Formalize attestation push

Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>

Author: puerco

go.mod

@@ -4,8 +4,8 @@ go 1.25.8
 
 require (
 	github.com/carabiner-dev/attestation v0.2.1
-	github.com/carabiner-dev/collector v0.2.10-0.20260309053530-b55bbe428700
-	github.com/carabiner-dev/signer v0.3.7
+	github.com/carabiner-dev/collector v0.2.10-0.20260310234513-8d637f10649f
+	github.com/carabiner-dev/signer v0.3.8-0.20260310160610-a37998585604
 	github.com/carabiner-dev/vcslocator v0.4.0
 	github.com/fatih/color v1.18.0
 	github.com/go-git/go-billy/v6 v6.0.0-20260226131633-45bd0956d66f

go.sum

@@ -89,6 +89,8 @@ github.com/carabiner-dev/attestation v0.2.1 h1:VhjV5YlO9TsW50Sr/Zd54bdbZhhDAqgxC
 github.com/carabiner-dev/attestation v0.2.1/go.mod h1:O84vF84RZG3pJO/6BYrPs718bZviHF5DKajP1HsrDpw=
 github.com/carabiner-dev/collector v0.2.10-0.20260309053530-b55bbe428700 h1:S4NFLl3/UJvA4aUuPVY3MECUQS0jhHdT//+excPvWUc=
 github.com/carabiner-dev/collector v0.2.10-0.20260309053530-b55bbe428700/go.mod h1:ltqIryrtd+Ev+zAW9Q2h/UHNVMhT2nR1Fmchk+8lbs8=
+github.com/carabiner-dev/collector v0.2.10-0.20260310234513-8d637f10649f h1:2Q5VzbSVNKPwhP9rUjwH3ZWajDYwxB+3ZT0MTU/80ho=
+github.com/carabiner-dev/collector v0.2.10-0.20260310234513-8d637f10649f/go.mod h1:nqe5n0soDuenKtOt9i4G8D/anZiRTiZywzo3pNqf5As=
 github.com/carabiner-dev/ghrfs v0.3.4 h1:XJoDXkuw+8KQPTC4oI0da8vLpnx7cfQBGgyjzo+Eqrc=
 github.com/carabiner-dev/ghrfs v0.3.4/go.mod h1:u9We7molIUX6sCe4ox70juKOnbNAUpDv+B5Cerbqhio=
 github.com/carabiner-dev/github v0.2.2 h1:Ykrlcct71fRQm4j37LhAz9FyzG4n1nlm2e+V62MIoJM=
@@ -107,6 +109,8 @@ github.com/carabiner-dev/predicates v0.1.0 h1:t6tQF9gFdr6TIccWtuNk3kFasx8eu88INF
 github.com/carabiner-dev/predicates v0.1.0/go.mod h1:jL6EAD+LiI6GW/rOdRYAJF4HaA88/V2Q4n7yUGNQ7XM=
 github.com/carabiner-dev/signer v0.3.7 h1:oEmOg17Szs5+x0oVVGXluPNsVaQyROlXrBPxgwxfOHg=
 github.com/carabiner-dev/signer v0.3.7/go.mod h1:gReZbCZlINz8Pm/hrD1HtRcGFaO9MGUAu/v+iZp7R6Y=
+github.com/carabiner-dev/signer v0.3.8-0.20260310160610-a37998585604 h1:2PeAzIFCqbCF/upSb4Hqj5HwTvuJ6D6KjP2F5yH7WrA=
+github.com/carabiner-dev/signer v0.3.8-0.20260310160610-a37998585604/go.mod h1:kqmUAFHKgQXFsIsIFjbk4UlOMXNte7J1IVxIgKAnY/M=
 github.com/carabiner-dev/vcslocator v0.4.0 h1:HxU8F7FWJatnIhR6NowsPpfki8xw2uNDRLuikcBHFao=
 github.com/carabiner-dev/vcslocator v0.4.0/go.mod h1:B3JFnwypdrRVQPJKNK3BOlRw6DbgmsiHGmoT3ZELpp8=
 github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=

internal/cmd/checklevelprov.go

@@ -11,11 +11,6 @@ import (
 	"slices"
 	"strings"
 
