll(l.basePath, 0755); err != nil {
 		return fmt.Errorf("failed to create directory %s: %w", l.basePath, err)
 	}
 
-	// Generate filename based on imageRef type
+	// Generate filename with timestamp and content hash for uniqueness
 	timestamp := time.Now().Format("2006-01-02T15-04-05.000000000")
-	var filename string
-	if imageRef == "" {
-		// Snapshot VSA - include content hash for uniqueness
-		contentHash := sha256.Sum256(envelopeContent)
-		filename = fmt.Sprintf("vsa-snapshot-%s-%x.json", timestamp, contentHash[:4])
-	} else {
-		// Component VSA
-		hash := sha256.Sum256([]byte(imageRef))
-		filename = fmt.Sprintf("vsa-%s-%x.json", timestamp, hash[:8])
-	}
+	contentHash := sha256.Sum256(envelopeContent)
+	filename := fmt.Sprintf("vsa-%s-%x.json", timestamp, contentHash[:8])
 
 	// Write to file
 	filePath := filepath.Join(l.basePath, filename)
@@ -96,18 +88,10 @@ func (l *LocalBackend) Upload(ctx context.Context, envelopeContent []byte, image
 		absPath = filePath // fallback to relative path
 	}
 
-	// Log success with different messages for component vs snapshot VSAs
-	var logMessage string
-	if imageRef == "" {
-		logMessage = "[VSA] Successfully saved Snapshot VSA to local file"
-	} else {
-		logMessage = "[VSA] Successfully saved Component VSA to local file"
-	}
-
 	log.WithFields(log.Fields{
 		"path": absPath,
 		"size": len(envelopeContent),
-	}).Info(logMessage)
+	}).Info("[VSA] Successfully saved VSA to local file")
 
 	return nil
 }

internal/validate/vsa/storage_local_test.go

@@ -79,19 +79,18 @@ func TestLocalBackend_Name(t *testing.T) {
 	assert.Equal(t, "Local (/tmp/test)", backend.Name())
 }
 
-func TestLocalBackend_Upload_ComponentVSA(t *testing.T) {
+func TestLocalBackend_Upload(t *testing.T) {
 	// Create temporary directory
 	tempDir := t.TempDir()
 	backend := &LocalBackend{basePath: tempDir}
 
 	ctx := context.Background()
-	testEnvelope := `{"payload":"test-component","signatures":[{"sig":"test-sig"}]}`
-	imageRef := "quay.io/test/image@sha256:abc123def456"
+	testEnvelope := `{"payload":"test-vsa","signatures":[{"sig":"test-sig"}]}`
 
-	err := backend.Upload(ctx, []byte(testEnvelope), imageRef)
+	err := backend.Upload(ctx, []byte(testEnvelope))
 	require.NoError(t, err)
 
-	// Verify file was created (should contain hash of imageRef)
+	// Verify file was created
 	files, err := os.ReadDir(tempDir)
 	require.NoError(t, err)
 	require.Len(t, files, 1)
@@ -108,126 +107,69 @@ func TestLocalBackend_Upload_ComponentVSA(t *testing.T) {
 	assert.Equal(t, testEnvelope, string(content))
 }
 
-func TestLocalBackend_Upload_SnapshotVSA(t *testing.T) {
-	// Create temporary directory
-	tempDir := t.TempDir()
-	backend := &LocalBackend{basePath: tempDir}
-
-	ctx := context.Background()
-	testEnvelope := `{"payload":"test-snapshot","signatures":[{"sig":"test-sig"}]}`
-	imageRef := "" // Empty for snapshot VSAs
-
-	err := backend.Upload(ctx, []byte(testEnvelope), imageRef)
-	require.NoError(t, err)
-
-	// Verify file was created with snapshot naming
-	files, err := os.ReadDir(tempDir)
-	require.NoError(t, err)
-	require.Len(t, files, 1)
-
-	filename := files[0].Name()
-	assert.True(t, strings.HasPrefix(filename, "vsa-snapshot-"))
-	assert.True(t, strings.HasSuffix(filename, ".json"))
-
-	// Verify file content
-	filePath := filepath.Join(tempDir, filename)
-	content, err := os.ReadFile(filePath)
-	require.NoError(t, err)
-	assert.Equal(t, testEnvelope, string(content))
-}
-
 func TestLocalBackend_Upload_FilenameUniqueness(t *testing.T) {
 	// Create temporary directory
 	tempDir := t.TempDir()
 	backend := &LocalBackend{basePath: tempDir}
 
 	ctx := context.Background()
 	testEnvelope := `{"payload":"test","signatures":[{"sig":"test"}]}`
-	imageRef := "quay.io/test/image@sha256:same"
 
