test: Add test data for v1.8.0 (#681)

Signed-off-by: Ian Lewis <ianlewis@google.com>

cli/slsa-verifier/main_regression_test.go

@@ -9,7 +9,6 @@ import (
 	"fmt"
 	"io/ioutil"
 	"os"
-	"path"
 	"path/filepath"
 	"strings"
 	"testing"
@@ -546,7 +545,7 @@ func Test_runVerifyGHAArtifactPath(t *testing.T) {
 				}
 
 				// TODO(#258): invalid builder ref.
-				sv := path.Base(v)
+				sv := filepath.Base(v)
 				// For each test, we run 4 sub-tests:
 				// 	1. With the the full builderID including the semver in short form.
 				//	2. With the the full builderID including the semver in long form.
@@ -773,7 +772,7 @@ func Test_runVerifyGHAArtifactImage(t *testing.T) {
 			for _, v := range checkVersions {
 				image := filepath.Clean(filepath.Join(TEST_DIR, v, tt.artifact))
 				// TODO(#258): test for tagged builder.
-				sv := path.Base(v)
+				sv := filepath.Base(v)
 				// For each test, we run 2 sub-tests:
 				//	1. With the the full builderID including the semver in short form.
 				//	2. With the the full builderID including the semver in long form.
@@ -1220,7 +1219,7 @@ func Test_runVerifyGCBArtifactImage(t *testing.T) {
 			}
 
 			for _, v := range checkVersions {
-				semver := path.Base(v)
+				semver := filepath.Base(v)
 				// For each test, we run 2 sub-tests:
 				// 	1. With the the full builderID including the semver.
 				//	2. With only the name of the builder.
@@ -1383,7 +1382,13 @@ func Test_runVerifyGHAContainerBased(t *testing.T) {
 
 			for _, v := range checkVersions {
 				testPath := filepath.Clean(filepath.Join(TEST_DIR, v, tt.artifacts[0]))
-				provenancePath := fmt.Sprintf("%s.intoto.sigstore", testPath)
+				sv := filepath.Base(v)
+				var provenancePath string
+				if semver.Compare(sv, "v1.8.0") >= 0 {
+					provenancePath = fmt.Sprintf("%s.intoto.build.slsa", testPath)
+				} else {
+					provenancePath = fmt.Sprintf("%s.intoto.sigstore", testPath)
+				}
 
 				artifacts := make([]string, len(tt.artifacts))
 				for i, artifact := range tt.artifacts {
@@ -1395,7 +1400,6 @@ func Test_runVerifyGHAContainerBased(t *testing.T) {
 				//	2. With the the full builderID including the semver in long form.
 				//	3. With only the name of the builder.
 				//	4. With no builder ID.
-				sv := path.Base(v)
 				builder := "https://github.com/slsa-framework/slsa-github-generator/.github/workflows/builder_container-based_slsa3.yml"
 
 				refName := "@refs/tags/"

cli/slsa-verifier/testdata/gha_generic_container/v1.8.0/container_workflow_dispatch.digest

@@ -0,0 +1 @@
+sha256:038d72307b94cd27dffbfb458b695758929980cebec68ca892061a280636952b

cli/slsa-verifier/testdata/gha_generic_container/v1.8.0/container_workflow_dispatch/blobs/sha256/038d72307b94cd27dffbfb458b695758929980cebec68ca892061a280636952b

@@ -0,0 +1,28 @@
+{
+  "schemaVersion": 2,
+  "mediaType": "application/vnd.oci.image.index.v1+json",
+  "manifests": [
+    {
+      "mediaType": "application/vnd.oci.image.manifest.v1+json",
+      "digest": "sha256:5c323fdfbf3cbe9d5cc4580f2dcc34a43fdbcf46c25784d68c25fe6909055060",
+      "size": 2183,
+      "platform": {
+        "architecture": "amd64",
+        "os": "linux"
+      }
+    },
+    {
+      "mediaType": "application/vnd.oci.image.manifest.v1+json",
+      "digest": "sha256:085e838ef71453d1911bf61a3b499719b09659a5dd2a7c89e8e359fe342a4ab5",
+      "size": 567,
+      "annotations": {
+        "vnd.docker.reference.digest": "sha256:5c323fdfbf3cbe9d5cc4580f2dcc34a43fdbcf46c25784d68c25fe6909055060",
+        "vnd.docker.reference.type": "attestation-manifest"
+      },
+      "platform": {
+        "architecture": "unknown",
+        "os": "unknown"
+      }
+    }
+  ]
+}

cli/slsa-verifier/testdata/gha_generic_container/v1.8.0/container_workflow_dispatch/blobs/sha256/085e838ef71453d1911bf61a3b499719b09659a5dd2a7c89e8e359fe342a4ab5

