provide support for multiple buildTypes. The initial types are to

support more general slsa verifiers and provide more verbose output for
tekton verifiers. This implementation will default to the slsa
buildType.

pkg/chains/formats/slsa/internal/slsaconfig/slsaconfig.go

@@ -20,4 +20,6 @@ type SlsaConfig struct {
 	BuilderID string
 	// DeepInspectionEnabled configures whether to dive into child taskruns in a pipelinerun
 	DeepInspectionEnabled bool
+	// The buildType for the build definition
+	BuildType string
 }

pkg/chains/formats/slsa/v2alpha2/internal/build_types/build_types.go

@@ -0,0 +1,6 @@
+package buildtypes
+
+const (
+	SlsaBuildType   = "https://tekton.dev/chains/v2/slsa"
+	TektonBuildType = "https://tekton.dev/chains/v2/slsa-tekton"
+)

pkg/chains/formats/slsa/v2alpha2/internal/external_parameters/external_parameters.go

@@ -0,0 +1,44 @@
+package externalparameters
+
+import (
+	"fmt"
+
+	"github.com/tektoncd/chains/pkg/chains/objects"
+	"github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1"
+)
+
+func buildConfigSource(provenance *v1beta1.Provenance) map[string]string {
+	ref := ""
+	for alg, hex := range provenance.RefSource.Digest {
+		ref = fmt.Sprintf("%s:%s", alg, hex)
+		break
+	}
+	buildConfigSource := map[string]string{
+		"ref":        ref,
+		"repository": provenance.RefSource.URI,
+		"path":       provenance.RefSource.EntryPoint,
+	}
+	return buildConfigSource
+}
+
+// PipelineRun adds the pipeline run spec and provenance if available
+func PipelineRun(pro *objects.PipelineRunObject) map[string]any {
+	externalParams := make(map[string]any)
+
+	if provenance := pro.GetRemoteProvenance(); provenance != nil {
+		externalParams["buildConfigSource"] = buildConfigSource(provenance)
+	}
+	externalParams["runSpec"] = pro.Spec
+	return externalParams
+}
+
+// TaskRun adds the task run spec and provenance if available
+func TaskRun(tro *objects.TaskRunObject) map[string]any {
+	externalParams := make(map[string]any)
+
+	if provenance := tro.GetRemoteProvenance(); provenance != nil {
+		externalParams["buildConfigSource"] = buildConfigSource(provenance)
+	}
+	externalParams["runSpec"] = tro.Spec
+	return externalParams
+}

pkg/chains/formats/slsa/v2alpha2/internal/external_parameters/external_parameters_test.go

