Prepare API example

Author: selalererjfrog

.github/workflows/prepare_api_example.yml

@@ -0,0 +1,87 @@
+name: "Preare docker evidence with prepare API example"
+
+on:
+  workflow_dispatch:
+
+permissions:
+  id-token: write
+  contents: read
+  actions: read
+
+jobs:
+  prepare-docker-evidence-example:
+    runs-on: ubuntu-latest
+    env:
+      DOCKER_REPO: 'test-docker-local'
+      IMAGE_NAME: 'my-very-cool-image'
+      IMAGE_TAG: '40'
+    steps:
+      - name: Call the prepare API
+        run: |
+          DOCKER_REPO=${{ env.DOCKER_REPO }}
+          IMAGE_NAME=${{ env.IMAGE_NAME }}
+          IMAGE_TAG=${{ env.IMAGE_TAG }}
+          [ "$DOCKER_REPO" == "" ] && echo "Missing env.DOCKER_REPO" && exit 1
+          [ "$IMAGE_NAME" == "" ] && echo "Missing env.IMAGE_NAME" && exit 1
+          [ "$IMAGE_TAG" == "" ] && echo "Missing env.IMAGE_TAG" && exit 1
+          REQUEST=$(cat << EOF
+          {
+            "subject" {
+              "subject_type": "package",
+              "package_repo": "${{ env.DOCKER_REPO }}",
+              "package_name": "${{ env.IMAGE_NAME }}",
+              "package_version": "${{ env.IMAGE_TAG }}"
+            },
+            "predicate": {
+              "statement": "This docker image is great."
+            },
+            "predicate_type": "https://example.com/evidence/statement/v1"
+          }
+          EOF
+          )
+          echo "Request: $REQUEST"
+          URL="${{ vars.ARTIFACTORY_URL }}/evidence/api/v1/evidence/prepare"
+          echo "URL: $URL"
+          [ "${{ secrets.ARTIFACTORY_ACCESS_TOKEN }}" == "" ] && echo "secrets.ARTIFACTORY_ACCESS_TOKEN is empty!" && exit 1
+          curl -X POST -H 'Content-Type: application/json' -H "Authorization: Bearer ${{ secrets.ARTIFACTORY_ACCESS_TOKEN }}" -d "REQUEST" -o response.json "$URL"
+          echo "Response: $(cat response.json)"
+          # Make sure it is valid response
+          cat response.json | grep "dsse_payload"
+      - name: Sign the payload
+        run: |
+          BASE64_PAYLOAD=$(cat response.json | jq .dsse_payload | tr -d '"')
+          echo "Base64 payload: $BASE64_PAYLOAD"
+          PAYLOAD=$(echo -n "$BASE64_PAYLOAD" | base64 -d)
+          echo "Payload: $PAYLOAD"
+          PAYLOAD_TYPE=$(cat response.json | jq .dsse_payload_type | tr -d '"')
+          echo "Payload type: $PAYLOAD_TYPE"
+          PAYLOAD_LEN="${#PAYLOAD}"
+          PAYLOAD_TYPE_LEN="${#PAYLOAD_TYPE}"
+          PRE_AUTH_ENC="DSSEv1 $PAYLOAD_TYPE_LEN $PAYLOAD_TYPE $PAYLOAD_LEN $PAYLOAD"
+          echo "Pre-authentication encoding: $PRE_AUTH_ENC"
+          PAYLOAD_SIGNATURE=$(echo -n "$PRE_AUTH_ENC" | openssl dgst -sha256 -sign "${{ secrets.JIRA_TEST_PKEY }}" | openssl base64 | tr -d '\n')
+          echo "Signature: $PAYLOAD_SIGNATURE"
+          echo -n "$PAYLOAD_SIGNATURE" > signature_file
+      - name: Build the DSSE
+        run: |
+          DSSE=$(cat << EOF
+          {
+            "payloadType": $(cat response.json | jq .dsse_payload_type),
+            "payload": $(cat response.json | jq .dsse_payload),
+            "sinatures": [
+              {
+                "keyid": "${{ vars.JIRA_TEST_KEY }}",
+                "sig": "$(cat signature_file)"
+              }
+            ]
+          }
+          EOF
+          )
+          echo "DSSE: $DSSE"
+          echo -n "$DSSE" > dsse.json
+      - name: Create the evidence
+        run: |
+          POST_URL=$(cat response.json | jq .post_url | tr -d '"')
+          curl -X POST -H 'Content-Type: application/json' -H "Authorization: Bearer ${{ secrets.ARTIFACTORY_ACCESS_TOKEN }}" -d @dsse.json "${{ vars.ARTIFACTORY_URL }}$POST_URL"
+
+