Verify layout for example pdo client container build pipeline

Signed-off-by: Marcela Melara <[email protected]>

.gitignore

@@ -1,3 +1,4 @@
 scai-venv
 __pycache__
 *~
+*.pem

examples/hermetic-evidence/metadata/attestations/build.1f575092.json

@@ -0,0 +1 @@
+{"payloadType":"application/vnd.in-toto+json","payload":"eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoicGRvX2NsaWVudF93YXdha2EiLCJkaWdlc3QiOnsic2hhMjU2IjoiOWZiN2VmNTUyMjk4ZjhmYmFkODQ2MDRkMDYxMDBlNzYwYjdiOGM0Y2I0ZDZjNGI3Mjc4NjVmMWYyODVkMDZhYyJ9fV0sInByZWRpY2F0ZVR5cGUiOiJodHRwczovL2luLXRvdG8uaW8vYXR0ZXN0YXRpb24vc2NhaS9hdHRyaWJ1dGUtcmVwb3J0L3YwLjIiLCJwcmVkaWNhdGUiOnsiYXR0cmlidXRlcyI6W3siYXR0cmlidXRlIjoiSXNIZXJtZXRpY0J1aWxkIiwiZXZpZGVuY2UiOnsiYW5ub3RhdGlvbnMiOnsiZXhwZWN0ZWRSZXN1bHQiOiJmYWlsIn0sImRpZ2VzdCI6eyJzaGEyNTYiOiJjMzZlOTY2OWJlNzkyMmZlZDBlYzRmMGU0NTQzZTcwMWRhMDhiY2NhZDAzZGQwNDIzZDM4ZTQ4NmZlZGM4M2QzIn0sImRvd25sb2FkTG9jYXRpb24iOiJodHRwczovL2dpdGh1Yi5jb20vbWFyY2VsYW1lbGFyYS9wcml2YXRlLWRhdGEtb2JqZWN0cy9zdWl0ZXMvMTU0MTc3MjYxNDIvYXJ0aWZhY3RzLzg4MDQwMzM5OCIsIm1lZGlhVHlwZSI6InRleHQvcGxhaW4iLCJuYW1lIjoic3RyYWNlLmxvZyJ9LCJ0YXJnZXQiOnsiZGlnZXN0Ijp7InNoYTI1NiI6Ijk0ZDE4NzE2ZWU0NDEyMTc1YzVkOWRhMWNlNTA5NDcxNTNlMDljNDc2MmY5MDQ0YWY2ZjJkNjgyOGIxMmZlNWIifSwiZG93bmxvYWRMb2NhdGlvbiI6Imh0dHBzOi8vZ2l0aHViLmNvbS9tYXJjZWxhbWVsYXJhL3ByaXZhdGUtZGF0YS1vYmplY3RzL3N1aXRlcy8xNTQxNzcyNjE0Mi9hcnRpZmFjdHMvODgwNDAzMzkyL3Bkb19jbGllbnRfd2F3YWthLnNsc2EuaW50b3RvLmpzb25sIiwibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmluLXRvdG8rZHNzZSIsIm5hbWUiOiJidWlsZC40NTJlNjI4YS5qc29uIn19XX19","signatures":[{"keyid":"1f57509240de3e7921e29a896553e7cf912441e17fe8cbd675457c7ba45bcee6","sig":"LH8wuhKTQNj3weL9UdF6SqqQy7TWhm+Jg8kcd+KVkjVk6+y6/xwob1sgvsJ+ZpIbM07zDKHd9W6Qvon0oEhx9mEeBwW90DIJexWdd4MpkcU7qCnU0DhBKGPdc6tjCBz3RGIRbpIgi5LgC/TR+ihuoFSPT07/inaRLcfIf5F1D/FV+rbi80bnAHE9OzsVX8o0UrHDoQmdukytcagy9YWnOh0hwDG0mMxoHd3xM3R8/03DP7iZMJHmv8SRQQdUFFaUGyskzari5D4jPFRI4eQByOn20bd8TsOqH06uSd4jEda/IZa8eZwisZctEFssQfRBfpFOB7T71E9kQeYUaMlunsjvKXOfbP8ixFjJSLYXO09c6KMsrO9yuxv2whewIKwpYX/EiJFwyztxVYh0JfT9CjI+z8VUhJ+Eh0DmgRX+jG9liX0DKXQNDtZmFHo8tTdmflcuT1FLchm4IAPB467xl9tGxycBzEL5ac9r9ZCKcbx8lxpOxBIFpH1G2g+d143L"}]}

