Merge branch 'main' into feat/grpc-configurable-size-limit

Signed-off-by: Jordan McClintock <jordan@defenseunicorns.com>

Author: corang

.chainloop.yml

@@ -1,6 +1,6 @@
 # This indicates the [current version]+next
 # to indicate that we are building a new version of the project
-projectVersion: v1.93.2+next
+projectVersion: v1.93.3+next
 
 # Experimental feature used by Chainloop labs shared workflow https://github.com/chainloop-dev/labs
 # It maps the material names with location in disk so they get automatically attested

app/cli/cmd/errors.go

@@ -63,7 +63,6 @@ func isRetriableAPIError(err error) bool {
 	retriableCodes := []codes.Code{
 		codes.Unavailable,
 		codes.Internal,
-		codes.ResourceExhausted,
 		codes.DeadlineExceeded,
 	}
 

app/cli/pkg/action/attestation_push.go

@@ -25,7 +25,6 @@ import (
 	"time"
 
 	pb "github.com/chainloop-dev/chainloop/app/controlplane/api/controlplane/v1"
-	"github.com/chainloop-dev/chainloop/pkg/attestation"
 	"github.com/chainloop-dev/chainloop/pkg/attestation/crafter"
 	v1 "github.com/chainloop-dev/chainloop/pkg/attestation/crafter/api/attestation/v1"
 	"github.com/chainloop-dev/chainloop/pkg/attestation/renderer"
@@ -263,7 +262,7 @@ func (action *AttestationPush) Run(ctx context.Context, attestationID string, ru
 
 	workflow := crafter.CraftingState.Attestation.GetWorkflow()
 
-	attestationResult.Digest, err = pushToControlPlane(ctx, action.CPConnection, envelope, bundle, workflow.GetWorkflowRunId(), workflow.GetVersion().GetMarkAsReleased())
+	attestationResult.Digest, err = pushToControlPlane(ctx, action.CPConnection, bundle, workflow.GetWorkflowRunId(), workflow.GetVersion().GetMarkAsReleased())
 	if err != nil {
 		return nil, fmt.Errorf("pushing to control plane: %w", err)
 	}
@@ -303,32 +302,15 @@ func (action *AttestationPush) saveBundle(bundle *protobundle.Bundle) error {
 	return nil
 }
 
-func pushToControlPlane(ctx context.Context, conn *grpc.ClientConn, envelope *dsse.Envelope, bundle *protobundle.Bundle, workflowRunID string, markVersionAsReleased bool) (string, error) {
+func pushToControlPlane(ctx context.Context, conn *grpc.ClientConn, bundle *protobundle.Bundle, workflowRunID string, markVersionAsReleased bool) (string, error) {
 	encodedBundle, err := encodeBundle(bundle)
 	if err != nil {
 		return "", fmt.Errorf("encoding attestation: %w", err)
 	}
 
 	client := pb.NewAttestationServiceClient(conn)
-
-	// if endpoint doesn't accept the bundle, we still send the plain attestation for backwards compatibility
-	encodedAttestation, err := encodeEnvelope(envelope)
-	if err != nil {
-		return "", fmt.Errorf("encoding attestation: %w", err)
-	}
-
-	// remove additional base64 encoding in signature. See https://github.com/chainloop-dev/chainloop/issues/1832
-	attestation.FixSignatureInBundle(bundle)
-	encodedFixedBundle, err := encodeBundle(bundle)
-	if err != nil {
-		return "", fmt.Errorf("encoding attestation: %w", err)
-	}
-
-	// Store bundle next versions will perform this in a single call)
 	resp, err := client.Store(ctx, &pb.AttestationServiceStoreRequest{
-		Attestation:           encodedAttestation,
-		Bundle:                encodedBundle,
-		AttestationBundle:     encodedFixedBundle,
+		AttestationBundle:     encodedBundle,
 		WorkflowRunId:         workflowRunID,
 		MarkVersionAsReleased: &markVersionAsReleased,
 	})
@@ -339,10 +321,6 @@ func pushToControlPlane(ctx context.Context, conn *grpc.ClientConn, envelope *ds
 	return resp.Result.Digest, nil
 }
 
-func encodeEnvelope(e *dsse.Envelope) ([]byte, error) {
-	return json.Marshal(e)
-}
-
 func encodeBundle(b *protobundle.Bundle) ([]byte, error) {
 	return protojson.Marshal(b)
 }

app/controlplane/api/controlplane/v1/workflow_run.pb.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2024-2025 The Chainloop Authors.
+// Copyright 2024-2026 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -157,16 +157,15 @@ message AttestationServiceInitResponse {
 }
 
 message AttestationServiceStoreRequest {
-  // encoded DSEE envelope
-  bytes attestation = 1 [deprecated = true];
-  // deprecated because of https://github.com/chainloop-dev/chainloop/issues/1832
-  bytes bundle = 4 [deprecated = true];
   // encoded Sigstore attestation bundle
   bytes attestation_bundle = 5;
 
   string workflow_run_id = 2 [(buf.validate.field).string = {min_len: 1}];
   // mark the associated version as released
   optional bool mark_version_as_released = 3;
+
+  reserved 1, 4;
+  reserved "attestation", "bundle";
 }
 
 message AttestationServiceStoreResponse {

app/controlplane/api/controlplane/v1/workflow_run.proto

@@ -146,7 +146,12 @@ func main() {
 
 	app, cleanup, err := wireApp(ctx, &bc, credsWriter, logger, availablePlugins)
 	if err != nil {
-		panic(err)
+		_ = logger.Log(log.LevelError, "msg", "failed to initialize control plane", "error", err.Error())
+		// Invoke critical deferred cleanups explicitly since os.Exit skips defers.
+		cancel()
+		availablePlugins.Cleanup()
+		flush()
+		os.Exit(1) //nolint:gocritic // deferred cleanups called explicitly above
 	}
 	defer cleanup()