(ctx context.Context, script *engine.Policy, material []byte, args map[string]string)
| 610 | } |
| 611 | |
| 612 | func (pv *PolicyVerifier) executeScript(ctx context.Context, script *engine.Policy, material []byte, args map[string]string) (*engine.EvaluationResult, error) { |
| 613 | // Detect policy type |
| 614 | policyType := engine.DetectPolicyType(script.Source) |
| 615 | |
| 616 | pv.logger.Debug().Str("policy", script.Name).Str("type", string(policyType)).Msg("executing policy") |
| 617 | |
| 618 | // Create appropriate engine |
| 619 | var policyEngine engine.PolicyEngine |
| 620 | var err error |
| 621 | |
| 622 | // Build engine options that apply to both engine types |
| 623 | var opts []engine.Option |
| 624 | |
| 625 | if pv.allowedHostnames != nil { |
| 626 | pv.logger.Debug().Strs("hostnames", pv.allowedHostnames).Msg("adding additional allowed hostnames") |
| 627 | opts = append(opts, engine.WithAllowedHostnames(pv.allowedHostnames...)) |
| 628 | } |
| 629 | |
| 630 | if pv.includeRawData { |
| 631 | opts = append(opts, engine.WithIncludeRawData(true)) |
| 632 | } |
| 633 | |
| 634 | if pv.enablePrint { |
| 635 | opts = append(opts, engine.WithEnablePrint(true)) |
| 636 | } |
| 637 | |
| 638 | if pv.logger != nil { |
| 639 | opts = append(opts, engine.WithLogger(pv.logger)) |
| 640 | } |
| 641 | |
| 642 | if pv.grpcConn != nil { |
| 643 | opts = append(opts, engine.WithGRPCConn(pv.grpcConn)) |
| 644 | } |
| 645 | |
| 646 | if pv.projectName != "" || pv.projectVersionName != "" { |
| 647 | opts = append(opts, engine.WithProjectContext(pv.projectName, pv.projectVersionName)) |
| 648 | } |
| 649 | |
| 650 | switch policyType { |
| 651 | case engine.PolicyTypeRego: |
| 652 | policyEngine = rego.NewEngine(opts...) |
| 653 | case engine.PolicyTypeWASM: |
| 654 | policyEngine = wasm.NewEngine(opts...) |
| 655 | |
| 656 | default: |
| 657 | return nil, fmt.Errorf("unknown policy type: %s", policyType) |
| 658 | } |
| 659 | |
| 660 | // Convert args from map[string]string to map[string]any |
| 661 | argsAny := getInputArguments(args) |
| 662 | |
| 663 | // Execute using the selected engine |
| 664 | res, err := policyEngine.Verify(ctx, script, material, argsAny) |
| 665 | if err != nil { |
| 666 | // Gracefully degrade when a policy references a chainloop.* builtin that this |
| 667 | // client version doesn't have registered (e.g., chainloop.vulnerability on an |
| 668 | // older CLI). Mark as skipped so the attestation can proceed. |
| 669 | // Intentionally blocked OPA functions (opa.runtime, trace, etc.) are NOT |
no test coverage detected