()
| 248 | } |
| 249 | |
| 250 | func (r *RendererV02) predicate() (*structpb.Struct, error) { |
| 251 | normalizedMaterials, err := outputMaterials(r.att, false) |
| 252 | if err != nil { |
| 253 | return nil, fmt.Errorf("error normalizing materials: %w", err) |
| 254 | } |
| 255 | |
| 256 | evalResult, err := mappedPolicyEvaluations(r.att) |
| 257 | if err != nil { |
| 258 | return nil, fmt.Errorf("error rendering policy evaluations: %w", err) |
| 259 | } |
| 260 | |
| 261 | policyCheckBlockingStrategy := PolicyViolationBlockingStrategyAdvisory |
| 262 | if r.att.GetBlockOnPolicyViolation() { |
| 263 | policyCheckBlockingStrategy = PolicyViolationBlockingStrategyEnforced |
| 264 | } |
| 265 | |
| 266 | // An attestation is blocked when: |
| 267 | // - any of the policies marked as gate has violations |
| 268 | // - or if there are any policy violations and the attestation is configured to be blocked on violations |
| 269 | // In all cases, if the bypass flag is set, the attestation is not blocked |
| 270 | blocked := !r.att.GetBypassPolicyCheck() && (evalResult.hasGatedViolations || (evalResult.hasViolations && r.att.GetBlockOnPolicyViolation())) |
| 271 | |
| 272 | hasGates := evalResult.hasGates || policyCheckBlockingStrategy == PolicyViolationBlockingStrategyEnforced |
| 273 | |
| 274 | p := ProvenancePredicateV02{ |
| 275 | ProvenancePredicateCommon: predicateCommon(r.builder, r.att), |
| 276 | Materials: normalizedMaterials, |
| 277 | PolicyEvaluations: evalResult.evaluations, |
| 278 | PolicyEvaluationsRef: r.policyEvaluationsRef, |
| 279 | PolicyHasViolations: evalResult.hasViolations, |
| 280 | PolicyEvaluationsCount: evalResult.evaluationsCount, |
| 281 | PolicyViolationsCount: evalResult.violationsCount, |
| 282 | PolicySkippedCount: evalResult.skippedCount, |
| 283 | PolicyPassedCount: evalResult.passedCount, |
| 284 | PolicySuppressedCount: evalResult.suppressedCount, |
| 285 | PolicyHasGatedViolations: evalResult.hasGatedViolations, |
| 286 | PolicyHasGates: hasGates, |
| 287 | PolicyCheckBlockingStrategy: policyCheckBlockingStrategy, |
| 288 | PolicyBlockBypassEnabled: r.att.GetBypassPolicyCheck(), |
| 289 | PolicyAttBlocked: blocked, |
| 290 | SigningCA: r.att.GetSigningOptions().GetSigningCa(), |
| 291 | SigningTSA: r.att.GetSigningOptions().GetTimestampAuthorityUrl(), |
| 292 | } |
| 293 | |
| 294 | // transform to structpb.Struct in a two steps process |
| 295 | // 1 - ProvenancePredicate -> json |
| 296 | // 2 - json -> structpb.Struct |
| 297 | predicateJSON, err := json.Marshal(p) |
| 298 | if err != nil { |
| 299 | return nil, fmt.Errorf("error marshaling predicate: %w", err) |
| 300 | } |
| 301 | |
| 302 | predicate := &structpb.Struct{} |
| 303 | if err := protojson.Unmarshal(predicateJSON, predicate); err != nil { |
| 304 | return nil, fmt.Errorf("error unmarshaling predicate: %w", err) |
| 305 | } |
| 306 | |
| 307 | return predicate, nil |
no test coverage detected