@@ -0,0 +1,19 @@
+{
+  "schemaVersion": 2,
+  "mediaType": "application/vnd.oci.image.manifest.v1+json",
+  "config": {
+    "mediaType": "application/vnd.oci.image.config.v1+json",
+    "digest": "sha256:9482db6a03f933341e26c555d2456e98526cfe8d7fbf7bd1370460b06a5cdd9f",
+    "size": 167
+  },
+  "layers": [
+    {
+      "mediaType": "application/vnd.in-toto+json",
+      "digest": "sha256:b5d5bed7682d285fe850b15e8e5a3df200ff2f202d12f1c72017b03c1aed29d4",
+      "size": 14044,
+      "annotations": {
+        "in-toto.io/predicate-type": "https://slsa.dev/provenance/v0.2"
+      }
+    }
+  ]
+}

cli/slsa-verifier/testdata/gha_generic_container/v1.8.0/container_workflow_dispatch/blobs/sha256/5c323fdfbf3cbe9d5cc4580f2dcc34a43fdbcf46c25784d68c25fe6909055060

@@ -0,0 +1,61 @@
+{
+  "schemaVersion": 2,
+  "mediaType": "application/vnd.oci.image.manifest.v1+json",
+  "config": {
+    "mediaType": "application/vnd.oci.image.config.v1+json",
+    "digest": "sha256:fa05c7ac17c3df1a35c3746f0c023a464bf47fea352b6d9caa320f6dc82c28f1",
+    "size": 2153
+  },
+  "layers": [
+    {
+      "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
+      "digest": "sha256:a7ca0d9ba68fdce7e15bc0952d3e898e970548ca24d57698725836c039086639",
+      "size": 103732
+    },
+    {
+      "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
+      "digest": "sha256:fe5ca62666f04366c8e7f605aa82997d71320183e99962fa76b3209fdfbb8b58",
+      "size": 21202
+    },
+    {
+      "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
+      "digest": "sha256:b02a7525f878e61fc1ef8a7405a2cc17f866e8de222c1c98fd6681aff6e509db",
+      "size": 716491
+    },
+    {
+      "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
+      "digest": "sha256:fcb6f6d2c9986d9cd6a2ea3cc2936e5fc613e09f1af9042329011e43057f3265",
+      "size": 317
+    },
+    {
+      "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
+      "digest": "sha256:e8c73c638ae9ec5ad70c49df7e484040d889cca6b4a9af056579c3d058ea93f0",
+      "size": 198
+    },
+    {
+      "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
+      "digest": "sha256:1e3d9b7d145208fa8fa3ee1c9612d0adaac7255f1bbc9ddea7e461e0b317805c",
+      "size": 113
+    },
+    {
+      "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
+      "digest": "sha256:4aa0ea1413d37a58615488592a0b827ea4b2e48fa5a77cf707d0e35f025e613f",
+      "size": 385
+    },
+    {
+      "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
+      "digest": "sha256:7c881f9ab25e0d86562a123b5fb56aebf8aa0ddd7d48ef602faf8d1e7cf43d8c",
+      "size": 355
+    },
+    {
+      "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
+      "digest": "sha256:5627a970d25e752d971a501ec7e35d0d6fdcd4a3ce9e958715a686853024794a",
+      "size": 130562
+    },
+    {
+      "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
+      "digest": "sha256:ef39a1978fe1d3994ab1e3feff1b9ca573b63f2a287aec44e9c28715bddf727b",
+      "size": 648811
+    }
+  ]
+}

cli/slsa-verifier/testdata/gha_generic_container/v1.8.0/container_workflow_dispatch/blobs/sha256/66e6ea84946fc865c5b4627520930f4e25ebbc869fe829e7baa2b2da952f3bd6

@@ -0,0 +1 @@
+{"architecture":"","created":"2023-08-04T05:28:12.189847216Z","history":[{"created":"0001-01-01T00:00:00Z"}],"os":"","rootfs":{"type":"layers","diff_ids":["sha256:291729ce6264067c1a61f8156f9133f2efcc3f72341d5cd22f2b9ba279ecb25f"]},"config":{}}

cli/slsa-verifier/testdata/gha_generic_container/v1.8.0/container_workflow_dispatch/blobs/sha256/9482db6a03f933341e26c555d2456e98526cfe8d7fbf7bd1370460b06a5cdd9f

