Repository: ratify-project/ratify
Pull request #2238 (2025-05-13 05:31:06)

feat!: add v2 executor
# Description

## What this PR does / why we need it:
1. Add constructor to create V2 executor and define its options.
2. Remove v1 executor.

## Which issue(s) this PR fixes *(optional, using `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when the PR gets merged)*:
Fixes #

## Type of change

Please delete options that are not relevant.

- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
- [ ] Helm Chart Change (any edit/addition/update that is necessary for changes merged to the `main` branch)
- [ ] This change requires a documentation update

# How Has This Been Tested?

Please describe the tests that you ran to verify your changes. Please also list any relevant details for your test configuration

- [ ] Test A
- [ ] Test B

# Checklist:

- [ ] Does the affected code have corresponding tests?
- [ ] Are the changes documented, not just with inline documentation, but also with conceptual documentation such as an overview of a new feature, or task-based documentation like a tutorial? Consider if this change should be announced on your project blog.
- [ ] Does this introduce breaking changes that would require an announcement or bumping the major version?
- [ ] Do all new files have appropriate license header?

# Post Merge Requirements
- [ ] MAINTAINERS: manually trigger the "Publish Package" workflow after merging any PR that indicates `Helm Chart Change`


codecov[bot]: ## [Codecov](https://app.codecov.io/gh/ratify-project/ratify/pull/2238?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=ratify-project) Report
All modified and coverable lines are covered by tests :white_check_mark:

| [Files with missing lines](https://app.codecov.io/gh/ratify-project/ratify/pull/2238?dropdown=coverage&src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=ratify-project) | Coverage Δ | |
|---|---|---|
| [internal/executor/executor.go](https://app.codecov.io/gh/ratify-project/ratify/pull/2238?src=pr&el=tree&filepath=internal%2Fexecutor%2Fexecutor.go&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=ratify-project#diff-aW50ZXJuYWwvZXhlY3V0b3IvZXhlY3V0b3IuZ28=) | `100.00% <100.00%> (ø)` | |
| [internal/policyenforcer/factory/factory.go](https://app.codecov.io/gh/ratify-project/ratify/pull/2238?src=pr&el=tree&filepath=internal%2Fpolicyenforcer%2Ffactory%2Ffactory.go&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=ratify-project#diff-aW50ZXJuYWwvcG9saWN5ZW5mb3JjZXIvZmFjdG9yeS9mYWN0b3J5Lmdv) | `100.00% <100.00%> (ø)` | |
| [...policyenforcer/factory/thresholdpolicy/register.go](https://app.codecov.io/gh/ratify-project/ratify/pull/2238?src=pr&el=tree&filepath=internal%2Fpolicyenforcer%2Ffactory%2Fthresholdpolicy%2Fregister.go&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=ratify-project#diff-aW50ZXJuYWwvcG9saWN5ZW5mb3JjZXIvZmFjdG9yeS90aHJlc2hvbGRwb2xpY3kvcmVnaXN0ZXIuZ28=) | `100.00% <100.00%> (ø)` | |
| [internal/policyenforcer/policyenforcer.go](https://app.codecov.io/gh/ratify-project/ratify/pull/2238?src=pr&el=tree&filepath=internal%2Fpolicyenforcer%2Fpolicyenforcer.go&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=ratify-project#diff-aW50ZXJuYWwvcG9saWN5ZW5mb3JjZXIvcG9saWN5ZW5mb3JjZXIuZ28=) | `100.00% <100.00%> (ø)` | |
| [internal/store/factory/factory.go](https://app.codecov.io/gh/ratify-project/ratify/pull/2238?src=pr&el=tree&filepath=internal%2Fstore%2Ffactory%2Ffactory.go&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=ratify-project#diff-aW50ZXJuYWwvc3RvcmUvZmFjdG9yeS9mYWN0b3J5Lmdv) | `100.00% <100.00%> (ø)` | |
| [...ernal/store/factory/filesystemocistore/register.go](https://app.codecov.io/gh/ratify-project/ratify/pull/2238?src=pr&el=tree&filepath=internal%2Fstore%2Ffactory%2Ffilesystemocistore%2Fregister.go&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=ratify-project#diff-aW50ZXJuYWwvc3RvcmUvZmFjdG9yeS9maWxlc3lzdGVtb2Npc3RvcmUvcmVnaXN0ZXIuZ28=) | `100.00% <100.00%> (ø)` | |
| [internal/store/factory/registrystore/register.go](https://app.codecov.io/gh/ratify-project/ratify/pull/2238?src=pr&el=tree&filepath=internal%2Fstore%2Ffactory%2Fregistrystore%2Fregister.go&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=ratify-project#diff-aW50ZXJuYWwvc3RvcmUvZmFjdG9yeS9yZWdpc3RyeXN0b3JlL3JlZ2lzdGVyLmdv) | `100.00% <100.00%> (ø)` | |
| [internal/store/storemux.go](https://app.codecov.io/gh/ratify-project/ratify/pull/2238?src=pr&el=tree&filepath=internal%2Fstore%2Fstoremux.go&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=ratify-project#diff-aW50ZXJuYWwvc3RvcmUvc3RvcmVtdXguZ28=) | `100.00% <100.00%> (ø)` | |
| [internal/verifier/factory/notation/register.go](https://app.codecov.io/gh/ratify-project/ratify/pull/2238?src=pr&el=tree&filepath=internal%2Fverifier%2Ffactory%2Fnotation%2Fregister.go&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=ratify-project#diff-aW50ZXJuYWwvdmVyaWZpZXIvZmFjdG9yeS9ub3RhdGlvbi9yZWdpc3Rlci5nbw==) | `96.70% <ø> (-0.08%)` | :arrow_down: |

