| 158 | } |
| 159 | |
| 160 | func runInspect(opts *Options) error { |
| 161 | attestations, err := verification.GetLocalAttestations(opts.BundlePath) |
| 162 | if err != nil { |
| 163 | return fmt.Errorf("failed to read attestations") |
| 164 | } |
| 165 | |
| 166 | inspectedBundles := []BundleInspection{} |
| 167 | unsafeSigstorePolicy := verify.NewPolicy(verify.WithoutArtifactUnsafe(), verify.WithoutIdentitiesUnsafe()) |
| 168 | |
| 169 | for _, a := range attestations { |
| 170 | inspectedBundle := BundleInspection{} |
| 171 | |
| 172 | // we ditch the verificationResult to avoid even implying that it is "verified" |
| 173 | // you can't meaningfully "verify" a bundle with such an Unsafe policy! |
| 174 | _, err := opts.SigstoreVerifier.Verify([]*api.Attestation{a}, unsafeSigstorePolicy) |
| 175 | |
| 176 | // food for thought for later iterations: |
| 177 | // if the err is present, we keep on going because we want to be able to |
| 178 | // inspect bundles we might not have trusted materials for. |
| 179 | // but maybe we should print the error? |
| 180 | if err == nil { |
| 181 | inspectedBundle.Authentic = true |
| 182 | } |
| 183 | |
| 184 | entity := a.Bundle |
| 185 | verificationContent, err := entity.VerificationContent() |
| 186 | if err != nil { |
| 187 | return fmt.Errorf("failed to fetch verification content: %w", err) |
| 188 | } |
| 189 | |
| 190 | // summarize cert if present |
| 191 | if leafCert := verificationContent.Certificate(); leafCert != nil { |
| 192 | |
| 193 | certSummary, err := certificate.SummarizeCertificate(leafCert) |
| 194 | if err != nil { |
| 195 | return fmt.Errorf("failed to summarize certificate: %w", err) |
| 196 | } |
| 197 | |
| 198 | inspectedBundle.Certificate = CertificateInspection{ |
| 199 | Summary: certSummary, |
| 200 | NotBefore: leafCert.NotBefore, |
| 201 | NotAfter: leafCert.NotAfter, |
| 202 | } |
| 203 | |
| 204 | } |
| 205 | |
| 206 | // parse the sig content and pop the statement |
| 207 | sigContent, err := entity.SignatureContent() |
| 208 | if err != nil { |
| 209 | return fmt.Errorf("failed to fetch signature content: %w", err) |
| 210 | } |
| 211 | |
| 212 | if envelope := sigContent.EnvelopeContent(); envelope != nil { |
| 213 | stmt, err := envelope.Statement() |
| 214 | if err != nil { |
| 215 | return fmt.Errorf("failed to fetch envelope statement: %w", err) |
| 216 | } |
| 217 | |