Add sigstore bundle verification

evidence/get/testutils.go

@@ -14,4 +14,4 @@ func ReadTestDataFile(filename string) (string, error) {
 		return "", fmt.Errorf("failed to read test data file %s: %w", filename, err)
 	}
 	return string(data), nil
-} 
+}

evidence/model/verify.go

@@ -1,8 +1,12 @@
 package model
 
-import "github.com/jfrog/jfrog-cli-artifactory/evidence/dsse"
+import (
+	"github.com/jfrog/jfrog-cli-artifactory/evidence/dsse"
+	"github.com/sigstore/sigstore-go/pkg/bundle"
+	"github.com/sigstore/sigstore-go/pkg/verify"
+)
 
-const SchemaVersion = "1.0"
+const SchemaVersion = "1.1"
 
 type VerificationResponse struct {
 	// Update the schemaVersion value when this structure is updated.
@@ -18,20 +22,25 @@ type Subject struct {
 }
 
 type EvidenceVerification struct {
-	DsseEnvelope       dsse.Envelope              `json:"dsseEnvelope"`
+	MediaType          MediaType                  `json:"mediaType"`
 	DownloadPath       string                     `json:"downloadPath"`
 	SubjectChecksum    string                     `json:"evidenceSubjectSha256"`
 	PredicateType      string                     `json:"predicateType"`
 	CreatedBy          string                     `json:"createdBy"`
 	CreatedAt          string                     `json:"createdAt"`
 	VerificationResult EvidenceVerificationResult `json:"verificationResult"`
+	DsseEnvelope       *dsse.Envelope             `json:"dsseEnvelope,omitempty"`
+	SigstoreBundle     *bundle.Bundle             `json:"sigstoreBundle,omitempty"`
 }
 
 type EvidenceVerificationResult struct {
-	Sha256VerificationStatus     VerificationStatus `json:"sha256VerificationStatus"`
-	SignaturesVerificationStatus VerificationStatus `json:"signaturesVerificationStatus"`
-	KeySource                    string             `json:"keySource,omitempty"`
-	KeyFingerprint               string             `json:"keyFingerprint,omitempty"`
+	Sha256VerificationStatus         VerificationStatus         `json:"sha256VerificationStatus,omitempty"`
+	SignaturesVerificationStatus     VerificationStatus         `json:"signaturesVerificationStatus,omitempty"`
+	SigstoreBundleVerificationStatus VerificationStatus         `json:"sigstoreBundleVerificationStatus,omitempty"`
+	KeySource                        string                     `json:"keySource,omitempty"`
+	KeyFingerprint                   string                     `json:"keyFingerprint,omitempty"`
+	SigstoreBundleVerificationResult *verify.VerificationResult `json:"sigstoreBundleVerificationResult,omitempty"`
+	FailureReason                    string                     `json:"failureReason,omitempty"`
 }
 
 type VerificationStatus string
@@ -40,3 +49,10 @@ const (
 	Success = "success"
 	Failed  = "failed"
 )
+
+type MediaType string
+
+const (
+	SigstoreBundle MediaType = "sigstore.bundle"
+	SimpleDSSE     MediaType = "evidence.dsse"
+)