[recipe_wrapper] Use a in-toto attestation
This change modifies the use of the attestation tool to use an in-toto attestation.
The TL;DR is that there is a deprecated way of doing things called Core Provenance, which was the internal BCID implementation. Then came SLSA v0.1 which had its own attestation format which was then used by the in-toto organization. The attestation format appears to have been subsumed by in-toto, and so it's now an in-toto Statement instead which uses the SLSA provenance format and if you understand it all by now you're doing better than me.
The format appears to be rather loose and mostly human-readable metadata. I don't think anything but the subjects and digest are actually used for verification.
Bug: b/298073152
Bug: b/297416582
Change-Id: I86430bf8fcdc900a9d96d39ad6cf93214ec6a9aa
Reviewed-on: https://fuchsia-review.googlesource.com/c/infra/infra/+/912739
Commit-Queue: Chris Lewis <cflewis@google.com>
Reviewed-by: Nathan Mulcahey <nmulcahey@google.com>
5 files changed
