|
| 1 | +package archivista |
| 2 | + |
| 3 | +import ( |
| 4 | + "context" |
| 5 | + "encoding/json" |
| 6 | + "errors" |
| 7 | + "fmt" |
| 8 | + "net/http" |
| 9 | + "strings" |
| 10 | + |
| 11 | + archivistaClient "github.com/in-toto/archivista/pkg/http-client" |
| 12 | + "github.com/in-toto/go-witness/dsse" |
| 13 | + "github.com/tektoncd/chains/pkg/chains/objects" |
| 14 | + "github.com/tektoncd/chains/pkg/config" |
| 15 | + tektonv1 "github.com/tektoncd/pipeline/pkg/apis/pipeline/v1" |
| 16 | + "github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1" // if needed |
| 17 | + tektonclient "github.com/tektoncd/pipeline/pkg/client/clientset/versioned" |
| 18 | + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" |
| 19 | + "k8s.io/apimachinery/pkg/types" |
| 20 | + "knative.dev/pkg/logging" |
| 21 | +) |
| 22 | + |
| 23 | +const ( |
| 24 | + StorageBackendArchivista = "archivista" |
| 25 | +) |
| 26 | + |
| 27 | +// Backend is the interface that all storage backends must implement. |
| 28 | +type Backend interface { |
| 29 | + StorePayload(ctx context.Context, obj objects.TektonObject, rawPayload []byte, signature string, opts config.StorageOpts) error |
| 30 | + RetrievePayloads(ctx context.Context, obj objects.TektonObject, opts config.StorageOpts) (map[string]string, error) |
| 31 | + RetrieveSignatures(ctx context.Context, obj objects.TektonObject, opts config.StorageOpts) (map[string][]string, error) |
| 32 | + Type() string |
| 33 | +} |
| 34 | + |
| 35 | +// ArchivistaStorage implements the Backend interface for Archivista. |
| 36 | +type ArchivistaStorage struct { |
| 37 | + client *archivistaClient.ArchivistaClient |
| 38 | + url string |
| 39 | + cfg config.ArchivistaStorageConfig |
| 40 | + tektonClient tektonclient.Interface // Injected Tekton client for patching objects |
| 41 | +} |
| 42 | + |
| 43 | +// NewArchivistaStorage initializes a new ArchivistaStorage backend. |
| 44 | +func NewArchivistaStorage(cfg config.Config, tektonClient tektonclient.Interface) (*ArchivistaStorage, error) { |
| 45 | + archCfg := cfg.Storage.Archivista |
| 46 | + if strings.TrimSpace(archCfg.URL) == "" { |
| 47 | + return nil, fmt.Errorf("missing archivista URL in storage configuration") |
| 48 | + } |
| 49 | + |
| 50 | + client, err := archivistaClient.CreateArchivistaClient(&http.Client{}, archCfg.URL) |
| 51 | + if err != nil { |
| 52 | + return nil, fmt.Errorf("failed to create Archivista client: %w", err) |
| 53 | + } |
| 54 | + |
| 55 | + return &ArchivistaStorage{ |
| 56 | + client: client, |
| 57 | + url: archCfg.URL, |
| 58 | + cfg: archCfg, |
| 59 | + tektonClient: tektonClient, |
| 60 | + }, nil |
| 61 | +} |
| 62 | + |
| 63 | +// patchTektonObjectAnnotations patches the Tekton object's annotations with the given key/value pairs |
| 64 | +// in one single patch call. |
| 65 | +func PatchTektonObjectAnnotations(ctx context.Context, obj objects.TektonObject, annotations map[string]string, tektonClient tektonclient.Interface) error { |
| 66 | + patchData := map[string]interface{}{ |
| 67 | + "metadata": map[string]interface{}{ |
| 68 | + "annotations": annotations, |
| 69 | + }, |
| 70 | + } |
| 71 | + patchBytes, err := json.Marshal(patchData) |
| 72 | + if err != nil { |
| 73 | + return fmt.Errorf("failed to marshal patch data: %w", err) |
| 74 | + } |
| 75 | + |
| 76 | + switch o := obj.GetObject().(type) { |
| 77 | + case *tektonv1.TaskRun: |
| 78 | + _, err = tektonClient.TektonV1().TaskRuns(o.Namespace).Patch(ctx, o.Name, types.MergePatchType, patchBytes, metav1.PatchOptions{}) |
| 79 | + return err |
| 80 | + case *tektonv1.PipelineRun: |
