Canonicalize JSON before signing

This is required by the [in-toto spec](https://github.com/in-toto/docs/blob/master/in-toto-spec.md#4-document-formats).

Signed-off-by: Pieter Lexis <[email protected]>

cmd/slsa-provenance/cli/sign.go

@@ -7,6 +7,7 @@ import (
 	"io/ioutil"
 	"os"
 
+	cjson "github.com/docker/go/canonical/json"
 	"github.com/pkg/errors"
 	"github.com/sigstore/sigstore/pkg/signature"
 	"github.com/sigstore/sigstore/pkg/signature/dsse"
@@ -52,9 +53,8 @@ func Sign() *cobra.Command {
 
 			wrappedSigner := dsse.WrapSigner(signer, intoto.InTotoPayloadType)
 
-			// TODO canonicalize the provenance
 			var toSign []byte
-			if toSign, err = json.Marshal(provenance); err != nil {
+			if toSign, err = cjson.MarshalCanonical(provenance); err != nil {
 				// Should be impossible, but hey!
 				return errors.Wrap(err, "Could not marshal provenance for signing")
 			}

go.mod

@@ -20,6 +20,7 @@ require (
 
 require (
 	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/docker/go v1.5.1-1
 	github.com/golang/protobuf v1.5.2 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
 	github.com/inconshreveable/mousetrap v1.0.0 // indirect

go.sum

@@ -284,6 +284,8 @@ github.com/docker/distribution v2.7.1-0.20190205005809-0d3efadf0154+incompatible
 github.com/docker/distribution v2.7.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/docker v20.10.7+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.6.3/go.mod h1:WRaJzqw3CTB9bk10avuGsjVBZsD05qeibJ1/TYlvc0Y=
+github.com/docker/go v1.5.1-1 h1:hr4w35acWBPhGBXlzPoHpmZ/ygPjnmFVxGxxGnMyP7k=
+github.com/docker/go v1.5.1-1/go.mod h1:CADgU4DSXK5QUlFslkQu2yW2TKzFZcXq/leZfM0UH5Q=
 github.com/docker/go-connections v0.4.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
 github.com/docker/go-events v0.0.0-20170721190031-9461782956ad/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA=
 github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA=