feat(materials): add binary-safe inline material support

app/cli/pkg/action/workflow_run_describe.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2024-2025 The Chainloop Authors.
+// Copyright 2024-2026 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -23,6 +23,7 @@ import (
 	"fmt"
 	"sort"
 	"strings"
+	"unicode/utf8"
 
 	pb "github.com/chainloop-dev/chainloop/app/controlplane/api/controlplane/v1"
 	"github.com/chainloop-dev/chainloop/pkg/attestation/renderer/chainloop"
@@ -76,6 +77,7 @@ type PolicyEvaluationStatus struct {
 type Material struct {
 	Name           string        `json:"name"`
 	Value          string        `json:"value"`
+	RawValue       []byte        `json:"raw_value,omitempty"`
 	Hash           string        `json:"hash"`
 	Tag            string        `json:"tag"`
 	Filename       string        `json:"filename"`
@@ -312,9 +314,22 @@ func policyEvaluationPBToAction(in *pb.PolicyEvaluation) *PolicyEvaluation {
 }
 
 func materialPBToAction(in *pb.AttestationItem_Material) *Material {
+	// Prefer raw_value (binary-safe) when available.
+	// Fall back to deprecated string value field for compatibility with
+	// older control plane versions that don't populate raw_value.
+	var value string
+	if raw := in.GetRawValue(); len(raw) > 0 {
+		if utf8.Valid(raw) {
+			value = string(raw)
+		}
+	} else {
+		value = in.GetValue() //nolint:staticcheck // fallback for older servers
+	}
+
 	m := &Material{
 		Name:           in.Name,
-		Value:          in.Value,
+		Value:          value,
+		RawValue:       in.GetRawValue(),
 		Type:           in.Type,
 		Hash:           in.Hash,
 		Tag:            in.Tag,

app/controlplane/api/controlplane/v1/response_messages.proto

@@ -130,8 +130,8 @@ message AttestationItem {
 
   message Material {
     string name = 1;
-    // This might be the raw value, the container image name, the filename and so on
-    string value = 2;
+    // Deprecated: use raw_value instead. This field cannot represent binary content.
+    string value = 2 [deprecated = true];
     // filename of the artifact that was either uploaded or injected inline in "value"
     string filename = 8;
     // Material type, i.e ARTIFACT
@@ -144,6 +144,12 @@ message AttestationItem {
     bool uploaded_to_cas = 6;
     // the content instead if inline
     bool embedded_inline = 7;
+    // Binary-safe material content. For inline artifacts, contains the raw bytes.
+    // For string materials, contains the UTF-8 encoded value.
+    // For non-inline materials (container images, uploaded artifacts), contains
+    // the filename or image reference as UTF-8.
+    // Clients should prefer this field over the deprecated string value field.
+    bytes raw_value = 10;
   }
 }
 

app/controlplane/internal/service/attestation.go

@@ -21,6 +21,7 @@ import (
 	"fmt"
 	"sort"
 	"time"
+	"unicode/utf8"
 
 	"github.com/cenkalti/backoff/v4"
 	cpAPI "github.com/chainloop-dev/chainloop/app/controlplane/api/controlplane/v1"
@@ -654,12 +655,18 @@ func extractMaterials(in []*chainloop.NormalizedMaterial) ([]*cpAPI.AttestationI
 			Type:           m.Type,
 			Filename:       m.Filename,
 			Annotations:    m.Annotations,
-			Value:          m.Value,
+			RawValue:       m.Value,
 			UploadedToCas:  m.UploadedToCAS,
 			EmbeddedInline: m.EmbeddedInline,
 			Tag:            m.Tag,
 		}
 
+		// Deprecated: maintained for backward compatibility with older CLI versions
+		// that read the string value field. Only populated when content is valid UTF-8.
+		if utf8.Valid(m.Value) {
+			materialItem.Value = string(m.Value) //nolint:staticcheck // deprecated field populated for backward compatibility
+		}
+
 		if m.Hash != nil {
 			materialItem.Hash = m.Hash.String()
 		}