feat: Share util functions

[laurentsimon]

This PR does 3 things:

1. Share util functions between builders
2. Ensure the files we create do not already exist (O_EXCL)
3. Add sanity checks when downloading an artifact for the non-existence of the file

I started looking into

slsa-github-generator/internal/builders/go/main.go

Line 87 in 0f97cca

err = ioutil.WriteFile(filename, attBytes, 0o600)

and https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/generic/attest.go#L165

Then I realized that a malicious developer can use this function to sign any file present in the generator directory. The reason is that if the file already exists, this function does not return an error and continue silently. Fortunately we don't checkout the developer repository (by design), because it might have allowed the developer to set the path to a file they control.

I think an attacker could only have selected files with .intoto.jsonl extension, so just a few testcase files. I have not tested filenames like some-file\0(to remove the extension in

slsa-github-generator/internal/builders/go/main.go

Line 86 in 0f97cca

filename := fmt.Sprintf("%s.intoto.jsonl", subject)

), but I doubt it would work...

So I created the CreateNewFileUnderCurrentDirectory() function which uses O_EXCL and use it across the 2 existing builders.

Besides these changes, the rest is mostly re-factoring.

[ianlewis]

Thanks, I'll give this a review tomorrow

[asraa]

Thanks! Really minor nits

[laurentsimon]

I'll wait for an ack from @ianlewis before merging.