cli · kommendorkapten · Sep 11, 2024 · Aug 29, 2024
@@ -27,4 +27,7 @@
 # vim
 *.swp
 
+# Emacs
+*~
+
 vendor/
@@ -8,7 +8,6 @@ import (
 
 	"github.com/cli/cli/v2/api"
 	ioconfig "github.com/cli/cli/v2/pkg/cmd/attestation/io"
-	"github.com/cli/go-gh/v2/pkg/auth"
 )
 
 const (
@@ -18,12 +17,14 @@ const (
 )
 
 type apiClient interface {
+	REST(hostname, method, p string, body io.Reader, data interface{}) error
 	RESTWithNext(hostname, method, p string, body io.Reader, data interface{}) (string, error)
 }
 
 type Client interface {
 	GetByRepoAndDigest(repo, digest string, limit int) ([]*Attestation, error)
 	GetByOwnerAndDigest(owner, digest string, limit int) ([]*Attestation, error)
+	GetTrustDomain() (string, error)
 }
 
 type LiveClient struct {
@@ -32,9 +33,7 @@ type LiveClient struct {
 	logger *ioconfig.Handler
 }
 
-func NewLiveClient(hc *http.Client, l *ioconfig.Handler) *LiveClient {
-	host, _ := auth.DefaultHost()
-
+func NewLiveClient(hc *http.Client, host string, l *ioconfig.Handler) *LiveClient {
 	return &LiveClient{
 		api:    api.NewClientFromHTTP(hc),
 		host:   strings.TrimSuffix(host, "/"),
@@ -64,6 +63,12 @@ func (c *LiveClient) GetByOwnerAndDigest(owner, digest string, limit int) ([]*At
 	return c.getAttestations(url, owner, digest, limit)
 }
 
+// GetTrustDomain returns the current trust domain. If the default is used
+// the empty string is returned
+func (c *LiveClient) GetTrustDomain() (string, error) {
+	return c.getTrustDomain(MetaPath)
+}
+
 func (c *LiveClient) getAttestations(url, name, digest string, limit int) ([]*Attestation, error) {
 	c.logger.VerbosePrintf("Fetching attestations for artifact digest %s\n\n", digest)
 
@@ -102,3 +107,14 @@ func (c *LiveClient) getAttestations(url, name, digest string, limit int) ([]*At
 
 	return attestations, nil
 }
+
+func (c *LiveClient) getTrustDomain(url string) (string, error) {
+	var resp MetaResponse
+
+	err := c.api.REST(c.host, http.MethodGet, url, nil, &resp)
+	if err != nil {
+		return "", err
+	}
+
+	return resp.Domains.ArtifactAttestations.TrustDomain, nil
+}
@@ -172,3 +172,35 @@ func TestGetByDigest_Error(t *testing.T) {
 	require.Error(t, err)
 	require.Nil(t, attestations)
 }
+
+func TestGetTrustDomain(t *testing.T) {
+	fetcher := mockMetaGenerator{
+		TrustDomain: "foo",
+	}
+
+	t.Run("with returned trust domain", func(t *testing.T) {
+		c := LiveClient{
+			api: mockAPIClient{
+				OnREST: fetcher.OnREST,
+			},
+			logger: io.NewTestHandler(),
+		}
+		td, err := c.GetTrustDomain()
+		require.Nil(t, err)
+		require.Equal(t, "foo", td)
+
+	})
+
+	t.Run("with error", func(t *testing.T) {
+		c := LiveClient{
+			api: mockAPIClient{
+				OnREST: fetcher.OnRESTError,
+			},
+			logger: io.NewTestHandler(),
+		}
+		td, err := c.GetTrustDomain()
+		require.Equal(t, "", td)
+		require.ErrorContains(t, err, "test error")
+	})
+
+}
@@ -10,12 +10,17 @@ import (
 
 type mockAPIClient struct {
 	OnRESTWithNext func(hostname, method, p string, body io.Reader, data interface{}) (string, error)
+	OnREST         func(hostname, method, p string, body io.Reader, data interface{}) error
 }
 
 func (m mockAPIClient) RESTWithNext(hostname, method, p string, body io.Reader, data interface{}) (string, error) {
 	return m.OnRESTWithNext(hostname, method, p, body, data)
 }
 
