6 Commits

Author SHA1 Message Date
Justin Chadwell
78d8b926db inspect: lazily load attestation data
Delay loading the attestation data immediately, and only compute it upon
request. We do this using a deferred function which allows to define the
computation in the same place as before, but perform the computation
later.

With this patch, we ensure that the attestation data is only pulled from
the remote if it is actually referenced in the format string -
otherwise, we can skip it, for improved performance.

Signed-off-by: Justin Chadwell <me@jedevc.com>
2023-01-24 12:10:57 +00:00
Justin Chadwell
9fb3ff1a27
inspect: change additional spdxs to not have duplicates
Signed-off-by: Justin Chadwell <me@jedevc.com>
(cherry picked from commit 484823c97d8155f4ff7d454ff394dd9595c642a3)
2023-01-09 15:53:37 -08:00
Justin Chadwell
9d4f38c5fa
inspect: provide access to multiple spdx documents
Signed-off-by: Justin Chadwell <me@jedevc.com>
(cherry picked from commit 3ce17b01dc614f4224d7f13a993b6ba235dfdab9)
2023-01-09 15:53:34 -08:00
Justin Chadwell
793082f543
inspect: parse sbom and provenance into json structs
Signed-off-by: Justin Chadwell <me@jedevc.com>
(cherry picked from commit e68c566c1c37dfbe77cd479a8bf2743ff4dee969)
2023-01-09 15:53:29 -08:00
Justin Chadwell
fe6f697205
inspect: break after first matching attestation
Signed-off-by: Justin Chadwell <me@jedevc.com>
(cherry picked from commit 19d16aa941baa6b6bdd397029471edb7fea6e190)
2023-01-09 15:53:13 -08:00
CrazyMax
8a7a221a7f
imagetools inspect: handle provenance and sbom
use stub structs for SLSA/SBOM while waiting for
go-imageinspect library to be public.

Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2023-01-06 16:33:47 -08:00