Only upload to the tlog once!

Signed-off-by: Dan Lorenc <dlorenc@google.com>
tektoncd · Aug 21, 2021 · 407e75f · 407e75f
1 parent 98e6c21
commit 407e75f
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 0 deletions.
diff --git a/pkg/chains/rekor.go b/pkg/chains/rekor.go
@@ -89,6 +89,11 @@ func shouldUploadTlog(cfg config.Config, tr *v1beta1.TaskRun) bool {
 	if !cfg.Transparency.VerifyAnnotation {
 		return true
 	}
+
+	// Already uploaded, don't do it again
+	if _, ok := tr.Annotations[ChainsTransparencyAnnotation]; ok {
+		return false
+	}
 	// verify the annotation
 	for k, v := range tr.Annotations {
 		if k == RekorAnnotation && v == "true" {

diff --git a/pkg/chains/rekor_test.go b/pkg/chains/rekor_test.go
@@ -63,6 +63,15 @@ func TestShouldUploadTlog(t *testing.T) {
 			annotations: map[string]string{RekorAnnotation: "true"},
 			expected:    true,
 		},
+		{
+			description: "already uploaded",
+			cfg: config.TransparencyConfig{
+				Enabled:          true,
+				VerifyAnnotation: true,
+			},
+			annotations: map[string]string{ChainsTransparencyAnnotation: "foo"},
+			expected:    false,
+		},
 	}
 
 	for _, test := range tests {