<details><summary> :rocket: New features to boost your workflow: </summary>

- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
</details>

Patch:
diff --git a/internal/executor/executor.go b/internal/executor/executor.go
new file mode 100644
index 0000000..73902d0
--- /dev/null
+++ b/internal/executor/executor.go
@@ -0,0 +1,64 @@
+/*
+Copyright The Ratify Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package executor
+
+import (
+	"fmt"
+
+	"github.com/ratify-project/ratify-go"
+	"github.com/ratify-project/ratify/v2/internal/policyenforcer"
+	policyFactory "github.com/ratify-project/ratify/v2/internal/policyenforcer/factory"
+	"github.com/ratify-project/ratify/v2/internal/store"
+	"github.com/ratify-project/ratify/v2/internal/verifier"
+	"github.com/ratify-project/ratify/v2/internal/verifier/factory"
+)
+
+// Options contains the configuration options to create a new executor.
+type Options struct {
+	// Verifiers contains the configuration options for the verifiers. Required.
+	Verifiers []factory.NewVerifierOptions `json:"verifiers"`
+
+	// Stores contains the configuration options for the stores. Required.
+	Stores store.PatternOptions `json:"stores"`
+
+	// Policy contains the configuration options for the policy enforcer.
+	// Optional.
+	Policy *policyFactory.NewPolicyEnforcerOptions `json:"policyEnforcer,omitempty"`
+}
+
+// NewExecutor creates a new [ratify.Executor] instance based on the provided
+// options.
+func NewExecutor(opts *Options) (*ratify.Executor, error) {
+	if opts == nil {
+		return nil, fmt.Errorf("executor options cannot be nil")
+	}
+	verifiers, err := verifier.NewVerifiers(opts.Verifiers)
+	if err != nil {
+		return nil, err
+	}
+
+	storeMux, err := store.NewStore(opts.Stores)
+	if err != nil {
+		return nil, err
+	}
+
+	policy, err := policyenforcer.NewPolicyEnforcer(opts.Policy)
+	if err != nil {
+		return nil, err
+	}
+
+	return ratify.NewExecutor(storeMux, verifiers, policy)
+}
diff --git a/pkg/executor/api.go b/pkg/executor/api.go
deleted file mode 100644
index c405921..0000000
--- a/pkg/executor/api.go
+++ /dev/null
@@ -1,41 +0,0 @@
-/*
-Copyright The Ratify Authors.
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package executor
-
-import (
-	"context"
-	"time"
-
-	"github.com/ratify-project/ratify/pkg/executor/types"
-)
-
-// VerifyParameters describes the subject verification parameters
-type VerifyParameters struct {
-	Subject        string   `json:"subjectReference"`
-	ReferenceTypes []string `json:"referenceTypes,omitempty"`
-}
-
-// Executor is an interface that defines methods to verify a subject
-type Executor interface {
-	// VerifySubject returns the result of verifying a subject
-	VerifySubject(ctx context.Context, verifyParameters VerifyParameters) (types.VerifyResult, error)
-
-	// GetVerifyRequestTimeout returns the timeout for the verification request configured with the executor
-	GetVerifyRequestTimeout() time.Duration
-
-	// GetMutationRequestTimeout returns the timeout for the mutation request configured with the executor
-	GetMutationRequestTimeout() time.Duration
-}
diff --git a/pkg/executor/config/config.go b/pkg/executor/config/config.go
deleted file mode 100644
index e7c665f..0000000
--- a/pkg/executor/config/config.go
+++ /dev/null
@@ -1,25 +0,0 @@
-/*
-Copyright The Ratify Authors.
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package config
-
-// ExecutorConfig represents the configuration for the executor
-type ExecutorConfig struct {
-	// Gatekeeper default verification webhook timeout is 3 seconds. 100ms network buffer added
-	VerificationRequestTimeout *int `json:"verificationRequestTimeout"`
-	// Gatekeeper default mutation webhook timeout is 1 seconds. 50ms network buffer added
-	MutationRequestTimeout *int `json:"mutationRequestTimeout"`
-	// TODO Add cache config
-}
diff --git a/pkg/executor/core/executor.go b/pkg/executor/core/executor.go
deleted file mode 100644
index b364bee..0000000
--- a/pkg/executor/core/executor.go
+++ /dev/null
@@ -1,313 +0,0 @@
-/*
-Copyright The Ratify Authors.
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package core
-
-import (
-	"context"
-	"fmt"
-	"sync"
-	"time"
-
-	"github.com/ratify-project/ratify/errors"
-	"github.com/ratify-project/ratify/internal/logger"
-	"github.com/ratify-project/ratify/pkg/common"
-	e "github.com/ratify-project/ratify/pkg/executor"
-	"github.com/ratify-project/ratify/pkg/executor/config"
-	"github.com/ratify-project/ratify/pkg/executor/types"
-	"github.com/ratify-project/ratify/pkg/metrics"
-	"github.com/ratify-project/ratify/pkg/ocispecs"
-	"github.com/ratify-project/ratify/pkg/policyprovider"
-	pt "github.com/ratify-project/ratify/pkg/policyprovider/types"
-	"github.com/ratify-project/ratify/pkg/referrerstore"
-	su "github.com/ratify-project/ratify/pkg/referrerstore/utils"
-	"github.com/ratify-project/ratify/pkg/utils"
-	vr "github.com/ratify-project/ratify/pkg/verifier"
-	vt "github.com/ratify-project/ratify/pkg/verifier/types"
-	"golang.org/x/sync/errgroup"
-)
-
-const (
-	defaultVerifyRequestTimeoutMilliseconds = 2900
-	defaultMutateRequestTimeoutMilliseconds = 950
-)
-
-var logOpt = logger.Option{
-	ComponentType: logger.Executor,
-}
-
-// Executor describes an execution engine that queries the stores for the supply chain content,
-// runs them through the verifiers as governed by the policy enforcer
-type Executor struct {
-	ReferrerStores []referrerstore.ReferrerStore
-	PolicyEnforcer policyprovider.PolicyProvider
-	Verifiers      []vr.ReferenceVerifier
-	Config         *config.ExecutorConfig
-}
-
-// TODO Logging within executor
-// VerifySubject verifies the subject and returns results.
-func (executor Executor) VerifySubject(ctx context.Context, verifyParameters e.VerifyParameters) (types.VerifyResult, error) {
-	if executor.PolicyEnforcer == nil {
-		return types.VerifyResult{}, errors.ErrorCodePolicyProviderNotFound.WithDetail("Policy configuration not found")
-	}
-	result, err := executor.verifySubjectInternal(ctx, verifyParameters)
-	if err != nil {
-		// get the result for the error based on the policy.
-		// Do we need to consider no referrers as success or failure?
-		result = executor.PolicyEnforcer.ErrorToVerifyResult(ctx, verifyParameters.Subject, err)
-	}
-	if executor.PolicyEnforcer.GetPolicyType(ctx) == pt.ConfigPolicy {
-		return result, nil
-	}
-	return result, err
-}
-
-// verifySubjectInternal verifies the subject with results.
