Repository: cli/cli
File: pkg/cmd/attestation/verification/policy.go (Go)

Code before:
		return fmt.Errorf("RunnerEnvironment must be set to either \"\" or %s", GitHubRunner)
	}
	if c.Certificate.SourceRepositoryOwnerURI == "" {
		return fmt.Errorf("SourceRepositoryOwnerURI must be set")
	}
	if c.PredicateType == "" {
		return fmt.Errorf("PredicateType must be set")
	}
	if c.SANRegex == "" && c.SAN == "" {
		return fmt.Errorf("SANRegex or SAN must be set")
	}
	return nil
}

func (c EnforcementCriteria) BuildPolicyInformation() string {
	template :=
		`
The following policy criteria will be enforced against all attestations:
- Predicate type must match %s
- Signing certificate's OIDC issuer must match %s
- Artifact must be built in an organization whose URI is %s`

	info := fmt.Sprintf(template, c.PredicateType, c.Certificate.Issuer, c.Certificate.SourceRepositoryOwnerURI)

	if c.Certificate.SourceRepositoryURI != "" {
		info += fmt.Sprintf("\n- Artifact built in a repository whose URI is %s", c.Certificate.SourceRepositoryURI)
	}

	if c.Certificate.RunnerEnvironment == GitHubRunner {
		info += "\n- Attestation must have been generated by an Action workflow executed in a GitHub hosted runner"
	}

	if c.SAN != "" {
		info += fmt.Sprintf("\n- Signing certificate must have a Subject Alternative Name matching the exact value %s", c.SAN)
	} else if c.SANRegex != "" {
		info += fmt.Sprintf("\n- Signing certificate must have a Subject Alternative Name matching the regex %s", c.SANRegex)
	}

	return info
}

func (c EnforcementCriteria) BuildPolicyInformationForTable() [][]string {
	predicateInfo := []string{"Predicate type", c.PredicateType}
	issuerInfo := []string{"Issuer", c.Certificate.Issuer}
	ownerURIInfo := []string{"SourceRepositoryOwnerURI", c.Certificate.SourceRepositoryOwnerURI}
	info := [][]string{predicateInfo, issuerInfo, ownerURIInfo}

	if c.Certificate.SourceRepositoryURI != "" {
		sourceRepoURIInfo := []string{"SourceRepositoryURI", c.Certificate.SourceRepositoryURI}
		info = append(info, sourceRepoURIInfo)
	}

Review comment (suggestion):
similarly,

```suggestion
		info += fmt.Sprintf("\n- Source Repository URI must match %s", c.Certificate.SourceRepositoryURI)
```

Code after:
	if c.Certificate.RunnerEnvironment != "" && c.Certificate.RunnerEnvironment != GitHubRunner {
		return fmt.Errorf("RunnerEnvironment must be set to either \"\" or %s", GitHubRunner)
	}
	if c.Certificate.SourceRepositoryOwnerURI == "" {
		return fmt.Errorf("SourceRepositoryOwnerURI must be set")
	}
	if c.PredicateType == "" {
		return fmt.Errorf("PredicateType must be set")
	}
	if c.SANRegex == "" && c.SAN == "" {
		return fmt.Errorf("SANRegex or SAN must be set")
	}
	return nil
}

func (c EnforcementCriteria) BuildPolicyInformation() string {
	policyAttr := make([][]string, 0, 6)

	policyAttr = appendStr(policyAttr, "- OIDC Issuer must match", c.Certificate.Issuer)
	if c.Certificate.RunnerEnvironment == GitHubRunner {
		policyAttr = appendStr(policyAttr, "- Action workflow Runner Environment must match ", GitHubRunner)
	}

	policyAttr = appendStr(policyAttr, "- Source Repository Owner URI must match", c.Certificate.SourceRepositoryOwnerURI)

	if c.Certificate.SourceRepositoryURI != "" {
		policyAttr = appendStr(policyAttr, "- Source Repository URI must match", c.Certificate.SourceRepositoryURI)
	}

	policyAttr = appendStr(policyAttr, "- Predicate type must match", c.PredicateType)

	if c.SAN != "" {
		policyAttr = appendStr(policyAttr, "- Subject Alternative Name must match", c.SAN)
	} else if c.SANRegex != "" {
		policyAttr = appendStr(policyAttr, "- Subject Alternative Name must match regex", c.SANRegex)
	}

	maxColLen := 0
	for _, attr := range policyAttr {
		if len(attr[0]) > maxColLen {
			maxColLen = len(attr[0])
		}
	}

	policyInfo := ""
	for _, attr := range policyAttr {
		dots := strings.Repeat(".", maxColLen-len(attr[0]))
		policyInfo += fmt.Sprintf("%s:%s %s\n", attr[0], dots, attr[1])
	}

	return policyInfo