fix: update attestation code to remove library dependencies and shellout for keyless flow (#1442)

Co-authored-by: Alex Goodman <alex.goodman@anchore.com>

syft/event/event.go

@@ -32,6 +32,6 @@ const (
 	// ImportStarted is a partybus event that occurs when an SBOM upload process has begun
 	ImportStarted partybus.EventType = "syft-import-started-event"
 
-	// UploadAttestation is a partybus event that occurs when syft uploads an attestation to an OCI registry (+ any transparency log)
-	UploadAttestation partybus.EventType = "syft-upload-attestation"
+	// AttestationStarted is a partybus event that occurs when starting an SBOM attestation process
+	AttestationStarted partybus.EventType = "syft-attestation-started-event"
 )

syft/event/monitor/generic_task.go

@@ -0,0 +1,23 @@
+package monitor
+
+import (
+	"io"
+
+	"github.com/wagoodman/go-progress"
+)
+
+type ShellProgress struct {
+	io.Reader
+	*progress.Manual
+}
+
+type Title struct {
+	Default      string
+	WhileRunning string
+	OnSuccess    string
+}
+
+type GenericTask struct {
+	Title   Title
+	Context string
+}

syft/event/parsers/parsers.go

@@ -5,11 +5,13 @@ package parsers
 
 import (
 	"fmt"
+	"io"
 
 	"github.com/wagoodman/go-partybus"
 	"github.com/wagoodman/go-progress"
 
 	"github.com/anchore/syft/syft/event"
+	"github.com/anchore/syft/syft/event/monitor"
 	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/pkg/cataloger"
 )
@@ -153,15 +155,20 @@ func ParseImportStarted(e partybus.Event) (string, progress.StagedProgressable,
 	return host, prog, nil
 }
 
-func ParseUploadAttestation(e partybus.Event) (progress.StagedProgressable, error) {
-	if err := checkEventType(e.Type, event.UploadAttestation); err != nil {
-		return nil, err
+func ParseAttestationStartedEvent(e partybus.Event) (io.Reader, progress.Progressable, *monitor.GenericTask, error) {
+	if err := checkEventType(e.Type, event.AttestationStarted); err != nil {
+		return nil, nil, nil, err
 	}
 
-	prog, ok := e.Value.(progress.StagedProgressable)
+	source, ok := e.Source.(monitor.GenericTask)
 	if !ok {
-		return nil, newPayloadErr(e.Type, "Value", e.Value)
+		return nil, nil, nil, newPayloadErr(e.Type, "Source", e.Source)
 	}
 
-	return prog, nil
+	sp, ok := e.Value.(*monitor.ShellProgress)
+	if !ok {
+		return nil, nil, nil, newPayloadErr(e.Type, "Value", e.Value)
+	}
+
+	return sp.Reader, sp.Manual, &source, nil
 }

syft/sbom/multi_writer.go

@@ -99,6 +99,18 @@ func (m *multiWriter) Write(s SBOM) (errs error) {
 	return errs
 }
 
+// Bytes returns the bytes of the SBOM that would be written
+func (m *multiWriter) Bytes(s SBOM) (bytes []byte, err error) {
+	for _, w := range m.writers {
+		b, err := w.Bytes(s)
+		if err != nil {
+			return nil, err
+		}
+		bytes = append(bytes, b...)
+	}
+	return bytes, nil
+}
+
 // Close closes all writers
 func (m *multiWriter) Close() (errs error) {
 	for _, w := range m.writers {

syft/sbom/stream_writer.go

@@ -1,6 +1,7 @@
 package sbom
 
 import (
+	"bytes"
 	"io"
 )
 
@@ -16,6 +17,16 @@ func (w *streamWriter) Write(s SBOM) error {
 	return w.format.Encode(w.out, s)
 }
 
+// Bytes returns the bytes of the SBOM that would be written
+func (w *streamWriter) Bytes(s SBOM) ([]byte, error) {
+	var buffer bytes.Buffer
+	err := w.format.Encode(&buffer, s)
+	if err != nil {
+		return nil, err
+	}
+	return buffer.Bytes(), nil
+}
+
 // Close any resources, such as open files
 func (w *streamWriter) Close() error {
 	if w.close != nil {

syft/sbom/writer.go

@@ -7,6 +7,9 @@ type Writer interface {
 	// Write writes the provided SBOM
 	Write(SBOM) error
 
+	// Bytes returns the bytes of the SBOM that would be written
+	Bytes(SBOM) ([]byte, error)
+
 	// Closer a resource cleanup hook which will be called after SBOM
 	// is written or if an error occurs before Write is called
 	io.Closer