Filter attestation retrieval by predicate type - #193
Closed
bdehamer wants to merge 2 commits into
Closed
Conversation
Previously the provider called the OCI Referrers API and then downloaded every Sigstore bundle attached to an image. For images with many referring artifacts this meant one registry download per attestation. Add an optional predicate-type filter. When the new -predicate-type flag (chart value predicateType) is set, retrieval is limited to the first referrer whose dev.sigstore.bundle.predicateType annotation matches the configured value, downloading a single attestation instead of all of them. When empty (the default) behavior is unchanged and all bundles are fetched, so this is fully backward compatible. The selection logic is extracted into a pure selectBundleDescriptors helper and unit tested. Also wire the flag into the cver debug CLI and document the option in the README and Helm chart. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Adds configurable predicate-type filtering to reduce attestation registry downloads.
Changes:
- Filters Sigstore referrers by predicate annotation.
- Adds CLI and Helm configuration.
- Adds documentation and unit tests.
Show a summary per file
| File | Description |
|---|---|
README.md |
Documents filtering usage. |
pkg/fetcher/bundle.go |
Implements descriptor selection. |
pkg/fetcher/bundle_test.go |
Tests selection behavior. |
cmd/cver/cver.go |
Adds debug CLI flag. |
cmd/aaop/aaop.go |
Configures the provider filter. |
cmd/aaop/aaop_test.go |
Tests fetcher configuration. |
charts/artifact-attestations-opa-provider/values.yaml |
Adds the Helm value. |
charts/artifact-attestations-opa-provider/templates/deployment.yaml |
Conditionally renders the flag. |
Review details
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
- Files reviewed: 8/8 changed files
- Comments generated: 1
- Review effort level: Balanced
Comment on lines
+292
to
+293
| if desc.Annotations[PredicateTypeAnnotation] == predicateType { | ||
| return []v1.Descriptor{desc} |
Contributor
Author
There was a problem hiding this comment.
Yep, this is totally valid. Intentionally ignoring this for the moment to see if this even helps reduce the incidence of errors in our tests.
piceri
previously approved these changes
Aug 13, 2026
Signed-off-by: Brian DeHamer <bdehamer@github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Previously the provider called the OCI Referrers API and then downloaded every Sigstore bundle attached to an image. For images with many referring artifacts, this meant one registry download per attestation.
This PR adds an optional predicate-type filter. When set, retrieval is limited to the first referrer whose
dev.sigstore.bundle.predicateTypeannotation matches the configured value — downloading a single attestation instead of all of them. When empty (the default), behavior is unchanged and all bundles are fetched, so this is fully backward compatible.The goal is to significantly cut registry API traffic for the common case where we know up front which attestation we want (e.g. SLSA build provenance).
Changes
pkg/fetcher/bundle.go: newPredicateTypeconfig var +PredicateTypeAnnotationconstant. Selection is extracted into a pure, unit-testedselectBundleDescriptorshelper that filters the referrers manifest before any blob download.cmd/aaop: new-predicate-typeflag, wired throughconfigureBundleFetcher.cmd/cver: same-predicate-typeflag on the debug CLI.predicateTypevalue (empty default); the-predicate-typearg is only rendered when set.selectBundleDescriptorstable tests, and updatedconfigureBundleFetchertests.Usage
Design note
The spec lists the bundle
artifactTypeasapplication/vnd.dev.sigstore.bundle.v0.3+json. This PR keeps the existing version-agnostic prefix match (application/vnd.dev.sigstore.bundle) as the "is this a Sigstore bundle" gate and layers the predicate-type annotation on top, so it won't silently break on a future bundle version. The annotation is the real discriminator.Filtering relies on the
dev.sigstore.bundle.predicateTypeannotation being present on the referrer, which GitHub's attestation tooling (actions/attest,actions/publish-immutable-action) populates.Testing
go test ./... -race— all passgolangci-lint run ./...— 0 issueshelm templateverified: arg present whenpredicateTypeis set, omitted when empty