Add support for deriving VCS tags from attestations

- extend Git attestations to store tags
- implement conversion of generic statement type to concrete types
- parse tags from attestations and use for artifacts

Author: errordeveloper

attest/manifest/manifest.go

@@ -16,7 +16,7 @@ var (
 )
 
 type DirContents struct {
-	types.GenericStatement[SourceDirectory]
+	types.GenericStatement[SourceDirectoryContents]
 }
 
 type SourceDirectory struct {
@@ -25,14 +25,16 @@ type SourceDirectory struct {
 	VCSEntries *types.PathCheckSummaryCollection `json:"vcsEntries"`
 }
 
+type SourceDirectoryContents struct {
+	SourceDirectory `json:"containedInDirectory"`
+}
+
 func MakeDirContentsStatement(dir string, entries *types.PathCheckSummaryCollection) types.Statement {
 	return &DirContents{
-		types.MakeStatement[SourceDirectory](
+		types.MakeStatement[SourceDirectoryContents](
 			ManifestDirPredicateType,
-			struct {
-				SourceDirectory `json:"containedInDirectory"`
-			}{
-				SourceDirectory{
+			SourceDirectoryContents{
+				SourceDirectory: SourceDirectory{
 					Path:       dir,
 					VCSEntries: entries,
 				},
@@ -42,6 +44,14 @@ func MakeDirContentsStatement(dir string, entries *types.PathCheckSummaryCollect
 	}
 }
 
+func MakeDirContentsStatementFrom(statement types.Statement) DirContents {
+	dirContents := DirContents{
+		GenericStatement: attestTypes.GenericStatement[SourceDirectoryContents]{},
+	}
+	dirContents.ConvertFrom(statement)
+	return dirContents
+}
+
 func (a SourceDirectory) Compare(b SourceDirectory) types.Cmp {
 	if cmp := cmp.Compare(a.Path, b.Path); cmp != 0 {
 		return &cmp
@@ -55,3 +65,7 @@ func (a SourceDirectory) Compare(b SourceDirectory) types.Cmp {
 	cmp := a.VCSEntries.Compare(*b.VCSEntries)
 	return &cmp
 }
+
+func (a SourceDirectoryContents) Compare(b SourceDirectoryContents) types.Cmp {
+	return a.SourceDirectory.Compare(b.SourceDirectory)
+}

attest/types/types.go

@@ -119,6 +119,30 @@ func Export(s ExportableStatement) toto.Statement {
 	}
 }
 
+func FilterByPredicateType(t string, s Statements) Statements {
+	results := Statements{}
+	for i := range s {
+		if s[i].GetType() == t {
+			results = append(results, s[i])
+		}
+	}
+	return results
+}
+
+type StamentConverter[T any] struct {
+	Statement
+}
+
+func (s *GenericStatement[T]) ConvertFrom(statement Statement) error {
+	predicate, ok := statement.GetPredicate().(ComparablePredicate[T])
+	if !ok {
+		return fmt.Errorf("cannot convert statement with predicte of type %T into %T", statement.GetPredicate(), GenericStatement[T]{})
+	}
+
+	*s = MakeStatement[T](statement.GetType(), predicate, statement.GetSubject()...)
+	return nil
+}
+
 func (s Statements) Export() []toto.Statement {
 	statements := make([]toto.Statement, len(s))
 	for i := range s {
@@ -368,8 +392,9 @@ func comparePathCheckSummaries(a, b PathCheckSummary) int {
 	return cmp.Compare(a.Common().Path, b.Common().Path)
 }
 
-func (p Predicate[T]) GetType() string   { return p.Type }
-func (p Predicate[T]) GetPredicate() any { return p.ComparablePredicate }
+func (p Predicate[T]) GetType() string           { return p.Type }
+func (p Predicate[T]) GetPredicate() any         { return p.ComparablePredicate }
+func (p Predicate[T]) GetUnderlyingPredicate() T { return p.ComparablePredicate.(T) }
 
 func (p Predicate[T]) Compare(b any) Cmp {
 	if b, ok := b.(Predicate[T]); ok {

oci/artefact.go

@@ -13,6 +13,8 @@ import (
 	"path/filepath"
 	"time"
 
