Merge pull request conforma#2678 from dheerajodha/EC-1309

EC-1309: Upload signed VSA to Rekor

Author: dheerajodha

acceptance/acceptance_test.go

@@ -40,6 +40,7 @@ import (
 	"github.com/conforma/cli/acceptance/tekton"
 	"github.com/conforma/cli/acceptance/testenv"
 	"github.com/conforma/cli/acceptance/tuf"
+	"github.com/conforma/cli/acceptance/vsa"
 	"github.com/conforma/cli/acceptance/wiremock"
 )
 
@@ -73,6 +74,7 @@ func initializeScenario(sc *godog.ScenarioContext) {
 	pipeline.AddStepsTo(sc)
 	conftest.AddStepsTo(sc)
 	tuf.AddStepsTo(sc)
+	vsa.AddStepsTo(sc)
 
 	sc.Before(func(ctx context.Context, sc *godog.Scenario) (context.Context, error) {
 		logger, ctx := log.LoggerFor(ctx)

acceptance/cli/cli.go

@@ -59,6 +59,11 @@ type status struct {
 	stderr *bytes.Buffer
 }
 
+// Vars returns the variables map from the status
+func (s *status) Vars() map[string]string {
+	return s.vars
+}
+
 type key int
 
 const (
@@ -199,6 +204,7 @@ func setupKeys(ctx context.Context, vars map[string]string, environment []string
 	// to avail all public keys that have been generated for
 	// substitution
 	publicKeys := crypto.PublicKeysFrom(ctx)
+	privateKeys := crypto.PrivateKeysFrom(ctx)
 
 	for name, publicKey := range publicKeys {
 		key, err := os.CreateTemp("", "*.pub")
@@ -234,6 +240,31 @@ func setupKeys(ctx context.Context, vars map[string]string, environment []string
 		vars[name+"_PUBLIC_KEY_XML"] = publicKeyXML.String()
 	}
 
+	// Setup private keys for VSA functionality
+	for name, privateKey := range privateKeys {
+		privKey, err := os.CreateTemp("", "*.pem")
+		if err != nil {
+			return environment, vars, err
+		}
+
+		if !testenv.Persisted(ctx) {
+			testenv.Testing(ctx).Cleanup(func() {
+				os.Remove(privKey.Name())
+			})
+		}
+
+		_, err = privKey.WriteString(privateKey)
+		if err != nil {
+			return environment, vars, err
+		}
+		err = privKey.Close()
+		if err != nil {
+			return environment, vars, err
+		}
+
+		vars[name+"_PRIVATE_KEY"] = privKey.Name()
+	}
+
 	return environment, vars, nil
 }
 
@@ -675,6 +706,12 @@ func ecStatusFrom(ctx context.Context) (*status, error) {
 	return status, nil
 }
 
+// EcStatusFrom returns the command execution status from the context
+// This is an exported wrapper for ecStatusFrom to allow access from other packages
+func EcStatusFrom(ctx context.Context) (*status, error) {
+	return ecStatusFrom(ctx)
+}
+
 // logExecution logs the details of the execution and offers hits as how to
 // troubleshoot test failures by using persistent environment
 func logExecution(ctx context.Context) {

acceptance/crypto/keys.go

@@ -117,6 +117,19 @@ func PublicKeysFrom(ctx context.Context) map[string]string {
 	return ret
 }
 
+// PrivateKeysFrom returns a map of all private keys encoded in PEM format
+// keyed by the name of the key
+func PrivateKeysFrom(ctx context.Context) map[string]string {
+	keys := allKeysFrom(ctx)
+
+	ret := make(map[string]string, len(keys))
+	for name, key := range keys {
+		ret[name] = string(key.PrivateBytes)
+	}
+
+	return ret
+}
+
 // AddStepsTo adds Gherkin steps to the godog ScenarioContext
 func AddStepsTo(sc *godog.ScenarioContext) {
 	sc.Step(`^a key pair named "([^"]*)"$`, GenerateKeyPairNamed)

