Method run

pkg/cmd/plugin_verify.go:70–124

(out io.Writer)

}

func (o *pluginVerifyOptions) run(out io.Writer) error {
	// Verify the plugin path exists
	fi, err := os.Stat(o.pluginPath)
	if err != nil {
		return err
	}

	// Only support tarball verification
	if fi.IsDir() {
		return errors.New("directory verification not supported - only plugin tarballs can be verified")
	}

	// Verify it's a tarball
	if !plugin.IsTarball(o.pluginPath) {
		return errors.New("plugin file must be a gzipped tarball (.tar.gz or .tgz)")
	}

	// Look for provenance file
	provFile := o.pluginPath + ".prov"
	if _, err := os.Stat(provFile); err != nil {
		return fmt.Errorf("could not find provenance file %s: %w", provFile, err)
	}

	// Read the files
	archiveData, err := os.ReadFile(o.pluginPath)
	if err != nil {
		return fmt.Errorf("failed to read plugin file: %w", err)
	}

	provData, err := os.ReadFile(provFile)
	if err != nil {
		return fmt.Errorf("failed to read provenance file: %w", err)
	}

	// Verify the plugin using data
	verification, err := plugin.VerifyPlugin(archiveData, provData, filepath.Base(o.pluginPath), o.keyring)
	if err != nil {
		return err
	}

	// Output verification details
	for name := range verification.SignedBy.Identities {
		fmt.Fprintf(out, "Signed by: %v\n", name)
	}
	fmt.Fprintf(out, "Using Key With Fingerprint: %X\n", verification.SignedBy.PrimaryKey.Fingerprint)

	// Only show hash for tarballs
	if verification.FileHash != "" {
		fmt.Fprintf(out, "Plugin Hash Verified: %s\n", verification.FileHash)
	} else {
		fmt.Fprintf(out, "Plugin Metadata Verified: %s\n", verification.FileName)
	}

	return nil
}