extract

func RetrieveAllArtifactURIs ¶

func RetrieveAllArtifactURIs(ctx context.Context, obj objects.TektonObject, deepInspectionEnabled bool) []string

RetrieveAllArtifactURIs returns all the URIs of the software artifacts produced from the run object. - It first extracts intoto subjects from run object results and converts the subjects to a slice of string URIs in the format of "NAME" + "@" + "ALGORITHM" + ":" + "DIGEST". - If no subjects could be extracted from results, then an empty slice is returned.

func SubjectDigests ¶

func SubjectDigests(ctx context.Context, obj objects.TektonObject, slsaconfig *slsaconfig.SlsaConfig) []*intoto.ResourceDescriptor

SubjectDigests returns software artifacts produced from the TaskRun/PipelineRun object in the form of standard subject field of intoto statement. The type hinting fields expected in results help identify the generated software artifacts. Valid type hinting fields must:

• have suffix `IMAGE_URL` & `IMAGE_DIGEST` or `ARTIFACT_URI` & `ARTIFACT_DIGEST` pair.
• the `*_DIGEST` field must be in the format of "<algorithm>:<actual-sha>" where the algorithm must be "sha256" and actual sha must be valid per https://github.com/opencontainers/image-spec/blob/main/descriptor.md#sha-256.
• the `*_URL` or `*_URI` fields cannot be empty.

func SubjectsFromBuildArtifact ¶ added in v0.21.0

func SubjectsFromBuildArtifact(ctx context.Context, results []objects.Result) []*intoto.ResourceDescriptor

SubjectsFromBuildArtifact returns the software artifacts/images produced by the TaskRun/PipelineRun in the form of standard subject field of intoto statement. The detection is based on type hinting. To be read as a software artifact the type hintint should: - use one of the following type-hints:

• Use the *ARTIFACT_OUTPUTS object type-hinting suffix. The value associated with the result should be an object with the fields `uri`, `digest`, and `isBuildArtifact` set to true.
• Use the IMAGES type-hint
• Use the *IMAGE_URL / *IMAGE_DIGEST type-hint suffix