Add attestations show view
What does this MR do and why?
Adds the show page for attestations, where we render the metadata for an attestation derived from its file. This is developed under the slsa_provenance_statement feature flag.
Changes include:
- Creating the show page. This renders the attestation metadata and a link to download the attestation file.
- Each attestation in the attestations table (
/-/attestations) link to their own show page. - Because we need to parse the attestation file to get the metadata, I added
spec/fixtures/supply_chain/parseable_attestation.jsonso we can test that we're parsing the file correctly.
References
Resolves Create Attestations Show View (#566595)
Screenshots or screen recordings
How to set up and validate locally
- Enable the
slsa_provenance_statementfeature flag. - Make sure to use a project that has run at least one pipeline, since an attestation needs to have an associated CI build. If your project doesn't have a pipeline or a CI config, make sure you have gilab-runner running, then go to Secure > Pipeline editor to create/update your
.gitlab-ci.ymlfile. This will automatically run a pipeline for you. - Create a list of attestations with the rails console for your project.
project = Project.find_by_full_path('project-path')
build = project.builds.last
data = URI("https://gitlab.com/gitlab-org/software-supply-chain-security/tools/sigstore-local/-/raw/main/sample.sigstore.json").read
25.times do |i|
temp_file = Tempfile.new("sample_#{i + 1}.sigstore.json")
temp_file.write(data)
temp_file.rewind
attestation = SupplyChain::Attestation.create!(
project: build.project,
build_id: build.id,
status: ['success', 'error'].sample,
predicate_kind: "provenance",
predicate_type: "https://slsa.dev/provenance/v1",
subject_digest: SecureRandom.hex(32),
file: temp_file
)
end
- Go to
/<path-to-project>/-/attestationsto view the attestation list page. Verify that individual attestations now link to their details page. - View
/<path-to-project>/-/attestations/<attestation.iid>to view an attestation.
MR acceptance checklist
Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.
Edited by Mireya Andres





