adds filename to intoto private key path

charts/devguard/Chart.yaml

@@ -15,7 +15,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.5.7
+version: 0.5.8
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

charts/devguard/templates/devguard/deployment.yaml

@@ -99,7 +99,7 @@ spec:
           - mountPath: /github-app-private-key
             name: github-app-private-key
             subPath: privateKey
-          - mountPath: /intoto-private-key
+          - mountPath: /intoto-private-key.pem
             name: intoto-private-key
             subPath: privateKey
 

cmd/devguard-scanner/commands/intoto/intoto_verify.go

@@ -16,9 +16,12 @@
 package intotocmd
 
 import (
+	"fmt"
 	"io"
 	"net/http"
 	"os"
+	"os/exec"
+	"regexp"
 
 	toto "github.com/in-toto/in-toto-golang/in_toto"
 	"github.com/l3montree-dev/devguard/client"
@@ -96,6 +99,21 @@ func verify(cmd *cobra.Command, args []string) error {
 	if err != nil {
 		return err
 	}
+	imageName := args[0]
+
+	// image name regex
+	// we expect the image name to be in the format of <registry>/<image>:<tag>[@digest]
+	reg := regexp.MustCompile(`^([a-zA-Z0-9.-]+(?:/[a-zA-Z0-9._-]+)+):([a-zA-Z0-9._-]+)(@sha256:[a-f0-9]{64})?$`)
+	if !reg.MatchString(imageName) {
+		return fmt.Errorf("invalid image name")
+	}
+
+	// now get the digest from the layout argument - we expect it to be an image tag
+	// use crane to get the digest
+	err = exec.Command("sh", "-c", "crane", "digest", fmt.Sprintf("\"%s\"", imageName), ">", "image-digest.txt").Run() // nolint:gosec//Checked using regex
+	if err != nil {
+		return err
+	}
 
 	_, err = toto.InTotoVerify(rootLayout, map[string]toto.Key{
 		layoutKey.KeyID: layoutKey,