update verifier to check environment (#47)

Signed-off-by: Asra Ali <asraa@google.com>

main_test.go

@@ -31,71 +31,71 @@ func Test_runVerify(t *testing.T) {
 		{
 			name:     "valid main branch default",
 			artifact: "./testdata/binary-linux-amd64-workflow_dispatch",
-			source:   "github.com/laurentsimon/slsa-on-github-test",
+			source:   "github.com/asraa/slsa-on-github-test",
 		},
 		{
 			name:     "valid main branch set",
 			artifact: "./testdata/binary-linux-amd64-workflow_dispatch",
-			source:   "github.com/laurentsimon/slsa-on-github-test",
+			source:   "github.com/asraa/slsa-on-github-test",
 			branch:   "main",
 		},
 		{
 			name:     "wrong branch master",
 			artifact: "./testdata/binary-linux-amd64-workflow_dispatch",
-			source:   "github.com/laurentsimon/slsa-on-github-test",
+			source:   "github.com/asraa/slsa-on-github-test",
 			branch:   "master",
 			err:      pkg.ErrorMismatchBranch,
 		},
 		{
 			name:     "wrong source append A",
 			artifact: "./testdata/binary-linux-amd64-workflow_dispatch",
-			source:   "github.com/laurentsimon/slsa-on-github-testA",
+			source:   "github.com/asraa/slsa-on-github-testA",
 			err:      pkg.ErrorMismatchRepository,
 		},
 		{
 			name:     "wrong source prepend A",
 			artifact: "./testdata/binary-linux-amd64-workflow_dispatch",
-			source:   "Agithub.com/laurentsimon/slsa-on-github-test",
+			source:   "Agithub.com/asraa/slsa-on-github-test",
 			err:      pkg.ErrorMismatchRepository,
 		},
 		{
 			name:     "wrong source middle A",
 			artifact: "./testdata/binary-linux-amd64-workflow_dispatch",
-			source:   "github.com/Alaurentsimon/slsa-on-github-test",
+			source:   "github.com/Aasraa/slsa-on-github-test",
 			err:      pkg.ErrorMismatchRepository,
 		},
 		{
 			name:     "tag no match empty tag workflow_dispatch",
 			artifact: "./testdata/binary-linux-amd64-workflow_dispatch",
-			source:   "github.com/laurentsimon/slsa-on-github-test",
+			source:   "github.com/asraa/slsa-on-github-test",
 			ptag:     pString("v1.2.3"),
 			err:      pkg.ErrorMismatchTag,
 		},
 		{
 			name:        "versioned tag no match empty tag workflow_dispatch",
 			artifact:    "./testdata/binary-linux-amd64-workflow_dispatch",
-			source:      "github.com/laurentsimon/slsa-on-github-test",
+			source:      "github.com/asraa/slsa-on-github-test",
 			pversiontag: pString("v1"),
 			err:         pkg.ErrorInvalidSemver,
 		},
 		{
 			name:     "tag v1.2.3 no match v1.2.4",
 			artifact: "./testdata/binary-linux-amd64-push-v1.2.4",
-			source:   "github.com/laurentsimon/slsa-on-github-test",
+			source:   "github.com/asraa/slsa-on-github-test",
 			ptag:     pString("v1.2.3"),
 			err:      pkg.ErrorMismatchTag,
 		},
 		{
 			name:     "tag v1.2 no match v1.2.4",
 			artifact: "./testdata/binary-linux-amd64-push-v1.2.4",
-			source:   "github.com/laurentsimon/slsa-on-github-test",
+			source:   "github.com/asraa/slsa-on-github-test",
 			ptag:     pString("v1.2"),
 			err:      pkg.ErrorMismatchTag,
 		},
 		{
 			name:     "tag v1 no match v1.2.4",
 			artifact: "./testdata/binary-linux-amd64-push-v1.2.4",
-			source:   "github.com/laurentsimon/slsa-on-github-test",
+			source:   "github.com/asraa/slsa-on-github-test",
 			ptag:     pString("v1"),
 			err:      pkg.ErrorMismatchTag,
 		},
@@ -103,60 +103,60 @@ func Test_runVerify(t *testing.T) {
 		{
 			name:        "versioned v1.2.4 match push-v1.2.4",
 			artifact:    "./testdata/binary-linux-amd64-push-v1.2.4",
-			source:      "github.com/laurentsimon/slsa-on-github-test",
+			source:      "github.com/asraa/slsa-on-github-test",
 			pversiontag: pString("v1.2.4"),
 		},
 		{
 			name:        "versioned v1.2 match push-v1.2.4",
 			artifact:    "./testdata/binary-linux-amd64-push-v1.2.4",
-			source:      "github.com/laurentsimon/slsa-on-github-test",
+			source:      "github.com/asraa/slsa-on-github-test",
 			pversiontag: pString("v1.2"),
 		},
 		{
 			name:        "versioned v1 match push-v1.2.4",