-func (executor Executor) verifySubjectInternal(ctx context.Context, verifyParameters e.VerifyParameters) (types.VerifyResult, error) {
-	verifierReports, err := executor.verifySubjectInternalWithoutDecision(ctx, verifyParameters)
-	if err != nil {
-		return types.VerifyResult{}, err
-	}
-	if executor.PolicyEnforcer.GetPolicyType(ctx) == pt.ConfigPolicy {
-		if len(verifierReports) == 0 {
-			return types.VerifyResult{}, errors.ErrorCodeNoVerifierReport.WithDetail(fmt.Sprintf("No verification results for the artifact %s. Ensure verifiers are properly configured and that artifact metadata is attached", verifyParameters.Subject))
-		}
-	}
-	// If it requires embedded Rego Policy Engine make the decision, execute
-	// OverallVerifyResult to evaluate the overall result based on the policy.
-	// NOTE: if Passthrough Mode is enabled, executor will just return the
-	// VerifierReports without evaluating the policy.
-	overallVerifySuccess := executor.PolicyEnforcer.OverallVerifyResult(ctx, verifierReports)
-	return types.VerifyResult{IsSuccess: overallVerifySuccess, VerifierReports: verifierReports}, nil
-}
-
-// verifySubjectInternalWithoutDecision verifies the subject and returns result
-// without making decisions on the result.
-func (executor Executor) verifySubjectInternalWithoutDecision(ctx context.Context, verifyParameters e.VerifyParameters) ([]interface{}, error) {
-	subjectReference, err := utils.ParseSubjectReference(verifyParameters.Subject)
-	if err != nil {
-		return nil, err
-	}
-
-	desc, err := su.ResolveSubjectDescriptor(ctx, &executor.ReferrerStores, subjectReference)
-	if err != nil {
-		return nil, err
-	}
-
-	logger.GetLogger(ctx, logOpt).Infof("Resolve of the image completed successfully the digest is %s", desc.Digest)
-
-	subjectReference.Digest = desc.Digest
-
-	verifierReports := make([]interface{}, 0)
-	eg, errCtx := errgroup.WithContext(ctx)
-	var mu sync.Mutex
-
-	for _, referrerStore := range executor.ReferrerStores {
-		referrerStore := referrerStore
-		eg.Go(func() error {
-			var continuationToken string
-			innerGroup, innerErrCtx := errgroup.WithContext(errCtx)
-			for {
-				referrersResult, err := referrerStore.ListReferrers(errCtx, subjectReference, verifyParameters.ReferenceTypes, continuationToken, desc)
-				if err != nil {
-					return errors.ErrorCodeListReferrersFailure.NewError(errors.ReferrerStore, referrerStore.Name(), errors.EmptyLink, err, nil, errors.HideStackTrace)
-				}
-				continuationToken = referrersResult.NextToken
-				for _, reference := range referrersResult.Referrers {
-					if !executor.PolicyEnforcer.VerifyNeeded(innerErrCtx, subjectReference, reference) {
-						continue
-					}
-					reference := reference
-					innerGroup.Go(func() error {
-						if executor.PolicyEnforcer.GetPolicyType(ctx) == pt.RegoPolicy {
-							verifyResult, err := executor.verifyReferenceForRegoPolicy(innerErrCtx, subjectReference, reference, referrerStore)
-							if err != nil {
-								logger.GetLogger(ctx, logOpt).Errorf("error while verifying reference %+v, err: %v", reference, err)
-								return err
-							}
-							mu.Lock() // locks the verifierReports List for write safety
-							defer mu.Unlock()
-							verifierReports = append(verifierReports, verifyResult)
-						} else {
-							verifyResult := executor.verifyReferenceForJSONPolicy(innerErrCtx, subjectReference, reference, referrerStore)
-							mu.Lock() // locks the verifierReports List for write safety
-							defer mu.Unlock()
-							verifierReports = append(verifierReports, verifyResult.VerifierReports...)
-						}
-						return nil
-					})
-				}
-				if continuationToken == "" {
-					break
-				}
-			}
-			return innerGroup.Wait()
-		})
-	}
-
-	if err = eg.Wait(); err != nil {
-		return nil, err
-	}
-
-	return verifierReports, nil
-}
-
-// verifyReferenceForJSONPolicy verifies the referenced artifact with results
-// used for the Json-based policy enforcer.
-func (executor Executor) verifyReferenceForJSONPolicy(ctx context.Context, subjectRef common.Reference, referenceDesc ocispecs.ReferenceDescriptor, referrerStore referrerstore.ReferrerStore) types.VerifyResult {
-	var verifyResults []interface{}
-	var isSuccess = true
-
-	for _, verifier := range executor.Verifiers {
-		if verifier.CanVerify(ctx, referenceDesc) {
-			verifierStartTime := time.Now()
-			verifyResult, err := verifier.Verify(ctx, subjectRef, referenceDesc, referrerStore)
-			if err != nil {
-				verifierErr := errors.ErrorCodeVerifyReferenceFailure.WithError(err)
-				verifyResult = vr.NewVerifierResult("", verifier.Name(), verifier.Type(), "", false, &verifierErr, nil)
-			}
-
-			if len(verifier.GetNestedReferences()) > 0 {
-				executor.addNestedVerifierResult(ctx, referenceDesc, subjectRef, &verifyResult)
-			}
-
-			verifyResult.Subject = subjectRef.String()
-			verifyResult.ReferenceDigest = referenceDesc.Digest.String()
-			verifyResult.ArtifactType = referenceDesc.ArtifactType
-			verifyResults = append(verifyResults, verifyResult)
-			isSuccess = verifyResult.IsSuccess
-			metrics.ReportVerifierDuration(ctx, time.Since(verifierStartTime).Milliseconds(), verifier.Name(), subjectRef.String(), isSuccess, err != nil)
-			break
-		}
-	}
-
-	return types.VerifyResult{IsSuccess: isSuccess, VerifierReports: verifyResults}
-}
-
-// verifyReferenceForRegoPolicy verifies the referenced artifact with results
-// used for Rego-based policy enforcer.
-func (executor Executor) verifyReferenceForRegoPolicy(ctx context.Context, subjectRef common.Reference, referenceDesc ocispecs.ReferenceDescriptor, referrerStore referrerstore.ReferrerStore) (types.NestedVerifierReport, error) {
-	nestedReport := types.NestedVerifierReport{
-		Subject:         subjectRef.String(),
-		ArtifactType:    referenceDesc.ArtifactType,
-		ReferenceDigest: referenceDesc.Digest.String(),
-		VerifierReports: make([]vt.VerifierResult, 0),
-		NestedReports:   make([]types.NestedVerifierReport, 0),
-	}
-	var mu sync.Mutex
-	eg, errCtx := errgroup.WithContext(ctx)
-
-	eg.Go(func() error {
-		return executor.addNestedReports(errCtx, referenceDesc, subjectRef, &nestedReport)
-	})
-
-	for _, verifier := range executor.Verifiers {
-		if !verifier.CanVerify(ctx, referenceDesc) {
-			continue
-		}
-		verifier := verifier
-		eg.Go(func() error {
-			var verifierReport vt.VerifierResult
-			verifierStartTime := time.Now()
