Add SLSA 1.0 attestation support to cosign. Closes #2860

[ziel]

Summary

This change adds support for the SLSA 1.0 provenance predicate (https://slsa.dev/spec/v1.0/provenance).

cosign attest and related commands cannot validate it currently, and the custom type must be used for it instead. After this change, it will be possible to specify the new provenance attestation type as slsaprovenance1.

Related issue: #2860

Release Note

Added a new type slsaprovenance1 to support slsa 1.0 provenance in attest and verify commands.

Documentation

The attestation types do not appear to be documented at https://docs.sigstore.dev so there is no related change there.

[ziel]

Hi all! I'm not super sure if this is the right way to support this -- but figured it might be easiest to discuss with something as a starting point. I think my open questions are:

• is making this an explicit type alongside the original slsaprovenance a good approach?
• is slsaprovenance1 an acceptable name for this type?

Also, side note -- I updated two tests to run against the old and new types as subtests. The change is a bit easier to read when ignoring whitespace as there's a large block which was indented in both cases.

[haydentherapper]

I think this is a good way to approach this, and we can plan to change the behavior of the flags in a later release as a breaking change, where slsaprovenance will generate a v1.0 attestation and we'll drop support for v0.2.

cc @znewman01

[codecov]

Codecov Report

Merging #3219 (1ac71d7) into main (865e7b3) will not change coverage.
Report is 10 commits behind head on main.
The diff coverage is 0.00%.

@@           Coverage Diff           @@
##             main    #3219   +/-   ##
=======================================
  Coverage   30.33%   30.33%           
=======================================
  Files         155      155           
  Lines        9827     9827           
=======================================
  Hits         2981     2981           
  Misses       6398     6398           
  Partials      448      448           

Files Changed	Coverage Δ
cmd/cosign/cli/options/predicate.go	0.00% <0.00%> (ø)

[znewman01]

Maybe to ease the transition can we add a slsaprovenance0.2 option that's just an alias for the current behavior?

Then we could at some future point switch over slsaprovenance to point to slsaprovenance1.

Otherwise looks great, thanks for the change!

[ziel]

hi @znewman01 -- i added a patch related to your change request, if you have a moment to peek at it. i called the type slasprovenance02 because there's places in the code base which don't like the . -- though we could have it diverge from the those if that'd be better