-	"github.com/carabiner-dev/attestation"
-	"github.com/carabiner-dev/collector"
-	"github.com/carabiner-dev/collector/envelope"
-	"github.com/carabiner-dev/collector/repository/github"
-	"github.com/carabiner-dev/collector/repository/note"
 	"github.com/spf13/cobra"
 	"google.golang.org/protobuf/encoding/protojson"
 
@@ -59,61 +54,6 @@ func (po *pushOptions) AddFlags(cmd *cobra.Command) {
 	cmd.PersistentFlags().StringSliceVar(&po.pushLocation, "push", []string{}, fmt.Sprintf("Push signed attestations to storage %v", supportedPushRepos))
 }
 
-func (po *pushOptions) GetCollectorAgent(opts commitOptions, token string) (*collector.Agent, error) {
-	if len(po.pushLocation) == 0 {
-		return nil, nil
-	}
-
-	// Create the attestation storage repositories
-	agent, err := collector.New()
-	if err != nil {
-		return nil, err
-	}
-
-	for _, uri := range po.pushLocation {
-		var repo attestation.Repository
-		var err error
-
-		// Translate just "note" or "github" to the full repo spec acting on
-		// the sepcified commit
-		switch uri {
-		case note.TypeMoniker:
-			uri = fmt.Sprintf(
-				"note:git+https://github.com/%s/%s@%s",
-				opts.owner, opts.repository, opts.commit,
-			)
-		case github.TypeMoniker:
-			uri = fmt.Sprintf("github:%s/%s", opts.owner, opts.repository)
-		}
-		switch {
-		case strings.HasPrefix(uri, "github:"):
-			repo, err = github.New(
-				// Initialize the github repository
-				github.WithInit(uri),
-				// We pass the token to use in the githu client
-				github.WithToken(token),
-			)
-		case strings.HasPrefix(uri, "note:"):
-			repo, err = note.New(
-				// Initialize the notes repository
-				note.WithInit(uri),
-				// Push is enabled as we will append the note to the remote
-				note.WithPush(true),
-				// Push via http, using the GH access token
-				note.WithHttpAuth("x-access-token", token),
-			)
-		default:
-			return nil, fmt.Errorf("repository type not supported")
-		}
-		if err != nil {
-			return nil, fmt.Errorf("creating storage repository: %w", err)
-		}
-		agent.AddRepository(repo) //nolint:errcheck,gosec // always returns nil
-	}
-
-	return agent, nil
-}
-
 type checkLevelProvOpts struct {
 	commitOptions
 	verifierOptions
@@ -187,18 +127,15 @@ and pushed to its remote (--push=note).
 				return err
 			}
 
-			t, err := authenticator.ReadToken()
-			if err != nil {
-				return err
-			}
-
 			// Create a new sourcetool object
 			srctool, err := sourcetool.New(
 				sourcetool.WithAuthenticator(authenticator),
 				sourcetool.WithAllowMergeCommits(opts.allowMergeCommits),
+				sourcetool.WithNotesStorer(slices.Contains(opts.pushLocation, "notes")),
+				sourcetool.WithGithubStorer(slices.Contains(opts.pushLocation, "github")),
 			)
 			if err != nil {
-				return err
+				return fmt.Errorf("creating sourcetool: %w", err)
 			}
 
 			// Create the provenance attestation
@@ -272,30 +209,6 @@ and pushed to its remote (--push=note).
 						return fmt.Errorf("writing bundle data: %w", err)
 					}
 				}
-
-				cl, err := opts.GetCollectorAgent(opts.commitOptions, t)
-				if err != nil {
-					return fmt.Errorf("creating storage repositories: %w", err)
-				}
-
-				// If there are any storage repositories configured, push the attestations
-				if cl != nil {
-					// Parse the attestations into envelopes
-					envProv, err := envelope.Parsers.Parse(strings.NewReader(signedProv))
-					if err != nil || len(envProv) == 0 {
-						return fmt.Errorf("parsing provenance: %w", err)
-					}
-					envVsa, err := envelope.Parsers.Parse(strings.NewReader(signedVsa))
-					if err != nil || len(envVsa) == 0 {
-						return fmt.Errorf("parsing VSA: %w", err)
-					}
-
-					// And store them
-					err = cl.Store(cmd.Context(), []attestation.Envelope{envProv[0], envVsa[0]})
-					if err != nil {
-						return fmt.Errorf("storing attestations: %w", err)
-					}
-				}
 			default:
 				log.Printf("unsigned prov: %s\n", unsignedProv)
 				log.Printf("unsigned vsa: %s\n", unsignedVsa)