-			verifierResult, err := verifier.Verify(errCtx, subjectRef, referenceDesc, referrerStore)
-			if err != nil {
-				verifierErr := errors.ErrorCodeVerifyReferenceFailure.WithError(err)
-				verifierReport = vt.CreateVerifierResult(verifier.Name(), verifier.Type(), "", false, &verifierErr)
-			} else {
-				verifierReport = vt.NewVerifierResult(verifierResult)
-			}
-
-			mu.Lock()
-			nestedReport.VerifierReports = append(nestedReport.VerifierReports, verifierReport)
-			mu.Unlock()
-
-			metrics.ReportVerifierDuration(errCtx, time.Since(verifierStartTime).Milliseconds(), verifier.Name(), subjectRef.String(), verifierReport.IsSuccess, err != nil)
-			return nil
-		})
-	}
-
-	if err := eg.Wait(); err != nil {
-		return types.NestedVerifierReport{}, err
-	}
-	return nestedReport, nil
-}
-
-// addNestedVerifierResult adds the nested verifier result to the parent verify
-// result used for Json-based policy enforcer.
-func (executor Executor) addNestedVerifierResult(ctx context.Context, referenceDesc ocispecs.ReferenceDescriptor, subjectRef common.Reference, verifyResult *vr.VerifierResult) {
-	verifyParameters := e.VerifyParameters{
-		Subject:        fmt.Sprintf("%s@%s", subjectRef.Path, referenceDesc.Digest),
-		ReferenceTypes: []string{"*"},
-	}
-
-	nestedVerifyResult, err := executor.VerifySubject(ctx, verifyParameters)
-	if err != nil {
-		nestedVerifyResult = executor.PolicyEnforcer.ErrorToVerifyResult(ctx, verifyParameters.Subject, err)
-	}
-
-	for _, report := range nestedVerifyResult.VerifierReports {
-		if result, ok := report.(vr.VerifierResult); ok {
-			verifyResult.NestedResults = append(verifyResult.NestedResults, result)
-			if !nestedVerifyResult.IsSuccess {
-				verifyResult.IsSuccess = false
-				verifyResult.Message = "nested verification failed"
-			}
-		}
-	}
-}
-
-// addNestedReports adds the nested verifier reports to the parent report used
-// for Rego-based policy enforcer.
-func (executor Executor) addNestedReports(ctx context.Context, referenceDes ocispecs.ReferenceDescriptor, subjectRef common.Reference, verifierReport *types.NestedVerifierReport) error {
-	verifyParameters := e.VerifyParameters{
-		Subject:        fmt.Sprintf("%s@%s", subjectRef.Path, referenceDes.Digest),
-		ReferenceTypes: []string{"*"},
-	}
-
-	// get nested reports.
-	reports, err := executor.verifySubjectInternal(ctx, verifyParameters)
-	if err != nil {
-		return fmt.Errorf("failed to verify nested subject, param: %+v, err: %w", verifyParameters, err)
-	}
-
-	// append nested reports to the parent report.
-	nestedReports := make([]types.NestedVerifierReport, 0, len(reports.VerifierReports))
-	for _, report := range reports.VerifierReports {
-		nestedReport, err := types.NewNestedVerifierReport(report)
-		if err != nil {
-			return errors.ErrorCodeExecutorFailure.WithError(err)
-		}
-		nestedReports = append(nestedReports, nestedReport)
-	}
-	verifierReport.NestedReports = nestedReports
-	return nil
-}
-
-func (executor Executor) GetVerifyRequestTimeout() time.Duration {
-	timeoutMilliSeconds := defaultVerifyRequestTimeoutMilliseconds
-	if executor.Config != nil && executor.Config.VerificationRequestTimeout != nil {
-		timeoutMilliSeconds = *executor.Config.VerificationRequestTimeout
-	}
-	return time.Duration(timeoutMilliSeconds) * time.Millisecond
-}
-
-func (executor Executor) GetMutationRequestTimeout() time.Duration {
-	timeoutMilliSeconds := defaultMutateRequestTimeoutMilliseconds
-	if executor.Config != nil && executor.Config.MutationRequestTimeout != nil {
-		timeoutMilliSeconds = *executor.Config.MutationRequestTimeout
-	}
-	return time.Duration(timeoutMilliSeconds) * time.Millisecond
-}
diff --git a/pkg/executor/core/executorwithcache.go b/pkg/executor/core/executorwithcache.go
deleted file mode 100644
index c95171f..0000000
--- a/pkg/executor/core/executorwithcache.go
+++ /dev/null
@@ -1,49 +0,0 @@
-/*
-Copyright The Ratify Authors.
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package core
-
-import (
-	"context"
-	"time"
-
-	"github.com/ratify-project/ratify/pkg/executor"
-	"github.com/ratify-project/ratify/pkg/executor/types"
-	"github.com/ratify-project/ratify/pkg/verifiercache"
-)
-
-// ExecutorWithCache wraps the executor with a verifier cache
-type ExecutorWithCache struct {
-	base                   executor.Executor
-	verifierCache          verifiercache.VerifierCache
-	verfierCacheItemExpiry time.Duration
-}
-
-func (executor ExecutorWithCache) VerifySubject(ctx context.Context, verifyParameters executor.VerifyParameters) (types.VerifyResult, error) {
-	// check the cache for the existence of item
-	cachedResult, ok := executor.verifierCache.GetVerifyResult(ctx, verifyParameters.Subject)
-
-	if ok {
-		return cachedResult, nil
-	}
-
-	result, err := executor.base.VerifySubject(ctx, verifyParameters)
-
-	if err == nil {
-		executor.verifierCache.SetVerifyResult(ctx, verifyParameters.Subject, result, executor.verfierCacheItemExpiry)
-	}
-
-	return result, err
-}
diff --git a/pkg/executor/types/types.go b/pkg/executor/types/types.go
deleted file mode 100644
index 30bac9a..0000000
--- a/pkg/executor/types/types.go
+++ /dev/null
@@ -1,47 +0,0 @@
-/*
-Copyright The Ratify Authors.
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package types
-
-import (
-	"fmt"
-
-	"github.com/ratify-project/ratify/pkg/verifier/types"
-)
-
-// VerifyResult describes the results of verifying a subject
-type VerifyResult struct {
-	IsSuccess       bool          `json:"isSuccess,omitempty"`
-	VerifierReports []interface{} `json:"verifierReports"`
-}
-
-// NestedVerifierReport describes the results of verifying an artifact and its
-// nested artifacts by available verifiers.
-// Note: NestedVerifierReport is used for verification results in v1.
-type NestedVerifierReport struct {
-	Subject         string                 `json:"subject"`
-	ReferenceDigest string                 `json:"referenceDigest"`
-	ArtifactType    string                 `json:"artifactType"`
-	VerifierReports []types.VerifierResult `json:"verifierReports"`
-	NestedReports   []NestedVerifierReport `json:"nestedReports"`
-}
-
-// NewNestedVerifierReport creates a new NestedVerifierReport from an interface.
-func NewNestedVerifierReport(report interface{}) (NestedVerifierReport, error) {
-	if nvr, ok := report.(NestedVerifierReport); ok {
-		return nvr, nil
-	}
-	return NestedVerifierReport{}, fmt.Errorf("unable to convert %v to NestedVerifierReport", report)
-}