| 81 | + _, err = tektonClient.TektonV1().PipelineRuns(o.Namespace).Patch(ctx, o.Name, types.MergePatchType, patchBytes, metav1.PatchOptions{}) |
| 82 | + return err |
| 83 | + case *v1beta1.TaskRun: |
| 84 | + _, err = tektonClient.TektonV1beta1().TaskRuns(o.Namespace).Patch(ctx, o.Name, types.MergePatchType, patchBytes, metav1.PatchOptions{}) |
| 85 | + return err |
| 86 | + case *v1beta1.PipelineRun: |
| 87 | + _, err = tektonClient.TektonV1beta1().PipelineRuns(o.Namespace).Patch(ctx, o.Name, types.MergePatchType, patchBytes, metav1.PatchOptions{}) |
| 88 | + return err |
| 89 | + default: |
| 90 | + return fmt.Errorf("unsupported Tekton object type for patching") |
| 91 | + } |
| 92 | +} |
| 93 | + |
| 94 | +// StorePayload builds a DSSE envelope from the raw payload and signature, |
| 95 | +// logs the envelope, uploads it via the Archivista client API, and patches the |
| 96 | +// Tekton object with the returned gitoid and Archivista URL. |
| 97 | +func (a *ArchivistaStorage) StorePayload(ctx context.Context, obj objects.TektonObject, rawPayload []byte, signature string, opts config.StorageOpts) error { |
| 98 | + logger := logging.FromContext(ctx) |
| 99 | + var env dsse.Envelope |
| 100 | + if err := json.Unmarshal([]byte(signature), &env); err != nil { |
| 101 | + logger.Errorf("Failed to parse DSSE envelope: %w", err) |
| 102 | + return errors.Join(errors.New("Failed to parse DSSE envelope"), err) |
| 103 | + } |
| 104 | + |
| 105 | + // Upload the envelope using the Archivista client's Store method. |
| 106 | + uploadResp, err := a.client.Store(ctx, env) |
| 107 | + if err != nil { |
| 108 | + logger.Errorw("Failed to upload DSSE envelope to Archivista", "error", err) |
| 109 | + return err |
| 110 | + } |
| 111 | + logger.Infof("Successfully uploaded DSSE envelope to Archivista, response: %+v", uploadResp) |
| 112 | + |
| 113 | + // Update the in-memory Tekton object with Archivista annotations. |
| 114 | + annotations := map[string]string{ |
| 115 | + "chains.tekton.dev/archivista-gitoid": uploadResp.Gitoid, |
| 116 | + "chains.tekton.dev/archivista-url": a.url, |
| 117 | + } |
| 118 | + obj.SetAnnotations(annotations) |
| 119 | + |
| 120 | + // Patch the live Tekton object in one call. |
| 121 | + if err := PatchTektonObjectAnnotations(ctx, obj, annotations, a.tektonClient); err != nil { |
| 122 | + logger.Errorw("Failed to patch Tekton object with Archivista annotations", "error", err) |
| 123 | + return fmt.Errorf("failed to patch Tekton object: %w", err) |
| 124 | + } |
| 125 | + |
| 126 | + return nil |
| 127 | +} |
| 128 | + |
| 129 | +// RetrievePayload is not implemented for Archivista. |
| 130 | +func (a *ArchivistaStorage) RetrievePayload(ctx context.Context, key string) ([]byte, []byte, error) { |
| 131 | + return nil, nil, fmt.Errorf("RetrievePayload not implemented for Archivista") |
| 132 | +} |
| 133 | + |
| 134 | +// RetrievePayloads is not implemented for Archivista. |
| 135 | +func (a *ArchivistaStorage) RetrievePayloads(ctx context.Context, obj objects.TektonObject, opts config.StorageOpts) (map[string]string, error) { |
| 136 | + return nil, fmt.Errorf("RetrievePayloads not implemented for Archivista") |
| 137 | +} |
| 138 | + |
| 139 | +// RetrieveSignatures is not implemented for Archivista. |
| 140 | +func (a *ArchivistaStorage) RetrieveSignatures(ctx context.Context, obj objects.TektonObject, opts config.StorageOpts) (map[string][]string, error) { |
| 141 | + return nil, fmt.Errorf("RetrieveSignatures not implemented for Archivista") |
| 142 | +} |
| 143 | + |
| 144 | +// Type returns the storage backend type. |
| 145 | +func (a *ArchivistaStorage) Type() string { |
| 146 | + return StorageBackendArchivista |
| 147 | +} |
0 commit comments