Add cyclonedx predicate type for attestations

cmd/cosign/cli/options/predicate.go

@@ -28,22 +28,24 @@ import (
 )
 
 const (
-	PredicateCustom   = "custom"
-	PredicateSLSA     = "slsaprovenance"
-	PredicateSPDX     = "spdx"
-	PredicateSPDXJSON = "spdxjson"
-	PredicateLink     = "link"
-	PredicateVuln     = "vuln"
+	PredicateCustom    = "custom"
+	PredicateSLSA      = "slsaprovenance"
+	PredicateSPDX      = "spdx"
+	PredicateSPDXJSON  = "spdxjson"
+	PredicateCycloneDX = "cyclonedx"
+	PredicateLink      = "link"
+	PredicateVuln      = "vuln"
 )
 
 // PredicateTypeMap is the mapping between the predicate `type` option to predicate URI.
 var PredicateTypeMap = map[string]string{
-	PredicateCustom:   attestation.CosignCustomProvenanceV01,
-	PredicateSLSA:     slsa.PredicateSLSAProvenance,
-	PredicateSPDX:     in_toto.PredicateSPDX,
-	PredicateSPDXJSON: in_toto.PredicateSPDX,
-	PredicateLink:     in_toto.PredicateLinkV1,
-	PredicateVuln:     attestation.CosignVulnProvenanceV01,
+	PredicateCustom:    attestation.CosignCustomProvenanceV01,
+	PredicateSLSA:      slsa.PredicateSLSAProvenance,
+	PredicateSPDX:      in_toto.PredicateSPDX,
+	PredicateSPDXJSON:  in_toto.PredicateSPDX,
+	PredicateCycloneDX: attestation.PredicateCycloneDX,
+	PredicateLink:      in_toto.PredicateLinkV1,
+	PredicateVuln:      attestation.CosignVulnProvenanceV01,
 }
 
 // PredicateOptions is the wrapper for predicate related options.
@@ -56,7 +58,7 @@ var _ Interface = (*PredicateOptions)(nil)
 // AddFlags implements Interface
 func (o *PredicateOptions) AddFlags(cmd *cobra.Command) {
 	cmd.Flags().StringVar(&o.Type, "type", "custom",
-		"specify a predicate type (slsaprovenance|link|spdx|spdxjson|vuln|custom) or an URI")
+		"specify a predicate type (slsaprovenance|link|spdx|spdxjson|cyclonedx|vuln|custom) or an URI")
 }
 
 // ParsePredicateType parses the predicate `type` flag passed into a predicate URI, or validates `type` is a valid URI.

pkg/apis/policy/v1alpha1/clusterimagepolicy_validation.go

@@ -165,7 +165,7 @@ func (a *Attestation) Validate(ctx context.Context) *apis.FieldError {
 	}
 	if a.PredicateType == "" {
 		errs = errs.Also(apis.ErrMissingField("predicateType"))
-	} else if a.PredicateType != "custom" && a.PredicateType != "slsaprovenance" && a.PredicateType != "spdx" && a.PredicateType != "spdxjson" && a.PredicateType != "link" && a.PredicateType != "vuln" {
+	} else if a.PredicateType != "custom" && a.PredicateType != "slsaprovenance" && a.PredicateType != "spdx" && a.PredicateType != "spdxjson" && a.PredicateType != "cyclonedx" && a.PredicateType != "link" && a.PredicateType != "vuln" {
 		// TODO(vaikas): The above should be using something like:
 		// if _, ok := options.PredicateTypeMap[a.PrecicateType]; !ok {
 		// But it causes an import loop. That refactor can be part of

pkg/apis/policy/v1beta1/clusterimagepolicy_validation.go

@@ -165,7 +165,7 @@ func (a *Attestation) Validate(ctx context.Context) *apis.FieldError {
 	}
 	if a.PredicateType == "" {
 		errs = errs.Also(apis.ErrMissingField("predicateType"))
-	} else if a.PredicateType != "custom" && a.PredicateType != "slsaprovenance" && a.PredicateType != "spdx" && a.PredicateType != "spdxjson" && a.PredicateType != "link" && a.PredicateType != "vuln" {
+	} else if a.PredicateType != "custom" && a.PredicateType != "slsaprovenance" && a.PredicateType != "spdx" && a.PredicateType != "spdxjson" && a.PredicateType != "cyclonedx" && a.PredicateType != "link" && a.PredicateType != "vuln" {
 		// TODO(vaikas): The above should be using something like:
 		// if _, ok := options.PredicateTypeMap[a.PrecicateType]; !ok {
 		// But it causes an import loop. That refactor can be part of

pkg/cosign/attestation/attestation.go

@@ -34,6 +34,9 @@ const (
 
 	// CosignVulnProvenanceV01 specifies the type of VulnerabilityScan Predicate
 	CosignVulnProvenanceV01 = "cosign.sigstore.dev/attestation/vuln/v1"
+
+	// PredicateCycloneDX represents a SBOM using the CycloneDX standard.
+	PredicateCycloneDX = "https://cyclonedx.org/schema"
 )
 
