feat(chains): expose storage.oci.encoding-format in CRD

config/base/generated-crds/operator.tekton.dev_tektonconfigs.yaml

@@ -374,6 +374,8 @@ spec:
                     type: string
                   storage.grafeas.projectid:
                     type: string
+                  storage.oci.encoding-format:
+                    type: string
                   storage.oci.repository:
                     type: string
                   storage.oci.repository.insecure:

docs/TektonChain.md

@@ -96,6 +96,7 @@ spec:
   storage.gcs.bucket: #value
   storage.oci.repository: #value
   storage.oci.repository.insecure: #value (boolean - true/false)
+  storage.oci.encoding-format: #value (dsse or sigstore-bundle, default: dsse)
   storage.docdb.url: #value
   storage.docdb.mongo-server-url: #value
   storage.docdb.mongo-server-url-dir: #value

docs/TektonConfig.md

@@ -283,6 +283,7 @@ chain:
   storage.gcs.bucket: #value
   storage.oci.repository: #value
   storage.oci.repository.insecure: #value (boolean - true/false)
+  storage.oci.encoding-format: #value (dsse or sigstore-bundle, default: dsse)
   storage.docdb.url: #value
   storage.grafeas.projectid: #value
   storage.grafeas.noteid: #value

pkg/apis/operator/v1alpha1/tektonchain_types.go

@@ -108,6 +108,7 @@ type ChainProperties struct {
 	StorageGCSBucket              string `json:"storage.gcs.bucket,omitempty"`
 	StorageOCIRepository          string `json:"storage.oci.repository,omitempty"`
 	StorageOCIRepositoryInsecure  *bool  `json:"storage.oci.repository.insecure,omitempty"`
+	StorageOCIEncodingFormat      string `json:"storage.oci.encoding-format,omitempty"`
 	StorageDocDBURL               string `json:"storage.docdb.url,omitempty"`
 	StorageDocDBMongoServerURL    string `json:"storage.docdb.mongo-server-url,omitempty"`
 	StorageDocDBMongoServerURLDir string `json:"storage.docdb.mongo-server-url-dir,omitempty"`

pkg/apis/operator/v1alpha1/tektonchain_validation.go

@@ -34,6 +34,7 @@ var (
 	allowedArtifactsStorage                         = sets.NewString("", "tekton", "oci", "gcs", "docdb", "grafeas", "kafka")
 	allowedControllerEnvs                           = sets.NewString("MONGO_SERVER_URL")
 	allowedBuildDefinitionType                      = sets.NewString("", "https://tekton.dev/chains/v2/slsa", "https://tekton.dev/chains/v2/slsa-tekton")
+	allowedStorageOCIEncodingFormat                 = sets.NewString("", "dsse", "sigstore-bundle")
 )
 
 func (tc *TektonChain) Validate(ctx context.Context) (errs *apis.FieldError) {
@@ -132,6 +133,10 @@ func (tcs *TektonChainSpec) ValidateChainConfig(path string) (errs *apis.FieldEr
 		}
 	}
 
+	if !allowedStorageOCIEncodingFormat.Has(tcs.StorageOCIEncodingFormat) {
+		errs = errs.Also(apis.ErrInvalidValue(tcs.StorageOCIEncodingFormat, path+".storage.oci.encoding-format"))
+	}
+
 	if !allowedX509SignerFulcioProvider.Has(tcs.X509SignerFulcioProvider) {
 		errs = errs.Also(apis.ErrInvalidValue(tcs.X509SignerFulcioProvider, path+".signers.x509.fulcio.provider"))
 	}

pkg/apis/operator/v1alpha1/tektonchain_validation_test.go

@@ -366,6 +366,44 @@ func Test_ValidateTektonChain_ConfigBuildDefinitionType(t *testing.T) {
 	}
 }
 
+func Test_ValidateTektonChain_InvalidStorageOCIEncodingFormat(t *testing.T) {
+	tc := &TektonChain{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "chain",
+			Namespace: "namespace",
+		},
+		Spec: TektonChainSpec{
+			CommonSpec: CommonSpec{
+				TargetNamespace: "namespace",
+			},
+		},
+	}
+	tc.Spec.Chain.ChainProperties.StorageOCIEncodingFormat = "unknown-format"
+	err := tc.Validate(context.TODO())
+	assert.Equal(t, "invalid value: unknown-format: spec.storage.oci.encoding-format", err.Error())
+}
+
+func Test_ValidateTektonChain_ValidStorageOCIEncodingFormat(t *testing.T) {
+	tc := &TektonChain{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "chain",
+			Namespace: "namespace",
+		},
+		Spec: TektonChainSpec{
+			CommonSpec: CommonSpec{
+				TargetNamespace: "namespace",
+			},
+		},
+	}
+	for _, format := range []string{"dsse", "sigstore-bundle"} {
+		tc.Spec.Chain.ChainProperties.StorageOCIEncodingFormat = format
+		err := tc.Validate(context.TODO())
+		if err != nil {
+			t.Errorf("ValidateTektonChain.Validate() expected no error for encoding-format %q, but got: %v", format, err)
+		}
+	}
+}
+
 func Test_ValidateTektonChain_InvalidControllerEnv(t *testing.T) {
 	tc := &TektonChain{
 		ObjectMeta: metav1.ObjectMeta{