Test patch:
diff --git a/internal/executor/executor_test.go b/internal/executor/executor_test.go
new file mode 100644
index 0000000..fe18753
--- /dev/null
+++ b/internal/executor/executor_test.go
@@ -0,0 +1,178 @@
+/*
+Copyright The Ratify Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package executor
+
+import (
+	"context"
+	"testing"
+
+	"github.com/ratify-project/ratify-go"
+	"github.com/ratify-project/ratify/v2/internal/store/factory"
+
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+	ef "github.com/ratify-project/ratify/v2/internal/policyenforcer/factory"
+	vf "github.com/ratify-project/ratify/v2/internal/verifier/factory"
+)
+
+const (
+	mockVerifierName       = "mock-verifier-name"
+	mockVerifierType       = "mock-verifier-type"
+	mockStoreType          = "mock-store"
+	mockPolicyEnforcerType = "mock-policy-enforcer"
+)
+
+type mockStore struct{}
+
+func (m *mockStore) Resolve(_ context.Context, _ string) (ocispec.Descriptor, error) {
+	return ocispec.Descriptor{}, nil
+}
+
+func (m *mockStore) ListReferrers(_ context.Context, _ string, _ []string, _ func(referrers []ocispec.Descriptor) error) error {
+	return nil
+}
+
+func (m *mockStore) FetchBlob(_ context.Context, _ string, _ ocispec.Descriptor) ([]byte, error) {
+	return nil, nil
+}
+
+func (m *mockStore) FetchManifest(_ context.Context, _ string, _ ocispec.Descriptor) ([]byte, error) {
+	return nil, nil
+}
+
+func newMockStore(_ factory.NewStoreOptions) (ratify.Store, error) {
+	return &mockStore{}, nil
+}
+
+type mockPolicyEnforcer struct{}
+
+func (m *mockPolicyEnforcer) Evaluator(_ context.Context, _ string) (ratify.Evaluator, error) {
+	return nil, nil
+}
+
+func createPolicyEnforcer(_ *ef.NewPolicyEnforcerOptions) (ratify.PolicyEnforcer, error) {
+	return &mockPolicyEnforcer{}, nil
+}
+
+type mockVerifier struct{}
+
+func (m *mockVerifier) Name() string {
+	return mockVerifierName
+}
+func (m *mockVerifier) Type() string {
+	return mockVerifierType
+}
+func (m *mockVerifier) Verifiable(_ ocispec.Descriptor) bool {
+	return true
+}
+
+func (m *mockVerifier) Verify(_ context.Context, _ *ratify.VerifyOptions) (*ratify.VerificationResult, error) {
+	return &ratify.VerificationResult{}, nil
+}
+
+func createMockVerifier(_ vf.NewVerifierOptions) (ratify.Verifier, error) {
+	return &mockVerifier{}, nil
+}
+
+func TestNewExecutor(t *testing.T) {
+	factory.RegisterStoreFactory(mockStoreType, newMockStore)
+	vf.RegisterVerifierFactory(mockVerifierType, createMockVerifier)
+	ef.RegisterPolicyEnforcerFactory(mockPolicyEnforcerType, createPolicyEnforcer)
+
+	tests := []struct {
+		name           string
+		opts           *Options
+		expectErr      bool
+		expectExecutor bool
+	}{
+		{
+			name:           "nil options",
+			opts:           nil,
+			expectErr:      true,
+			expectExecutor: false,
+		},
+		{
+			name:           "failed to create verifiers",
+			opts:           &Options{},
+			expectErr:      true,
+			expectExecutor: false,
+		},
+		{
+			name: "failed to create store",
+			opts: &Options{
+				Verifiers: []vf.NewVerifierOptions{
+					{
+						Name: mockVerifierName,
+						Type: mockVerifierType,
+					},
+				},
+			},
+			expectErr:      true,
+			expectExecutor: false,
+		},
+		{
+			name: "failed to create policy enforcer",
+			opts: &Options{
+				Verifiers: []vf.NewVerifierOptions{
+					{
+						Name: mockVerifierName,
+						Type: mockVerifierType,
+					},
+				},
+				Stores: map[string]factory.NewStoreOptions{
+					"test": {
+						Type: mockStoreType,
+					},
+				},
+				Policy: &ef.NewPolicyEnforcerOptions{},
+			},
+			expectErr:      true,
+			expectExecutor: false,
+		},
+		{
+			name: "valid options",
+			opts: &Options{
+				Verifiers: []vf.NewVerifierOptions{
+					{
+						Name: mockVerifierName,
+						Type: mockVerifierType,
+					},
+				},
+				Stores: map[string]factory.NewStoreOptions{
+					"test": {
+						Type: mockStoreType,
+					},
+				},
+				Policy: &ef.NewPolicyEnforcerOptions{
+					Type: mockPolicyEnforcerType,
+				},
+			},
+			expectErr:      false,
+			expectExecutor: true,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			executor, err := NewExecutor(test.opts)
+			if (err != nil) != test.expectErr {
+				t.Errorf("expected error: %v, got: %v", test.expectErr, err)
+			}
+			if (executor != nil) != test.expectExecutor {
+				t.Errorf("expected executor: %v, got: %v", test.expectExecutor, executor != nil)
+			}
+		})
+	}
+}
diff --git a/pkg/executor/core/executor_test.go b/pkg/executor/core/executor_test.go
deleted file mode 100644
index 871a408..0000000
--- a/pkg/executor/core/executor_test.go
+++ /dev/null
@@ -1,880 +0,0 @@
-/*
-Copyright The Ratify Authors.
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package core
-
-import (
-	"context"
-	"errors"
-	"reflect"
-	"testing"
-	"time"
-
-	"github.com/opencontainers/go-digest"
-	oci "github.com/opencontainers/image-spec/specs-go/v1"
-	ratifyerrors "github.com/ratify-project/ratify/errors"
-	"github.com/ratify-project/ratify/pkg/common"
-	e "github.com/ratify-project/ratify/pkg/executor"
-	exConfig "github.com/ratify-project/ratify/pkg/executor/config"
-	"github.com/ratify-project/ratify/pkg/executor/types"
-	"github.com/ratify-project/ratify/pkg/ocispecs"
-	"github.com/ratify-project/ratify/pkg/policyprovider"
-	policyConfig "github.com/ratify-project/ratify/pkg/policyprovider/configpolicy"
-	pt "github.com/ratify-project/ratify/pkg/policyprovider/types"
-	"github.com/ratify-project/ratify/pkg/referrerstore"
-	storeConfig "github.com/ratify-project/ratify/pkg/referrerstore/config"
-	"github.com/ratify-project/ratify/pkg/referrerstore/mocks"
-	"github.com/ratify-project/ratify/pkg/verifier"
-)
-
-const (
-	testArtifactType1 = "test-type1"
-	testArtifactType2 = "test-type2"
-	subject1          = "localhost:5000/net-monitor:v1"
-	subjectDigest     = "sha256:6a5a5368e0c2d3e5909184fa28ddfd56072e7ff3ee9a945876f7eee5896ef5bb"
-	signatureDigest   = "sha256:9f13e0ac480cf86a5c9ec5d173001bbb6ec455f501f1812f0b0ad1f3468e8cfa"
-	artifactType      = "testArtifactType"
-)
-
-type mockPolicyProvider struct {
-	result     bool
-	policyType string
-}
-
-func (p *mockPolicyProvider) VerifyNeeded(_ context.Context, _ common.Reference, _ ocispecs.ReferenceDescriptor) bool {
-	return true
-}
-
-func (p *mockPolicyProvider) ContinueVerifyOnFailure(_ context.Context, _ common.Reference, _ ocispecs.ReferenceDescriptor, _ types.VerifyResult) bool {
-	return true
-}
-
-func (p *mockPolicyProvider) ErrorToVerifyResult(_ context.Context, _ string, _ error) types.VerifyResult {
-	return types.VerifyResult{}
-}
-
-func (p *mockPolicyProvider) OverallVerifyResult(_ context.Context, _ []interface{}) bool {
-	return p.result
-}
-
-func (p *mockPolicyProvider) GetPolicyType(_ context.Context) string {
-	if p.policyType == "" {
-		return pt.ConfigPolicy
-	}
-	return pt.RegoPolicy
-}
-
-type mockStore struct {
-	referrers map[string][]ocispecs.ReferenceDescriptor
-}
-
-func (s *mockStore) Name() string {
-	return "mockStore"
-}
-
-func (s *mockStore) ListReferrers(_ context.Context, _ common.Reference, _ []string, _ string, subjectDesc *ocispecs.SubjectDescriptor) (referrerstore.ListReferrersResult, error) {
-	if s.referrers == nil {
-		return referrerstore.ListReferrersResult{}, errors.New("some error happened")
-	}
-	if _, ok := s.referrers[subjectDesc.Digest.String()]; ok {
-		return referrerstore.ListReferrersResult{
-			NextToken: "",
-			Referrers: s.referrers[subjectDesc.Digest.String()],
-		}, nil
-	}
-	return referrerstore.ListReferrersResult{}, nil
-}
-
-func (s *mockStore) GetBlobContent(_ context.Context, _ common.Reference, _ digest.Digest) ([]byte, error) {
-	return nil, nil