@@ -0,0 +1,97 @@
+package externalparameters
+
+import (
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/tektoncd/chains/pkg/chains/objects"
+	"github.com/tektoncd/chains/pkg/internal/objectloader"
+	"github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1"
+)
+
+func TestBuildConfigSource(t *testing.T) {
+	provenance := &v1beta1.Provenance{
+		RefSource: &v1beta1.RefSource{
+			Digest:     map[string]string{"alg1": "hex1", "alg2": "hex2"},
+			URI:        "https://tekton.com",
+			EntryPoint: "/path/to/entry",
+		},
+	}
+
+	want := map[string]string{
+		"ref":        "alg1:hex1",
+		"repository": "https://tekton.com",
+		"path":       "/path/to/entry",
+	}
+
+	got := buildConfigSource(provenance)
+
+	if diff := cmp.Diff(want, got); diff != "" {
+		t.Errorf("buildConfigSource(): -want +got: %s", diff)
+	}
+}
+func createPro(path string) *objects.PipelineRunObject {
+	pr, err := objectloader.PipelineRunFromFile(path)
+	if err != nil {
+		panic(err)
+	}
+	tr1, err := objectloader.TaskRunFromFile("../../../testdata/v2alpha2/taskrun1.json")
+	if err != nil {
+		panic(err)
+	}
+	tr2, err := objectloader.TaskRunFromFile("../../../testdata/v2alpha2/taskrun2.json")
+	if err != nil {
+		panic(err)
+	}
+	p := objects.NewPipelineRunObject(pr)
+	p.AppendTaskRun(tr1)
+	p.AppendTaskRun(tr2)
+	return p
+}
+
+func TestPipelineRun(t *testing.T) {
+	pro := createPro("../../../testdata/v2alpha2/pipelinerun1.json")
+
+	got := PipelineRun(pro)
+
+	want := map[string]any{
+		"runSpec": v1beta1.PipelineRunSpec{
+			PipelineRef: &v1beta1.PipelineRef{Name: "test-pipeline"},
+			Params: v1beta1.Params{
+				{
+					Name:  "IMAGE",
+					Value: v1beta1.ParamValue{Type: "string", StringVal: "test.io/test/image"},
+				},
+			},
+			ServiceAccountName: "pipeline",
+		},
+	}
+
+	if diff := cmp.Diff(want, got); diff != "" {
+		t.Errorf("PipelineRun(): -want +got: %s", diff)
+	}
+}
+
+func TestTaskRun(t *testing.T) {
+	tr, err := objectloader.TaskRunFromFile("../../../testdata/v2alpha2/taskrun1.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	got := TaskRun(objects.NewTaskRunObject(tr))
+
+	want := map[string]any{
+		"runSpec": v1beta1.TaskRunSpec{
+			Params: v1beta1.Params{
+				{Name: "IMAGE", Value: v1beta1.ParamValue{Type: "string", StringVal: "test.io/test/image"}},
+				{Name: "CHAINS-GIT_COMMIT", Value: v1beta1.ParamValue{Type: "string", StringVal: "taskrun"}},
+				{Name: "CHAINS-GIT_URL", Value: v1beta1.ParamValue{Type: "string", StringVal: "https://git.test.com"}},
+			},
+			ServiceAccountName: "default",
+			TaskRef:            &v1beta1.TaskRef{Name: "build", Kind: "Task"},
+		},
+	}
+
+	if diff := cmp.Diff(want, got); diff != "" {
+		t.Errorf("TaskRun(): -want +got: %s", diff)
+	}
+}

pkg/chains/formats/slsa/v2alpha2/internal/internal_parameters/internal_parameters.go

@@ -0,0 +1,26 @@
+package internalparameters
+
+import (
+	"github.com/tektoncd/chains/pkg/chains/objects"
+	"github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1"
+)
+
+// SLSAInternalParameters provides the chains config as internalparameters
+func SLSAInternalParameters(tko objects.TektonObject) map[string]any {
+	internalParams := make(map[string]any)
+	if provenance := tko.GetProvenance(); provenance != (*v1beta1.Provenance)(nil) && provenance.FeatureFlags != nil {
+		internalParams["tekton-pipelines-feature-flags"] = *provenance.FeatureFlags
+	}
+	return internalParams
+}
+
+// TektonInternalParameters provides the chains config as well as annotations and labels
+func TektonInternalParameters(tko objects.TektonObject) map[string]any {
+	internalParams := make(map[string]any)
+	if provenance := tko.GetProvenance(); provenance != (*v1beta1.Provenance)(nil) && provenance.FeatureFlags != nil {
+		internalParams["tekton-pipelines-feature-flags"] = *provenance.FeatureFlags
+	}
+	internalParams["labels"] = tko.GetLabels()
+	internalParams["annotations"] = tko.GetAnnotations()
+	return internalParams
+}

pkg/chains/formats/slsa/v2alpha2/internal/internal_parameters/internal_parameters_test.go

