Handle signing and attesting blobs

pkg/chains/storage/oci/attestation.go

@@ -61,7 +61,10 @@ func (s *AttestationStorer) Store(ctx context.Context, req *api.StoreRequest[nam
 		repo = *s.repo
 	}
 	se, err := ociremote.SignedEntity(req.Artifact, ociremote.WithRemoteOptions(s.remoteOpts...))
-	if err != nil {
+	var entityNotFoundError *ociremote.EntityNotFoundError
+	if errors.As(err, &entityNotFoundError) {
+		se = ociremote.SignedUnknown(req.Artifact)
+	} else if err != nil {
 		return nil, errors.Wrap(err, "getting signed image")
 	}
 

pkg/chains/storage/oci/attestation_test.go

@@ -0,0 +1,111 @@
+// Copyright 2025 The Tekton Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package oci
+
+import (
+	"fmt"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/google/go-containerregistry/pkg/name"
+	"github.com/google/go-containerregistry/pkg/registry"
+	"github.com/google/go-containerregistry/pkg/v1/random"
+	"github.com/google/go-containerregistry/pkg/v1/remote"
+	"github.com/google/go-containerregistry/pkg/v1/types"
+	intoto "github.com/in-toto/attestation/go/v1"
+	"github.com/tektoncd/chains/pkg/chains/signing"
+	"github.com/tektoncd/chains/pkg/chains/storage/api"
+	logtesting "knative.dev/pkg/logging/testing"
+)
+
+func TestAttestationStorer_Store(t *testing.T) {
+	tests := []struct {
+		name            string
+		writeToRegistry func(*testing.T, string) name.Digest
+		wantErr         error
+	}{
+		{
+			name: "image manifest",
+			writeToRegistry: func(t *testing.T, registryName string) name.Digest {
+				t.Helper()
+				img, err := random.Image(1024, 2)
+				if err != nil {
+					t.Fatalf("failed to create random image: %s", err)
+				}
+				imgDigest, err := img.Digest()
+				if err != nil {
+					t.Fatalf("failed to get image digest: %v", err)
+				}
+				ref, err := name.NewDigest(fmt.Sprintf("%s/test/img@%s", registryName, imgDigest))
+				if err != nil {
+					t.Fatalf("failed to parse digest: %v", err)
+				}
+				if err := remote.Write(ref, img); err != nil {
+					t.Fatalf("failed to write image to mock registry: %v", err)
+				}
+				return ref
+			},
+		},
+		{
+			name: "image layer",
+			writeToRegistry: func(t *testing.T, registryName string) name.Digest {
+				t.Helper()
+				layer, err := random.Layer(1024, types.OCILayer)
+				if err != nil {
+					t.Fatalf("failed to create random layer: %v", err)
+				}
+				layerDigest, err := layer.Digest()
+				if err != nil {
+					t.Fatalf("failed to get layer digest: %v", err)
+				}
+				ref, err := name.NewDigest(fmt.Sprintf("%s/test/img@%s", registryName, layerDigest))
+				if err != nil {
+					t.Fatalf("failed to parse digest: %v", err)
+				}
+				if err := remote.WriteLayer(ref.Repository, layer); err != nil {
+					t.Fatalf("failed to write layer to mock registry: %v", err)
+				}
+				return ref
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			s := httptest.NewServer(registry.New())
+			defer s.Close()
+			registryName := strings.TrimPrefix(s.URL, "http://")
+
+			ref := tt.writeToRegistry(t, registryName)
+
+			storer, err := NewAttestationStorer(WithTargetRepository(ref.Repository))
+			if err != nil {
+				t.Fatalf("failed to create storer: %v", err)
+			}
+
+			ctx := logtesting.TestContextWithLogger(t)
+			_, err = storer.Store(ctx, &api.StoreRequest[name.Digest, *intoto.Statement]{
+				Artifact: ref,
+				Payload:  &intoto.Statement{},
+				Bundle:   &signing.Bundle{},
+			})
+
+			if err != nil {
+				t.Fatalf("error during Store(): %s", err)
+			}
+		})
+	}
+}