 			artifact:    "./testdata/binary-linux-amd64-push-v1.2.4",
-			source:      "github.com/laurentsimon/slsa-on-github-test",
+			source:      "github.com/asraa/slsa-on-github-test",
 			pversiontag: pString("v1"),
 		},
 		{
 			name:        "versioned v2 no match push-v1.2.4",
 			artifact:    "./testdata/binary-linux-amd64-push-v1.2.4",
-			source:      "github.com/laurentsimon/slsa-on-github-test",
+			source:      "github.com/asraa/slsa-on-github-test",
 			pversiontag: pString("v2"),
 			err:         pkg.ErrorMismatchVersionedTag,
 		},
 		{
 			name:        "versioned v0 no match push-v1.2.4",
 			artifact:    "./testdata/binary-linux-amd64-push-v1.2.4",
-			source:      "github.com/laurentsimon/slsa-on-github-test",
+			source:      "github.com/asraa/slsa-on-github-test",
 			pversiontag: pString("v0"),
 			err:         pkg.ErrorMismatchVersionedTag,
 		},
 		{
 			name:        "versioned v1.3 no match push-v1.2.4",
 			artifact:    "./testdata/binary-linux-amd64-push-v1.2.4",
-			source:      "github.com/laurentsimon/slsa-on-github-test",
+			source:      "github.com/asraa/slsa-on-github-test",
 			pversiontag: pString("v1.3"),
 			err:         pkg.ErrorMismatchVersionedTag,
 		},
 		{
 			name:        "versioned v1.1 no match push-v1.2.4",
 			artifact:    "./testdata/binary-linux-amd64-push-v1.2.4",
-			source:      "github.com/laurentsimon/slsa-on-github-test",
+			source:      "github.com/asraa/slsa-on-github-test",
 			pversiontag: pString("v1.1"),
 			err:         pkg.ErrorMismatchVersionedTag,
 		},
 		{
 			name:        "versioned v1.2.3 no match push-v1.2.4",
 			artifact:    "./testdata/binary-linux-amd64-push-v1.2.4",
-			source:      "github.com/laurentsimon/slsa-on-github-test",
+			source:      "github.com/asraa/slsa-on-github-test",
 			pversiontag: pString("v1.2.3"),
 			err:         pkg.ErrorMismatchVersionedTag,
 		},
 		{
 			name:        "versioned v1.2.5 no match push-v1.2.4",
 			artifact:    "./testdata/binary-linux-amd64-push-v1.2.4",
-			source:      "github.com/laurentsimon/slsa-on-github-test",
+			source:      "github.com/asraa/slsa-on-github-test",
 			pversiontag: pString("v1.2.5"),
 			err:         pkg.ErrorMismatchVersionedTag,
 		},
@@ -164,54 +164,54 @@ func Test_runVerify(t *testing.T) {
 		{
 			name:        "versioned v2 match push-v2",
 			artifact:    "./testdata/binary-linux-amd64-push-v2",
-			source:      "github.com/laurentsimon/slsa-on-github-test",
+			source:      "github.com/asraa/slsa-on-github-test",
 			pversiontag: pString("v2"),
 		},
 		{
 			name:        "versioned v2.0 match push-v2",
 			artifact:    "./testdata/binary-linux-amd64-push-v2",
-			source:      "github.com/laurentsimon/slsa-on-github-test",
+			source:      "github.com/asraa/slsa-on-github-test",
 			pversiontag: pString("v2.0"),
 		},
 		{
 			name:        "versioned v2.1 no match push-v2",
 			artifact:    "./testdata/binary-linux-amd64-push-v2",
-			source:      "github.com/laurentsimon/slsa-on-github-test",
+			source:      "github.com/asraa/slsa-on-github-test",
 			pversiontag: pString("v2.1"),
 			err:         pkg.ErrorMismatchVersionedTag,
 		},
 		{
 			name:        "versioned v1 no match push-v2",
 			artifact:    "./testdata/binary-linux-amd64-push-v2",
-			source:      "github.com/laurentsimon/slsa-on-github-test",
+			source:      "github.com/asraa/slsa-on-github-test",
 			pversiontag: pString("v1"),
 			err:         pkg.ErrorMismatchVersionedTag,
 		},
 		{
 			name:        "versioned v3 no match push-v2",
 			artifact:    "./testdata/binary-linux-amd64-push-v2",
-			source:      "github.com/laurentsimon/slsa-on-github-test",
+			source:      "github.com/asraa/slsa-on-github-test",
 			pversiontag: pString("v3"),
 			err:         pkg.ErrorMismatchVersionedTag,
 		},
 		{
 			name:        "versioned v1.2 no match push-v2",
 			artifact:    "./testdata/binary-linux-amd64-push-v2",
-			source:      "github.com/laurentsimon/slsa-on-github-test",
+			source:      "github.com/asraa/slsa-on-github-test",
