feat(trace): declare the disk export is unsigned in its manifest

The export manifest now carries signed and is_attestation fields, both false, so a reader cannot mistake the on-disk evidence for a signed attestation. This satisfies the manifest declaration the spec requires (issue-3582 R-006).

Refs #3582

Chainloop-Trace-Sessions: d139ac66-b95f-4920-ac38-12997996037d

Signed-off-by: Matías Insaurralde <matias@chainloop.dev>

Author: matiasinsaurralde

app/cli/pkg/action/trace_export.go

@@ -169,10 +169,16 @@ type exportedMaterial struct {
 
 // exportManifest is the top-level index of an export directory.
 type exportManifest struct {
-	GeneratedAt string             `json:"generated_at"`
-	Redaction   bool               `json:"redaction"`
-	Sessions    []string           `json:"sessions"`
-	Materials   []exportedMaterial `json:"materials"`
+	GeneratedAt string `json:"generated_at"`
+	// Signed and IsAttestation are always false: the export is an unsigned
+	// evidence set, not a signed in-toto attestation, so it proves nothing on
+	// its own. The index declares this so a reader never mistakes the export for
+	// an attestation (spec issue-3582, R-006).
+	Signed        bool               `json:"signed"`
+	IsAttestation bool               `json:"is_attestation"`
+	Redaction     bool               `json:"redaction"`
+	Sessions      []string           `json:"sessions"`
+	Materials     []exportedMaterial `json:"materials"`
 }
 
 func newDiskMaterialSink(outDir string, noRedact bool, logger zerolog.Logger) *diskMaterialSink {
@@ -286,10 +292,12 @@ func (s *diskMaterialSink) writeManifest(redaction bool) error {
 	}
 
 	manifest := exportManifest{
-		GeneratedAt: time.Now().UTC().Format(time.RFC3339),
-		Redaction:   redaction,
-		Sessions:    sessions,
-		Materials:   s.materials,
+		GeneratedAt:   time.Now().UTC().Format(time.RFC3339),
+		Signed:        false,
+		IsAttestation: false,
+		Redaction:     redaction,
+		Sessions:      sessions,
+		Materials:     s.materials,
 	}
 
 	data, err := json.MarshalIndent(manifest, "", "  ")

app/cli/pkg/action/trace_export_test.go

@@ -120,6 +120,9 @@ func TestRunTraceExportMatchesPush(t *testing.T) {
 	data, err := os.ReadFile(filepath.Join(outDir, manifestFileName))
 	require.NoError(t, err)
 	require.NoError(t, json.Unmarshal(data, &manifest))
+	// R-006: the index declares the export is unsigned and not an attestation.
+	assert.False(t, manifest.Signed)
+	assert.False(t, manifest.IsAttestation)
 	assert.True(t, manifest.Redaction)
 	assert.Contains(t, manifest.Sessions, sessionName)
 	require.NotEmpty(t, manifest.Materials)