@@ -0,0 +1 @@
+{"architecture":"unknown","os":"unknown","config":{},"rootfs":{"type":"layers","diff_ids":["sha256:b5d5bed7682d285fe850b15e8e5a3df200ff2f202d12f1c72017b03c1aed29d4"]}}

cli/slsa-verifier/testdata/gha_generic_container/v1.8.0/container_workflow_dispatch/blobs/sha256/fa05c7ac17c3df1a35c3746f0c023a464bf47fea352b6d9caa320f6dc82c28f1

@@ -0,0 +1 @@
+{"architecture":"amd64","config":{"User":"0","Env":["PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin","SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt"],"Entrypoint":["/app"],"WorkingDir":"/","Labels":{"org.opencontainers.image.created":"2023-08-04T05:26:42.155Z","org.opencontainers.image.description":"","org.opencontainers.image.licenses":"Apache-2.0","org.opencontainers.image.revision":"6cf671f47f3752f97b9f5bff511e37b938fe10d2","org.opencontainers.image.source":"https://github.com/slsa-framework/example-package","org.opencontainers.image.title":"example-package","org.opencontainers.image.url":"https://github.com/slsa-framework/example-package","org.opencontainers.image.version":"main"},"OnBuild":null},"created":"2023-08-04T05:27:08.87906323Z","history":[{"created":"0001-01-01T00:00:00Z"},{"created":"0001-01-01T00:00:00Z"},{"created":"0001-01-01T00:00:00Z"},{"created":"0001-01-01T00:00:00Z"},{"created":"0001-01-01T00:00:00Z"},{"created":"0001-01-01T00:00:00Z"},{"created":"0001-01-01T00:00:00Z"},{"created":"0001-01-01T00:00:00Z"},{"created":"0001-01-01T00:00:00Z"},{"created":"2023-08-04T05:27:08.87906323Z","created_by":"COPY /app/app /app # buildkit","comment":"buildkit.dockerfile.v0"},{"created":"2023-08-04T05:27:08.87906323Z","created_by":"ENTRYPOINT [\"/app\"]","comment":"buildkit.dockerfile.v0","empty_layer":true}],"os":"linux","rootfs":{"type":"layers","diff_ids":["sha256:e023e0e48e6e29e90e519f4dd356d058ff2bffbd16e28b802f3b8f93aa4ccb17","sha256:6fbdf253bbc2490dcfede5bdb58ca0db63ee8aff565f6ea9f918f3bce9e2d5aa","sha256:7bea6b893187b14fc0a759fe5f8972d1292a9c0554c87cbf485f0947c26b8a05","sha256:ff5700ec54186528cbae40f54c24b1a34fb7c01527beaa1232868c16e2353f52","sha256:d52f02c6501c9c4410568f0bf6ff30d30d8290f57794c308fe36ea78393afac2","sha256:e624a5370eca2b8266e74d179326e2a8767d361db14d13edd9fb57e408731784","sha256:1a73b54f556b477f0a8b939d13c504a3b4f4db71f7a09c63afbc10acb3de5849","sha256:d2d7ec0f6756eb51cf1602c6f8ac4dd811d3d052661142e0110357bf0b581457","sha256:4cb10dd2545bd173858450b80853b850e49608260f1a0789e0d0b39edf12f500","sha256:be25d7896d63e03998411a1ca2f3d2475568fc0c20a0ca5e3a37029e24fe6e68"]}}

cli/slsa-verifier/testdata/gha_generic_container/v1.8.0/container_workflow_dispatch/index.json

@@ -0,0 +1,21 @@
+{
+   "schemaVersion": 2,
+   "manifests": [
+      {
+         "mediaType": "application/vnd.oci.image.index.v1+json",
+         "size": 856,
+         "digest": "sha256:038d72307b94cd27dffbfb458b695758929980cebec68ca892061a280636952b",
+         "annotations": {
+            "kind": "dev.cosignproject.cosign/imageIndex"
+         }
+      },
+      {
+         "mediaType": "application/vnd.oci.image.manifest.v1+json",
+         "size": 10470,
+         "digest": "sha256:195f75fe5d0554704527695e9205c457d3544bd0b078340bebd109a761c57920",
+         "annotations": {
+            "kind": "dev.cosignproject.cosign/atts"
+         }
+      }
+   ]
+}

cli/slsa-verifier/testdata/gha_generic_container/v1.8.0/container_workflow_dispatch/oci-layout

@@ -0,0 +1,3 @@
+{
+    "imageLayoutVersion": "1.0.0"
+}