+	"golang.org/x/mod/semver"
+
 	ociclient "github.com/fluxcd/pkg/oci"
 	"github.com/go-git/go-git/v5/utils/ioutil"
 	"github.com/google/go-containerregistry/pkg/compression"
@@ -23,7 +25,9 @@ import (
 	"github.com/google/go-containerregistry/pkg/v1/tarball"
 	typesv1 "github.com/google/go-containerregistry/pkg/v1/types"
 
+	"github.com/errordeveloper/tape/attest/manifest"
 	attestTypes "github.com/errordeveloper/tape/attest/types"
+	"github.com/errordeveloper/tape/attest/vcs/git"
 	manifestTypes "github.com/errordeveloper/tape/manifest/types"
 )
 
@@ -250,7 +254,11 @@ func (c *Client) PushArtefact(ctx context.Context, destinationRef, sourceDir str
 	}
 	hash := hex.EncodeToString(c.hash.Sum(nil))
 	tag := repo.Tag(manifestTypes.ConfigImageTagPrefix + hash)
-	tagAlias := tag.Context().Tag(manifestTypes.ConfigImageTagPrefix + hash[:7])
+
+	tagAliases := append(
+		SemVerTagsFromAttestations(ctx, tag, sourceAttestations...),
+		tag.Context().Tag(manifestTypes.ConfigImageTagPrefix+hash[:7]),
+	)
 
 	if timestamp == nil {
 		timestamp = new(time.Time)
@@ -341,11 +349,51 @@ func (c *Client) PushArtefact(ctx context.Context, destinationRef, sourceDir str
 		return "", fmt.Errorf("pushing index failed: %w", err)
 	}
 
-	if err := remote.Tag(tagAlias, index, c.remoteWithContext(ctx)...); err != nil {
-		return "", fmt.Errorf("adding alias tagging failed: %w", err)
+	for i := range tagAliases {
+		if err := remote.Tag(tagAliases[i], index, c.remoteWithContext(ctx)...); err != nil {
+			return "", fmt.Errorf("adding alias tagging failed: %w", err)
+		}
+	}
+	// TODO: reteurn tag and all of its aliases
+	return tagAliases[0].String() + "@" + digest.String(), err
+}
+
+func SemVerTagsFromAttestations(ctx context.Context, tag name.Tag, sourceAttestations ...attestTypes.Statement) []name.Tag {
+	statements := attestTypes.FilterByPredicateType(manifest.ManifestDirPredicateType, sourceAttestations)
+	if len(statements) != 1 {
+		return []name.Tag{}
 	}
 
-	return tagAlias.String() + "@" + digest.String(), err
+	entries := manifest.MakeDirContentsStatementFrom(statements[0]).GetUnderlyingPredicate().VCSEntries
+	if len(entries.EntryGroups) != 1 && len(entries.Providers) != 1 ||
+		entries.Providers[0] != git.ProviderName {
+		return []name.Tag{}
+	}
+	if len(entries.EntryGroups[0]) == 0 {
+		return []name.Tag{}
+	}
+
+	// TODO: try to use generics for this?
+	groupSummary, ok := entries.EntryGroups[0][0].Full().(*git.Summary)
+	if !ok {
+		return []name.Tag{}
+	}
+	ref := groupSummary.Git.Reference
+	if len(ref.Tags) == 0 {
+		return []name.Tag{}
+	}
+	// TODO: detect tags with groupSummary.Path+"/" as prefix and priorities them
+	tags := make([]name.Tag, 0, len(ref.Tags))
+	for i := range ref.Tags {
+		t := ref.Tags[i].Name
+		if semver.IsValid(t) || semver.IsValid("v"+t) {
+			tags = append(tags, tag.Context().Tag(ref.Tags[i].Name))
+		}
+	}
+	if len(tags) == 0 {
+		return []name.Tag{}
+	}
+	return tags
 }
 
 func makeDescriptorWithPlatform() Descriptor {