Repository: deislabs/ratify (go)

Issue:
Update the timeout for default failure to avoid false positives
Ratify should default failure. 
https://github.com/deislabs/ratify/blob/efe40f7e9bed136f03f21885443b9f82aa27e3b0/pkg/executor/core/executor.go#L36
Currently the timeout is 8 seconds and so gatekeeper will fail and let the deployment through. 

1. Update timeout to a shorter interval to fail the deployment. 
2. Ensure that the signature is still requested so that the next deployment can succeed with a cached request. 

Pull request:
[Bugfix] Updating default timeout
Fixes #92 

Root Cause:

- The Gatekeeper validating webhook timeout is set to 3 seconds while the current verification timeout is 8 seconds
- A longer running verification process will cause the Gatekeeper webhook to timeout and cancel the context
- The error will be emitted but code structure will short circuit to success. 

Solution: 
- Set timeout to be less than or equal to the webhook timeout (3 seconds). Verifier will timeout before webhook does and block the deployment as expected. 

Validation Steps:
1. Update notaryv2 plugin to sleep for time > 3 seconds
2. Attempt to deploy signed image. 
3. Deployment is blocked with error message: `Error from server ([ratify-constraint] Image verification failed : {"errors": [], "responses": [], "status_code": 200, "system_error": "validate operation failed with error operation timed out after duration 3s"}): admission webhook "validation.gatekeeper.sh" denied the request: [ratify-constraint] Image verification failed : {"errors": [], "responses": [], "status_code": 200, "system_error": "validate operation failed with error operation timed out after duration 3s"}`

Patch:
diff --git a/README.md b/README.md
index dbcc64e..21b6758 100644
--- a/README.md
+++ b/README.md
@@ -82,6 +82,8 @@ kubectl delete namespace demo
 The [docs](docs/README.md) folder contains the beginnings of a formal
 specification for the Reference Artifact Verification framework and its plugin model.
 
+Meeting notes for weekly project syncs can be found [here](https://hackmd.io/ABueHjizRz2iFQpWnQrnNA?both)
+
 ## Code of Conduct
 
 This project has adopted the [Microsoft Open Source Code of
diff --git a/charts/ratify/templates/configmap.yaml b/charts/ratify/templates/configmap.yaml
index bbaaebe..203998e 100644
--- a/charts/ratify/templates/configmap.yaml
+++ b/charts/ratify/templates/configmap.yaml
@@ -10,6 +10,9 @@ data:
         "plugins": [
             {
                 "name": "oras",
+                {{- if .Values.cosign.enabled }}
+                "cosign-enabled": true,
+                {{- end }}
                 "localCachePath": "./local_oras_cache"
             }
         ]
@@ -29,6 +32,13 @@ data:
                 "verificationCerts": [
                     "/usr/local/ratify-certs/ratify-test.crt"
                   ]
+            {{- if .Values.cosign.enabled }}
+            },
+            {
+                "name": "cosign",
+                "artifactTypes": "org.sigstore.cosign.v1",
+                "key": "/usr/local/ratify-certs/cosign.pub"
+            {{- end }}
             }
           ]
       }
diff --git a/charts/ratify/templates/secret.yaml b/charts/ratify/templates/secret.yaml
index a6ad222..47ade8a 100644
--- a/charts/ratify/templates/secret.yaml
+++ b/charts/ratify/templates/secret.yaml
@@ -4,3 +4,6 @@ metadata:
   name: {{ include "ratify.fullname" . }}-certificate
 data:
   ratify-test.crt: {{ .Values.ratifyTestCert | b64enc | quote }}
+  {{- if .Values.cosign.enabled }}
+  cosign.pub: {{ .Values.cosign.key | b64enc | quote }}
+  {{- end }}
diff --git a/charts/ratify/values.yaml b/charts/ratify/values.yaml
index 6473335..2b4a3dc 100644
--- a/charts/ratify/values.yaml
+++ b/charts/ratify/values.yaml
@@ -24,6 +24,9 @@ ratifyTestCert: |
   +QsmXjQo4s6vYCeUXeg/fRlNbPrcHFscDPe62gfSD/h2ziKnvGASh8JFY9jaITCn
   c92MWya0Lw==
   -----END CERTIFICATE-----
+cosign:
+  enabled: false
+  key: ""
 resources:
    limits:
      cpu: 100m
diff --git a/docs/examples/ratify-on-aws.md b/docs/examples/ratify-on-aws.md
new file mode 100644
index 0000000..a0db06f
--- /dev/null
+++ b/docs/examples/ratify-on-aws.md
@@ -0,0 +1,240 @@
+# Ratify on AWS
+This guide will explain how to get up and running with Ratify on AWS using EKS and ECR. This will involve setting up
+necessary AWS resources, installing necessary components, and configuring them properly. Once everything is set up we
+will walk through a simple scenario of verifying the signature on a container image at deployment time.
+
+By the end of this guide you will have a public ECR repository, an EKS cluster with Gatekeeper and Ratify installed,
+and have validated that only images signed with a particular key can be deployed.
+
+This guide assumes you are starting from scratch, but portions of the guide can be skipped if you have an existing EKS
+cluster or ECR repository.
+
+## Table of Contents
+1. [Prerequisites](#prerequisites)
+2. [Setting Up ECR](#set-up-ecr)
+3. [Setting Up EKS](#set-up-eks)
+4. [Prepare Container Image](#prepare-container-image)
+5. [Configure Ratify](#configure-ratify)
+6. [Deploy Ratify](#deploy-ratify)
+7. [Deploy Container Image](#deploy-container-image)
+8. [Cleaning Up](#cleaning-up)
+
+## Prerequisites
+There are a couple tools you will need locally to complete this guide:
+- [awscli](https://aws.amazon.com/cli/): This is used to interact with AWS and provision necessary resources
+- [eksctl](https://docs.aws.amazon.com/eks/latest/userguide/eksctl.html): This is used to easily provision EKS clusters
+- [kubectl](https://kubernetes.io/docs/tasks/tools/): This is used to interact with the EKS cluster we will create
+- [helm](https://helm.sh/docs/intro/quickstart/): This is used to install ratify components into the EKS cluster
+- [docker](https://www.docker.com/get-started): This is used to build the container image we will deploy in this guide
+- [cosign](https://github.com/sigstore/cosign): This is used to sign the container image we will deploy in this guide
+- [ratify](https://github.com/deislabs/ratify/releases): This is used to check images from ECR locally
+- [jq](https://stedolan.github.io/jq/): This is used to capture variables from json returned by commands
+
+If you have not done so already, configure awscli to interact with your AWS account by following these [instructions](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-prereqs.html).
+
+## Set Up ECR
+We need to provision a public container repository to make our container images and their associated artifacts
+available to our EKS cluster. We will do this using awscli. For this guide we will be provisioning a public ECR
+repository to keep things simple.
+
+```shell
+export REPO_NAME=ratifydemo
+export REPO_URI=$(aws ecr-public create-repository --repository-name $REPO_NAME --region us-east-1 | jq -r ."repository"."repositoryUri" )
+```
+
+We will use the repository URI returned by the create command later to build and tag the images we create.
+
+For more information on provisioning ECR repositories check the [documentation](https://docs.aws.amazon.com/AmazonECR/latest/public/public-getting-started.html).
+
+## Set Up EKS
+We will need to provision a Kubernetes cluster to deploy everything on. We will do this using the `eksctl` command line
+utility. Before provisioning our EKS cluster we will need to create a key pair for the nodes:
+
+```shell
+aws ec2 create-key-pair --region us-east-1 --key-name ratifyDemo
+```
+
+Save the output to your local machine, then run the following to create the cluster:
+
+```shell
+eksctl create cluster \
+  --name ratify-demo \
+  --region us-east-1 \
+  --zones us-east-1c,us-east-1d \
+  --with-oidc \
+  --ssh-access \
+  --ssh-public-key ratifyDemo
+```
+
+The template will provision a basic EKS cluster with default settings.
+
+Additional information on EKS deployment can be found in the EKS [documentation](https://docs.aws.amazon.com/eks/latest/userguide/getting-started-console.html).