-}
-
-func (s *mockStore) GetReferenceManifest(_ context.Context, _ common.Reference, _ ocispecs.ReferenceDescriptor) (ocispecs.ReferenceManifest, error) {
-	return ocispecs.ReferenceManifest{}, nil
-}
-
-func (s *mockStore) GetConfig() *storeConfig.StoreConfig {
-	return nil
-}
-
-func (s *mockStore) GetSubjectDescriptor(_ context.Context, subjectReference common.Reference) (*ocispecs.SubjectDescriptor, error) {
-	if subjectReference.Tag == "v1" {
-		return &ocispecs.SubjectDescriptor{
-			Descriptor: oci.Descriptor{
-				Digest: subjectDigest,
-			},
-		}, nil
-	}
-	return &ocispecs.SubjectDescriptor{
-		Descriptor: oci.Descriptor{
-			Digest: subjectReference.Digest,
-		},
-	}, nil
-}
-
-type mockVerifier struct {
-	canVerify      bool
-	verifierResult verifier.VerifierResult
-}
-
-func (v *mockVerifier) Name() string {
-	return "verifier-mockVerifier"
-}
-
-func (v *mockVerifier) Type() string {
-	return "mockVerifier"
-}
-
-func (v *mockVerifier) CanVerify(_ context.Context, _ ocispecs.ReferenceDescriptor) bool {
-	return v.canVerify
-}
-
-func (v *mockVerifier) Verify(_ context.Context,
-	_ common.Reference,
-	_ ocispecs.ReferenceDescriptor,
-	_ referrerstore.ReferrerStore) (verifier.VerifierResult, error) {
-	if reflect.DeepEqual(v.verifierResult, verifier.VerifierResult{}) {
-		return verifier.VerifierResult{}, errors.New("no verifier result")
-	}
-	return v.verifierResult, nil
-}
-
-func (v *mockVerifier) GetNestedReferences() []string {
-	return nil
-}
-
-func TestVerifySubjectInternal_ResolveSubjectDescriptor_Failed(t *testing.T) {
-	executor := Executor{}
-
-	verifyParameters := e.VerifyParameters{
-		Subject: "localhost:5000/net-monitor:v1",
-	}
-
-	_, err := executor.verifySubjectInternal(context.Background(), verifyParameters)
-
-	if err == nil {
-		t.Fatal("expected subject parsing to fail")
-	}
-}
-
-func TestVerifySubjectInternal_ResolveSubjectDescriptor_Success(t *testing.T) {
-	testDigest := digest.FromString("test")
-	store := &mocks.TestStore{
-		References: []ocispecs.ReferenceDescriptor{},
-		ResolveMap: map[string]digest.Digest{
-			"v1": testDigest,
-		},
-	}
-
-	executor := Executor{
-		ReferrerStores: []referrerstore.ReferrerStore{store},
-		PolicyEnforcer: &mockPolicyProvider{},
-	}
-
-	verifyParameters := e.VerifyParameters{
-		Subject: "localhost:5000/net-monitor:v1",
-	}
-
-	if _, err := executor.verifySubjectInternal(context.Background(), verifyParameters); !errors.Is(err, ratifyerrors.ErrorCodeNoVerifierReport.WithDetail("")) {
-		t.Fatalf("expected ErrReferrersNotFound actual %v", err)
-	}
-}
-
-func TestVerifySubjectInternal_Verify_NoReferrers(t *testing.T) {
-	testDigest := digest.FromString("test")
-	configPolicy := policyConfig.PolicyEnforcer{}
-	ex := &Executor{
-		PolicyEnforcer: configPolicy,
-		ReferrerStores: []referrerstore.ReferrerStore{&mocks.TestStore{
-			ResolveMap: map[string]digest.Digest{
-				"v1": testDigest,
-			},
-		}},
-		Verifiers: []verifier.ReferenceVerifier{&TestVerifier{}},
-		Config: &exConfig.ExecutorConfig{
-			VerificationRequestTimeout: nil,
-			MutationRequestTimeout:     nil,
-		},
-	}
-
-	verifyParameters := e.VerifyParameters{
-		Subject: "localhost:5000/net-monitor:v1",
-	}
-
-	if _, err := ex.verifySubjectInternal(context.Background(), verifyParameters); !errors.Is(err, ratifyerrors.ErrorCodeNoVerifierReport.WithDetail("")) {
-		t.Fatalf("expected ErrReferrersNotFound actual %v", err)
-	}
-}
-
-func TestVerifySubjectInternal_CanVerify_ExpectedResults(t *testing.T) {
-	testDigest := digest.FromString("test")
-	configPolicy := policyConfig.PolicyEnforcer{
-		ArtifactTypePolicies: map[string]pt.ArtifactTypeVerifyPolicy{
-			testArtifactType1: pt.AnyVerifySuccess,
-		}}
-	store := &mocks.TestStore{References: []ocispecs.ReferenceDescriptor{
-		{
-			ArtifactType: testArtifactType1,
-		},
-		{
-			ArtifactType: "test-type2",
-		}},
-		ResolveMap: map[string]digest.Digest{
-			"v1": testDigest,
-		},
-	}
-	ver := &TestVerifier{
-		CanVerifyFunc: func(at string) bool {
-			return at == testArtifactType1
-		},
-		VerifyResult: func(_ string) bool {
-			return true
-		},
-	}
-
-	ex := &Executor{
-		PolicyEnforcer: configPolicy,
-		ReferrerStores: []referrerstore.ReferrerStore{store},
-		Verifiers:      []verifier.ReferenceVerifier{ver},
-		Config: &exConfig.ExecutorConfig{
-			VerificationRequestTimeout: nil,
-			MutationRequestTimeout:     nil,
-		},
-	}
-
-	verifyParameters := e.VerifyParameters{
-		Subject: "localhost:5000/net-monitor:v1",
-	}
-
-	result, err := ex.verifySubjectInternal(context.Background(), verifyParameters)
-
-	if err != nil {
-		t.Fatalf("verification failed with err %v", err)
-	}
-
-	if !result.IsSuccess {
-		t.Fatal("verification expected to be success")
-	}
-
-	if len(result.VerifierReports) != 1 {
-		t.Fatalf("verification expected to return single report but actual count %d", len(result.VerifierReports))
-	}
-}
-
-func TestVerifySubjectInternal_VerifyFailures_ExpectedResults(t *testing.T) {
-	testDigest := digest.FromString("test")
-	testArtifactType := "test-type1"
-	configPolicy := policyConfig.PolicyEnforcer{
-		ArtifactTypePolicies: map[string]pt.ArtifactTypeVerifyPolicy{
-			testArtifactType: pt.AnyVerifySuccess,
-		}}
-	store := &mocks.TestStore{References: []ocispecs.ReferenceDescriptor{
-		{
-			ArtifactType: testArtifactType,
-		},
-		{
-			ArtifactType: "test-type2",
-		}},
-		ResolveMap: map[string]digest.Digest{
-			"v1": testDigest,
-		},
-	}
-	ver := &TestVerifier{
-		CanVerifyFunc: func(_ string) bool {
-			return true
-		},
-		VerifyResult: func(artifactType string) bool {
-			return artifactType != testArtifactType
-		},
-	}
-
-	ex := &Executor{
-		PolicyEnforcer: configPolicy,
-		ReferrerStores: []referrerstore.ReferrerStore{store},
-		Verifiers:      []verifier.ReferenceVerifier{ver},
-		Config: &exConfig.ExecutorConfig{
-			VerificationRequestTimeout: nil,
-			MutationRequestTimeout:     nil,
-		},
-	}
-
-	verifyParameters := e.VerifyParameters{
-		Subject: "localhost:5000/net-monitor:v1",
-	}
-
-	result, err := ex.verifySubjectInternal(context.Background(), verifyParameters)
-
-	if err != nil {
-		t.Fatalf("verification failed with err %v", err)
-	}
-
-	if result.IsSuccess {
-		t.Fatal("verification expected to fail")
-	}
-}
-
-func TestVerifySubjectInternal_VerifySuccess_ExpectedResults(t *testing.T) {
-	testDigest := digest.FromString("test")
-	configPolicy := policyConfig.PolicyEnforcer{
-		ArtifactTypePolicies: map[string]pt.ArtifactTypeVerifyPolicy{
-			testArtifactType1: pt.AnyVerifySuccess,
-			testArtifactType2: pt.AnyVerifySuccess,
-		}}
-	store := &mocks.TestStore{References: []ocispecs.ReferenceDescriptor{
-		{
-			ArtifactType: testArtifactType1,
-		},
-		{
-			ArtifactType: testArtifactType2,
-		}},
-		ResolveMap: map[string]digest.Digest{
-			"v1": testDigest,
-		},
-	}
-	ver := &TestVerifier{
-		CanVerifyFunc: func(_ string) bool {
-			return true
-		},
-		VerifyResult: func(_ string) bool {
-			return true
-		},
-	}
-
-	ex := &Executor{
-		PolicyEnforcer: configPolicy,
-		ReferrerStores: []referrerstore.ReferrerStore{store},
-		Verifiers:      []verifier.ReferenceVerifier{ver},
-		Config: &exConfig.ExecutorConfig{
-			VerificationRequestTimeout: nil,
-			MutationRequestTimeout:     nil,
-		},
-	}
-
-	verifyParameters := e.VerifyParameters{
-		Subject: "localhost:5000/net-monitor:v1",
-	}
-
-	result, err := ex.verifySubjectInternal(context.Background(), verifyParameters)
-
-	if err != nil {
-		t.Fatalf("verification failed with err %v", err)
-	}
-
-	if !result.IsSuccess {
-		t.Fatal("verification expected to fail")
-	}
-
-	if len(result.VerifierReports) != 2 {