acceptance/rekor/rekor.go

@@ -361,4 +361,65 @@ func AddStepsTo(sc *godog.ScenarioContext) {
 	sc.Step(`^stub rekord running$`, stubRekordRunning)
 	sc.Step(`^a valid Rekor entry for attestation of "([^"]*)"$`, RekorEntryForAttestation)
 	sc.Step(`^a valid Rekor entry for image signature of "([^"]*)"$`, RekorEntryForImageSignature)
+	sc.Step(`^VSA upload to Rekor should be expected$`, expectVSAUploadToRekor)
+	sc.Step(`^VSA should be uploaded to Rekor successfully$`, vsaShouldBeUploadedToRekor)
+}
+
+// expectVSAUploadToRekor creates WireMock stubs to expect VSA upload requests to Rekor
+func expectVSAUploadToRekor(ctx context.Context) error {
+	// Create a stub that accepts any VSA upload request to /api/v1/log/entries
+	// and returns a successful Rekor entry response using the same format as existing stubs
+	entryUUID := "24296fb24b8ad77a12345678901234567890abcd"
+
+	// Create a minimal valid base64 envelope for the response
+	// This represents a basic in-toto attestation structure
+	envelope := map[string]interface{}{
+		"payload":     "eyJzdWJqZWN0IjpudWxsLCJwcmVkaWNhdGUiOnsidmVyaWZpZWRMZXZlbHMiOltdLCJkZXBlbmRlbmN5TGV2ZWxzIjp7fSwidGltZVZlcmlmaWVkIjoiMjAyNC0wMS0wMVQwMDowMDowMFoifX0=",
+		"payloadType": "application/vnd.in-toto+json",
+		"signatures": []map[string]string{
+			{"sig": "MEUCIQDexample123456789", "keyid": ""},
+		},
+	}
+
+	envelopeBytes, _ := json.Marshal(envelope)
+	envelopeB64 := base64.StdEncoding.EncodeToString(envelopeBytes)
+
+	response := map[string]interface{}{
+		entryUUID: map[string]interface{}{
+			"body":           envelopeB64,
+			"integratedTime": 1674049693,
+			"logID":          "c0d23d6ad406973f9559f3ba2d1ca01f84147d8ffc5b8445c224f98b9591801d",
+			"logIndex":       9876543,
+			"verification": map[string]interface{}{
+				"signedEntryTimestamp": "MEUCIQDexampleTimestamp123456789abcdefghijklmnopqrstuvwxyz==",
+			},
+		},
+	}
+
+	responseBody, err := json.Marshal(response)
+	if err != nil {
+		return fmt.Errorf("failed to marshal Rekor response: %w", err)
+	}
+
+	return wiremock.StubFor(ctx, wiremock.Post(wiremock.URLPathEqualTo("/api/v1/log/entries")).
+		WillReturnResponse(wiremock.NewResponse().
+			WithStatus(201).
+			WithHeaders(map[string]string{
+				"Content-Type": "application/json",
+				"Location":     fmt.Sprintf("/api/v1/log/entries/%s", entryUUID),
+			}).
+			WithBody(string(responseBody))))
+}
+
+// vsaShouldBeUploadedToRekor verifies that VSA uploads to Rekor occurred successfully.
+// This relies on WireMock's automatic verification - if VSA uploads didn't happen or
+// didn't match our stub, WireMock will report unmatched requests/stubs in its After hook.
+func vsaShouldBeUploadedToRekor(ctx context.Context) error {
+	if !wiremock.IsRunning(ctx) {
+		return fmt.Errorf("WireMock is not running - cannot verify VSA uploads")
+	}
+
+	// WireMock automatically verifies that our expectVSAUploadToRekor stub was matched
+	// by actual VSA upload requests. No explicit verification needed here.
+	return nil
 }

acceptance/vsa/vsa.go

@@ -0,0 +1,79 @@
+// Copyright The Conforma Contributors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// SPDX-License-Identifier: Apache-2.0
+
+// Package vsa provides step definitions for VSA (Verification Summary Attestation) functionality testing
+package vsa
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"path/filepath"
+
+	"github.com/cucumber/godog"
+
+	"github.com/conforma/cli/acceptance/cli"
+	"github.com/conforma/cli/acceptance/log"
+)
+
+// vsaEnvelopeFilesShouldExist checks that VSA envelope files exist in the specified directory
+func vsaEnvelopeFilesShouldExist(ctx context.Context, directory string) (context.Context, error) {
+	logger, _ := log.LoggerFor(ctx)
+
+	// Get command status to access variables for expansion
+	status, err := cli.EcStatusFrom(ctx)
+	if err != nil {
+		return ctx, err
+	}
+
+	// Expand variables in the directory path using the vars map
+	expandedDir := os.Expand(directory, func(key string) string {
+		if value, ok := status.Vars()[key]; ok {
+			return value
+		}
+		return ""
+	})
+
+	logger.Infof("Checking for VSA envelope files in directory: %s", expandedDir)
+
+	// Check if directory exists
+	if _, err := os.Stat(expandedDir); os.IsNotExist(err) {
+		return ctx, fmt.Errorf("VSA output directory does not exist: %s", expandedDir)
+	}
+
+	// Look for VSA envelope files (should have .json extension and vsa- prefix)
+	files, err := filepath.Glob(filepath.Join(expandedDir, "vsa-*.json"))
+	if err != nil {
+		return ctx, fmt.Errorf("error searching for VSA envelope files: %v", err)
+	}
+
+	if len(files) == 0 {
+		return ctx, fmt.Errorf("no VSA envelope files found in directory: %s", expandedDir)
+	}
+
+	for _, file := range files {
+		logger.Infof("Found VSA envelope file: %s", file)
+	}
+
+	logger.Infof("Successfully found VSA envelope files in: %s", expandedDir)
+
+	return ctx, nil
+}
+
+// AddStepsTo adds VSA-related step definitions to the godog ScenarioContext
+func AddStepsTo(ctx *godog.ScenarioContext) {
+	ctx.Step(`^VSA envelope files should exist in "([^"]*)"$`, vsaEnvelopeFilesShouldExist)
+}