+func (m mockAPIClient) REST(hostname, method, p string, body io.Reader, data interface{}) error {
+	return m.OnREST(hostname, method, p, body, data)
+}
+
 type mockDataGenerator struct {
 	NumAttestations int
 }
@@ -87,3 +92,26 @@ func (m mockDataGenerator) OnRESTWithNextNoAttestations(hostname, method, p stri
 func (m mockDataGenerator) OnRESTWithNextError(hostname, method, p string, body io.Reader, data interface{}) (string, error) {
 	return "", errors.New("failed to get attestations")
 }
+
+type mockMetaGenerator struct {
+	TrustDomain string
+}
+
+func (m mockMetaGenerator) OnREST(hostname, method, p string, body io.Reader, data interface{}) error {
+	var template = `
+{
+  "domains": {
+    "artifact_attestations": {
+      "trust_domain": "%s"
+    }
+  }
+}
+`
+	var jsonString = fmt.Sprintf(template, m.TrustDomain)
+	return json.Unmarshal([]byte(jsonString), &data)
+
+}
+
+func (m mockMetaGenerator) OnRESTError(hostname, method, p string, body io.Reader, data interface{}) error {
+	return errors.New("test error")
+}
@@ -9,6 +9,7 @@ import (
 type MockClient struct {
 	OnGetByRepoAndDigest  func(repo, digest string, limit int) ([]*Attestation, error)
 	OnGetByOwnerAndDigest func(owner, digest string, limit int) ([]*Attestation, error)
+	OnGetTrustDomain      func() (string, error)
 }
 
 func (m MockClient) GetByRepoAndDigest(repo, digest string, limit int) ([]*Attestation, error) {
@@ -19,6 +20,10 @@ func (m MockClient) GetByOwnerAndDigest(owner, digest string, limit int) ([]*Att
 	return m.OnGetByOwnerAndDigest(owner, digest, limit)
 }
 
+func (m MockClient) GetTrustDomain() (string, error) {
+	return m.OnGetTrustDomain()
+}
+
 func makeTestAttestation() Attestation {
 	return Attestation{Bundle: data.SigstoreBundle(nil)}
 }

@@ -0,0 +1,15 @@
+package api
+
+const MetaPath = "meta"
+
+type ArtifactAttestations struct {
+	TrustDomain string `json:"trust_domain"`
+}
+
+type Domain struct {
+	ArtifactAttestations ArtifactAttestations `json:"artifact_attestations"`
+}
+
+type MetaResponse struct {
+	Domains Domain `json:"domains"`
+}
@@ -4,14 +4,11 @@ import (
 	"errors"
 
 	"github.com/cli/cli/v2/internal/ghinstance"
-	"github.com/cli/go-gh/v2/pkg/auth"
 )
 
 var ErrUnsupportedHost = errors.New("An unsupported host was detected. Note that gh attestation does not currently support GHES")
 
-func IsHostSupported() error {
-	host, _ := auth.DefaultHost()
-
+func IsHostSupported(host string) error {
 	// Note that this check is slightly redundant as Tenancy should not be considered Enterprise
 	// but the ghinstance package has not been updated to reflect this yet.
 	if ghinstance.IsEnterprise(host) && !ghinstance.IsTenancy(host) {

@@ -3,6 +3,8 @@ package auth
 import (
 	"testing"
 
+	ghauth "github.com/cli/go-gh/v2/pkg/auth"
+
 	"github.com/stretchr/testify/require"
 )
 
@@ -38,7 +40,8 @@ func TestIsHostSupported(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Setenv("GH_HOST", tc.host)
 
