(ctx context.Context, content []byte, opts *ActionsOpts)
| 45 | } |
| 46 | |
| 47 | func verifyBundle(ctx context.Context, content []byte, opts *ActionsOpts) (bool, error) { |
| 48 | sc := pb.NewSigningServiceClient(opts.CPConnection) |
| 49 | trResp, err := sc.GetTrustedRoot(ctx, &pb.GetTrustedRootRequest{}) |
| 50 | if err != nil { |
| 51 | // if trusted root is not implemented, skip verification |
| 52 | if status.Code(err) != codes.Unimplemented { |
| 53 | return false, fmt.Errorf("failed getting trusted root: %w", err) |
| 54 | } |
| 55 | } |
| 56 | |
| 57 | if trResp != nil { |
| 58 | tr, err := trustedRootPbToVerifier(trResp) |
| 59 | if err != nil { |
| 60 | return false, fmt.Errorf("getting roots: %w", err) |
| 61 | } |
| 62 | if err = verifier.VerifyBundle(ctx, content, tr); err != nil { |
| 63 | if !errors.Is(err, verifier.ErrMissingVerificationMaterial) { |
| 64 | opts.Logger.Debug().Err(err).Msg("bundle verification failed") |
| 65 | return false, errors.New("bundle verification failed") |
| 66 | } |
| 67 | } else { |
| 68 | return true, nil |
| 69 | } |
| 70 | } |
| 71 | |
| 72 | return false, nil |
| 73 | } |
no test coverage detected