diff --git a/cmd/cosign/cli/verify/verify_attestation.go b/cmd/cosign/cli/verify/verify_attestation.go index cde32f683cf..01ea6e044bd 100644 --- a/cmd/cosign/cli/verify/verify_attestation.go +++ b/cmd/cosign/cli/verify/verify_attestation.go @@ -201,6 +201,7 @@ func (c *VerifyAttestationCommand) Exec(ctx context.Context, images []string) (e } } + var checked []oci.Signature var validationErrors []error for _, vp := range verified { payload, err := policy.AttestationToPayloadJSON(ctx, c.PredicateType, vp) @@ -217,6 +218,7 @@ func (c *VerifyAttestationCommand) Exec(ctx context.Context, images []string) (e cueValidationErr := cue.ValidateJSON(payload, cuePolicies) if cueValidationErr != nil { validationErrors = append(validationErrors, cueValidationErr) + continue } } @@ -225,8 +227,11 @@ func (c *VerifyAttestationCommand) Exec(ctx context.Context, images []string) (e regoValidationErrs := rego.ValidateJSON(payload, regoPolicies) if len(regoValidationErrs) > 0 { validationErrors = append(validationErrors, regoValidationErrs...) + continue } } + + checked = append(checked, vp) } if len(validationErrors) > 0 { @@ -237,10 +242,14 @@ func (c *VerifyAttestationCommand) Exec(ctx context.Context, images []string) (e return fmt.Errorf("%d validation errors occurred", len(validationErrors)) } + if len(checked) == 0 { + return fmt.Errorf("none of the attestations matched the predicate type: %s", c.PredicateType) + } + // TODO: add CUE validation report to `PrintVerificationHeader`. PrintVerificationHeader(imageRef, co, bundleVerified, fulcioVerified) // The attestations are always JSON, so use the raw "text" mode for outputting them instead of conversion - PrintVerification(imageRef, verified, "text") + PrintVerification(imageRef, checked, "text") } return nil