Record reference provenance in manifests

internal/framework/pipeline/references.go

@@ -11,6 +11,7 @@ import (
 	"strings"
 	"unicode/utf8"
 
+	"gitea.maximumdirect.net/eric/notarius/internal/core/artifacts"
 	"gitea.maximumdirect.net/eric/notarius/internal/framework/contracts"
 )
 
@@ -185,3 +186,33 @@ func CloneReferenceSet(in contracts.ReferenceSet) contracts.ReferenceSet {
 	}
 	return out
 }
+
+func ReferenceProvenance(resolved ResolvedPipeline) []artifacts.ReferenceProvenance {
+	provenance := []artifacts.ReferenceProvenance{}
+	for _, lane := range resolved.ArtifactLanes {
+		if len(lane.ReferenceSet.Slots) == 0 {
+			continue
+		}
+		slotNames := make([]string, 0, len(lane.ReferenceSet.Slots))
+		for slotName := range lane.ReferenceSet.Slots {
+			slotNames = append(slotNames, slotName)
+		}
+		sort.Strings(slotNames)
+		for _, slotName := range slotNames {
+			slot := lane.ReferenceSet.Slots[slotName]
+			for _, item := range slot.Items {
+				provenance = append(provenance, artifacts.ReferenceProvenance{
+					LaneID:        lane.ID,
+					SlotName:      item.SlotName,
+					OriginType:    item.Origin.Type,
+					OriginURI:     item.Origin.URI,
+					Digest:        item.Digest,
+					MediaType:     item.MediaType,
+					SizeBytes:     item.SizeBytes,
+					BindingSource: item.BindingSource,
+				})
+			}
+		}
+	}
+	return provenance
+}