-		t.Fatalf("verification expected to return two reports but actual count %d", len(result.VerifierReports))
-	}
-}
-
-// TestVerifySubjectInternalWithDecision_MultipleArtifacts_ExpectedResults tests multiple artifacts are verified concurrently
-func TestVerifySubjectInternalWithDecision_MultipleArtifacts_ExpectedResults(t *testing.T) {
-	testDigest := digest.FromString("test")
-	configPolicy := policyConfig.PolicyEnforcer{
-		ArtifactTypePolicies: map[string]pt.ArtifactTypeVerifyPolicy{
-			testArtifactType1: pt.AnyVerifySuccess,
-			testArtifactType2: pt.AnyVerifySuccess,
-		}}
-	store := &mocks.TestStore{References: []ocispecs.ReferenceDescriptor{
-		{
-			ArtifactType: testArtifactType1,
-		},
-		{
-			ArtifactType: testArtifactType2,
-		}},
-		ResolveMap: map[string]digest.Digest{
-			"v1": testDigest,
-		},
-	}
-	ver := &TestVerifier{
-		CanVerifyFunc: func(_ string) bool {
-			return true
-		},
-		VerifyResult: func(artifactType string) bool {
-			if artifactType == testArtifactType1 {
-				time.Sleep(2 * time.Second)
-			}
-			return true
-		},
-	}
-
-	ex := &Executor{
-		PolicyEnforcer: configPolicy,
-		ReferrerStores: []referrerstore.ReferrerStore{store},
-		Verifiers:      []verifier.ReferenceVerifier{ver},
-		Config: &exConfig.ExecutorConfig{
-			VerificationRequestTimeout: nil,
-			MutationRequestTimeout:     nil,
-		},
-	}
-
-	verifyParameters := e.VerifyParameters{
-		Subject: "localhost:5000/net-monitor:v1",
-	}
-
-	result, err := ex.verifySubjectInternal(context.Background(), verifyParameters)
-
-	if err != nil {
-		t.Fatalf("verification failed with err %v", err)
-	}
-
-	if !result.IsSuccess {
-		t.Fatal("verification expected to fail")
-	}
-
-	if len(result.VerifierReports) != 2 {
-		t.Fatalf("verification expected to return two reports but actual count %d", len(result.VerifierReports))
-	}
-
-	if result.VerifierReports[0].(verifier.VerifierResult).ArtifactType != "test-type2" {
-		t.Fatalf("verification expected to return second artifact verifier report first")
-	}
-}
-
-// TestVerifySubjectInternal_NestedReferences_Expected tests verifier config can specify nested references
-func TestVerifySubjectInternal_NestedReferences_Expected(t *testing.T) {
-	configPolicy := policyConfig.PolicyEnforcer{
-		ArtifactTypePolicies: map[string]pt.ArtifactTypeVerifyPolicy{
-			"default": "all",
-		}}
-
-	store := mocks.CreateNewTestStoreForNestedSbom()
-
-	// sbom verifier WITH nested references in config
-	sbomVerifier := &TestVerifier{
-		CanVerifyFunc: func(at string) bool {
-			return at == mocks.SbomArtifactType
-		},
-		VerifyResult: func(_ string) bool {
-			return true
-		},
-		nestedReferences: []string{"string-content-does-not-matter"},
-	}
-
-	signatureVerifier := &TestVerifier{
-		CanVerifyFunc: func(at string) bool {
-			return at == mocks.SignatureArtifactType
-		},
-		VerifyResult: func(_ string) bool {
-			return true
-		},
-	}
-
-	ex := &Executor{
-		PolicyEnforcer: configPolicy,
-		ReferrerStores: []referrerstore.ReferrerStore{store},
-		Verifiers:      []verifier.ReferenceVerifier{sbomVerifier, signatureVerifier},
-		Config: &exConfig.ExecutorConfig{
-			VerificationRequestTimeout: nil,
-			MutationRequestTimeout:     nil,
-		},
-	}
-
-	verifyParameters := e.VerifyParameters{
-		Subject: mocks.TestSubjectWithDigest,
-	}
-
-	result, err := ex.verifySubjectInternal(context.Background(), verifyParameters)
-
-	if err != nil {
-		t.Fatalf("verification failed with err %v", err)
-	}
-
-	if !result.IsSuccess {
-		t.Fatal("verification expected to succeed")
-	}
-
-	if len(result.VerifierReports) != 2 {
-		t.Fatalf("verification expected to return two reports but actual count %d", len(result.VerifierReports))
-	}
-
-	for _, report := range result.VerifierReports {
-		castedReport := report.(verifier.VerifierResult)
-
-		// check sbom report
-		if castedReport.ArtifactType == mocks.SbomArtifactType {
-			// check sbom has one nested results
-			if len(castedReport.NestedResults) != 1 {
-				t.Fatalf("Expected sbom report to have 1 nested result")
-			}
-			// check sbom nested result is successful
-			if !castedReport.NestedResults[0].IsSuccess {
-				t.Fatalf("Expected the sbom nested result to be successful")
-			}
-		} else {
-			// check non-sbom reports have zero nested results
-			if len(castedReport.NestedResults) != 0 {
-				t.Fatalf("Expected non-sboms reports to have zero nested results")
-			}
-		}
-	}
-}
-
-// TestVerifySubjectInternal__NoNestedReferences_Expected tests verifier config can specify no nested references
-func TestVerifySubjectInternal_NoNestedReferences_Expected(t *testing.T) {
-	configPolicy := policyConfig.PolicyEnforcer{
-		ArtifactTypePolicies: map[string]pt.ArtifactTypeVerifyPolicy{
-			"default": "all",
-		}}
-	store := mocks.CreateNewTestStoreForNestedSbom()
-
-	// sbom verifier WITHOUT nested references in config
-	sbomVer := &TestVerifier{
-		CanVerifyFunc: func(at string) bool {
-			return at == mocks.SbomArtifactType
-		},
-		VerifyResult: func(_ string) bool {
-			return true
-		},
-	}
-
-	signatureVer := &TestVerifier{
-		CanVerifyFunc: func(at string) bool {
-			return at == mocks.SignatureArtifactType
-		},
-		VerifyResult: func(_ string) bool {
-			return true
-		},
-	}
-
-	ex := &Executor{
-		PolicyEnforcer: configPolicy,
-		ReferrerStores: []referrerstore.ReferrerStore{store},
-		Verifiers:      []verifier.ReferenceVerifier{sbomVer, signatureVer},
-		Config: &exConfig.ExecutorConfig{
-			VerificationRequestTimeout: nil,
-			MutationRequestTimeout:     nil,
-		},
-	}
-
-	verifyParameters := e.VerifyParameters{
-		Subject: mocks.TestSubjectWithDigest,
-	}
-
-	result, err := ex.verifySubjectInternal(context.Background(), verifyParameters)
-
-	if err != nil {
-		t.Fatalf("verification failed with err %v", err)
-	}
-
-	if !result.IsSuccess {
-		t.Fatal("verification expected to succeed")
-	}
-
-	if len(result.VerifierReports) != 2 {
-		t.Fatalf("verification expected to return two reports but actual count %d", len(result.VerifierReports))
-	}
-
-	// check each report for: success, zero nested results
-	for _, report := range result.VerifierReports {
-		castedReport := report.(verifier.VerifierResult)
-
-		// check for success
-		if !castedReport.IsSuccess {
-			t.Fatal("verification expected to succeed")
-		}
-		// check there are no nested results
-		if len(castedReport.NestedResults) != 0 {
-			t.Fatalf("expected reports to have zero nested results")
-		}
-	}
-}
-
-// TestGetVerifyRequestTimeout_ExpectedResults tests the verification request timeout returned
-func TestGetVerifyRequestTimeout_ExpectedResults(t *testing.T) {
-	testcases := []struct {
-		setTimeout      int
-		ex              Executor
-		expectedTimeout int
-	}{
-		{
-			setTimeout: -1,
-			ex: Executor{
-				PolicyEnforcer: policyConfig.PolicyEnforcer{},
-				ReferrerStores: []referrerstore.ReferrerStore{},
-				Verifiers:      []verifier.ReferenceVerifier{},
-				Config:         nil,
-			},
-			expectedTimeout: 2900,
-		},
-		{
-			setTimeout: -1,
-			ex: Executor{
-				PolicyEnforcer: policyConfig.PolicyEnforcer{},
-				ReferrerStores: []referrerstore.ReferrerStore{},
-				Verifiers:      []verifier.ReferenceVerifier{},
-				Config: &exConfig.ExecutorConfig{
-					VerificationRequestTimeout: nil,
-					MutationRequestTimeout:     nil,
-				},
-			},
-			expectedTimeout: 2900,
-		},
-		{
-			setTimeout: 5000,
-			ex: Executor{
-				PolicyEnforcer: policyConfig.PolicyEnforcer{},
-				ReferrerStores: []referrerstore.ReferrerStore{},
-				Verifiers:      []verifier.ReferenceVerifier{},
-				Config: &exConfig.ExecutorConfig{
-					VerificationRequestTimeout: new(int),
-					MutationRequestTimeout:     nil,
-				},
-			},
-			expectedTimeout: 5000,
-		},
-	}
-
