Function processVSAResult

cmd/validate/vsa.go:803–840

processVSAResult processes a VSA validation result and updates the image status and aggregated data

(vsaResult *vsa.ValidationResult, imgStatus *ImageStatus, data *AllSectionsData, shortDigest string)

// processVSAResult processes a VSA validation result and updates the image status and aggregated data
func processVSAResult(vsaResult *vsa.ValidationResult, imgStatus *ImageStatus, data *AllSectionsData, shortDigest string) {
	if vsaResult.Passed {
		imgStatus.VSAStatus = "PASSED"
		data.VSAPassed++
	} else {
		reason := extractFallbackReason(vsaResult)
		imgStatus.VSAStatus = fmt.Sprintf("FAILED(reason=%s)", reason)
		data.VSAFailed++
		data.FallbackReasons[reason] = true
	}

	// Aggregate signature status
	// When SignatureVerified is false, mark as NOT VERIFIED
	// This covers both cases: signature verification failure and retrieval failure (no VSA to verify)
	if !vsaResult.SignatureVerified {
		data.SignatureStatus = "NOT VERIFIED"
	}

	// Aggregate predicate status
	if vsaResult.PredicateOutcome == "passed" {
		data.PredicatePassed++
	} else if vsaResult.PredicateOutcome != "" {
		data.PredicateFailed++
	}

	// Check for policy diff using structured fields (preferred) or message parsing (fallback)
	added, removed, changed, hasDiff := parsePolicyDiffFromMessage(vsaResult)
	if hasDiff {
		data.HasPolicyDiff = true
		data.AffectedImages = append(data.AffectedImages, shortDigest)
		data.PolicyDiffCounts[shortDigest] = PolicyDiffCounts{
			Added: added, Removed: removed, Changed: changed,
		}
		data.PolicyMismatches++
	} else if vsaResult.Passed {
		data.PolicyMatches++
	}
}

// aggregateAllSectionsData - Single pass aggregation, collects all data needed
func aggregateAllSectionsData(allResults []vsa.ComponentResult) AllSectionsData {