-			err := IsHostSupported()
+			host, _ := ghauth.DefaultHost()
+			err := IsHostSupported(host)
 			if tc.expectedErr {
 				require.ErrorIs(t, err, ErrUnsupportedHost)
 			} else {

@@ -11,6 +11,7 @@ import (
 	"github.com/cli/cli/v2/pkg/cmd/attestation/io"
 	"github.com/cli/cli/v2/pkg/cmd/attestation/verification"
 	"github.com/cli/cli/v2/pkg/cmdutil"
+	ghauth "github.com/cli/go-gh/v2/pkg/auth"
 
 	"github.com/MakeNowJust/heredoc"
 	"github.com/spf13/cobra"
@@ -78,16 +79,18 @@ func NewDownloadCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Comman
 			if err != nil {
 				return err
 			}
-			opts.APIClient = api.NewLiveClient(hc, opts.Logger)
 
-			opts.OCIClient = oci.NewLiveClient()
-
-			opts.Store = NewLiveStore("")
-
-			if err := auth.IsHostSupported(); err != nil {
+			if opts.Hostname == "" {
+				opts.Hostname, _ = ghauth.DefaultHost()
+			}
+			if err := auth.IsHostSupported(opts.Hostname); err != nil {
 				return err
 			}
 
+			opts.APIClient = api.NewLiveClient(hc, opts.Hostname, opts.Logger)
+			opts.OCIClient = oci.NewLiveClient()
+			opts.Store = NewLiveStore("")
+
 			if runF != nil {
 				return runF(opts)
 			}
@@ -106,6 +109,7 @@ func NewDownloadCmd(f *cmdutil.Factory, runF func(*Options) error) *cobra.Comman
 	downloadCmd.Flags().StringVarP(&opts.PredicateType, "predicate-type", "", "", "Filter attestations by provided predicate type")
 	cmdutil.StringEnumFlag(downloadCmd, &opts.DigestAlgorithm, "digest-alg", "d", "sha256", []string{"sha256", "sha512"}, "The algorithm used to compute a digest of the artifact")
 	downloadCmd.Flags().IntVarP(&opts.Limit, "limit", "L", api.DefaultLimit, "Maximum number of attestations to fetch")
+	downloadCmd.Flags().StringVarP(&opts.Hostname, "hostname", "", "", "Configure host to use")
 
 	return downloadCmd
 }

@@ -24,6 +24,7 @@ type Options struct {
 	Owner           string
 	PredicateType   string
 	Repo            string
+	Hostname        string
 }
 
 func (opts *Options) AreFlagsValid() error {

@@ -55,17 +55,27 @@ type AttestationDetail struct {
 	WorkflowID     string `json:"workflowId"`
 }
 
-func getOrgAndRepo(repoURL string) (string, string, error) {
-	after, found := strings.CutPrefix(repoURL, "https://github.com/")
-	if !found {
-		return "", "", fmt.Errorf("failed to get org and repo from %s", repoURL)
+func getOrgAndRepo(tenant, repoURL string) (string, string, error) {
+	var after string
+	var found bool
+	if tenant == "" {
+		after, found = strings.CutPrefix(repoURL, "https://github.com/")
+		if !found {
+			return "", "", fmt.Errorf("failed to get org and repo from %s", repoURL)
+		}
+	} else {
+		after, found = strings.CutPrefix(repoURL,
+			fmt.Sprintf("https://%s.ghe.com/", tenant))
+		if !found {
+			return "", "", fmt.Errorf("failed to get org and repo from %s", repoURL)
+		}
 	}
 
 	parts := strings.Split(after, "/")
 	return parts[0], parts[1], nil
 }
 
-func getAttestationDetail(attr api.Attestation) (AttestationDetail, error) {
+func getAttestationDetail(tenant string, attr api.Attestation) (AttestationDetail, error) {
 	envelope, err := attr.Bundle.Envelope()
 	if err != nil {
 		return AttestationDetail{}, fmt.Errorf("failed to get envelope from bundle: %v", err)
@@ -87,7 +97,7 @@ func getAttestationDetail(attr api.Attestation) (AttestationDetail, error) {
 		return AttestationDetail{}, fmt.Errorf("failed to unmarshal predicate: %v", err)
 	}
 