 			pversiontag: pString("v1.2"),
 			err:         pkg.ErrorMismatchVersionedTag,
 		},
 		{
 			name:        "versioned v3 no match push-v2",
 			artifact:    "./testdata/binary-linux-amd64-push-v2",
-			source:      "github.com/laurentsimon/slsa-on-github-test",
+			source:      "github.com/asraa/slsa-on-github-test",
 			pversiontag: pString("v3"),
 			err:         pkg.ErrorMismatchVersionedTag,
 		},
 		{
 			name:        "versioned v0 no match push-v2",
 			artifact:    "./testdata/binary-linux-amd64-push-v2",
-			source:      "github.com/laurentsimon/slsa-on-github-test",
+			source:      "github.com/asraa/slsa-on-github-test",
 			pversiontag: pString("v0"),
 			err:         pkg.ErrorMismatchVersionedTag,
 		},
@@ -219,68 +219,68 @@ func Test_runVerify(t *testing.T) {
 		{
 			name:        "versioned v2.5 match push-v2.5",
 			artifact:    "./testdata/binary-linux-amd64-push-v2.5",
-			source:      "github.com/laurentsimon/slsa-on-github-test",
+			source:      "github.com/asraa/slsa-on-github-test",
 			pversiontag: pString("v2.5"),
 		},
 		{
 			name:        "versioned v2.5.1 match push-v2.5",
 			artifact:    "./testdata/binary-linux-amd64-push-v2.5",
-			source:      "github.com/laurentsimon/slsa-on-github-test",
+			source:      "github.com/asraa/slsa-on-github-test",
 			pversiontag: pString("v2.5.1"),
 			err:         pkg.ErrorMismatchVersionedTag,
 		},
 		{
 			name:        "versioned v2.5.3 match push-v2.5",
 			artifact:    "./testdata/binary-linux-amd64-push-v2.5",
-			source:      "github.com/laurentsimon/slsa-on-github-test",
+			source:      "github.com/asraa/slsa-on-github-test",
 			pversiontag: pString("v2.5.3"),
 			err:         pkg.ErrorMismatchVersionedTag,
 		},
 		{
 			name:        "versioned v2 match push-v2.5",
 			artifact:    "./testdata/binary-linux-amd64-push-v2.5",
-			source:      "github.com/laurentsimon/slsa-on-github-test",
+			source:      "github.com/asraa/slsa-on-github-test",
 			pversiontag: pString("v2"),
 		},
 		{
 			name:        "versioned v2.4 no match push-v2.5",
 			artifact:    "./testdata/binary-linux-amd64-push-v2.5",
-			source:      "github.com/laurentsimon/slsa-on-github-test",
+			source:      "github.com/asraa/slsa-on-github-test",
 			pversiontag: pString("v2.4"),
 			err:         pkg.ErrorMismatchVersionedTag,
 		},
 		{
 			name:        "versioned v2.4.1 no match push-v2.5",
 			artifact:    "./testdata/binary-linux-amd64-push-v2.5",
-			source:      "github.com/laurentsimon/slsa-on-github-test",
+			source:      "github.com/asraa/slsa-on-github-test",
 			pversiontag: pString("v2.4.1"),
 			err:         pkg.ErrorMismatchVersionedTag,
 		},
 		{
 			name:        "versioned v2.4.5 no match push-v2.5",
 			artifact:    "./testdata/binary-linux-amd64-push-v2.5",
-			source:      "github.com/laurentsimon/slsa-on-github-test",
+			source:      "github.com/asraa/slsa-on-github-test",
 			pversiontag: pString("v2.4.5"),
 			err:         pkg.ErrorMismatchVersionedTag,
 		},
 		{
 			name:        "versioned v1 no match push-v2.5",
 			artifact:    "./testdata/binary-linux-amd64-push-v2.5",
-			source:      "github.com/laurentsimon/slsa-on-github-test",
+			source:      "github.com/asraa/slsa-on-github-test",
 			pversiontag: pString("v1"),
 			err:         pkg.ErrorMismatchVersionedTag,
 		},
 		{
 			name:        "versioned v3 no match push-v2.5",
 			artifact:    "./testdata/binary-linux-amd64-push-v2.5",
-			source:      "github.com/laurentsimon/slsa-on-github-test",
+			source:      "github.com/asraa/slsa-on-github-test",
 			pversiontag: pString("v3"),
 			err:         pkg.ErrorMismatchVersionedTag,
 		},
 		{
 			name:        "versioned v3.1 no match push-v2.5",
 			artifact:    "./testdata/binary-linux-amd64-push-v2.5",
-			source:      "github.com/laurentsimon/slsa-on-github-test",
+			source:      "github.com/asraa/slsa-on-github-test",
 			pversiontag: pString("v3.1"),
 			err:         pkg.ErrorMismatchVersionedTag,
 		},

