// Sirf signature ye batata hai ki "image hamne banayi". Provenance attestation
// ye batata hai ki "kaunse commit se, kis machine par, kab, kis pipeline se".
// Audit me yahi sabse pehle poochha jaata hai.
def call(Map info) {
    withCredentials([string(credentialsId: 'vault-deployer-token', variable: 'VAULT_TOKEN')]) {
        withEnv([
            "P_REPO=${info.repo}", "P_COMMIT=${info.commit}",
            "P_BUILD=${info.build}", "P_JOB=${info.job}", "P_BUILDER=${info.builder}"
        ]) {
            sh '''
                set +x
                umask 077
                WORK=$(mktemp -d); trap "rm -rf $WORK" EXIT

                curl -sf -H "X-Vault-Token: $VAULT_TOKEN" "$VAULT_ADDR/v1/platform/data/cosign" > $WORK/c.json
                python3 - "$WORK" <<'PY'
import json, sys, os
w = sys.argv[1]
d = json.load(open(w + '/c.json'))['data']['data']
for k, f in (('private_key', 'cosign.key'), ('password', 'pw')):
    open(os.path.join(w, f), 'w').write(d[k])
PY
                curl -sf -H "X-Vault-Token: $VAULT_TOKEN" "$VAULT_ADDR/v1/$VAULT_MOUNT/data/registry" > $WORK/r.json
                python3 - "$WORK" "$REGISTRY" <<'PY'
import base64, json, os, sys
w, reg = sys.argv[1], sys.argv[2]
d = json.load(open(w + '/r.json'))['data']['data']
auth = base64.b64encode(('%s:%s' % (d['username'], d['password'])).encode()).decode()
os.makedirs(os.path.expanduser('~/.docker'), exist_ok=True)
json.dump({'auths': {reg: {'auth': auth}}}, open(os.path.expanduser('~/.docker/config.json'), 'w'))
PY

                # SLSA v0.2 predicate - kis source se kaise bani
                python3 - "$WORK" <<'PY'
import json, os, sys, datetime
w = sys.argv[1]
pred = {
    "builder": {"id": os.environ["P_BUILDER"]},
    "buildType": "https://ns31240276.ip-51-195-4.eu/devops-platform/jenkins@v1",
    "invocation": {
        "configSource": {
            "uri": os.environ["P_REPO"],
            "digest": {"sha1": os.environ["P_COMMIT"]},
            "entryPoint": os.environ["P_JOB"],
        },
        "environment": {"buildNumber": os.environ["P_BUILD"]},
    },
    "metadata": {
        "buildInvocationId": os.environ["P_BUILD"],
        "buildFinishedOn": datetime.datetime.now(datetime.timezone.utc)
            .strftime("%Y-%m-%dT%H:%M:%SZ"),
        "completeness": {"parameters": True, "environment": False, "materials": True},
        "reproducible": False,
    },
    "materials": [{
        "uri": os.environ["P_REPO"],
        "digest": {"sha1": os.environ["P_COMMIT"]},
    }],
}
open(w + '/predicate.json', 'w').write(json.dumps(pred, indent=2))
PY

                COSIGN_PASSWORD=$(cat $WORK/pw) cosign attest \
                    --key $WORK/cosign.key --yes --tlog-upload=false \
                    --type slsaprovenance --predicate $WORK/predicate.json \
                    "$FULL_IMAGE"
                rm -f ~/.docker/config.json
                echo "  provenance attach ho gaya: $FULL_IMAGE"
            '''
        }
    }
}