-	for _, testcase := range testcases {
-		if testcase.setTimeout >= 0 {
-			*testcase.ex.Config.VerificationRequestTimeout = testcase.setTimeout
-		}
-		expected := time.Millisecond * time.Duration(testcase.expectedTimeout)
-		actual := testcase.ex.GetVerifyRequestTimeout()
-		if actual != expected {
-			t.Fatalf("verification request timeout returned expected %dms but got %dms", expected.Milliseconds(), actual.Milliseconds())
-		}
-	}
-}
-
-// TestGetMutationRequestTimeout_ExpectedResults tests the mutation request timeout returned
-func TestGetMutationRequestTimeout_ExpectedResults(t *testing.T) {
-	testcases := []struct {
-		setTimeout      int
-		ex              Executor
-		expectedTimeout int
-	}{
-		{
-			setTimeout: -1,
-			ex: Executor{
-				PolicyEnforcer: policyConfig.PolicyEnforcer{},
-				ReferrerStores: []referrerstore.ReferrerStore{},
-				Verifiers:      []verifier.ReferenceVerifier{},
-				Config:         nil,
-			},
-			expectedTimeout: 950,
-		},
-		{
-			setTimeout: -1,
-			ex: Executor{
-				PolicyEnforcer: policyConfig.PolicyEnforcer{},
-				ReferrerStores: []referrerstore.ReferrerStore{},
-				Verifiers:      []verifier.ReferenceVerifier{},
-				Config: &exConfig.ExecutorConfig{
-					VerificationRequestTimeout: nil,
-					MutationRequestTimeout:     nil,
-				},
-			},
-			expectedTimeout: 950,
-		},
-		{
-			setTimeout: 2400,
-			ex: Executor{
-				PolicyEnforcer: policyConfig.PolicyEnforcer{},
-				ReferrerStores: []referrerstore.ReferrerStore{},
-				Verifiers:      []verifier.ReferenceVerifier{},
-				Config: &exConfig.ExecutorConfig{
-					VerificationRequestTimeout: nil,
-					MutationRequestTimeout:     new(int),
-				},
-			},
-			expectedTimeout: 2400,
-		},
-	}
-
-	for _, testcase := range testcases {
-		if testcase.setTimeout >= 0 {
-			*testcase.ex.Config.MutationRequestTimeout = testcase.setTimeout
-		}
-		expected := time.Millisecond * time.Duration(testcase.expectedTimeout)
-		actual := testcase.ex.GetMutationRequestTimeout()
-		if actual != expected {
-			t.Fatalf("mutation request timeout returned expected %dms but got %dms", expected.Milliseconds(), actual.Milliseconds())
-		}
-	}
-}
-
-func TestVerifySubject(t *testing.T) {
-	testCases := []struct {
-		name           string
-		params         e.VerifyParameters
-		expectedResult types.VerifyResult
-		stores         []referrerstore.ReferrerStore
-		policyEnforcer policyprovider.PolicyProvider
-		verifiers      []verifier.ReferenceVerifier
-		referrers      []ocispecs.ReferenceDescriptor
-		expectErr      bool
-	}{
-		{
-			name: "verify subject with invalid subject",
-			policyEnforcer: &mockPolicyProvider{
-				policyType: pt.RegoPolicy,
-			},
-			params:    e.VerifyParameters{},
-			expectErr: true,
-		},
-		{
-			name: "error from ListReferrers",
-			params: e.VerifyParameters{
-				Subject: subject1,
-			},
-			stores: []referrerstore.ReferrerStore{
-				&mockStore{
-					referrers: nil,
-				},
-			},
-			policyEnforcer: &mockPolicyProvider{
-				policyType: pt.RegoPolicy,
-			},
-			expectErr:      true,
-			expectedResult: types.VerifyResult{},
-		},
-		{
-			name: "empty referrers",
-			params: e.VerifyParameters{
-				Subject: subject1,
-			},
-			stores: []referrerstore.ReferrerStore{
-				&mockStore{
-					referrers: nil,
-				},
-			},
-			policyEnforcer: &mockPolicyProvider{
-				policyType: pt.RegoPolicy,
-			},
-			expectErr:      true,
-			expectedResult: types.VerifyResult{},
-		},
-		{
-			name: "one signature without matching verifier",
-			params: e.VerifyParameters{
-				Subject: subject1,
-			},
-			stores: []referrerstore.ReferrerStore{
-				&mockStore{
-					referrers: map[string][]ocispecs.ReferenceDescriptor{
-						subjectDigest: {
-							{
-								ArtifactType: artifactType,
-								Descriptor: oci.Descriptor{
-									Digest: signatureDigest,
-								},
-							},
-						},
-					},
-				},
-			},
-			verifiers: []verifier.ReferenceVerifier{
-				&mockVerifier{
-					canVerify: false,
-				},
-			},
-			policyEnforcer: &mockPolicyProvider{
-				result:     true,
-				policyType: pt.RegoPolicy,
-			},
-			expectErr: false,
-			expectedResult: types.VerifyResult{
-				IsSuccess: true,
-			},
-		},
-		{
-			name: "one signature with verifier failed",
-			params: e.VerifyParameters{
-				Subject: subject1,
-			},
-			stores: []referrerstore.ReferrerStore{
-				&mockStore{
-					referrers: map[string][]ocispecs.ReferenceDescriptor{
-						subjectDigest: {
-							{
-								ArtifactType: artifactType,
-								Descriptor: oci.Descriptor{
-									Digest: signatureDigest,
-								},
-							},
-						},
-					},
-				},
-			},
-			verifiers: []verifier.ReferenceVerifier{
-				&mockVerifier{
-					canVerify: true,
-					verifierResult: verifier.VerifierResult{
-						IsSuccess: false,
-					},
-				},
-			},
-			policyEnforcer: &mockPolicyProvider{
-				result:     false,
-				policyType: pt.RegoPolicy,
-			},
-			expectErr:      false,
-			expectedResult: types.VerifyResult{IsSuccess: false},
-		},
-		{
-			name: "one signature with verifier success",
-			params: e.VerifyParameters{
-				Subject: subject1,
-			},
-			stores: []referrerstore.ReferrerStore{
-				&mockStore{
-					referrers: map[string][]ocispecs.ReferenceDescriptor{
-						subjectDigest: {
-							{
-								ArtifactType: artifactType,
-								Descriptor: oci.Descriptor{
-									Digest: signatureDigest,
-								},
-							},
-						},
-					},
-				},
-			},
-			verifiers: []verifier.ReferenceVerifier{
-				&mockVerifier{
-					canVerify: true,
-					verifierResult: verifier.VerifierResult{
-						IsSuccess: true,
-					},
-				},
-			},
-			policyEnforcer: &mockPolicyProvider{
-				result:     true,
-				policyType: pt.RegoPolicy,
-			},
-			expectErr: false,
-			expectedResult: types.VerifyResult{
-				IsSuccess: true,
-			},
-		},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			ex := &Executor{tc.stores, tc.policyEnforcer, tc.verifiers, nil}
-
-			result, err := ex.VerifySubject(context.Background(), tc.params)
-			if (err != nil) != tc.expectErr {
-				t.Fatalf("expected error %v but got %v", tc.expectErr, err)
-			}
-			if result.IsSuccess != tc.expectedResult.IsSuccess {
-				t.Fatalf("expected result: %+v but got: %+v", tc.expectedResult, result)
-			}
-		})
-	}
-}
diff --git a/pkg/executor/core/testtypes.go b/pkg/executor/core/testtypes.go
deleted file mode 100644
index e3717d4..0000000
--- a/pkg/executor/core/testtypes.go
+++ /dev/null
@@ -1,56 +0,0 @@
-/*
-Copyright The Ratify Authors.
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package core
-
-import (
-	"context"
-
-	"github.com/ratify-project/ratify/pkg/common"
-	"github.com/ratify-project/ratify/pkg/ocispecs"
-	"github.com/ratify-project/ratify/pkg/referrerstore"
-	"github.com/ratify-project/ratify/pkg/verifier"
-)
-
-type TestVerifier struct {
-	CanVerifyFunc    func(artifactType string) bool
-	VerifyResult     func(artifactType string) bool
-	nestedReferences []string
-}
-
-func (s *TestVerifier) Name() string {
-	return "verifier-testVerifier"
-}
-
-func (s *TestVerifier) Type() string {
-	return "testVerifier"
-}
-
-func (s *TestVerifier) CanVerify(_ context.Context, referenceDescriptor ocispecs.ReferenceDescriptor) bool {
-	return s.CanVerifyFunc(referenceDescriptor.ArtifactType)
-}
-
-func (s *TestVerifier) Verify(_ context.Context,
-	_ common.Reference,
-	referenceDescriptor ocispecs.ReferenceDescriptor,
-	_ referrerstore.ReferrerStore) (verifier.VerifierResult, error) {
-	return verifier.VerifierResult{
-		IsSuccess: s.VerifyResult(referenceDescriptor.ArtifactType),
-	}, nil
-}
-
-func (s *TestVerifier) GetNestedReferences() []string {
-	return s.nestedReferences
-}