pkg/provenance.go

@@ -503,36 +503,36 @@ func extractFromVersion(v string, i int) (string, error) {
 	return parts[i], nil
 }
 
-func getAsInt(parameters map[string]interface{}, field string) (int, error) {
-	value, ok := parameters[field]
+func getAsInt(environment map[string]interface{}, field string) (int, error) {
+	value, ok := environment[field]
 	if !ok {
 		return -1, fmt.Errorf("%w: %s", ErrorInvalidDssePayload,
-			fmt.Sprintf("parameters type for %s", field))
+			fmt.Sprintf("environment type for %s", field))
 	}
 
 	i, ok := value.(float64)
 	if !ok {
-		return -1, fmt.Errorf("%w: %s", ErrorInvalidDssePayload, "parameters type float64")
+		return -1, fmt.Errorf("%w: %s", ErrorInvalidDssePayload, "environment type float64")
 	}
 	return int(i), nil
 }
 
-func getAsString(parameters map[string]interface{}, field string) (string, error) {
-	value, ok := parameters[field]
+func getAsString(environment map[string]interface{}, field string) (string, error) {
+	value, ok := environment[field]
 	if !ok {
 		return "", fmt.Errorf("%w: %s", ErrorInvalidDssePayload,
-			fmt.Sprintf("parameters type for %s", field))
+			fmt.Sprintf("environment type for %s", field))
 	}
 
 	i, ok := value.(string)
 	if !ok {
-		return "", fmt.Errorf("%w: %s", ErrorInvalidDssePayload, "parameters type string")
+		return "", fmt.Errorf("%w: %s", ErrorInvalidDssePayload, "environment type string")
 	}
 	return i, nil
 }
 
-func getBaseRef(parameters map[string]interface{}) (string, error) {
-	baseRef, err := getAsString(parameters, "base_ref")
+func getBaseRef(environment map[string]interface{}) (string, error) {
+	baseRef, err := getAsString(environment, "github_base_ref")
 	if err != nil {
 		return "", err
 	}
@@ -545,7 +545,7 @@ func getBaseRef(parameters map[string]interface{}) (string, error) {
 	// Look at the event payload instead.
 	// We don't do that for all triggers because the payload
 	// is event-specific; and only the `push` event seems to have a `base_ref``.
-	eventName, err := getAsString(parameters, "event_name")
+	eventName, err := getAsString(environment, "github_event_name")
 	if err != nil {
 		return "", err
 	}
@@ -554,7 +554,7 @@ func getBaseRef(parameters map[string]interface{}) (string, error) {
 		return "", nil
 	}
 
