
    =                         S r SSKrSSKrSSKrSSKrSSKrSSKJrJrJ	r	  SSK
Jr  SSK
Jr  SSKJr  SSKJr  SSKJr  SS	KJr  SS
KJr  SSKJr  SSKJr  SSKJr  SSKrSrSrS rS rS rS r  SS jr! " S S\RD                  5      r#g)zLTool and utils for creating Sigstore attestations stored as a Docker images.    N)ListOptionalText)docker_creds)docker_name)docker_digest)docker_http)docker_image)docker_session)metadata)util)Errorz%application/vnd.dsse.envelope.v1+jsonzChttps://binaryauthorization.googleapis.com/policy_verification/v0.1c                 N    U R                  U5      (       a  U [        U5      S  $ U $ N)
startswithlen)textprefixs     Clib/googlecloudsdk/command_lib/container/binauthz/sigstore_image.py_RemovePrefixr   +   s'    	__VF	+    c                 ,    U SS [        U 5      * S-   -   $ )Nz===   )r   encodeds    r   AddMissingBase64Paddingr   1   s     	5,CL=1,-	--r   c                      [         R                  " U 5      $ ! [        R                   a"    [         R                  " [        U 5      5      s $ f = fr   )base64	b64decodebinasciir   urlsafe_b64decoder   r   s    r   StandardOrUrlsafeBase64Decoder"   5   sE    FG$$	 F##$;G$DEEFs    3AAc                     [         R                  " [        U 5      5      n[         R                  " [        US   5      5      nSR                  US   S   S   US   S   S   S   5      $ )au  Extract the image url from a DSSE of predicate type https://binaryauthorization.googleapis.com/policy_verification/*.

This is a helper function for mapping attestations back to their respective
images. Do not use this for signature verification.

Args:
  attestation: The attestation in base64 encoded string form.

Returns:
  The image url referenced in the attestation.
payloadz{}@sha256:{}subjectr   namedigestsha256)jsonloadsr"   format)attestation	deser_attdeser_payloads      r   AttestationToImageUrlr/   =   sq     jj6{CD)**#Ii$89- 
		Iq!&)Iq!(+H5
 r   c           
         [         R                  " 5       n[        R                  " [        R
                  " U SS95      n[        R                  " SR                  UR                  UR                  [        UR                  S5      5      5      nSnU(       aW  [        R                  nU(       a  UR                  U5        UR                  [        R                   " UR                  5      5      nUb  [#        U[        R$                  5      (       a  [&        R(                  " 5       n[*        R,                  " UUU[.        R0                  S9 n	U	R3                  5       (       a=  [5        U/U	5      n
[6        R8                  " XgU5      R;                  U
5         SSS5        g SSS5        [5        U/5      n
[6        R8                  " XgU5      R;                  U
5        g! , (       d  f       NA= f)af  Uploads a DSSE attestation to the registry.

Args:
  image_url: The image url of the target image.
  attestation: The attestation referencing the target image in JSON DSSE form.
  use_docker_creds: Whether to use the Docker configuration file for
    authenticating to the registry.
  docker_config_dir: Directory where Docker saves authentication settings.
 )schemez{}/{}:sha256-{}.attsha256:N)accepted_mimes)httplib2Httpr   Digestbinauthz_utilReplaceImageUrlSchemeTagr+   registry
repositoryr   r'   r   DefaultKeychainsetCustomConfigDirResolveRegistry
isinstance	Anonymousr   CredentialProviderr
   FromRegistryr	   SUPPORTED_MANIFEST_MIMESexistsSigstoreAttestationImager   Pushupload)	image_urlr,   use_docker_credsdocker_config_dirhttp_objtarget_imageattestation_tagcredskeychain
v2_2_image	new_images              r   UploadAttestationToRegistryrT   U   s    ]]_( ##)))B?,  OO""




!
!
++Y
7/ %++H!!"34[11,2G2GHIE
]j(>(>??##%E
    99	
 *K=*Ei /(;BB9M   '}5)oh7>>yI s   
A
G
G'c                       \ rS rSrSr SS\\   S\\R                     4S jjr
S\SS4S	 jrS\4S
 jrS\4S jrS\S\4S jrS rS rSrg)rG      zCreates a new image or appends a layers on top of an existing image.