pkg/chains/storage/oci/simple.go

@@ -57,7 +57,10 @@ func (s *SimpleStorer) Store(ctx context.Context, req *api.StoreRequest[name.Dig
 	logger.Info("Uploading signature")
 
 	se, err := ociremote.SignedEntity(req.Artifact, ociremote.WithRemoteOptions(s.remoteOpts...))
-	if err != nil {
+	var entityNotFoundError *ociremote.EntityNotFoundError
+	if errors.As(err, &entityNotFoundError) {
+		se = ociremote.SignedUnknown(req.Artifact)
+	} else if err != nil {
 		return nil, errors.Wrap(err, "getting signed image")
 	}
 

pkg/chains/storage/oci/simple_test.go

@@ -0,0 +1,110 @@
+// Copyright 2025 The Tekton Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package oci
+
+import (
+	"fmt"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/google/go-containerregistry/pkg/name"
+	"github.com/google/go-containerregistry/pkg/registry"
+	"github.com/google/go-containerregistry/pkg/v1/random"
+	"github.com/google/go-containerregistry/pkg/v1/remote"
+	"github.com/google/go-containerregistry/pkg/v1/types"
+	"github.com/tektoncd/chains/pkg/chains/formats/simple"
+	"github.com/tektoncd/chains/pkg/chains/signing"
+	"github.com/tektoncd/chains/pkg/chains/storage/api"
+	logtesting "knative.dev/pkg/logging/testing"
+)
+
+func TestSimpleStorer_Store(t *testing.T) {
+	tests := []struct {
+		name            string
+		writeToRegistry func(*testing.T, string) name.Digest
+	}{
+		{
+			name: "image manifest",
+			writeToRegistry: func(t *testing.T, registryName string) name.Digest {
+				t.Helper()
+				img, err := random.Image(1024, 2)
+				if err != nil {
+					t.Fatalf("failed to create random image: %s", err)
+				}
+				imgDigest, err := img.Digest()
+				if err != nil {
+					t.Fatalf("failed to get image digest: %v", err)
+				}
+				ref, err := name.NewDigest(fmt.Sprintf("%s/test/img@%s", registryName, imgDigest))
+				if err != nil {
+					t.Fatalf("failed to parse digest: %v", err)
+				}
+				if err := remote.Write(ref, img); err != nil {
+					t.Fatalf("failed to write image to mock registry: %v", err)
+				}
+				return ref
+			},
+		},
+		{
+			name: "image layer",
+			writeToRegistry: func(t *testing.T, registryName string) name.Digest {
+				t.Helper()
+				layer, err := random.Layer(1024, types.OCILayer)
+				if err != nil {
+					t.Fatalf("failed to create random layer: %s", err)
+				}
+				layerDigest, err := layer.Digest()
+				if err != nil {
+					t.Fatalf("failed to get layer digest: %v", err)
+				}
+				ref, err := name.NewDigest(fmt.Sprintf("%s/test/img@%s", registryName, layerDigest))
+				if err != nil {
+					t.Fatalf("failed to parse digest: %v", err)
+				}
+				if err := remote.WriteLayer(ref.Repository, layer); err != nil {
+					t.Fatalf("failed to write layer to mock registry: %v", err)
+				}
+				return ref
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			s := httptest.NewServer(registry.New())
+			defer s.Close()
+			registryName := strings.TrimPrefix(s.URL, "http://")
+
+			ref := tt.writeToRegistry(t, registryName)
+
+			storer, err := NewSimpleStorerFromConfig(WithTargetRepository(ref.Repository))
+			if err != nil {
+				t.Fatalf("failed to create storer: %v", err)
+			}
+
+			ctx := logtesting.TestContextWithLogger(t)
+			_, err = storer.Store(ctx, &api.StoreRequest[name.Digest, simple.SimpleContainerImage]{
+				Artifact: ref,
+				Payload:  simple.NewSimpleStruct(ref),
+				Bundle:   &signing.Bundle{},
+			})
+
+			if err != nil {
+				t.Fatalf("error during Store(): %s", err)
+			}
+		})
+	}
+}