 	// Upload same content multiple times
-	err1 := backend.Upload(ctx, []byte(testEnvelope), imageRef)
+	err1 := backend.Upload(ctx, []byte(testEnvelope))
 	require.NoError(t, err1)
 
-	err2 := backend.Upload(ctx, []byte(testEnvelope), imageRef)
+	err2 := backend.Upload(ctx, []byte(testEnvelope))
 	require.NoError(t, err2)
 
 	// Should have created two different files due to timestamps
 	files, err := os.ReadDir(tempDir)
 	require.NoError(t, err)
 	assert.Len(t, files, 2)
 
-	// Both should be valid component VSA files
+	// Both should be valid VSA files with proper naming
 	for _, file := range files {
 		assert.True(t, strings.HasPrefix(file.Name(), "vsa-"))
 		assert.True(t, strings.HasSuffix(file.Name(), ".json"))
-		assert.False(t, strings.HasPrefix(file.Name(), "vsa-snapshot-"))
+		assert.Contains(t, file.Name(), "-") // Should have timestamp and hash parts
 	}
-}
 
-func TestLocalBackend_Upload_SnapshotFilenameUniqueness(t *testing.T) {
-	// Create temporary directory
-	tempDir := t.TempDir()
-	backend := &LocalBackend{basePath: tempDir}
-
-	ctx := context.Background()
-	testEnvelope := `{"payload":"test-snapshot","signatures":[{"sig":"test"}]}`
-	imageRef := "" // Empty for snapshots
-
-	// Upload multiple snapshot VSAs
-	err1 := backend.Upload(ctx, []byte(testEnvelope), imageRef)
-	require.NoError(t, err1)
-
-	err2 := backend.Upload(ctx, []byte(testEnvelope), imageRef)
-	require.NoError(t, err2)
-
-	// Should have created two different files due to timestamps
-	files, err := os.ReadDir(tempDir)
-	require.NoError(t, err)
-	assert.Len(t, files, 2)
-
-	// Both should be snapshot VSA files
-	for _, file := range files {
-		assert.True(t, strings.HasPrefix(file.Name(), "vsa-snapshot-"))
-		assert.True(t, strings.HasSuffix(file.Name(), ".json"))
-	}
+	// Verify filenames are different (uniqueness)
+	assert.NotEqual(t, files[0].Name(), files[1].Name())
 }
 
-func TestLocalBackend_Upload_WriteError(t *testing.T) {
-	// Use non-existent directory to trigger write error (without creating it first)
-	backend := &LocalBackend{basePath: "/non/existent/path"}
-
+func TestLocalBackend_Upload_DirectoryHandling(t *testing.T) {
 	ctx := context.Background()
 	testEnvelope := `{"payload":"test","signatures":[{"sig":"test"}]}`
-	imageRef := "test-image@sha256:abc123"
 
-	err := backend.Upload(ctx, []byte(testEnvelope), imageRef)
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "failed to create directory")
-}
+	t.Run("successful directory creation", func(t *testing.T) {
+		// Create base temp directory
+		baseDir := t.TempDir()
 
-func TestLocalBackend_Upload_DirectoryCreation(t *testing.T) {
-	// Create base temp directory
-	baseDir := t.TempDir()
+		// Use a subdirectory that doesn't exist yet
+		subDir := filepath.Join(baseDir, "subdir", "nested")
+		backend := &LocalBackend{basePath: subDir}
 
-	// Use a subdirectory that doesn't exist yet
-	subDir := filepath.Join(baseDir, "subdir", "nested")
-	backend := &LocalBackend{basePath: subDir}
+		// This should create the directory structure
+		err := backend.Upload(ctx, []byte(testEnvelope))
+		require.NoError(t, err)
 
-	ctx := context.Background()
-	testEnvelope := `{"payload":"test","signatures":[{"sig":"test"}]}`
-	imageRef := "test-image@sha256:abc123"
+		// Verify directory was created
+		_, err = os.Stat(subDir)
+		assert.NoError(t, err)
 
