feat: add additional context to attested materials

[migmartri]

Attested materials now support arbitrary annotations that can be useful to add additional context.

For example

All materials

• Add the material name, this is the name from which it's referenced in the contract. This could be useful to figure out what generic material we want to download.

CAS-based materials

• add the filename

Container image

• add the image that was used during reference

[migmartri]

there is no required change in the attestation layer. The materials in the attestations already contain all that information. For example

Container image

    {
        "annotations": {
          "chainloop.material.name": "artifact",
          "chainloop.material.type": "CONTAINER_IMAGE"
        },
        "digest": {
          "sha256": "679d7f74941e1b121c49f85b2efbe7a147db90d60352e02b1d20da0a8b44c924"
        },
        "name": "ghcr.io/chainloop-dev/charts/chainloop"
      },

or artifact

      {
        "annotations": {
          "chainloop.material.cas": true,
          "chainloop.material.name": "log",
          "chainloop.material.type": "ARTIFACT"
        },
        "digest": {
          "sha256": "f3c18b363a45894baca751e44526b8af4853f7d519e42e1ca9962746dfcc028f"
        },
        "name": "output.log"
      }

This issue in fact was more related to our discovery endpoint. to be able to populate such info in an endpoint like this one

As you can see, the materials listed there does not contain annotations or additional metadata, and this is because those nodes are generic and depend on the context of the attestation the user is querying.

We might be able to make the API smart and hydrate the results if and only if we are talking about the context of a very specific attestation.

[migmartri]

This effort now has two angles

• [ ] a) Add more metadata to the attestation
• [ ] b) Add more metadata to the results based on the context of a given attestation

for a), apart of the current workflow name we can add

• team, project

and we can also add organization name