+
+## Prepare Container Image
+For this guide we will create a basic container image we can use to simulate deployments of a service. We will start by
+building the container image:
+
+```shell
+docker build -t $REPO_URI:v1 https://github.com/wabbit-networks/net-monitor.git#main
+```
+
+After the container is built we need to push it to the repository:
+
+```shell
+aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin $REPO_URI
+
+docker push $REPO_URI:v1
+```
+
+Once the container is built and pushed, we will use cosign to create a key and sign the container image:
+
+```shell
+cosign generate-key-pair
+
+cosign sign --key cosign.key $REPO_URI:v1
+```
+
+Both the container image and the signature should now be in the public ECR repository. We can use cosign to verify the
+signature and image are present and valid:
+
+```shell
+docker rmi $REPO_URI:v1
+
+cosign verify --key cosign.pub $REPO_URI:v1
+```
+
+## Configure Ratify
+### Ratify
+We need to ensure that Ratify is properly configured to find signature artifacts for our container image. This is done
+using a json configuration file. The Ratify configuration file for the guide is created and deployed by the helm chart,
+but we can look at what will be generated below:
+
+```json
+{
+    "stores": {
+        "version": "1.0.0",
+        "plugins": [
+            {
+                "name": "oras",
+                "cosign-enabled": true,
+                "localCachePath": "./local_oras_cache"
+            }
+        ]
+    },
+    "policies": {
+        "version": "1.0.0",
+        "artifactVerificationPolicies": {
+            "application/vnd.cncf.notary.v2.signature": "any"
+        }
+    },
+    "verifiers": {
+        "version": "1.0.0",
+        "plugins": [
+          {
+            "name":"notaryv2",
+            "artifactTypes" : "application/vnd.cncf.notary.v2.signature",
+            "verificationCerts": [
+              "/usr/local/ratify-certs/ratify-test.crt"
+            ]
+          },
+          {
+            "name": "cosign",
+            "artifactTypes": "application/vnd.dev.cosign.simplesigning.v1+json",
+            "key": "/usr/local/ratify-certs/cosign.pub"
+          }
+        ]
+        
+    }
+}
+```
+
+This configuration file does the following:
+- Enables the built-in `oras` referrer store with cosign support which will retrieve the necessary manifests and
+  signature artifacts from the container registry
+- Enables the built-in `notaryv2` verifier (this is not used in this demo, but is part of the default Ratify
+  configuration)
+- Enables the `cosign` verifier that will validate cosign signatures on container images
+
+The configuration file and cosign public key will be mounted into the Ratify container via the helm chart.
+
+### Gatekeeper
+The Ratify container will perform the actual validation of images and their artifacts, but
+[Gatekeeper](https://github.com/open-policy-agent/gatekeeper) is used as the policy controller for Kubernetes. The helm
+chart for this guide has a basic Gatekeeper rego that checks for the string "false" in the results from the Ratify
+container.
+
+This rego is kept simple to demonstrate the capability of Ratify. More complex combinations of regos and Ratify
+verifiers can be used to accomplish many types of checks. See the [Gatekeeper docs](https://open-policy-agent.github.io/gatekeeper/website/docs/)
+for more information on rego authoring.
+
+## Deploy Ratify
+We first need to install Gatekeeper into the cluster. We will use the Gatekeeper helm chart with some customizations:
+
+```shell
+helm repo add gatekeeper https://open-policy-agent.github.io/gatekeeper/charts
+
+helm install gatekeeper/gatekeeper  \
+    --name-template=gatekeeper \
+    --namespace gatekeeper-system --create-namespace \
+    --set enableExternalData=true \
+    --set controllerManager.dnsPolicy=ClusterFirst,audit.dnsPolicy=ClusterFirst
+```
+
+Once Gatekeeper has been deployed into the cluster we can deploy Ratify using the provided helm chart:
+
+```shell
+export COSIGN_PUBLIC_KEY=$(cat cosign.pub)
+
+helm install ratify charts/ratify \
+    --set cosign.enabled=true \
+    --set cosign.key=$COSIGN_PUBLIC_KEY
+
+kubectl apply -f ./charts/ratify-gatekeeper/templates/constraint.yaml
+```
+
+We can then confirm all pods are running:
+
+```shell
+kubectl get po -A
+```
+
+We should see a ratify pod and some gatekeeper pods running
+
+## Deploy Container Image
+Now that the signed container image is in the registry and Ratify is installed into the EKS cluster we can deploy our
+container image:
+
+```shell
+kubectl create ns demo
+
+kubectl run demosigned -n demo --image $REPO_URI:v1
+```
+
+We should be able to see from the Ratify and Gatekeeper logs that the container signature was validated. The pod for
+the container should also be running.
+
+```shell
+kubectl logs deployment/ratify
+```
+
+We can also test that an image without a valid signature is not able to run:
+
+```shell
+kubectl run demounsigned -n demo --image hello-world
+```
+
+The command should fail with an error and we should be able to see from the Ratify and Gatekeeper logs that the
+signature validation failed.
+
+```shell
+kubectl logs deployment/ratify
+```
+
+## Cleaning Up
+We can use awscli and eksctl to delete our ECR repository and EKS cluster:
+
+```shell
+aws ecr-public delete-repository --region us-east-1 --repository-name $REPO_NAME
+
+eksctl delete cluster --region us-east-1 --name ratify-demo
+```
diff --git a/httpserver/Dockerfile b/httpserver/Dockerfile
index 4181f69..78a1e4b 100644
--- a/httpserver/Dockerfile
+++ b/httpserver/Dockerfile
@@ -1,29 +1,43 @@
-FROM golang:alpine3.14 as builder
+ARG BUILDPLATFORM="linux/amd64"
+ARG BUILDERIMAGE="golang:1.17"
+ARG BASEIMAGE="gcr.io/distroless/static:nonroot"
 
