Function VerifyNotation

pkg/signutil/notationutil.go:62–98

VerifyNotation verifies an image(`rawRef`) with the pre-configured notation trust policy `hostsDirs` are used to resolve image `rawRef`

(ctx context.Context, rawRef string, hostsDirs []string)

// VerifyNotation verifies an image(`rawRef`) with the pre-configured notation trust policy
// `hostsDirs` are used to resolve image `rawRef`
func VerifyNotation(ctx context.Context, rawRef string, hostsDirs []string) (string, error) {
	digest, err := imgutil.ResolveDigest(ctx, rawRef, false, hostsDirs)
	if err != nil {
		log.G(ctx).WithError(err).Errorf("unable to resolve digest for an image %s: %v", rawRef, err)
		return rawRef, err
	}
	ref := rawRef
	if !strings.Contains(ref, "@") {
		ref += "@" + digest
	}

	log.G(ctx).Debugf("verifying image: %s", ref)

	notationExecutable, err := exec.LookPath("notation")
	if err != nil {
		log.G(ctx).WithError(err).Error("notation executable not found in path $PATH")
		log.G(ctx).Info("you might consider installing notation from: https://notaryproject.dev/docs/installation/cli/")
		return ref, err
	}

	notationCmd := exec.Command(notationExecutable, []string{"verify"}...)
	notationCmd.Env = os.Environ()

	notationCmd.Args = append(notationCmd.Args, ref)

	log.G(ctx).Debugf("running %s %v", notationExecutable, notationCmd.Args)

	err = processNotationIO(notationCmd)
	if err != nil {
		return ref, err
	}
	if err := notationCmd.Wait(); err != nil {
		return ref, err
	}

	return ref, nil
}

func processNotationIO(notationCmd *exec.Cmd) error {
	stdout, err := notationCmd.StdoutPipe()