[javirln]

This patch enhances the attestation add command by allowing it to accept HTTP(S) URLs. When a URL is provided, the CLI downloads the file and uses it for attestation, eliminating the need for users to have the file locally. Internally, the CLI stores the downloaded file in a temporary directory, preserving its base name for material verification before pushing it to the configured CAS.

The existing behavior of loading files from the local file system remains unchanged.

A few examples:

Loading a GitLab Security Report from the file system:

$ chainloop attestation add --value ./pkg/attestation/crafter/materials/testdata/gl-secret-detection-report.json
INF material kind detected kind=GITLAB_SECURITY_REPORT
INF material added to attestation
┌──────────┬─────────────────────────────────────────────────────────────────────────┐
│ Name     │ material-1740665350182267000                                            │
├──────────┼─────────────────────────────────────────────────────────────────────────┤
│ Type     │ GITLAB_SECURITY_REPORT                                                  │
├──────────┼─────────────────────────────────────────────────────────────────────────┤
│ Required │ No                                                                      │
├──────────┼─────────────────────────────────────────────────────────────────────────┤
│ Value    │ gl-secret-detection-report.json                                         │
├──────────┼─────────────────────────────────────────────────────────────────────────┤
│ Digest   │ sha256:1e542c962a0f26eb0a5a6bf504335407d62548525bdb2cab1667936e5da4933f │
└──────────┴─────────────────────────────────────────────────────────────────────────┘

Loading another material from an URL:

$ chainloop attestation add --value https://raw.githubusercontent.com/chainloop-dev/chainloop/refs/heads/main/pkg/attestation/crafter/materials/testdata/zap_scan.zip
INF material kind detected kind=ZAP_DAST_ZIP
INF material added to attestation
┌──────────┬─────────────────────────────────────────────────────────────────────────┐
│ Name     │ material-1740665230173345000                                            │
├──────────┼─────────────────────────────────────────────────────────────────────────┤
│ Type     │ ZAP_DAST_ZIP                                                            │
├──────────┼─────────────────────────────────────────────────────────────────────────┤
│ Required │ No                                                                      │
├──────────┼─────────────────────────────────────────────────────────────────────────┤
│ Value    │ zap_scan.zip                                                            │
├──────────┼─────────────────────────────────────────────────────────────────────────┤
│ Digest   │ sha256:7aa1273cbc367cd13cc7be0e97a939df47f9b35e1fc45b4b81b6152569b3565c │
└──────────┴─────────────────────────────────────────────────────────────────────────┘

Special cases such as container images remain the same as before:

$ chainloop attestation add --value ghcr.io/chainloop-dev/chainloop/control-plane:latest
INF material kind detected kind=CONTAINER_IMAGE
INF material added to attestation
┌──────────┬─────────────────────────────────────────────────────────────────────────┐
│ Name     │ material-1740666161405005000                                            │
├──────────┼─────────────────────────────────────────────────────────────────────────┤
│ Type     │ CONTAINER_IMAGE                                                         │
├──────────┼─────────────────────────────────────────────────────────────────────────┤
│ Required │ No                                                                      │
├──────────┼─────────────────────────────────────────────────────────────────────────┤
│ Value    │ ghcr.io/chainloop-dev/chainloop/control-plane:latest                    │
├──────────┼─────────────────────────────────────────────────────────────────────────┤
│ Digest   │ sha256:c8994629227d0482defd16585b851f676b1515f5b6cd59e214be2fa4ef39c76b │
└──────────┴─────────────────────────────────────────────────────────────────────────┘

[migmartri]

Great!

We might want to also add an example that says that you if you provide an http url the content will be downloaded first.