-WORKDIR /app
+FROM --platform=$BUILDPLATFORM $BUILDERIMAGE as builder
 
-COPY go.mod .
+ARG TARGETPLATFORM
+ARG TARGETOS
+ARG TARGETARCH
+ARG TARGETVARIANT=""
+ARG LDFLAGS
 
-COPY go.sum .
+ENV CGO_ENABLED=0 \
+    GOOS=${TARGETOS} \
+    GOARCH=${TARGETARCH} \
+    GOARM=${TARGETVARIANT}
 
-RUN go mod download
+WORKDIR /app
 
 COPY . .
 
-RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o /app/out/ /app/cmd/ratify 
-RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o /app/out/plugins/ /app/plugins/verifier/sbom
-RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o /app/out/plugins/ /app/plugins/verifier/cosign
+RUN go build -o /app/out/ /app/cmd/ratify 
+RUN go build -o /app/out/plugins/ /app/plugins/verifier/sbom
+RUN go build -o /app/out/plugins/ /app/plugins/verifier/cosign
 
-FROM alpine:3.14
+FROM $BASEIMAGE
 LABEL org.opencontainers.image.source https://github.com/deislabs/ratify
 
-RUN set -ex \
-    && apk add --no-cache ca-certificates apache2-utils
-
 ARG RATIFY_FOLDER=$HOME/.ratify/
+
+WORKDIR /
+
 COPY --from=builder /app/out/ratify /app/
 COPY --from=builder /app/out/plugins ${RATIFY_FOLDER}/plugins
 COPY --from=builder /app/config/config.json ${RATIFY_FOLDER}
+
 ENV RATIFY_CONFIG=${RATIFY_FOLDER}
+
 EXPOSE 6001
-CMD ["./app/ratify", "serve", "--http", ":6001"]
\ No newline at end of file
+
+USER 65532:65532
+
+ENTRYPOINT ["/app/ratify", "serve", "--http", ":6001"]
diff --git a/httpserver/handlers.go b/httpserver/handlers.go
index e195b34..93f469b 100644
--- a/httpserver/handlers.go
+++ b/httpserver/handlers.go
@@ -78,10 +78,10 @@ func (server *Server) verify(ctx context.Context, w http.ResponseWriter, r *http
 			})
 		}
 	}
-	return sendResponse(&results, "", w)
+	return sendResponse(&results, "", w, http.StatusOK)
 }
 