Adheres to the Sigstore Attestation spec:
https://github.com/sigstore/cosign/blob/main/specs/ATTESTATION_SPEC.md.
Nadditional_blobsbasec                    [         R                  " S U 5       5      U l        Ubm  X l        [        R
                  " U R                  R                  5       5      U l        [        R
                  " U R                  R                  5       5      U l	        gSU l        [        R                  SS[        R                  SS./ S.U l        [        5       U l	        g)zCreates a new Sigstore style image or extends a base image.

Args:
  additional_blobs: additional attestations to be appended to the image.
  base: optional base DockerImage.
c              3   R   #    U  H  n[         R                  " U5      U4v   M     g 7fr   )r   SHA256).0blobs     r   	<genexpr>4SigstoreAttestationImage.__init__.<locals>.<genexpr>   s$      57Gt		d	#T*7Gs   %'N   r1   r   )r'   	mediaTypesize)ra   schemaVersionconfiglayers)collectionsOrderedDict_additional_blobs_baser)   r*   manifest_base_manifestconfig_file_base_config_filer	   OCI_MANIFEST_MIMECONFIG_JSON_MIMEdict)selfrW   rX   s      r   __init__!SigstoreAttestationImage.__init__   s     )44 57G5 D j JJtzz':':'<=d#zz$***@*@*BCddj"44&77
 	d  $vdr   r]   returnc                 H    XR                   [        R                  " U5      '   g r   )rh   r   r[   )rq   r]   s     r   	add_layer"SigstoreAttestationImage.add_layer   s    9==//56r   c                 f   U R                   n[        R                  " 5       nUR                  [        R
                  S9nU R                  R                  5        Vs/ s H  n[        US5      PM     nnUR                  US9n[        R                  " UUSSS9n[        R                  " USS9$ s  snf )	Override.)
created_byr3   )re   r1   )optionsarchitectureoperating_systemT	sort_keys)rm   r   	OverridesOverrider   
USER_AGENTrh   keysr   r)   dumps)rq   rl   	overridesblob_sumre   s        r   rl   $SigstoreAttestationImage.config_file   s    ((K""$I""k.D.D"EI ..3355H 	h	*5  
 "" # I
 ##	K ::kT22#s   B.c           	         [         R                  " U R                  5      nU R                  R	                  5        H2  u  p#US   R                  U[        [        U5      S[        S.S.5        M4     U R                  5       nUR                  S5      n[        R                  " U5      US   S'   [        U5      US   S'   [        R                  " US	S
9$ )ry   re   r1   )z"dev.cosignproject.cosign/signaturepredicateType)r'   ra   rb   annotationsutf8rd   r'   rb   Tr~   )copydeepcopyrk   rh   itemsappendDSSE_PAYLOAD_TYPEr   BINAUTHZ_CUSTOM_PREDICATErl   encoder   r[   r)   r   )rq   rj   r   r]   rl   utf8_encoded_configs         r   rj   !SigstoreAttestationImage.manifest   s    }}T001H00668x(d)468	! 	 9 ""$K%,,V4#0#7#78K#LHXx !$%8!9HXv::h$//r   r'   c                     XR                   ;   a  U R                   U   $ U R                  (       a  U R                  R                  U5      $ [        SR	                  U5      5      e)z$Override. Returns uncompressed blob.zDigest not found: {})rh   ri   r]   r   r+   )rq   r'   s     r   r]   SigstoreAttestationImage.blob   sP    '''##F++zzZZ__V$$
&--f5
66r   c                     U $ )ry    )rq   s    r   	__enter__"SigstoreAttestationImage.__enter__   s    Kr   c                     g)ry   Nr   )rq   unused_typeunused_valueunused_tracebacks       r   __exit__!SigstoreAttestationImage.__exit__   s    
r   )rh   ri   rm   rk   r   )__name__
__module____qualname____firstlineno____doc__r   bytesr   r
   DockerImagerr   rv   r   rl   rj   r]   r   r   __static_attributes__r   r   r   rG   rG      s{     26&U& \--.&@>E >d >34 320 0(7 7% 7r   rG   )NN)$r   r   r    rf   r   r)   typingr   r   r   containerregistry.clientr   r   containerregistry.client.v2_2r   r	   r
   r    containerregistry.transform.v2_2r   'googlecloudsdk.api_lib.container.imagesr   -googlecloudsdk.command_lib.container.binauthzr8   googlecloudsdk.core.exceptionsr   r5   r   r   r   r   r"   r/   rT   r   rG   r   r   r   <module>r      s    S      ' ' 1 0 7 5 6 8 5 8 O 0  < I 
.F2 FJ6Jrf|77 fr   