Method VerifyStatement

pkg/policies/policies.go:573–610

VerifyStatement verifies that the statement is compliant with the policies present in the schema

(ctx context.Context, statement *intoto.Statement)

// VerifyStatement verifies that the statement is compliant with the policies present in the schema
func (pv *PolicyVerifier) VerifyStatement(ctx context.Context, statement *intoto.Statement) ([]*v12.PolicyEvaluation, error) {
	policies := pv.policies.GetAttestation()

	// Marshal statement once — it's read-only input shared across evaluations
	statementJSON, err := protojson.Marshal(statement)
	if err != nil {
		return nil, NewPolicyError(err)
	}

	results := make([]*v12.PolicyEvaluation, len(policies))
	g, gCtx := errgroup.WithContext(ctx)
	g.SetLimit(pv.maxConcurrency)

	for i, policyAtt := range policies {
		g.Go(func() error {
			ev, err := pv.evaluatePolicyAttachment(gCtx, policyAtt, statementJSON, &evalOpts{kind: v1.CraftingSchema_Material_ATTESTATION})
			if err != nil {
				return NewPolicyError(err)
			}
			results[i] = ev
			return nil
		})
	}

	if err := g.Wait(); err != nil {
		return nil, err
	}

	// Filter nil entries (skipped policies)
	result := make([]*v12.PolicyEvaluation, 0, len(policies))
	for _, ev := range results {
		if ev != nil {
			result = append(result, ev)
		}
	}

	return result, nil
}

func (pv *PolicyVerifier) executeScript(ctx context.Context, script *engine.Policy, material []byte, args map[string]string) (*engine.EvaluationResult, error) {
	// Detect policy type