Skip to content

feat: add material size annotation to attestations #2850

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
migmartri merged 1 commit into from
Mar 14, 2026
Merged

feat: add material size annotation to attestations #2850

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion pkg/attestation/crafter/materials/artifact_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
//
// Copyright 2023-2025 The Chainloop Authors.
// Copyright 2023-2026 The Chainloop Authors.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
Expand Down Expand Up @@ -96,6 +96,9 @@ func TestArtifactCraft(t *testing.T) {
assert.Equal(got.GetArtifact(), &attestationApi.Attestation_Material_Artifact{
Id: "test", Digest: "sha256:54181dfe59340b318253e59f7695f547c5c10d071cb75001170a389061349918", Name: "simple.txt",
})

// The result includes the size annotation
assert.Equal("8", got.Annotations[materials.AnnotationMaterialSize])
}

func TestArtifactCraftInline(t *testing.T) {
Expand Down Expand Up @@ -153,4 +156,6 @@ func assertMaterial(t *testing.T, got *attestationApi.Attestation_Material) {
// Inline content
Content: []byte("txt file"),
})
// The result includes the size annotation
assert.Equal("8", got.Annotations[materials.AnnotationMaterialSize])
}
21 changes: 14 additions & 7 deletions pkg/attestation/crafter/materials/evidence_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
//
// Copyright 2024-2025 The Chainloop Authors.
// Copyright 2024-2026 The Chainloop Authors.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
Expand Down Expand Up @@ -171,13 +171,15 @@ func TestEvidenceCraftWithJSONAnnotations(t *testing.T) {
expectedAnnotations: map[string]string{
"chainloop.material.evidence.id": "custom-evidence-123",
"chainloop.material.evidence.schema": "https://example.com/schema/v1",
materials.AnnotationMaterialSize: "297",
},
},
{
name: "JSON with id and data but no schema field extracts only id",
filePath: "./testdata/evidence-with-id-data-no-schema.json",
expectedAnnotations: map[string]string{
"chainloop.material.evidence.id": "custom-evidence-456",
materials.AnnotationMaterialSize: "158",
},
},
{
Expand All @@ -186,17 +188,22 @@ func TestEvidenceCraftWithJSONAnnotations(t *testing.T) {
expectedAnnotations: map[string]string{
"chainloop.material.evidence.id": "custom-evidence-123",
"chainloop.material.evidence.schema": "https://example.com/schema/v1",
materials.AnnotationMaterialSize: "325",
},
},
{
name: "JSON without required structure does not extract annotations",
filePath: "./testdata/evidence-invalid-structure.json",
expectedAnnotations: nil,
name: "JSON without required structure does not extract annotations",
filePath: "./testdata/evidence-invalid-structure.json",
expectedAnnotations: map[string]string{
materials.AnnotationMaterialSize: "90",
},
},
{
name: "Non-JSON file does not extract annotations",
filePath: "./testdata/simple.txt",
expectedAnnotations: nil,
name: "Non-JSON file does not extract annotations",
filePath: "./testdata/simple.txt",
expectedAnnotations: map[string]string{
materials.AnnotationMaterialSize: "8",
},
},
}

Expand Down
8 changes: 7 additions & 1 deletion pkg/attestation/crafter/materials/materials.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
//
// Copyright 2024-2025 The Chainloop Authors.
// Copyright 2024-2026 The Chainloop Authors.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
Expand All @@ -22,6 +22,7 @@ import (
"fmt"
"io"
"os"
"strconv"
"time"

"buf.build/go/protovalidate"
Expand All @@ -39,6 +40,7 @@ const (
AnnotationToolNameKey = "chainloop.material.tool.name"
AnnotationToolVersionKey = "chainloop.material.tool.version"
AnnotationToolsKey = "chainloop.material.tools"
AnnotationMaterialSize = "chainloop.material.size"
)

// IsLegacyAnnotation returns true if the annotation key is a legacy annotation
Expand Down Expand Up @@ -165,6 +167,10 @@ func uploadAndCraft(ctx context.Context, input *schemaapi.CraftingSchema_Materia
material.GetArtifact().Content = content
}

material.Annotations = map[string]string{

@cubic-dev-ai cubic-dev-ai Bot Mar 14, 2026 •
edited
Loading

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: This size annotation is dropped for file-based crafters that reinitialize m.Annotations after uploadAndCraft, so SPDX/SARIF/CSAF materials will not emit chainloop.material.size.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At pkg/attestation/crafter/materials/materials.go, line 170:

<comment>This size annotation is dropped for file-based crafters that reinitialize `m.Annotations` after `uploadAndCraft`, so SPDX/SARIF/CSAF materials will not emit `chainloop.material.size`.</comment>

<file context>
@@ -165,6 +167,10 @@ func uploadAndCraft(ctx context.Context, input *schemaapi.CraftingSchema_Materia
 		material.GetArtifact().Content = content
 	}
 
+	material.Annotations = map[string]string{
+		AnnotationMaterialSize: strconv.FormatInt(result.size, 10),
+	}
</file context>
Fix with Cubic

AnnotationMaterialSize: strconv.FormatInt(result.size, 10),
}

return material, nil
}

Expand Down
4 changes: 2 additions & 2 deletions pkg/attestation/crafter/materials/materials_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
//
// Copyright 2023 The Chainloop Authors.
// Copyright 2023-2026 The Chainloop Authors.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
Expand Down Expand Up @@ -51,5 +51,5 @@ func TestCraft(t *testing.T) {
// Timestamp
assert.WithinDuration(time.Now(), got.AddedAt.AsTime(), 5*time.Second)
// Annotations
assert.Equal(map[string]string{"test": "test"}, got.Annotations)
assert.Equal(map[string]string{"test": "test", "chainloop.material.size": "10"}, got.Annotations)
}
6 changes: 5 additions & 1 deletion pkg/attestation/crafter/materials/string.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
//
// Copyright 2023 The Chainloop Authors.
// Copyright 2023-2026 The Chainloop Authors.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
Expand All @@ -18,6 +18,7 @@ package materials
import (
"context"
"fmt"
"strconv"
"strings"

schemaapi "github.com/chainloop-dev/chainloop/app/controlplane/api/workflowcontract/v1"
Expand Down Expand Up @@ -53,5 +54,8 @@ func (i *StringCrafter) Craft(_ context.Context, value string) (*api.Attestation
Value: value, Digest: hash.String(),
},
},
Annotations: map[string]string{
AnnotationMaterialSize: strconv.Itoa(len(value)),
},
}, nil
}
Loading