feat(cli): explode archive materials in chainloop att add
Draft
JA
4mo ago+1149+1149+0123456789012345678901234567890123456789-10-10-01234567890123456789
Summary
chainloop attestation add --kind <KIND> --value <archive> now unpacks .zip, .tar, .tar.gz, and .tgz archives and records each contained regular file as its own material of the given kind, instead of requiring one att add invocation per file.
Behavior
- When
--kindis provided and the value resolves to a supported archive, each contained regular file is added as an individual material of that kind. - Archive-native kinds (e.g.
ZAP_DAST_ZIP), whose value is meant to be the archive itself, are still recorded whole. - Per-entry material names are derived from the entry filename (sanitized to DNS-1123, with collision suffixes);
--name, when provided, is used as a name prefix. - Annotations passed via
--annotationare applied to every extracted material. - The operation is atomic: either all qualifying entries are added or none.
- Extraction is guarded against zip bombs and path traversal:
--max-extract-entries(default 10000) and--max-extract-size(default 1GiB) are enforced while streaming, and directory, symlink, absolute, and path-traversal entries are skipped or rejected.
With no --kind, and for non-archive values, behavior is unchanged. There are no server-side, contract, or gRPC changes.
AI disclosure
This contribution was assisted by Claude Code.