| 141 | } |
| 142 | |
| 143 | func (pgv *PolicyGroupVerifier) VerifyStatement(ctx context.Context, statement *intoto.Statement) ([]*api.PolicyEvaluation, error) { |
| 144 | result := make([]*api.PolicyEvaluation, 0) |
| 145 | attachments := pgv.policyGroups |
| 146 | for _, groupAtt := range attachments { |
| 147 | group, desc, err := LoadPolicyGroup(ctx, groupAtt, &LoadPolicyGroupOptions{ |
| 148 | Client: pgv.client, |
| 149 | Logger: pgv.logger, |
| 150 | GroupCache: pgv.groupCache, |
| 151 | }) |
| 152 | if err != nil { |
| 153 | // Temporarily skip if policy groups still use old schema |
| 154 | // TODO: remove this check in next release |
| 155 | pgv.logger.Warn().Msgf("policy group '%s' skipped since it's not found or it might use an old schema version", groupAtt.GetRef()) |
| 156 | continue |
| 157 | } |
| 158 | // compute group arguments |
| 159 | groupArgs, err := ComputeArguments(group.GetMetadata().GetName(), group.GetSpec().GetInputs(), groupAtt.GetWith(), nil, pgv.logger) |
| 160 | if err != nil { |
| 161 | return nil, NewPolicyError(err) |
| 162 | } |
| 163 | |
| 164 | // Marshal statement once for all policies in this group |
| 165 | statementJSON, err := protojson.Marshal(statement) |
| 166 | if err != nil { |
| 167 | return nil, NewPolicyError(err) |
| 168 | } |
| 169 | |
| 170 | attestationPolicies := group.GetSpec().GetPolicies().GetAttestation() |
| 171 | groupResults := make([]*api.PolicyEvaluation, len(attestationPolicies)) |
| 172 | g, gCtx := errgroup.WithContext(ctx) |
| 173 | g.SetLimit(pgv.maxConcurrency) |
| 174 | |
| 175 | for i, attachment := range attestationPolicies { |
| 176 | g.Go(func() error { |
| 177 | // Check if policy should be skipped |
| 178 | skip, policyName, err := pgv.shouldSkipPolicy(gCtx, attachment, groupAtt.GetSkip()) |
| 179 | if err != nil { |
| 180 | return NewPolicyError(fmt.Errorf("failed to check if policy should be skipped: %w", err)) |
| 181 | } |
| 182 | |
| 183 | if skip { |
| 184 | pgv.logger.Debug().Str("policy", policyName).Msg("skipping attestation policy per skip list") |
| 185 | return nil |
| 186 | } |
| 187 | |
| 188 | ev, err := pgv.evaluatePolicyAttachment(gCtx, applyGroupGate(attachment, groupAtt), statementJSON, |
| 189 | &evalOpts{kind: v1.CraftingSchema_Material_ATTESTATION, bindings: groupArgs}, |
| 190 | ) |
| 191 | if err != nil { |
| 192 | return NewPolicyError(err) |
| 193 | } |
| 194 | |
| 195 | if ev != nil { |
| 196 | // Assign group reference to this evaluation |
| 197 | ev.GroupReference = &api.PolicyEvaluation_Reference{ |
| 198 | Name: group.GetMetadata().GetName(), |
| 199 | Digest: desc.GetDigest(), |
| 200 | Uri: desc.GetURI(), |