examples/hermetic-evidence/metadata/hermetic-build.scai.json

@@ -1,38 +1 @@
-{
-    "_type": "https://in-toto.io/Statement/v1",
-    "subject": [
-        {
-            "name": "pdo_client_wawaka",
-            "digest": {
-                "sha256": "9b151e8b47a372bb686a441349d981ebf38951d70c4e7bf4669672651da7d33e"
-            }
-        }
-    ],
-    "predicateType": "https://in-toto.io/attestation/scai/attribute-report/v0.2",
-    "predicate": {
-        "attributes": [
-            {
-                "target": {
-                    "mediaType": "application/vnd.in-toto.provenance+json",
-                    "digest": {
-                        "sha256": "d094023e47dadedb5591d70bf203b967daa1e0784b29135053e410e6627ab261"
-                    },
-                    "downloadLocation": "https://github.com/marcelamelara/private-data-objects/suites/15001861846/artifacts/856214822",
-                    "name": "pdo_client_wawaka.provenance.json"
-                },
-                "evidence": {
-                    "mediaType": "text/plain",
-                    "digest": {
-                        "sha256": "1fbd9b1a3b867657666edf7ac1f17a3cad6ff691364ab46848ca5f49720688a8"
-                    },
-                    "annotations": {
-                        "expectedResult": "fail"
-                    },
-                    "downloadLocation": "https://github.com/marcelamelara/private-data-objects/suites/15001861846/artifacts/856214824",
-                    "name": "strace.log"
-                },
-                "attribute": "IsHermeticBuild"
-            }
-        ]
-    }
-}
+{"_type":"https://in-toto.io/Statement/v1","subject":[{"name":"pdo_client_wawaka","digest":{"sha256":"9fb7ef552298f8fbad84604d06100e760b7b8c4cb4d6c4b727865f1f285d06ac"}}],"predicateType":"https://in-toto.io/attestation/scai/attribute-report/v0.2","predicate":{"attributes":[{"attribute":"IsHermeticBuild","evidence":{"annotations":{"expectedResult":"fail"},"digest":{"sha256":"c36e9669be7922fed0ec4f0e4543e701da08bccad03dd0423d38e486fedc83d3"},"downloadLocation":"https://github.com/marcelamelara/private-data-objects/suites/15417726142/artifacts/880403398","mediaType":"text/plain","name":"strace.log"},"target":{"digest":{"sha256":"94d18716ee4412175c5d9da1ce50947153e09c4762f9044af6f2d6828b12fe5b"},"downloadLocation":"https://github.com/marcelamelara/private-data-objects/suites/15417726142/artifacts/880403392/pdo_client_wawaka.slsa.intoto.jsonl","mediaType":"application/vnd.in-toto+dsse","name":"build.452e628a.json"}}]}}

examples/hermetic-evidence/metadata/is-hermetic-assertion.json

@@ -1,22 +1 @@
-{
-    "attribute": "IsHermeticBuild",
-    "target": {
-        "name": "pdo_client_wawaka.provenance.json",
-        "digest": {
-            "sha256": "d094023e47dadedb5591d70bf203b967daa1e0784b29135053e410e6627ab261"
-        },
-        "downloadLocation": "https://github.com/marcelamelara/private-data-objects/suites/15001861846/artifacts/856214822",
-        "mediaType": "application/vnd.in-toto.provenance+json"
-    },
-    "evidence": {
-        "name": "strace.log",
-        "digest": {
-            "sha256": "1fbd9b1a3b867657666edf7ac1f17a3cad6ff691364ab46848ca5f49720688a8"
-        },
-        "downloadLocation": "https://github.com/marcelamelara/private-data-objects/suites/15001861846/artifacts/856214824",
-        "mediaType": "text/plain",
-        "annotations": {
-            "expectedResult": "fail"
-        }
-    }
-}
+{"attribute":"IsHermeticBuild","target":{"name":"build.452e628a.json","digest":{"sha256":"94d18716ee4412175c5d9da1ce50947153e09c4762f9044af6f2d6828b12fe5b"},"downloadLocation":"https://github.com/marcelamelara/private-data-objects/suites/15417726142/artifacts/880403392/pdo_client_wawaka.slsa.intoto.jsonl","mediaType":"application/vnd.in-toto+dsse"},"evidence":{"name":"strace.log","digest":{"sha256":"c36e9669be7922fed0ec4f0e4543e701da08bccad03dd0423d38e486fedc83d3"},"downloadLocation":"https://github.com/marcelamelara/private-data-objects/suites/15417726142/artifacts/880403398","mediaType":"text/plain","annotations":{"expectedResult":"fail"}}}