@@ -0,0 +1,44 @@
+package internalparameters
+
+import (
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/tektoncd/chains/pkg/chains/objects"
+	"github.com/tektoncd/chains/pkg/internal/objectloader"
+	"github.com/tektoncd/pipeline/pkg/apis/config"
+)
+
+func TestTektonInternalParameters(t *testing.T) {
+	tr, err := objectloader.TaskRunFromFile("../../../testdata/v2alpha2/taskrun1.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	tro := objects.NewTaskRunObject(tr)
+	got := TektonInternalParameters(tro)
+	want := map[string]any{
+		"labels":                         tro.GetLabels(),
+		"annotations":                    tro.GetAnnotations(),
+		"tekton-pipelines-feature-flags": config.FeatureFlags{EnableAPIFields: "beta", ResultExtractionMethod: "termination-message"},
+	}
+
+	if diff := cmp.Diff(want, got); diff != "" {
+		t.Errorf("TaskRun(): -want +got: %s", diff)
+	}
+}
+
+func TestSLSAInternalParameters(t *testing.T) {
+	tr, err := objectloader.TaskRunFromFile("../../../testdata/v2alpha2/taskrun1.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	tro := objects.NewTaskRunObject(tr)
+	got := SLSAInternalParameters(tro)
+	want := map[string]any{
+		"tekton-pipelines-feature-flags": config.FeatureFlags{EnableAPIFields: "beta", ResultExtractionMethod: "termination-message"},
+	}
+
+	if diff := cmp.Diff(want, got); diff != "" {
+		t.Errorf("TaskRun(): -want +got: %s", diff)
+	}
+}

pkg/chains/formats/slsa/v2alpha2/internal/pipelinerun/pipelinerun.go

@@ -22,6 +22,9 @@ import (
 	slsa "github.com/in-toto/in-toto-golang/in_toto/slsa_provenance/v1"
 	"github.com/tektoncd/chains/pkg/chains/formats/slsa/extract"
 	"github.com/tektoncd/chains/pkg/chains/formats/slsa/internal/slsaconfig"
+	buildtypes "github.com/tektoncd/chains/pkg/chains/formats/slsa/v2alpha2/internal/build_types"
+	externalparameters "github.com/tektoncd/chains/pkg/chains/formats/slsa/v2alpha2/internal/external_parameters"
+	internalparameters "github.com/tektoncd/chains/pkg/chains/formats/slsa/v2alpha2/internal/internal_parameters"
 	resolveddependencies "github.com/tektoncd/chains/pkg/chains/formats/slsa/v2alpha2/internal/resolved_dependencies"
 	"github.com/tektoncd/chains/pkg/chains/objects"
 )
@@ -34,27 +37,24 @@ const (
 
 // GenerateAttestation generates a provenance statement with SLSA v1.0 predicate for a pipeline run.
 func GenerateAttestation(ctx context.Context, pro *objects.PipelineRunObject, slsaconfig *slsaconfig.SlsaConfig) (interface{}, error) {
-	rd, err := resolveddependencies.PipelineRun(ctx, pro, slsaconfig)
+	bp, err := byproducts(pro)
 	if err != nil {
 		return nil, err
 	}
-	bp, err := byproducts(pro)
+
+	bd, err := getBuildDefinition(ctx, slsaconfig, pro)
 	if err != nil {
 		return nil, err
 	}
+
 	att := intoto.ProvenanceStatementSLSA1{
 		StatementHeader: intoto.StatementHeader{
 			Type:          intoto.StatementInTotoV01,
 			PredicateType: slsa.PredicateSLSAProvenance,
 			Subject:       extract.SubjectDigests(ctx, pro, slsaconfig),
 		},
 		Predicate: slsa.ProvenancePredicate{
-			BuildDefinition: slsa.ProvenanceBuildDefinition{
-				BuildType:            "https://tekton.dev/chains/v2/slsa",
-				ExternalParameters:   externalParameters(pro),
-				InternalParameters:   internalParameters(pro),
-				ResolvedDependencies: rd,
-			},
+			BuildDefinition: bd,
 			RunDetails: slsa.ProvenanceRunDetails{
 				Builder: slsa.Builder{
 					ID: slsaconfig.BuilderID,
@@ -82,47 +82,6 @@ func metadata(pro *objects.PipelineRunObject) slsa.BuildMetadata {
 	return m
 }
 
