| 143 | } |
| 144 | |
| 145 | func NewValidateVSACmd() *cobra.Command { |
| 146 | data := &validateVSAData{ |
| 147 | strict: DefaultStrictMode, |
| 148 | effectiveTime: DefaultEffectiveTime, |
| 149 | vsaExpirationStr: DefaultVSAExpiration, |
| 150 | vsaExpiration: 168 * time.Hour, // 7 days default |
| 151 | workers: DefaultWorkers, |
| 152 | fallbackToImageValidation: DefaultFallbackEnabled, |
| 153 | } |
| 154 | |
| 155 | cmd := &cobra.Command{ |
| 156 | Use: "vsa <vsa-identifier>", |
| 157 | Short: "Validate VSA (Verification Summary Attestation)", |
| 158 | Long: hd.Doc(` |
| 159 | Validate VSA by comparing the embedded policy against a supplied policy configuration. |
| 160 | |
| 161 | By default, VSA signature verification is enabled and requires a public key. |
| 162 | Use --ignore-signature-verification to disable signature verification. |
| 163 | |
| 164 | By default, fallback to image validation is enabled when VSA validation fails. |
| 165 | Use --no-fallback to disable this behavior. |
| 166 | |
| 167 | Supports validation of: |
| 168 | - Single VSA by identifier (image digest, file path) |
| 169 | - Multiple VSAs from application snapshot |
| 170 | |
| 171 | VSA retrieval supports: |
| 172 | - Rekor transparency log |
| 173 | - Local filesystem storage |
| 174 | - Multiple backends with fallback |
| 175 | `), |
| 176 | // Check positional arguments |
| 177 | // Example: ec validate vsa image1@sha256:abc123 --policy policy.yaml --vsa-public-key key.pub |
| 178 | Args: func(cmd *cobra.Command, args []string) error { |
| 179 | // Custom argument validation using Cobra's Args field |
| 180 | if len(args) > 1 { |
| 181 | return fmt.Errorf("too many arguments provided") |
| 182 | } |
| 183 | |
| 184 | // Validate VSA identifier format if provided |
| 185 | if len(args) == 1 { |
| 186 | identifier := args[0] |
| 187 | if !vsa.IsValidVSAIdentifier(identifier) { |
| 188 | return fmt.Errorf("invalid VSA identifier format: %s", identifier) |
| 189 | } |
| 190 | } |
| 191 | |
| 192 | return nil |
| 193 | }, |
| 194 | PreRunE: func(cmd *cobra.Command, args []string) error { |
| 195 | // Compute fallback behavior: enabled by default, disabled if --no-fallback is set |
| 196 | data.fallbackToImageValidation = !data.noFallback |
| 197 | |
| 198 | return validateVSAInput(data, args) |
| 199 | }, |
| 200 | RunE: func(cmd *cobra.Command, args []string) error { |
| 201 | return runValidateVSA(cmd, data, args) |
| 202 | }, |