-	// This should create the directory structure
-	err := backend.Upload(ctx, []byte(testEnvelope), imageRef)
-	require.NoError(t, err)
+		// Verify file was created
+		files, err := os.ReadDir(subDir)
+		require.NoError(t, err)
+		assert.Len(t, files, 1)
+	})
 
-	// Verify directory was created
-	_, err = os.Stat(subDir)
-	assert.NoError(t, err)
+	t.Run("directory creation error", func(t *testing.T) {
+		// Use non-existent directory to trigger write error (without creating it first)
+		backend := &LocalBackend{basePath: "/non/existent/path"}
 
-	// Verify file was created
-	files, err := os.ReadDir(subDir)
-	require.NoError(t, err)
-	assert.Len(t, files, 1)
+		err := backend.Upload(ctx, []byte(testEnvelope))
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "failed to create directory")
+	})
 }

internal/validate/vsa/storage_rekor.go

@@ -80,12 +80,12 @@ func (r *RekorBackend) Name() string {
 }
 
 // Upload is not supported for Rekor backend - use UploadWithSigner instead
-func (r *RekorBackend) Upload(ctx context.Context, envelopeContent []byte, imageRef string) error {
+func (r *RekorBackend) Upload(ctx context.Context, envelopeContent []byte) error {
 	return fmt.Errorf("Rekor backend requires signer access for public key. Use UploadWithSigner instead")
 }
 
 // UploadWithSigner uploads a VSA envelope to the Rekor transparency log with access to the signer for public key extraction
-func (r *RekorBackend) UploadWithSigner(ctx context.Context, envelopeContent []byte, imageRef string, signer *Signer) error {
+func (r *RekorBackend) UploadWithSigner(ctx context.Context, envelopeContent []byte, signer *Signer) error {
 	// Safely convert retries to uint
 	var retryCount uint
 	if r.retries < 0 {
@@ -132,19 +132,11 @@ func (r *RekorBackend) UploadWithSigner(ctx context.Context, envelopeContent []b
 		logIndex = "unknown"
 	}
 
-	// Log success with different messages for component vs snapshot VSAs
-	var logMessage string
-	if imageRef == "" {
-		logMessage = "[VSA] Successfully uploaded Snapshot VSA to Rekor"
-	} else {
-		logMessage = "[VSA] Successfully uploaded Component VSA to Rekor"
-	}
-
 	log.WithFields(log.Fields{
 		"rekor_uuid":  entryUUID,
 		"rekor_url":   fmt.Sprintf("%s/api/v1/log/entries/%s", r.serverURL, entryUUID),
 		"rekor_index": logIndex,
-	}).Info(logMessage)
+	}).Info("[VSA] Successfully uploaded VSA to Rekor")
 
 	return nil
 }

internal/validate/vsa/storage_test.go

@@ -173,14 +173,14 @@ func TestUploadVSAEnvelope_EmptyConfigs(t *testing.T) {
 	envelopePath := tempFile.Name()
 
 	ctx := context.Background()
-	err = UploadVSAEnvelope(ctx, envelopePath, "test-image@sha256:abc123", []string{}, nil)
+	err = UploadVSAEnvelope(ctx, envelopePath, []string{}, nil)
 	assert.NoError(t, err)
 }
 
 func TestUploadVSAEnvelope_InvalidEnvelopePath(t *testing.T) {
 	ctx := context.Background()
 
-	err := UploadVSAEnvelope(ctx, "/non/existent/path", "test-image@sha256:abc123", []string{"local@/tmp"}, nil)
+	err := UploadVSAEnvelope(ctx, "/non/existent/path", []string{"local@/tmp"}, nil)
 	assert.Error(t, err)
 	assert.Contains(t, err.Error(), "failed to read VSA envelope")
 }
@@ -200,6 +200,6 @@ func TestUploadVSAEnvelope_InvalidStorageConfig(t *testing.T) {
 	envelopePath := tempFile.Name()
 
 	ctx := context.Background()
-	err = UploadVSAEnvelope(ctx, envelopePath, "test-image@sha256:abc123", []string{"invalid-format"}, nil)
+	err = UploadVSAEnvelope(ctx, envelopePath, []string{"invalid-format"}, nil)
 	assert.NoError(t, err) // Should not error, just warn and continue
 }