-	eventPayload, ok := parameters["event_payload"]
+	eventPayload, ok := environment["github_event_payload"]
 	if !ok {
 		return "", fmt.Errorf("%w: %s", ErrorInvalidDssePayload, "parameters type event payload")
 	}
@@ -579,17 +579,12 @@ func getTag(env *dsselib.Envelope) (string, error) {
 		return "", fmt.Errorf("%w: %s", ErrorInvalidDssePayload, "unmarshalling json")
 	}
 
-	parameters, ok := prov.Predicate.Invocation.Parameters.(map[string]interface{})
+	environment, ok := prov.Predicate.Invocation.Environment.(map[string]interface{})
 	if !ok {
 		return "", fmt.Errorf("%w: %s", ErrorInvalidDssePayload, "parameters type")
 	}
 
-	// Validate version.
-	if err := validateVersion(parameters); err != nil {
-		return "", err
-	}
-
-	refType, err := getAsString(parameters, "ref_type")
+	refType, err := getAsString(environment, "github_ref_type")
 	if err != nil {
 		return "", err
 	}
@@ -598,7 +593,7 @@ func getTag(env *dsselib.Envelope) (string, error) {
 	case "branch":
 		return "", nil
 	case "tag":
-		return getAsString(parameters, "ref")
+		return getAsString(environment, "github_ref")
 	default:
 		return "", fmt.Errorf("%w: %s %s", ErrorInvalidDssePayload,
 			"unknown ref type", refType)
@@ -617,39 +612,23 @@ func getBranch(env *dsselib.Envelope) (string, error) {
 		return "", fmt.Errorf("%w: %s", ErrorInvalidDssePayload, "unmarshalling json")
 	}
 
-	parameters, ok := prov.Predicate.Invocation.Parameters.(map[string]interface{})
+	environment, ok := prov.Predicate.Invocation.Environment.(map[string]interface{})
 	if !ok {
 		return "", fmt.Errorf("%w: %s", ErrorInvalidDssePayload, "parameters type")
 	}
 
-	// Validate version.
-	if err := validateVersion(parameters); err != nil {
-		return "", err
-	}
-
-	refType, err := getAsString(parameters, "ref_type")
+	refType, err := getAsString(environment, "github_ref_type")
 	if err != nil {
 		return "", err
 	}
 
 	switch refType {
 	case "branch":
-		return getAsString(parameters, "ref")
+		return getAsString(environment, "github_ref")
 	case "tag":
-		return getBaseRef(parameters)
+		return getBaseRef(environment)
 	default:
 		return "", fmt.Errorf("%w: %s %s", ErrorInvalidDssePayload,
 			"unknown ref type", refType)
 	}
 }
-
-func validateVersion(parameters map[string]interface{}) error {
-	version, err := getAsInt(parameters, "version")
-	if err != nil {
-		return err
-	}
-	if version != 1 {
-		return fmt.Errorf("%w", errorInvalidVersion)
-	}
-	return nil
-}

pkg/provenance_test.go

@@ -272,11 +272,6 @@ func Test_VerifyBranch(t *testing.T) {
 			path:     "./testdata/dsse-invalid-ref-type.intoto.jsonl",
 			expected: ErrorInvalidDssePayload,
 		},
-		{
-			name:     "invalid version",
-			path:     "./testdata/dsse-invalid-version.intoto.jsonl",
-			expected: errorInvalidVersion,
-		},
 		{
 			name:   "tag branch2",
 			path:   "./testdata/dsse-branch2-tag.intoto.jsonl",
@@ -328,11 +323,6 @@ func Test_VerifyTag(t *testing.T) {
 			path:     "./testdata/dsse-invalid-ref-type.intoto.jsonl",
 			expected: ErrorInvalidDssePayload,
 		},
-		{
-			name:     "invalid version",
-			path:     "./testdata/dsse-invalid-version.intoto.jsonl",
-			expected: errorInvalidVersion,
-		},
 		{
 			name: "tag vslsa1",
 			path: "./testdata/dsse-vslsa1-tag.intoto.jsonl",
@@ -393,12 +383,6 @@ func Test_VerifyVersionedTag(t *testing.T) {
 			expected: ErrorInvalidDssePayload,
 			tag:      "v1.2.3",
 		},
-		{
-			name:     "invalid version",
-			path:     "./testdata/dsse-invalid-version.intoto.jsonl",
-			expected: errorInvalidVersion,
-			tag:      "v1.2.3",
-		},
 		{
 			name:     "tag vslsa1 invalid",
 			path:     "./testdata/dsse-vslsa1-tag.intoto.jsonl",