Allow specificy Artifact as a HashOutput

Useful for allowing verifying over an artifact digest without needing to have the whole artifact available locally just to be digested Signed-off-by: Samuel Giddins <[email protected]>
sigstore · Sep 30, 2024 · 83aff1b · 83aff1b
1 parent bac851d
commit 83aff1b
Show file tree

Hide file tree

Showing 9 changed files with 107 additions and 19 deletions.
diff --git a/gen/jsonschema/schemas/Artifact.schema.json b/gen/jsonschema/schemas/Artifact.schema.json
@@ -13,6 +13,11 @@
                     "description": "The raw bytes of the artifact",
                     "format": "binary",
                     "binaryEncoding": "base64"
+                },
+                "artifactDigest": {
+                    "$ref": "#/definitions/dev.sigstore.common.v1.HashOutput",
+                    "additionalProperties": false,
+                    "description": "Digest of the artifact"
                 }
             },
             "additionalProperties": false,
@@ -27,9 +32,41 @@
                     "required": [
                         "artifact"
                     ]
+                },
+                {
+                    "required": [
+                        "artifact_digest"
+                    ]
                 }
             ],
             "title": "Artifact"
+        },
+        "dev.sigstore.common.v1.HashOutput": {
+            "properties": {
+                "algorithm": {
+                    "enum": [
+                        "HASH_ALGORITHM_UNSPECIFIED",
+                        "SHA2_256",
+                        "SHA2_384",
+                        "SHA2_512",
+                        "SHA3_256",
+                        "SHA3_384"
+                    ],
+                    "type": "string",
+                    "title": "This package defines commonly used message types within the Sigstore\n community.",
+                    "description": "This package defines commonly used message types within the Sigstore community.  Only a subset of the secure hash standard algorithms are supported. See \u003chttps://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf\u003e for more details. UNSPECIFIED SHOULD not be used, primary reason for inclusion is to force any proto JSON serialization to emit the used hash algorithm, as default option is to *omit* the default value of an enum (which is the first value, represented by '0'."
+                },
+                "digest": {
+                    "type": "string",
+                    "description": "This is the raw octets of the message digest as computed by the hash algorithm.",
+                    "format": "binary",
+                    "binaryEncoding": "base64"
+                }
+            },
+            "additionalProperties": false,
+            "type": "object",
+            "title": "Hash Output",
+            "description": "HashOutput captures a digest of a 'message' (generic octet sequence) and the corresponding hash algorithm used."
         }
     }
 }
diff --git a/gen/jsonschema/schemas/Input.schema.json b/gen/jsonschema/schemas/Input.schema.json
@@ -653,6 +653,11 @@
                     "description": "The raw bytes of the artifact",
                     "format": "binary",
                     "binaryEncoding": "base64"
+                },
+                "artifactDigest": {
+                    "$ref": "#/definitions/dev.sigstore.common.v1.HashOutput",
+                    "additionalProperties": false,
+                    "description": "Digest of the artifact"
                 }
             },
             "additionalProperties": false,
@@ -667,6 +672,11 @@
                     "required": [
                         "artifact"
                     ]
+                },
+                {
+                    "required": [
+                        "artifact_digest"
+                    ]
                 }
             ],
             "title": "Artifact"

diff --git a/gen/pb-go/verification/v1/sigstore_verification.pb.go b/gen/pb-go/verification/v1/sigstore_verification.pb.go
diff --git a/gen/pb-python/sigstore_protobuf_specs/dev/sigstore/verification/v1/__init__.py b/gen/pb-python/sigstore_protobuf_specs/dev/sigstore/verification/v1/__init__.py
diff --git a/gen/pb-ruby/lib/sigstore_verification_pb.rb b/gen/pb-ruby/lib/sigstore_verification_pb.rb
diff --git a/gen/pb-rust/sigstore-protobuf-specs/src/generated/dev.sigstore.verification.v1.rs b/gen/pb-rust/sigstore-protobuf-specs/src/generated/dev.sigstore.verification.v1.rs
@@ -247,7 +247,7 @@ pub mod artifact_verification_options {
 #[allow(clippy::derive_partial_eq_without_eq)]
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct Artifact {
-    #[prost(oneof = "artifact::Data", tags = "1, 2")]
+    #[prost(oneof = "artifact::Data", tags = "1, 2, 3")]
     pub data: ::core::option::Option<artifact::Data>,
 }
 /// Nested message and enum types in `Artifact`.
@@ -265,6 +265,9 @@ pub mod artifact {
         /// The raw bytes of the artifact
         #[prost(bytes, tag = "2")]
         Artifact(::prost::alloc::vec::Vec<u8>),
+        /// Digest of the artifact
+        #[prost(message, tag = "3")]
+        ArtifactDigest(super::super::super::common::v1::HashOutput),
     }
 }
 /// Input captures all that is needed to call the bundle verification method,

diff --git a/gen/pb-rust/sigstore-protobuf-specs/src/generated/file_descriptor_set.bin b/gen/pb-rust/sigstore-protobuf-specs/src/generated/file_descriptor_set.bin
diff --git a/gen/pb-typescript/src/__generated__/sigstore_verification.ts b/gen/pb-typescript/src/__generated__/sigstore_verification.ts
diff --git a/protos/sigstore_verification.proto b/protos/sigstore_verification.proto
@@ -136,6 +136,8 @@ message Artifact {
                 string artifact_uri = 1;
                 // The raw bytes of the artifact
                 bytes artifact = 2;
+                // Digest of the artifact
+                dev.sigstore.common.v1.HashOutput artifact_digest = 3;
         }
 }