diff --git a/experimental/auth-logic/wrappers/provenance_build_wrapper.go b/experimental/auth-logic/wrappers/provenance_build_wrapper.go index fc2e5870..6362302e 100644 --- a/experimental/auth-logic/wrappers/provenance_build_wrapper.go +++ b/experimental/auth-logic/wrappers/provenance_build_wrapper.go @@ -41,7 +41,8 @@ func (pbw ProvenanceBuildWrapper) EmitStatement() (UnattributedStatement, error) } sanitizedAppName := SanitizeName(provenance.Subject[0].Name) - verifier := verify.ReproducibleProvenanceVerifier{} + // TODO(#69): Set the verifier as a field in pbw, and use that here. + verifier := verify.AmberProvenanceMetadataVerifier{} if err := verifier.Verify(pbw.ProvenanceFilePath); err != nil { return UnattributedStatement{}, fmt.Errorf("verification of the provenance file failed: %v", err) } diff --git a/verify/verify.go b/verify/verify.go index 01b3538f..7006a3c2 100644 --- a/verify/verify.go +++ b/verify/verify.go @@ -83,3 +83,28 @@ func (verifier *ReproducibleProvenanceVerifier) Verify(provenanceFilePath string return nil } + +// AmberProvenanceMetadataVerifier verifies Amber provenances by comparing the +// content of the provenance predicate against a given set of expected values. +type AmberProvenanceMetadataVerifier struct { + // TODO(#69): Add metadata fields with their expected values. +} + +// Verify verifies a given Amber provenance file by checking its content +// against the expected values specified in this +// AmberProvenanceMetadataVerifier instance. Returns an error if any of the +// values is not as expected. Otherwise returns nil. +func (verifier *AmberProvenanceMetadataVerifier) Verify(provenanceFilePath string) error { + provenance, err := slsa.ParseProvenanceFile(provenanceFilePath) + if err != nil { + return fmt.Errorf("couldn't load the provenance file from %s: %v", provenanceFilePath, err) + } + + if provenance.Predicate.BuildType != common.AmberBuildTypeV1 { + return fmt.Errorf("incorrect BuildType: got %s, want %v", provenance.Predicate.BuildType, common.AmberBuildTypeV1) + } + + // TODO(#69): Check metadata against the expected values. + + return nil +}