Design and create an Adoptium MarketPlace data representation of a CDXA attestation

[andrew-m-leonard]

Design and create an Adoptium MarketPlace data representation of a CDXA attestation, that supports Adoptium member vendors publishing a CDXA attestation as to the "Reproducible Verification" of an Adoptium MarketPlace release.

A Vendor should be able to:

• Handcraft and "sign" a CDXA attestation json document that confirms the Reproducible Verification of a target Adoptium marketplace release JDK binary
• A Vendor can also "attest" to the "Reproducible Verification" of their own release, eg.Temurin attest to "Reproducible Verification" of their own JDK binary.
• A standard method of "signing" the json document should be employed.

[andrew-m-leonard]

• Introduce a new marketplace schema for an Attestation, around here
• Add to the marketplace client a new readRepositoryAttestationsForRelease(version, arch) to read any Attestation documents, around here:

  private List<Attestation> readRepositoryAttestationsForRelease(version, arch) throws FailedToPullDataException {

• Add a new public marketplace client API to read the list of Attestations. around here :

  public AttestationList readRepositoryAttestations() throws FailedToPullDataException {

• Add a new "Updater" method updateAttestations(vendor: Vendor), around here

  override suspend fun updateAttestations(vendor: Vendor): AttestationUpdateInfo {

  and called from around here during the update cycle

  val newAttestations = updateAttestations(vendor)

[andrew-m-leonard]

Extended the DataStore to store/retrieve Attestations by target VendorRelease:

• Add a new https://github.com/adoptium/marketplace-api.adoptium.net/blob/bb32d4ba4692bb06a61341e48b3953b50e5e5598/adoptium-marketplace-server/adoptium-marketplace-persistence/src/main/kotlin/net/adoptium/marketplace/dataSources/APIDataStore.kt#L8

  fun getAttestations(vendorRelease): AttestationList

• Add a new route and implementation for /v1/assets/attestationsForVendorRelease(vendorRelease) around here
• Add new method to the adoptium.net website to fetch getAllAttestationsForVendorRelease : https://github.com/adoptium/adoptium.net/blob/main/src/hooks/fetchMarketplace.tsx

[andrew-m-leonard]

MarketPlace sketch, the "Reproducible Verified" column would list Vendor "icons" that have verified the given vendor release:

[andrew-m-leonard]

@tellison @jiekang When you get a moment please, your thoughts on the above "sketch", thanks

[jiekang]

Sketch seems fine to me. I would probably make the logos smaller, square icons preferably.