feat: add material size annotation to attestations

[migmartri]

Summary

• Add chainloop.material.size built-in annotation that records the material size in bytes
• Applies to all file-based material types (artifacts, SBOMs, SARIF, etc.) and STRING materials
• Follows existing chainloop.material.* annotation naming convention

Example output after adding a material:

┌─────────────┬─────────────────────────────────────────────────────────────────────────┐
│ Name        │ artifact                                                                │
├─────────────┼─────────────────────────────────────────────────────────────────────────┤
│ Type        │ ARTIFACT                                                                │
├─────────────┼─────────────────────────────────────────────────────────────────────────┤
│ Required    │ No                                                                      │
├─────────────┼─────────────────────────────────────────────────────────────────────────┤
│ Value       │ 20240415_123801.jpg                                                     │
├─────────────┼─────────────────────────────────────────────────────────────────────────┤
│ Digest      │ sha256:d7f73a24a4bfe62d0024db940db13fca9bcf17040151b9607e6e52ec75b03f97 │
├─────────────┼─────────────────────────────────────────────────────────────────────────┤
│ Annotations │ ------                                                                  │
├─────────────┼─────────────────────────────────────────────────────────────────────────┤
│             │ chainloop.material.size: 1023852                                        │
└─────────────┴─────────────────────────────────────────────────────────────────────────┘

In the final in-toto attestation:

"materials": [
   {
      "annotations": {
         "chainloop.material.cas": true,
         "chainloop.material.name": "artifact",
         "chainloop.material.size": "1023852",
         "chainloop.material.type": "ARTIFACT"
      },
      "digest": {
         "sha256": "d7f73a24a4bfe62d0024db940db13fca9bcf17040151b9607e6e52ec75b03f97"
      },
      "name": "20240415_123801.jpg"
   }
]

Closes #2847

[cubic-dev-ai]

1 issue found across 5 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="pkg/attestation/crafter/materials/materials.go">

<violation number="1" location="pkg/attestation/crafter/materials/materials.go:170">
P2: This size annotation is dropped for file-based crafters that reinitialize `m.Annotations` after `uploadAndCraft`, so SPDX/SARIF/CSAF materials will not emit `chainloop.material.size`.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P2: This size annotation is dropped for file-based crafters that reinitialize m.Annotations after uploadAndCraft, so SPDX/SARIF/CSAF materials will not emit chainloop.material.size.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At pkg/attestation/crafter/materials/materials.go, line 170:

<comment>This size annotation is dropped for file-based crafters that reinitialize `m.Annotations` after `uploadAndCraft`, so SPDX/SARIF/CSAF materials will not emit `chainloop.material.size`.</comment>

<file context>
@@ -165,6 +167,10 @@ func uploadAndCraft(ctx context.Context, input *schemaapi.CraftingSchema_Materia
 		material.GetArtifact().Content = content
 	}
 
+	material.Annotations = map[string]string{
+		AnnotationMaterialSize: strconv.FormatInt(result.size, 10),
+	}
</file context>