(pol *v1.Policies, material *v12.Attestation_Material, materialPath string, debug bool, allowedHostnames []string, attestationClient controlplanev1.AttestationServiceClient, grpcConn *grpc.ClientConn, projectName, projectVersion string, logger *zerolog.Logger)
| 111 | } |
| 112 | |
| 113 | func verifyMaterial(pol *v1.Policies, material *v12.Attestation_Material, materialPath string, debug bool, allowedHostnames []string, attestationClient controlplanev1.AttestationServiceClient, grpcConn *grpc.ClientConn, projectName, projectVersion string, logger *zerolog.Logger) (*EvalSummary, error) { |
| 114 | var opts []policies.PolicyVerifierOption |
| 115 | if len(allowedHostnames) > 0 { |
| 116 | opts = append(opts, policies.WithAllowedHostnames(allowedHostnames...)) |
| 117 | } |
| 118 | |
| 119 | opts = append(opts, policies.WithIncludeRawData(debug)) |
| 120 | opts = append(opts, policies.WithEnablePrint(enablePrint)) |
| 121 | opts = append(opts, policies.WithGRPCConn(grpcConn)) |
| 122 | if projectName != "" || projectVersion != "" { |
| 123 | opts = append(opts, policies.WithProjectContext(projectName, projectVersion)) |
| 124 | } |
| 125 | |
| 126 | v := policies.NewPolicyVerifier(pol, attestationClient, logger, opts...) |
| 127 | policyEvs, err := v.VerifyMaterial(context.Background(), material, materialPath) |
| 128 | if err != nil { |
| 129 | return nil, err |
| 130 | } |
| 131 | |
| 132 | if len(policyEvs) == 0 || policyEvs[0] == nil { |
| 133 | return nil, fmt.Errorf("no execution branch matched, or all of them were ignored, for kind %s", material.MaterialType.String()) |
| 134 | } |
| 135 | |
| 136 | // Only one evaluation expected for a single policy attachment |
| 137 | policyEv := policyEvs[0] |
| 138 | |
| 139 | summary := &EvalSummary{ |
| 140 | Result: &EvalResult{ |
| 141 | Skipped: policyEv.GetSkipped(), |
| 142 | SkipReasons: policyEv.SkipReasons, |
| 143 | Violations: make([]string, 0, len(policyEv.Violations)), |
| 144 | }, |
| 145 | } |
| 146 | |
| 147 | // Split violations into string messages and structured findings. |
| 148 | // "violations" contains the message strings (what old CLIs see). |
| 149 | // "findings" contains the full structured data when present. |
| 150 | marshaler := protojson.MarshalOptions{UseProtoNames: true} |
| 151 | for _, v := range policyEv.Violations { |
| 152 | summary.Result.Violations = append(summary.Result.Violations, v.GetMessage()) |
| 153 | |
| 154 | if f := v.GetFinding(); f != nil { |
| 155 | // Clone to clear subject before marshaling |
| 156 | vc := proto.Clone(v).(*v12.PolicyEvaluation_Violation) |
| 157 | vc.Subject = "" |
| 158 | vc.Message = "" |
| 159 | |
| 160 | b, err := marshaler.Marshal(vc) |
| 161 | if err != nil { |
| 162 | return nil, fmt.Errorf("marshaling finding: %w", err) |
| 163 | } |
| 164 | summary.Result.Findings = append(summary.Result.Findings, b) |
| 165 | } |
| 166 | } |
| 167 | |
| 168 | // Include raw debug info if requested |
| 169 | if debug { |
| 170 | summary.DebugInfo = &EvalSummaryDebugInfo{ |
no test coverage detected