Stop using deprecated SLSA provenence struct type

[simonbaird]

The in_toto.ProvenanceStatementSLSA02 struct is identical to the deprecated in_toto.ProvenanceStatement struct. Let's stop using the older one.

https://github.com/in-toto/in-toto-golang/blob/8a5dc9e6d8637cf72c4b5103216ce3445e053a14/in_toto/attestations.go#L66

[codecov]

Codecov Report

Merging #1017 (a9987a7) into main (c118e5a) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##             main    #1017   +/-   ##
=======================================
  Coverage   79.20%   79.20%           
=======================================
  Files          58       58           
  Lines        4924     4924           
=======================================
  Hits         3900     3900           
  Misses       1024     1024           

Flag	Coverage Δ
generative	51.77% <ø> (ø)
integration	62.34% <ø> (ø)
unit	70.97% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

[lcarva]

Seeing these errors in the acceptance tests:

Error: received statement of unsupported type: {{https://in-toto.io/Statement/v0.1 https://slsa.dev/provenance/v0.2 [{acceptance/image map[sha256:362ff6d6a41a1df2325e23dfbdd323a864be835d953006f267f1d28a8a3a170d]}]} {{[https://tekton.dev/chains/v2}](https://tekton.dev/chains/v2%7D) https://tekton.dev/attestations/chains/pipelinerun@v2 {{ map[] } <nil> <nil>} <nil> <nil> []}}

[lcarva]

Ha! That's because cosign is still using the old deprecated format: https://github.com/sigstore/cosign/blob/ee66f352f5c657fa7d803442a31dc79012178167/pkg/cosign/attestation/attestation.go#L216

So we either wait for that to be updated, make a change to cosign, or change this assertion in our tests.

UPDATE: Created sigstore/cosign#3243

[simonbaird]

Huh, that's interesting. I guess this is a breaking change, both here and for cosign. Better move it to draft for now then.

[simonbaird]

https://www.github.com/sigstore/cosign/pull/3243 was merged.

[zregvart]

We did this in #1158, close?

[simonbaird]

We did this in #1158, close?

Cool, thanks. Closing.