ValidateImage executes the required method calls to evaluate a given policy against a given image url.
(ctx context.Context, comp app.SnapshotComponent, snap *app.SnapshotSpec, p policy.Policy, evaluators []evaluator.Evaluator, detailed bool)
| 39 | // ValidateImage executes the required method calls to evaluate a given policy |
| 40 | // against a given image url. |
| 41 | func ValidateImage(ctx context.Context, comp app.SnapshotComponent, snap *app.SnapshotSpec, p policy.Policy, evaluators []evaluator.Evaluator, detailed bool) (*output.Output, error) { |
| 42 | if trace.IsEnabled() { |
| 43 | region := trace.StartRegion(ctx, "ec:validate-image") |
| 44 | defer region.End() |
| 45 | trace.Logf(ctx, "", "image=%q", comp.ContainerImage) |
| 46 | } |
| 47 | |
| 48 | log.Debugf("Validating image %s", comp.ContainerImage) |
| 49 | |
| 50 | out := &output.Output{ImageURL: comp.ContainerImage, Detailed: detailed, Policy: p} |
| 51 | a, err := application_snapshot_image.NewApplicationSnapshotImage(ctx, comp, p, *snap) |
| 52 | if err != nil { |
| 53 | log.Debug("Failed to create application snapshot image!") |
| 54 | return nil, err |
| 55 | } |
| 56 | |
| 57 | out.SetImageAccessibleCheckFromError(a.ValidateImageAccess(ctx)) |
| 58 | if !out.ImageAccessibleCheck.Passed { |
| 59 | return out, nil |
| 60 | } |
| 61 | |
| 62 | if resolved, err := resolveAndSetImageUrl(ctx, comp.ContainerImage, a); err != nil { |
| 63 | return nil, err |
| 64 | } else { |
| 65 | out.ImageURL = resolved |
| 66 | } |
| 67 | |
| 68 | if err := a.FetchImageConfig(ctx); err != nil { |
| 69 | log.Debugf("Unable to fetch image config: %s", err) |
| 70 | } |
| 71 | if err := a.FetchParentImageConfig(ctx); err != nil { |
| 72 | log.Debugf("Unable to fetch parent's image config: %s", err) |
| 73 | } |
| 74 | if err := a.FetchImageFiles(ctx); err != nil { |
| 75 | log.Debugf("Unable to fetch image manifests: %s", err) |
| 76 | } |
| 77 | |
| 78 | // Handle image signature validation |
| 79 | if p.SkipImageSigCheck() { |
| 80 | log.Warn("Image signature check skipped") |
| 81 | } else { |
| 82 | out.SetImageSignatureCheckFromError(a.ValidateImageSignature(ctx)) |
| 83 | } |
| 84 | |
| 85 | // Handle attestation signature validation |
| 86 | if p.SkipAttSigCheck() { |
| 87 | log.Warn("Attestation signature check skipped, fetching attestations without verification") |
| 88 | if p.SkipImageSigCheck() { |
| 89 | log.Warn("Both --skip-image-sig-check and --skip-att-sig-check are active, all cryptographic verification is disabled") |
| 90 | } |
| 91 | if err := a.FetchAttestationsWithoutVerification(ctx); err != nil { |
| 92 | log.Warnf("Failed to fetch attestations without verification: %v", err) |
| 93 | out.SetAttestationSignatureCheckFromError(fmt.Errorf("failed to fetch attestations (signature check skipped): %w", err)) |
| 94 | return out, nil |
| 95 | } |
| 96 | } else { |
| 97 | out.SetAttestationSignatureCheckFromError(a.ValidateAttestationSignature(ctx)) |
| 98 | if !out.AttestationSignatureCheck.Passed { |