-func sendResponse(results *[]externaldata.Item, systemErr string, w http.ResponseWriter) error {
+func sendResponse(results *[]externaldata.Item, systemErr string, w http.ResponseWriter, respCode int) error {
 	response := externaldata.ProviderResponse{
 		APIVersion: apiVersion,
 		Kind:       "ProviderResponse",
@@ -93,7 +93,7 @@ func sendResponse(results *[]externaldata.Item, systemErr string, w http.Respons
 		response.Response.SystemError = systemErr
 	}
 
-	w.WriteHeader(http.StatusOK)
+	w.WriteHeader(respCode)
 	return json.NewEncoder(w).Encode(response)
 }
 
@@ -118,7 +118,7 @@ func processTimeout(h ContextHandler, duration time.Duration) ContextHandler {
 		}
 
 		if err != nil {
-			return sendResponse(nil, fmt.Sprintf("validate operation failed with error %v", err), w)
+			return sendResponse(nil, fmt.Sprintf("validate operation failed with error %v", err), w, http.StatusInternalServerError)
 		}
 
 		return nil
diff --git a/pkg/executor/core/executor.go b/pkg/executor/core/executor.go
index f667982..beb4274 100644
--- a/pkg/executor/core/executor.go
+++ b/pkg/executor/core/executor.go
@@ -33,7 +33,7 @@ import (
 	"github.com/sirupsen/logrus"
 )
 
-const defaultRequestTimeoutSeconds = 8
+const defaultRequestTimeoutMilliseconds = 2800
 
 // Executor describes an execution engine that queries the stores for the supply chain content,
 // runs them through the verifiers as governed by the policy enforcer
@@ -58,11 +58,11 @@ func (executor Executor) VerifySubject(ctx context.Context, verifyParameters e.V
 }
 
 func (executor Executor) GetVerifyRequestTimeout() time.Duration {
-	timeoutSeconds := defaultRequestTimeoutSeconds
+	timeoutMilliSeconds := defaultRequestTimeoutMilliseconds
 	if executor.Config != nil && executor.Config.RequestTimeout != nil {
-		timeoutSeconds = *executor.Config.RequestTimeout
+		timeoutMilliSeconds = *executor.Config.RequestTimeout
 	}
-	return time.Duration(timeoutSeconds) * time.Second
+	return time.Duration(timeoutMilliSeconds) * time.Millisecond
 }
 
 func (executor Executor) verifySubjectInternal(ctx context.Context, verifyParameters e.VerifyParameters) (types.VerifyResult, error) {


