in-toto / totoify-grafeas Goto Github PK

in-toto links can now be added to a Grafeas server as of v0.1.6. I propose we repurpose this repository to incorporate a tool that acts as the necessary middleman to restructure the metadata to the grafeas format. This involves serializing some of our dictionaries as lists, and this is partially performed by the in-toto Jenkins plugin when it uses the Grafeas transport. The tool should also be capable of reversing this transformation so as to enable regular in-toto-verification. It could act as a full interface between an in-toto implementation and a specified Grafeas server.

Ref: https://github.com/jenkinsci/in-toto-plugin/blob/master/src/main/java/io/jenkins/plugins/intotorecorder/transport/GrafeasTransport.java#L28

Hi there, we want to use in-toto with grafeas to prove complance in a CI/CD pipeline. So we started out with this project (after testing out in-toto itself). But I am having trouble to get it working as it is. the v1alpha1 version does not work at all for me.
I tried it with v1beta1 from grafeas but the api seems to have changed quite a lot. the operations method is not available anymore. And the note model seems to have changed.
Can you please point me in the right direction? We are willing to invest time to make it work.

Thanks
Gert Jan