-// internalParameters adds the tekton feature flags that were enabled
-// for the pipelinerun.
-func internalParameters(pro *objects.PipelineRunObject) map[string]any {
-	internalParams := make(map[string]any)
-	provenance := pro.GetProvenance()
-	if provenance != nil && provenance.FeatureFlags != nil {
-		internalParams["tekton-pipelines-feature-flags"] = *provenance.FeatureFlags
-	}
-	return internalParams
-}
-
-// externalParameters adds the pipeline run spec
-func externalParameters(pro *objects.PipelineRunObject) map[string]any {
-	externalParams := make(map[string]any)
-
-	// add the origin of top level pipeline config
-	// isRemotePipeline checks if the pipeline was fetched using a remote resolver
-	isRemotePipeline := false
-	if pro.Spec.PipelineRef != nil {
-		if pro.Spec.PipelineRef.Resolver != "" && pro.Spec.PipelineRef.Resolver != "Cluster" {
-			isRemotePipeline = true
-		}
-	}
-
-	if p := pro.Status.Provenance; p != nil && p.RefSource != nil && isRemotePipeline {
-		ref := ""
-		for alg, hex := range p.RefSource.Digest {
-			ref = fmt.Sprintf("%s:%s", alg, hex)
-			break
-		}
-		buildConfigSource := map[string]string{
-			"ref":        ref,
-			"repository": p.RefSource.URI,
-			"path":       p.RefSource.EntryPoint,
-		}
-		externalParams["buildConfigSource"] = buildConfigSource
-	}
-	externalParams["runSpec"] = pro.Spec
-	return externalParams
-}
-
 // byproducts contains the pipelineRunResults
 func byproducts(pro *objects.PipelineRunObject) ([]slsa.ResourceDescriptor, error) {
 	byProd := []slsa.ResourceDescriptor{}
@@ -140,3 +99,39 @@ func byproducts(pro *objects.PipelineRunObject) ([]slsa.ResourceDescriptor, erro
 	}
 	return byProd, nil
 }
+
+// getBuildDefinition get the buildDefinition based on the configured buildType. This will default to the slsa buildType
+func getBuildDefinition(ctx context.Context, slsaconfig *slsaconfig.SlsaConfig, pro *objects.PipelineRunObject) (slsa.ProvenanceBuildDefinition, error) {
+	// if buildType is not set in the chains-config, default to slsa build type
+	buildDefinitionType := slsaconfig.BuildType
+	if slsaconfig.BuildType == "" {
+		buildDefinitionType = buildtypes.SlsaBuildType
+	}
+
+	switch buildDefinitionType {
+	case buildtypes.SlsaBuildType:
+		rd, err := resolveddependencies.PipelineRun(ctx, pro, slsaconfig, resolveddependencies.AddSLSATaskDescriptor)
+		if err != nil {
+			return slsa.ProvenanceBuildDefinition{}, err
+		}
+		return slsa.ProvenanceBuildDefinition{
+			BuildType:            buildDefinitionType,
+			ExternalParameters:   externalparameters.PipelineRun(pro),
+			InternalParameters:   internalparameters.SLSAInternalParameters(pro),
+			ResolvedDependencies: rd,
+		}, nil
+	case buildtypes.TektonBuildType:
+		rd, err := resolveddependencies.PipelineRun(ctx, pro, slsaconfig, resolveddependencies.AddTektonTaskDescriptor)
+		if err != nil {
+			return slsa.ProvenanceBuildDefinition{}, err
+		}
+		return slsa.ProvenanceBuildDefinition{
+			BuildType:            buildDefinitionType,
+			ExternalParameters:   externalparameters.PipelineRun(pro),
+			InternalParameters:   internalparameters.TektonInternalParameters(pro),
+			ResolvedDependencies: rd,
+		}, nil
+	default:
+		return slsa.ProvenanceBuildDefinition{}, fmt.Errorf("unsupported buildType %v", buildDefinitionType)
+	}
+}