Test patch:
diff --git a/httpserver/server_test.go b/httpserver/server_test.go
new file mode 100644
index 0000000..2ec14e7
--- /dev/null
+++ b/httpserver/server_test.go
@@ -0,0 +1,85 @@
+/*
+Copyright The Ratify Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package httpserver
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/deislabs/ratify/pkg/executor/core"
+	"github.com/deislabs/ratify/pkg/ocispecs"
+	config "github.com/deislabs/ratify/pkg/policyprovider/configpolicy"
+	"github.com/deislabs/ratify/pkg/referrerstore"
+	"github.com/deislabs/ratify/pkg/referrerstore/mocks"
+	"github.com/deislabs/ratify/pkg/verifier"
+	"github.com/open-policy-agent/frameworks/constraint/pkg/externaldata"
+	"github.com/opencontainers/go-digest"
+)
+
+func TestServer_Timeout_Failed(t *testing.T) {
+	timeoutDuration := 6
+	testImageName := "localhost:5000/net-monitor:v1"
+	t.Run("server_timeout_fail", func(t *testing.T) {
+		body := new(bytes.Buffer)
+		json.NewEncoder(body).Encode(externaldata.NewProviderRequest([]string{testImageName}))
+		request := httptest.NewRequest(http.MethodPost, "/ratify/gatekeeper/v1/verify", bytes.NewReader(body.Bytes()))
+		responseRecorder := httptest.NewRecorder()
+
+		testDigest := digest.FromString("test")
+		configPolicy := config.PolicyEnforcer{}
+		store := &mocks.TestStore{References: []ocispecs.ReferenceDescriptor{
+			{
+				ArtifactType: "test-type1",
+			}},
+			ResolveMap: map[string]digest.Digest{
+				"v1": testDigest,
+			},
+		}
+		ver := &core.TestVerifier{
+			CanVerifyFunc: func(at string) bool {
+				return at == "test-type1"
+			},
+			VerifyResult: func(artifactType string) bool {
+				time.Sleep(time.Duration(timeoutDuration) * time.Second)
+				return true
+			},
+		}
+
+		ex := &core.Executor{
+			PolicyEnforcer: configPolicy,
+			ReferrerStores: []referrerstore.ReferrerStore{store},
+			Verifiers:      []verifier.ReferenceVerifier{ver},
+		}
+		server := &Server{
+			Executor: ex,
+			Context:  request.Context(),
+		}
+
+		handler := contextHandler{
+			context: server.Context,
+			handler: processTimeout(server.verify, server.Executor.GetVerifyRequestTimeout()),
+		}
+
+		handler.ServeHTTP(responseRecorder, request)
+		if responseRecorder.Code != http.StatusInternalServerError {
+			t.Errorf("Want status '%d', got '%d'", http.StatusInternalServerError, responseRecorder.Code)
+		}
+	})
+}
diff --git a/pkg/executor/core/executor_test.go b/pkg/executor/core/executor_test.go
index 57f2a1c..96a7cd1 100644
--- a/pkg/executor/core/executor_test.go
+++ b/pkg/executor/core/executor_test.go
@@ -105,10 +105,10 @@ func TestVerifySubject_CanVerify_ExpectedResults(t *testing.T) {
 		},
 	}
 	ver := &TestVerifier{
-		canVerify: func(at string) bool {
+		CanVerifyFunc: func(at string) bool {
 			return at == "test-type1"
 		},
-		verifyResult: func(artifactType string) bool {
+		VerifyResult: func(artifactType string) bool {
 			return true
 		},
 	}
@@ -153,10 +153,10 @@ func TestVerifySubject_VerifyFailures_ExpectedResults(t *testing.T) {
 		},
 	}
 	ver := &TestVerifier{
-		canVerify: func(at string) bool {
+		CanVerifyFunc: func(at string) bool {
 			return true
 		},
-		verifyResult: func(artifactType string) bool {
+		VerifyResult: func(artifactType string) bool {
 			if artifactType == "test-type1" {
 				return false
 			}
@@ -205,10 +205,10 @@ func TestVerifySubject_VerifySuccess_ExpectedResults(t *testing.T) {
 		},
 	}
 	ver := &TestVerifier{
-		canVerify: func(at string) bool {
+		CanVerifyFunc: func(at string) bool {
 			return true
 		},
-		verifyResult: func(artifactType string) bool {
+		VerifyResult: func(artifactType string) bool {
 			return true
 		},
 	}
diff --git a/pkg/executor/core/testtypes.go b/pkg/executor/core/testtypes.go
index 4537657..42f006b 100644
--- a/pkg/executor/core/testtypes.go
+++ b/pkg/executor/core/testtypes.go
@@ -26,8 +26,8 @@ import (
 )
 
 type TestVerifier struct {
-	canVerify    func(artifactType string) bool
-	verifyResult func(artifactType string) bool
+	CanVerifyFunc func(artifactType string) bool
+	VerifyResult  func(artifactType string) bool
 }
 
 func (s *TestVerifier) Name() string {
@@ -35,7 +35,7 @@ func (s *TestVerifier) Name() string {
 }
 
 func (s *TestVerifier) CanVerify(ctx context.Context, referenceDescriptor ocispecs.ReferenceDescriptor) bool {
-	return s.canVerify(referenceDescriptor.ArtifactType)
+	return s.CanVerifyFunc(referenceDescriptor.ArtifactType)
 }
 
 func (s *TestVerifier) Verify(ctx context.Context,
@@ -44,6 +44,6 @@ func (s *TestVerifier) Verify(ctx context.Context,
 	referrerStore referrerstore.ReferrerStore,
 	executor executor.Executor) (verifier.VerifierResult, error) {
 	return verifier.VerifierResult{
-		IsSuccess: s.verifyResult(referenceDescriptor.ArtifactType),
+		IsSuccess: s.VerifyResult(referenceDescriptor.ArtifactType),
 	}, nil
 }