Method VerifyMaterial

pkg/policies/policies.go:241–297

VerifyMaterial applies all required policies to a material

(ctx context.Context, material *v12.Attestation_Material, artifactPath string)

// VerifyMaterial applies all required policies to a material
func (pv *PolicyVerifier) VerifyMaterial(ctx context.Context, material *v12.Attestation_Material, artifactPath string) ([]*v12.PolicyEvaluation, error) {
	result := make([]*v12.PolicyEvaluation, 0)

	attachments, err := pv.requiredPoliciesForMaterial(ctx, material)
	if err != nil {
		return nil, NewPolicyError(err)
	}

	if len(attachments) == 0 {
		return result, nil
	}

	// Load material content
	subject, err := material.GetEvaluableContent(artifactPath)
	if err != nil {
		return nil, NewPolicyError(err)
	}

	// Track which scoped runtime inputs matched a policy so we can warn about
	// scopes that matched nothing (e.g. a typo in the policy name).
	tracker := newScopeTracker()

	results := make([]*v12.PolicyEvaluation, len(attachments))
	g, gCtx := errgroup.WithContext(ctx)
	g.SetLimit(pv.maxConcurrency)

	for i, attachment := range attachments {
		g.Go(func() error {
			ev, err := pv.evaluatePolicyAttachment(gCtx, attachment, subject,
				&evalOpts{kind: material.MaterialType, name: material.GetId(), runtimeInputs: pv.runtimeInputs, scopeTracker: tracker},
			)
			if err != nil {
				return NewPolicyError(err)
			}
			results[i] = ev
			return nil
		})
	}

	if err := g.Wait(); err != nil {
		return nil, err
	}

	for _, scope := range tracker.unmatched(pv.runtimeInputs) {
		pv.logger.Warn().Str("scope", scope).Str("material", material.GetId()).
			Msg("policy input scoped to a policy that matched no attachment for this material — check the policy name")
	}

	// Filter nil entries (skipped policies)
	for _, ev := range results {
		if ev != nil {
			result = append(result, ev)
		}
	}

	return result, nil
}