validateVSAInput validates the command input using Cobra's validation patterns
(data *validateVSAData, args []string)
| 340 | |
| 341 | // validateVSAInput validates the command input using Cobra's validation patterns |
| 342 | func validateVSAInput(data *validateVSAData, args []string) error { |
| 343 | // Set VSA identifier from args if provided |
| 344 | if len(args) > 0 { |
| 345 | data.vsaIdentifier = args[0] |
| 346 | } |
| 347 | |
| 348 | // Check if we have either VSA identifier, --vsa, or --images |
| 349 | if data.vsaIdentifier == "" && data.images == "" { |
| 350 | return fmt.Errorf("either --vsa, --images, or VSA identifier must be provided") |
| 351 | } |
| 352 | |
| 353 | // Validate VSA expiration format early |
| 354 | if err := parseVSAExpiration(data); err != nil { |
| 355 | return fmt.Errorf("invalid --vsa-expiration: %w", err) |
| 356 | } |
| 357 | |
| 358 | // Validate signature verification flags |
| 359 | // By default, signature verification is enabled, so vsa-public-key is required unless --ignore-signature-verification is set |
| 360 | if !data.ignoreSignatureVerification && data.publicKeyPath == "" { |
| 361 | return fmt.Errorf("--vsa-public-key is required for signature verification (use --ignore-signature-verification to disable signature verification)") |
| 362 | } |
| 363 | |
| 364 | // Validate fallback flags |
| 365 | if data.fallbackToImageValidation && data.fallbackPublicKey == "" { |
| 366 | return fmt.Errorf("--fallback-public-key is required when --fallback-to-image-validation is enabled") |
| 367 | } |
| 368 | |
| 369 | // Validate that fallback only works with image references |
| 370 | if data.fallbackToImageValidation && data.vsaIdentifier != "" { |
| 371 | identifierType := vsa.DetectIdentifierType(data.vsaIdentifier) |
| 372 | |
| 373 | // Check if it's actually a file path (even if detected as image reference due to name.ParseReference bug) |
| 374 | if vsa.IsFilePathLike(data.vsaIdentifier) { |
| 375 | return fmt.Errorf("fallback not supported for file paths (identifier: %s)", data.vsaIdentifier) |
| 376 | } |
| 377 | |
| 378 | if identifierType != vsa.IdentifierImageReference && identifierType != vsa.IdentifierImageDigest { |
| 379 | return fmt.Errorf("fallback only supported for image references and digests, not %v (identifier: %s)", identifierType, data.vsaIdentifier) |
| 380 | } |
| 381 | } |
| 382 | |
| 383 | return nil |
| 384 | } |
| 385 | |
| 386 | // parseVSAExpiration parses the VSA expiration string into a duration |
| 387 | func parseVSAExpiration(data *validateVSAData) error { |