pkg/attest/attester.go

@@ -10,7 +10,6 @@ import (
 	"slices"
 	"time"
 
-	"github.com/carabiner-dev/attestation"
 	intoto "github.com/in-toto/attestation/go/v1"
 	"google.golang.org/protobuf/encoding/protojson"
 	"google.golang.org/protobuf/proto"
@@ -24,12 +23,15 @@ import (
 )
 
 type AttesterOptions struct {
-	// Initialize dynamic notes collector
+	// Initialize dynamic notes fetcher and storer
 	InitNotesCollector bool
-	// Initialize attestations store collector
+
+	// Initialize attestations store collector and storer
 	InitGHCollector bool
+
 	// Additional read repositories
 	Repos []string
+
 	// Times to retry fetching attestations
 	Retries uint8
 }
@@ -43,7 +45,6 @@ type Attester struct {
 	verifier      Verifier
 	backend       models.VcsBackend
 	Options       AttesterOptions
-	storer        attestation.Storer
 	authenticator *auth.Authenticator
 }
 
@@ -106,22 +107,22 @@ func WithNotesCollector(yesno bool) optFn {
 // Validate checks that the attester configuration is complete
 func (a *Attester) Validate() error {
 	errs := []error{}
+
+	// Check a backend is configured
 	if a.backend == nil {
 		errs = append(errs, errors.New("attester has no backend defined"))
 	}
 
+	// Check we have attestation repos to read
 	if len(a.Options.Repos) == 0 && !a.Options.InitGHCollector && !a.Options.InitNotesCollector {
 		errs = append(errs, errors.New("no attestation repository configured"))
 	}
 
+	// Check we have a signature verifier
 	if a.verifier == nil {
 		errs = append(errs, errors.New("attester has no verifier"))
 	}
 
-	if a.storer == nil {
-		// errs = append(errs, errors.New("attester has no attestation storer defined"))
-	}
-
 	return errors.Join(errs...)
 }
 

pkg/sourcetool/options.go

@@ -18,13 +18,34 @@ func WithGithubCollector(yesno bool) ConfigFn {
 	}
 }
 
+func WithGithubStorer(yesno bool) ConfigFn {
+	return func(t *Tool) error {
+		t.Options.InitGHStorer = yesno
+		return nil
+	}
+}
+
 func WithNotesCollector(yesno bool) ConfigFn {
 	return func(t *Tool) error {
 		t.Options.InitNotesCollector = yesno
 		return nil
 	}
 }
 
+func WithNotesStorer(yesno bool) ConfigFn {
+	return func(t *Tool) error {
+		t.Options.InitNotesStorer = yesno
+		return nil
+	}
+}
+
+func WithStorageLocation(l ...string) ConfigFn {
+	return func(t *Tool) error {
+		t.Options.StorageLocations = l
+		return nil
+	}
+}
+
 func WithAuthenticator(a *auth.Authenticator) ConfigFn {
 	return func(t *Tool) error {
 		if a == nil {

pkg/sourcetool/options/options.go

@@ -22,11 +22,15 @@ type Options struct {
 	// PolicyRepo is the repository where the policies are stored
 	PolicyRepo string
 
-	// Initialize GitHub attestations store collector
+	// Initialize GitHub attestations storer and fetcher
 	InitGHCollector bool
+	InitGHStorer    bool
 
-	// Initialize Dynamic notes collector
+	// Initialize Dynamic notes storer and fetcher
 	InitNotesCollector bool
+	InitNotesStorer    bool
+
+	StorageLocations []string
 
 	models.BackendOptions
 }