Add URI and Digest to ConfigSource

Signed-off-by: Marco Franssen <[email protected]>

lib/intoto/intoto.go

@@ -75,6 +75,8 @@ func WithInvocation(buildType, entryPoint string, environment json.RawMessage, a
 		s.Predicate.Invocation = Invocation{
 			ConfigSource: ConfigSource{
 				EntryPoint: entryPoint,
+				URI:        materials[0].URI,
+				Digest:     materials[0].Digest,
 			},
 			Arguments: arguments,
 			// Subject to change and simplify https://github.com/slsa-framework/slsa/issues/178
@@ -147,7 +149,9 @@ type Invocation struct {
 // ConfigSource Describes where the config file that kicked off the build came from.
 // This is effectively a pointer to the source where buildConfig came from.
 type ConfigSource struct {
-	EntryPoint string `json:"entryPoint"`
+	EntryPoint string    `json:"entryPoint"`
+	URI        string    `json:"uri,omitempty"`
+	Digest     DigestSet `json:"digest,omitempty"`
 }
 
 // Completeness Indicates that the builder claims certain fields in this message to be complete.

lib/intoto/intoto_test.go

@@ -82,12 +82,18 @@ func assertStatement(assert *assert.Assertions, stmt *Statement, builderID, buil
 	assert.Len(stmt.Subject, 1)
 	assert.Equal(builderID, stmt.Predicate.Builder.ID)
 	assert.Equal(buildType, stmt.Predicate.BuildType)
-	assert.Equal("ci.yaml:build", i.ConfigSource.EntryPoint)
+	assertConfigSource(assert, i.ConfigSource, stmt.Predicate.Materials)
 	assert.Nil(i.Arguments)
 	assert.Equal(0, i.DefinedInMaterial)
 	assert.Equal(material, stmt.Predicate.Materials)
 }
 
+func assertConfigSource(assert *assert.Assertions, cs ConfigSource, materials []Item) {
+	assert.Equal("ci.yaml:build", cs.EntryPoint)
+	assert.Equal(materials[0].URI, cs.URI)
+	assert.Equal(materials[0].Digest, cs.Digest)
+}
+
 func TestSLSAProvenanceStatementJSON(t *testing.T) {
 	assert := assert.New(t)