fix validation for proposed vs committed log entries for intoto v0.0.1

[bobcallaway]

PTAL; I prefer this fix over #1294 because it more explicitly expresses the validation logic that was originally intended in the JSON schema.

I'd also like to handle any fixes for other intoto versions in separate PRs where possible.

Signed-off-by: Bob Callaway bcallaway@google.com

[haydentherapper]

Good with me! Just need to handle 0.0.2 in another PR

[codecov-commenter]

Codecov Report

Merging #1309 (4144c6d) into main (87170af) will decrease coverage by 0.06%.
The diff coverage is 13.04%.

📣 This organization is not using Codecov’s GitHub App Integration. We recommend you install it so Codecov can continue to function properly for your repositories. Learn more

@@            Coverage Diff             @@
##             main    #1309      +/-   ##
==========================================
- Coverage   63.13%   63.08%   -0.06%     
==========================================
  Files          82       82              
  Lines        7854     7883      +29     
==========================================
+ Hits         4959     4973      +14     
- Misses       2262     2272      +10     
- Partials      633      638       +5     

Flag	Coverage Δ
e2etests	46.61% <0.00%> (-0.06%)	⬇️
unittests	42.79% <13.04%> (+0.02%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
pkg/types/intoto/v0.0.1/entry.go	65.44% <13.04%> (-5.35%)	⬇️
pkg/types/rekord/v0.0.1/entry.go	66.97% <0.00%> (-0.63%)	⬇️
pkg/types/helm/v0.0.1/entry.go	49.18% <0.00%> (ø)
pkg/client/rekor_client.go	91.17% <0.00%> (+1.17%)	⬆️
pkg/types/alpine/v0.0.1/entry.go	72.90% <0.00%> (+1.19%)	⬆️
pkg/pki/ssh/ssh.go	59.37% <0.00%> (+8.52%)	⬆️

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

[bobcallaway]

verified that upload and get worked for intoto v0.0.1 for cosign v1.12.0, v1.12.1, v1.13.0, v1.13.1, and 2.0.0-rc1 flows.

#!/bin/sh

for cs in `ls cosign-*`; do 
	# genuuid
	uuid=$(uuidgen)
	# tag ttl.sh/uuid
	docker tag hello-world ttl.sh/$uuid
	# push ttl.sh
	docker push ttl.sh/$uuid
	COSIGN_EXPERIMENTAL=1 ./$cs attest -y --predicate intoto_dsse.json --type custom --rekor-url http://localhost:3000 ttl.sh/$uuid
done