Check if this attachment can be applied to a material, following these rules: 1. if the policy supports the material type, it can be applied 2. if the policy doesn't have any specified type (rare, but supported), it can only be applied if the attachment has a selector with the same name as the mater
(ctx context.Context, policyAtt *v1.PolicyAttachment, material *v12.Attestation_Material)
| 941 | // 2. if the policy doesn't have any specified type (rare, but supported), it can only be applied if the attachment has a selector with the same name as the material |
| 942 | // 3. otherwise, it cannot be applied |
| 943 | func (pv *PolicyVerifier) shouldApplyPolicy(ctx context.Context, policyAtt *v1.PolicyAttachment, material *v12.Attestation_Material) (bool, error) { |
| 944 | // load the policy spec |
| 945 | spec, _, err := pv.loadPolicySpec(ctx, policyAtt) |
| 946 | if err != nil { |
| 947 | return false, fmt.Errorf("failed to load policy attachment %q: %w", policyAtt.GetRef(), err) |
| 948 | } |
| 949 | |
| 950 | materialType := material.GetMaterialType() |
| 951 | filteredName := policyAtt.GetSelector().GetName() |
| 952 | specTypes := getPolicyTypes(spec) |
| 953 | |
| 954 | // if spec has a type, and it's different to the material type, skip |
| 955 | if len(specTypes) > 0 && !slices.Contains(specTypes, materialType) { |
| 956 | // types don't match, continue |
| 957 | return false, nil |
| 958 | } |
| 959 | |
| 960 | if filteredName != "" && filteredName != material.GetId() { |
| 961 | // a filer exists and doesn't match |
| 962 | return false, nil |
| 963 | } |
| 964 | |
| 965 | // no type nor name to match, we can't guess anything |
| 966 | if len(specTypes) == 0 && filteredName == "" { |
| 967 | return false, nil |
| 968 | } |
| 969 | |
| 970 | return true, nil |
| 971 | } |
| 972 | |
| 973 | func getPolicyTypes(p *v1.Policy) []v1.CraftingSchema_Material_MaterialType { |
| 974 | policyTypes := make([]v1.CraftingSchema_Material_MaterialType, 0) |
no test coverage detected