validate commit with image

Author: joejstuart

internal/image/image.go

@@ -99,7 +99,7 @@ func (i *imageValidator) ValidateImage(ctx context.Context) (*validatedImage, er
 	attestations, _, err := cosign.VerifyImageAttestations(ctx, i.reference, &i.checkOpts)
 	attStatements := make([]attestation, 0, len(attestations))
 	for _, att := range attestations {
-		attStatement, err := signatureToAttestation(ctx, att)
+		attStatement, err := SignatureToAttestation(ctx, att)
 		if err != nil {
 			return nil, err
 		}
@@ -118,7 +118,7 @@ func (i *imageValidator) ValidateImage(ctx context.Context) (*validatedImage, er
 
 }
 
-func signatureToAttestation(ctx context.Context, signature oci.Signature) (attestation, error) {
+func SignatureToAttestation(ctx context.Context, signature oci.Signature) (attestation, error) {
 	var att attestation
 	payload, err := policy.AttestationToPayloadJSON(ctx, "slsaprovenance", signature)
 	if err != nil {

internal/image/validate.go

@@ -18,6 +18,9 @@ package image
 
 import (
 	"context"
+	"encoding/json"
+	"errors"
+	"io/ioutil"
 
 	conftestOutput "github.com/open-policy-agent/conftest/output"
 	log "github.com/sirupsen/logrus"
@@ -73,6 +76,20 @@ func ValidateImage(ctx context.Context, imageRef, policyConfiguration, publicKey
 		return nil, err
 	}
 
+	attStatements := make([]attestation, 0, len(a.Attestations()))
+	for _, att := range a.Attestations() {
+		attStatement, err := SignatureToAttestation(ctx, att)
+		if err != nil {
+			return nil, err
+		}
+		attStatements = append(attStatements, attStatement)
+	}
+
+	commitFile := "/tmp/commit.json"
+	writeCommitData(attStatements, commitFile)
+
+	inputs = append(inputs, commitFile)
+
 	results, err := a.Evaluator.Evaluate(ctx, inputs)
 
 	if err != nil {
@@ -85,3 +102,33 @@ func ValidateImage(ctx context.Context, imageRef, policyConfiguration, publicKey
 
 	return out, nil
 }
+
+func writeCommitData(attestations []attestation, commitFile string) error {
+	payloads := make([]string, 0, len(attestations))
+	for _, att := range attestations {
+		signoffSource, err := att.NewSignOffSource()
+		if err != nil {
+			return err
+		}
+		if signoffSource == nil {
+			return errors.New("there is no signoff source in attestation")
+		}
+
+		signOff, err := signoffSource.GetSignOff()
+		if err != nil {
+			return err
+		}
+
+		if signOff != nil {
+			payload, err := json.MarshalIndent(signOff, "", " ")
+			if err != nil {
+				return err
+			}
+			payloads = append(payloads, string(payload))
+		}
+	}
+
+	payloadJson, _ := json.Marshal(payloads)
+	_ = ioutil.WriteFile(commitFile, payloadJson, 0644)
+	return nil
+}