1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
use schemars::JsonSchema;
use serde::{Deserialize, Serialize};
use super::{StringOrBool, deserialize_string_or_bool_opt};
// ---------------------------------------------------------------------------
// AttestationConfig
// ---------------------------------------------------------------------------
/// SLSA build-provenance / attestation configuration for binaries and archives.
///
/// Two modes select how anodizer participates in attestation:
///
/// - [`AttestationMode::Subjects`] (the default) emits a **subjects manifest**
/// (`dist/attestation-subjects.json`) that `anodizer-action` feeds to
/// GitHub's `actions/attest-build-provenance`. anodizer does NOT mint a
/// GitHub-trusted attestation itself in this mode — the Action's OIDC
/// identity does. This is the path fd / biome / gping use.
/// - [`AttestationMode::Emit`] generates a self-contained in-toto v1 statement
/// carrying an SLSA provenance v1 predicate over the selected artifacts,
/// writes it as a release asset (`attestation.intoto.jsonl`), and lets the
/// existing `signs:` stage sign it (keyed, not OIDC). This is for users who
/// can't run the Action (the `--with-provenance` toggle).
///
/// YAML:
/// ```yaml
/// attestations:
/// enabled: true
/// mode: subjects # or: emit ; default = subjects
/// artifacts: [archive, binary, checksum]
/// ```
#[derive(Debug, Clone, Serialize, Deserialize, Default, JsonSchema, PartialEq)]
#[serde(default, deny_unknown_fields)]
pub struct AttestationConfig {
/// Enable attestation. When false (the default), the stage is a no-op.
pub enabled: bool,
/// Participation mode: `subjects` (default) writes a manifest for
/// `actions/attest-build-provenance`; `emit` generates and signs an
/// in-toto SLSA provenance statement as a release asset.
pub mode: Option<AttestationMode>,
/// Which produced-artifact kinds to attest. Each entry selects a KIND
/// (`archive`, `binary`, `checksum`); the concrete subject set (filenames
/// + sha256) is DERIVED from the artifacts anodizer already produced.
///
/// Defaults to `[archive, binary, checksum]` when omitted.
pub artifacts: Option<Vec<AttestationArtifactKind>>,
/// Skip the attestation stage. Accepts a bool or a template string.
#[serde(deserialize_with = "deserialize_string_or_bool_opt", default)]
pub skip: Option<StringOrBool>,
}
/// Attestation participation mode. See [`AttestationConfig`].
#[derive(Debug, Clone, Copy, Serialize, Deserialize, JsonSchema, PartialEq, Eq)]
#[serde(rename_all = "snake_case")]
pub enum AttestationMode {
/// Emit a subjects manifest for `actions/attest-build-provenance` (OIDC).
Subjects,
/// Generate + sign a self-contained in-toto SLSA provenance statement.
Emit,
}
/// A selectable artifact KIND for attestation. Each variant maps to one or
/// more concrete [`crate::artifact::ArtifactKind`] values at subject-collection
/// time; together the variants cover the full release-uploadable surface so any
/// artifact that lands on the release can be attested.
#[derive(Debug, Clone, Copy, Serialize, Deserialize, JsonSchema, PartialEq, Eq, Hash)]
#[serde(rename_all = "snake_case")]
pub enum AttestationArtifactKind {
/// Packaged archives (`.tar.gz`, `.zip`, ...) and self-extracting archives.
Archive,
/// Raw uploadable binaries (uploaded as bare release assets).
Binary,
/// Checksum file(s) (`checksums.txt` and split sidecars).
Checksum,
/// Linux packages (`.deb` / `.rpm` / `.apk`) and source RPMs.
Package,
/// Source archives (`source:` tarball).
Source,
/// Generated SBOM documents.
Sbom,
/// OS installers: Windows MSI/NSIS, macOS DMG (disk image), and macOS PKG.
Installer,
}
impl AttestationConfig {
/// Filename of the subjects manifest written in `subjects` mode (single
/// crate / lockstep). Per-crate workspace mode prefixes the crate name.
pub const SUBJECTS_MANIFEST_NAME: &'static str = "attestation-subjects.json";
/// Filename of the in-toto statement written in `emit` mode (single crate
/// / lockstep). Per-crate workspace mode prefixes the crate name.
pub const STATEMENT_NAME: &'static str = "attestation.intoto.jsonl";
/// Resolve the participation mode, defaulting to `subjects`.
pub fn resolved_mode(&self) -> AttestationMode {
self.mode.unwrap_or(AttestationMode::Subjects)
}
/// The configured artifact-kind selection, or `None` when `artifacts:` is
/// omitted.
///
/// `None` is NOT a hand-curated subset — the stage interprets it as "attest
/// every release-uploadable artifact" (the full `release_uploadable_kinds()`
/// set minus signatures/certificates and the attestation outputs
/// themselves), so a `.deb`/`.rpm`/SBOM/installer the user ships is attested
/// by default rather than silently dropped.
pub fn resolved_artifacts(&self) -> Option<Vec<AttestationArtifactKind>> {
self.artifacts.clone()
}
}
#[cfg(test)]
mod tests {
use super::*;
#[test]
fn default_mode_is_subjects() {
let cfg = AttestationConfig::default();
assert_eq!(cfg.resolved_mode(), AttestationMode::Subjects);
}
#[test]
fn omitted_artifacts_resolve_to_none_meaning_attest_everything() {
// None signals the stage to attest the full release-uploadable set,
// not a hand-curated subset.
let cfg = AttestationConfig::default();
assert_eq!(cfg.resolved_artifacts(), None);
}
#[test]
fn parses_newly_selectable_kinds() {
let yaml = "enabled: true\nartifacts: [package, source, sbom, installer]\n";
let cfg: AttestationConfig = serde_yaml_ng::from_str(yaml).expect("parse");
assert_eq!(
cfg.resolved_artifacts(),
Some(vec![
AttestationArtifactKind::Package,
AttestationArtifactKind::Source,
AttestationArtifactKind::Sbom,
AttestationArtifactKind::Installer,
])
);
}
#[test]
fn default_is_disabled() {
assert!(!AttestationConfig::default().enabled);
}
#[test]
fn parses_yaml_with_explicit_mode_and_artifacts() {
let yaml = "enabled: true\nmode: emit\nartifacts: [archive, binary]\n";
let cfg: AttestationConfig = serde_yaml_ng::from_str(yaml).expect("parse");
assert!(cfg.enabled);
assert_eq!(cfg.resolved_mode(), AttestationMode::Emit);
assert_eq!(
cfg.resolved_artifacts(),
Some(vec![
AttestationArtifactKind::Archive,
AttestationArtifactKind::Binary
])
);
}
#[test]
fn rejects_unknown_field() {
let yaml = "enabled: true\nbogus: 1\n";
assert!(serde_yaml_ng::from_str::<AttestationConfig>(yaml).is_err());
}
#[test]
fn rejects_unknown_mode() {
let yaml = "enabled: true\nmode: sideways\n";
assert!(serde_yaml_ng::from_str::<AttestationConfig>(yaml).is_err());
}
}