runValidateVSA is the main command execution function
(cmd *cobra.Command, data *validateVSAData, args []string)
| 262 | |
| 263 | // runValidateVSA is the main command execution function |
| 264 | func runValidateVSA(cmd *cobra.Command, data *validateVSAData, args []string) error { |
| 265 | ctx := cmd.Context() |
| 266 | |
| 267 | // Set color support based on flags |
| 268 | utils.SetColorEnabled(data.noColor, data.forceColor) |
| 269 | |
| 270 | // Get show-policy-docs-link flag value |
| 271 | data.showPolicyDocsLink, _ = cmd.Flags().GetBool("show-policy-docs-link") |
| 272 | |
| 273 | // Parse VSA expiration |
| 274 | if err := parseVSAExpiration(data); err != nil { |
| 275 | return err |
| 276 | } |
| 277 | |
| 278 | // Load policy configuration |
| 279 | if err := loadPolicyConfig(ctx, data); err != nil { |
| 280 | return err |
| 281 | } |
| 282 | |
| 283 | // Precompute fallback validation context if fallback is enabled |
| 284 | if data.fallbackToImageValidation { |
| 285 | // Use the same resolved policy configuration as the main validation |
| 286 | policyConfiguration, err := validate_utils.GetPolicyConfig(ctx, data.policyConfig) |
| 287 | if err != nil { |
| 288 | return fmt.Errorf("failed to get policy configuration for fallback: %w", err) |
| 289 | } |
| 290 | |
| 291 | fallbackConfig := &vsa.FallbackConfig{ |
| 292 | FallbackToImageValidation: data.fallbackToImageValidation, |
| 293 | FallbackPublicKey: data.fallbackPublicKey, |
| 294 | PolicyConfig: policyConfiguration, // Use resolved policy configuration |
| 295 | EffectiveTime: data.effectiveTime, |
| 296 | Info: data.info, |
| 297 | } |
| 298 | fallbackContext, err := vsa.CreateFallbackValidationContext(ctx, fallbackConfig) |
| 299 | if err != nil { |
| 300 | return fmt.Errorf("failed to create fallback validation context: %w", err) |
| 301 | } |
| 302 | data.fallbackContext = fallbackContext |
| 303 | } |
| 304 | |
| 305 | // Create VSA retriever |
| 306 | retriever, err := vsa.CreateVSARetriever(data.vsaRetrieval, data.vsaIdentifier, data.images) |
| 307 | if err != nil { |
| 308 | return err |
| 309 | } |
| 310 | data.retriever = retriever |
| 311 | |
| 312 | // Process validation |
| 313 | // Normalize input to SnapshotSpec using DetermineInputSpec (same as validate image) |
| 314 | // This unifies --images and single identifier handling |
| 315 | identifier := extractVSAIdentifier(data, args) |
| 316 | |
| 317 | // Use DetermineInputSpec to normalize input (supports both --images and single identifier) |
| 318 | snapshot, _, err := applicationsnapshot.DetermineInputSpec(ctx, applicationsnapshot.Input{ |
| 319 | Image: identifier, // Single VSA identifier |
| 320 | Images: data.images, // Snapshot file/JSON string |
| 321 | }) |