Skip to content

Commit

Permalink
Allow specificy Artifact as a HashOutput (#406)
Browse files Browse the repository at this point in the history
Useful for allowing verifying over an artifact digest without needing to have the whole artifact available locally just to be digested

Signed-off-by: Samuel Giddins <[email protected]>
  • Loading branch information
segiddins authored Oct 1, 2024
1 parent bac851d commit 64a83d2
Show file tree
Hide file tree
Showing 9 changed files with 107 additions and 19 deletions.
37 changes: 37 additions & 0 deletions gen/jsonschema/schemas/Artifact.schema.json
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,11 @@
"description": "The raw bytes of the artifact",
"format": "binary",
"binaryEncoding": "base64"
},
"artifactDigest": {
"$ref": "#/definitions/dev.sigstore.common.v1.HashOutput",
"additionalProperties": false,
"description": "Digest of the artifact"
}
},
"additionalProperties": false,
Expand All @@ -27,9 +32,41 @@
"required": [
"artifact"
]
},
{
"required": [
"artifact_digest"
]
}
],
"title": "Artifact"
},
"dev.sigstore.common.v1.HashOutput": {
"properties": {
"algorithm": {
"enum": [
"HASH_ALGORITHM_UNSPECIFIED",
"SHA2_256",
"SHA2_384",
"SHA2_512",
"SHA3_256",
"SHA3_384"
],
"type": "string",
"title": "This package defines commonly used message types within the Sigstore\n community.",
"description": "This package defines commonly used message types within the Sigstore community. Only a subset of the secure hash standard algorithms are supported. See \u003chttps://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf\u003e for more details. UNSPECIFIED SHOULD not be used, primary reason for inclusion is to force any proto JSON serialization to emit the used hash algorithm, as default option is to *omit* the default value of an enum (which is the first value, represented by '0'."
},
"digest": {
"type": "string",
"description": "This is the raw octets of the message digest as computed by the hash algorithm.",
"format": "binary",
"binaryEncoding": "base64"
}
},
"additionalProperties": false,
"type": "object",
"title": "Hash Output",
"description": "HashOutput captures a digest of a 'message' (generic octet sequence) and the corresponding hash algorithm used."
}
}
}
10 changes: 10 additions & 0 deletions gen/jsonschema/schemas/Input.schema.json
Original file line number Diff line number Diff line change
Expand Up @@ -653,6 +653,11 @@
"description": "The raw bytes of the artifact",
"format": "binary",
"binaryEncoding": "base64"
},
"artifactDigest": {
"$ref": "#/definitions/dev.sigstore.common.v1.HashOutput",
"additionalProperties": false,
"description": "Digest of the artifact"
}
},
"additionalProperties": false,
Expand All @@ -667,6 +672,11 @@
"required": [
"artifact"
]
},
{
"required": [
"artifact_digest"
]
}
],
"title": "Artifact"
Expand Down
55 changes: 39 additions & 16 deletions gen/pb-go/verification/v1/sigstore_verification.pb.go

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions gen/pb-ruby/lib/sigstore_verification_pb.rb

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Original file line number Diff line number Diff line change
Expand Up @@ -247,7 +247,7 @@ pub mod artifact_verification_options {
#[allow(clippy::derive_partial_eq_without_eq)]
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct Artifact {
#[prost(oneof = "artifact::Data", tags = "1, 2")]
#[prost(oneof = "artifact::Data", tags = "1, 2, 3")]
pub data: ::core::option::Option<artifact::Data>,
}
/// Nested message and enum types in `Artifact`.
Expand All @@ -265,6 +265,9 @@ pub mod artifact {
/// The raw bytes of the artifact
#[prost(bytes, tag = "2")]
Artifact(::prost::alloc::vec::Vec<u8>),
/// Digest of the artifact
#[prost(message, tag = "3")]
ArtifactDigest(super::super::super::common::v1::HashOutput),
}
}
/// Input captures all that is needed to call the bundle verification method,
Expand Down
Binary file not shown.
11 changes: 9 additions & 2 deletions gen/pb-typescript/src/__generated__/sigstore_verification.ts

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 2 additions & 0 deletions protos/sigstore_verification.proto
Original file line number Diff line number Diff line change
Expand Up @@ -136,6 +136,8 @@ message Artifact {
string artifact_uri = 1;
// The raw bytes of the artifact
bytes artifact = 2;
// Digest of the artifact
dev.sigstore.common.v1.HashOutput artifact_digest = 3;
}
}

Expand Down

0 comments on commit 64a83d2

Please sign in to comment.