-	org, repo, err := getOrgAndRepo(predicate.BuildDefinition.ExternalParameters.Workflow.Repository)
+	org, repo, err := getOrgAndRepo(tenant, predicate.BuildDefinition.ExternalParameters.Workflow.Repository)
 	if err != nil {
 		return AttestationDetail{}, fmt.Errorf("failed to parse attestation content: %v", err)
 	}
@@ -101,11 +111,11 @@ func getAttestationDetail(attr api.Attestation) (AttestationDetail, error) {
 	}, nil
 }
 
-func getDetailsAsSlice(results []*verification.AttestationProcessingResult) ([][]string, error) {
+func getDetailsAsSlice(tenant string, results []*verification.AttestationProcessingResult) ([][]string, error) {
 	details := make([][]string, len(results))
 
 	for i, result := range results {
-		detail, err := getAttestationDetail(*result.Attestation)
+		detail, err := getAttestationDetail(tenant, *result.Attestation)
 		if err != nil {
 			return nil, fmt.Errorf("failed to get attestation detail: %v", err)
 		}
@@ -114,11 +124,11 @@ func getDetailsAsSlice(results []*verification.AttestationProcessingResult) ([][
 	return details, nil
 }
 
-func getAttestationDetails(results []*verification.AttestationProcessingResult) ([]AttestationDetail, error) {
+func getAttestationDetails(tenant string, results []*verification.AttestationProcessingResult) ([]AttestationDetail, error) {
 	details := make([]AttestationDetail, len(results))
 
 	for i, result := range results {
-		detail, err := getAttestationDetail(*result.Attestation)
+		detail, err := getAttestationDetail(tenant, *result.Attestation)
 		if err != nil {
 			return nil, fmt.Errorf("failed to get attestation detail: %v", err)
 		}

@@ -12,19 +12,27 @@ import (
 func TestGetOrgAndRepo(t *testing.T) {
 	t.Run("with valid source URL", func(t *testing.T) {
 		sourceURL := "https://github.com/github/gh-attestation"
-		org, repo, err := getOrgAndRepo(sourceURL)
+		org, repo, err := getOrgAndRepo("", sourceURL)
 		require.Nil(t, err)
 		require.Equal(t, "github", org)
 		require.Equal(t, "gh-attestation", repo)
 	})
 
 	t.Run("with invalid source URL", func(t *testing.T) {
 		sourceURL := "hub.com/github/gh-attestation"
-		org, repo, err := getOrgAndRepo(sourceURL)
+		org, repo, err := getOrgAndRepo("", sourceURL)
 		require.Error(t, err)
 		require.Zero(t, org)
 		require.Zero(t, repo)
 	})
+
+	t.Run("with valid source tenant URL", func(t *testing.T) {
+		sourceURL := "https://foo.ghe.com/github/gh-attestation"
+		org, repo, err := getOrgAndRepo("foo", sourceURL)
+		require.Nil(t, err)
+		require.Equal(t, "github", org)
+		require.Equal(t, "gh-attestation", repo)
+	})
 }
 
 func TestGetAttestationDetail(t *testing.T) {
@@ -35,7 +43,7 @@ func TestGetAttestationDetail(t *testing.T) {
 	require.NoError(t, err)
 
 	attestation := attestations[0]
-	detail, err := getAttestationDetail(*attestation)
+	detail, err := getAttestationDetail("", *attestation)
 	require.NoError(t, err)
 
 	require.Equal(t, "sigstore", detail.OrgName)
-Original file line number
+Diff line change
@@ Expand Up / @@ -27,4 +27,7 @@ @@
     # vim
     *.swp
+    # Emacs
+    *~
     vendor/