GCB: Verification issue with json.Unmarshal on slsaProvenance

[asraa]

Getting this error at main

$ ./slsa-verifier verify-image us-west2-docker.pkg.dev/slsa-tooling/example-package-repo/e2e-gcb-workflow_dispatch-main-cloudbuild-slsa3@sha256:71efcbb3f03f5914dcde87e38d3813f63982b475f76887babf25f76fff760d3c
 --builder-id https://cloudbuild.googleapis.com/GoogleHostedWorker --source-uri github.com/slsa-framework/example-package --provenance-path provenance.json
FAILED: SLSA verification failed: json.Unmarshal: json: cannot unmarshal string into Go struct field ProvenanceRecipe.provenance_summary.provenance.build.intotoStatement.slsaProvenance.recipe.definedInMaterial of type int

Investigating quickly
cc @laurentsimon

[asraa]

This is the provenance
https://gist.github.com/asraa/7a6af5208f54ac54394a39a7f6432839

[asraa]

haha, why is this a -1?
"definedInMaterial": "-1",

[asraa]

Answer:

          "description": "Index in materials containing the recipe steps that are not implied by recipe.type. For example, if the recipe type were \"make\", then this would point to the source containing the Makefile, not the make program itself. Set to -1 if the recipe doesn't come from a material, as zero is default unset value for int64.",

[laurentsimon]

https://github.com/in-toto/in-toto-golang/blob/master/in_toto/slsa_provenance/v0.1/provenance.go#L27
Why is the parser complaining? is it interpreting it as a string because of double quotes?

[asraa]

Yes exactly.

Since that's the unverified payload, I can change the value and try verification again, but that payload is also in the signed intoto statement and I get

no valid signature: [invalid DSSE envelope payload: json: cannot unmarshal string into Go struct field ProvenanceRecipe.predicate.recipe.definedInMaterial of type int]

[asraa]

This was fixed here with a (temporary?) copy of the intoto structs:
#292
GCB will fix the signed envelope data, but not the outer.