-
Notifications
You must be signed in to change notification settings - Fork 7
Expand file tree
/
Copy pathpull.go
More file actions
63 lines (50 loc) · 1.69 KB
/
pull.go
File metadata and controls
63 lines (50 loc) · 1.69 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
package githubapi
import (
"context"
"encoding/json"
"fmt"
"io"
"net/http"
cerrdefs "github.com/containerd/errdefs"
digest "github.com/opencontainers/go-digest"
"github.com/pkg/errors"
)
func PullAttestation(ctx context.Context, client *http.Client, dgst digest.Digest, repo string) ([]byte, error) {
// TODO: github token
url := fmt.Sprintf("https://api.github.com/repos/%s/attestations/%s?predicate_type=%s", repo, dgst, "https://slsa.dev/provenance/v1")
if client == nil {
client = http.DefaultClient
}
req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
if err != nil {
return nil, errors.Wrapf(err, "creating request to %s", url)
}
resp, err := client.Do(req)
if err != nil {
return nil, errors.Wrapf(err, "making request to %s", url)
}
defer resp.Body.Close()
if resp.StatusCode == http.StatusNotFound {
return nil, errors.Wrapf(cerrdefs.ErrNotFound, "attestation for digest %s in repo %s not found", dgst, repo)
}
if resp.StatusCode != http.StatusOK {
return nil, errors.Errorf("unexpected status code %d from %s", resp.StatusCode, url)
}
var result struct {
Attestations []struct {
Bundle *json.RawMessage `json:"bundle"`
} `json:"attestations"`
}
rdr := io.LimitReader(resp.Body, 4*1024*1024)
dec := json.NewDecoder(rdr)
if err := dec.Decode(&result); err != nil {
return nil, errors.Wrap(err, "decoding response")
}
if _, err := dec.Token(); !errors.Is(err, io.EOF) {
return nil, errors.Errorf("unexpected data after JSON bundle array")
}
if len(result.Attestations) == 0 {
return nil, errors.Wrapf(cerrdefs.ErrNotFound, "no attestations found for digest %s in repo %s", dgst, repo)
}
return *result.Attestations[0].Bundle, nil
}