 // CosignPredicate specifies the format of the Custom Predicate.
@@ -58,6 +61,12 @@ type CosignVulnStatement struct {
 	Predicate CosignVulnPredicate `json:"predicate"`
 }
 
+// TODO: upstream to in-toto
+type CycloneDXStatement struct {
+	in_toto.StatementHeader
+	Predicate interface{} `json:"predicate"`
+}
+
 type Invocation struct {
 	Parameters interface{} `json:"parameters"`
 	URI        string      `json:"uri"`
@@ -99,7 +108,7 @@ type GenerateOpts struct {
 }
 
 // GenerateStatement returns an in-toto statement based on the provided
-// predicate type (custom|slsaprovenance|spdx|spdxjson|link).
+// predicate type (custom|slsaprovenance|spdx|spdxjson|cyclonedx|link).
 func GenerateStatement(opts GenerateOpts) (interface{}, error) {
 	predicate, err := io.ReadAll(opts.Predicate)
 	if err != nil {
@@ -113,6 +122,8 @@ func GenerateStatement(opts GenerateOpts) (interface{}, error) {
 		return generateSPDXStatement(predicate, opts.Digest, opts.Repo, false)
 	case "spdxjson":
 		return generateSPDXStatement(predicate, opts.Digest, opts.Repo, true)
+	case "cyclonedx":
+		return generateCycloneDXStatement(predicate, opts.Digest, opts.Repo)
 	case "link":
 		return generateLinkStatement(predicate, opts.Digest, opts.Repo)
 	case "vuln":
@@ -245,6 +256,19 @@ func generateSPDXStatement(rawPayload []byte, digest string, repo string, parseJ
 	}, nil
 }
 
+func generateCycloneDXStatement(rawPayload []byte, digest string, repo string) (interface{}, error) {
+	var data interface{}
+	if err := json.Unmarshal(rawPayload, &data); err != nil {
+		return nil, err
+	}
+	return in_toto.SPDXStatement{
+		StatementHeader: generateStatementHeader(digest, repo, PredicateCycloneDX),
+		Predicate: CosignPredicate{
+			Data: data,
+		},
+	}, nil
+}
+
 func checkRequiredJSONFields(rawPayload []byte, typ reflect.Type) error {
 	var tmp map[string]interface{}
 	if err := json.Unmarshal(rawPayload, &tmp); err != nil {

pkg/policy/attestation.go

@@ -113,6 +113,15 @@ func AttestationToPayloadJSON(ctx context.Context, predicateType string, verifie
 		if err != nil {
 			return nil, fmt.Errorf("marshaling SPDXStatement: %w", err)
 		}
+	case options.PredicateCycloneDX:
+		var cyclonedxStatement attestation.CycloneDXStatement
+		if err := json.Unmarshal(decodedPayload, &cyclonedxStatement); err != nil {
+			return nil, fmt.Errorf("unmarshaling CycloneDXStatement: %w", err)
+		}
+		payload, err = json.Marshal(cyclonedxStatement)
+		if err != nil {
+			return nil, fmt.Errorf("marshaling CycloneDXStatement: %w", err)
+		}
 	case options.PredicateVuln:
 		var vulnStatement attestation.CosignVulnStatement
 		if err := json.Unmarshal(decodedPayload, &vulnStatement); err != nil {

test/e2e_test.go

@@ -225,6 +225,19 @@ func TestAttestVerifySPDXJSON(t *testing.T) {
 	)
 }
 
+func TestAttestVerifyCycloneDXJSON(t *testing.T) {
+	attestationBytes, err := os.ReadFile("./testdata/bom-go-mod.cyclonedx.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	attestVerify(t,
+		"cyclonedx",
+		string(attestationBytes),
+		`Data: specVersion: "7.7"`,
+		`Data: specVersion: "1.4"`,
+	)
+}
+
 func attestVerify(t *testing.T, predicateType, attestation, goodCue, badCue string) {
 	repo, stop := reg(t)
 	defer stop()

test/testdata/bom-go-mod.cyclonedx.json

@@ -0,0 +1,9 @@
+{
+    "bomFormat": "CycloneDX",
+    "specVersion": "1.4",
+    "serialNumber": "urn:uuid:9b0c2427-be94-439c-82e5-8928db124270",
+    "version": 1,
+    "metadata": {},
+    "components": [],
+    "dependencies": []
+}