cmd/validate/image.go

@@ -78,7 +78,7 @@ func validateImageCmd(validate imageValidationFunc) *cobra.Command {
 		workers                     int
 		vsaEnabled                  bool
 		vsaSigningKey               string
-		vsaUpload                   string
+		vsaUpload                   []string
 	}{
 		strict:  true,
 		workers: 5,
@@ -492,10 +492,45 @@ func validateImageCmd(validate imageValidationFunc) *cobra.Command {
 				}
 
 				// Process all VSAs using the service
-				err = vsaService.ProcessAllVSAs(cmd.Context(), report, getGitURL, getDigest)
+				vsaResult, err := vsaService.ProcessAllVSAs(cmd.Context(), report, getGitURL, getDigest)
 				if err != nil {
 					log.Errorf("Failed to process VSAs: %v", err)
 					// Don't return error here, continue with the rest of the command
+				} else {
+					// Upload VSAs to configured storage backends
+					if len(data.vsaUpload) > 0 {
+						log.Infof("[VSA] Starting upload to %d storage backend(s)", len(data.vsaUpload))
+
+						// Upload component VSA envelopes
+						for imageRef, envelopePath := range vsaResult.ComponentEnvelopes {
+							uploadErr := vsa.UploadVSAEnvelope(cmd.Context(), envelopePath, data.vsaUpload, signer)
+							if uploadErr != nil {
+								log.Errorf("[VSA] Upload failed for component %s: %v", imageRef, uploadErr)
+							} else {
+								log.Infof("[VSA] Uploaded Component VSA")
+							}
+						}
+
+						// Upload snapshot VSA envelope if it exists
+						if vsaResult.SnapshotEnvelope != "" {
+							uploadErr := vsa.UploadVSAEnvelope(cmd.Context(), vsaResult.SnapshotEnvelope, data.vsaUpload, signer)
+							if uploadErr != nil {
+								log.Errorf("[VSA] Upload failed for snapshot: %v", uploadErr)
+							} else {
+								log.Infof("[VSA] Uploaded Snapshot VSA")
+							}
+						}
+					} else {
+						// No upload backends configured - inform user about next steps
+						totalFiles := len(vsaResult.ComponentEnvelopes)
+						if vsaResult.SnapshotEnvelope != "" {
+							totalFiles++
+						}
+
+						if totalFiles > 0 {
+							log.Errorf("[VSA] VSA files generated but not uploaded (no --vsa-upload backends specified)")
+						}
+					}
 				}
 			}
 
@@ -593,7 +628,7 @@ func validateImageCmd(validate imageValidationFunc) *cobra.Command {
 
 	cmd.Flags().BoolVar(&data.vsaEnabled, "vsa", false, "Generate a Verification Summary Attestation (VSA) for each validated image.")
 	cmd.Flags().StringVar(&data.vsaSigningKey, "vsa-signing-key", "", "Path to the private key for signing the VSA.")
-	cmd.Flags().StringVar(&data.vsaUpload, "vsa-upload", "oci", "Where to upload the VSA attestation: oci, rekor, none")
+	cmd.Flags().StringSliceVar(&data.vsaUpload, "vsa-upload", nil, "Storage backends for VSA upload. Format: backend@url?param=value. Examples: rekor@https://rekor.sigstore.dev, local@./vsa-dir")
 
 	if len(data.input) > 0 || len(data.filePath) > 0 || len(data.images) > 0 {
 		if err := cmd.MarkFlagRequired("image"); err != nil {