Repository: containerd/containerd
File: pkg/imageverifier/bindir/bindir.go (Go)

Code before:
	reason := &strings.Builder{}
	for i, entry := range entries {
		if (i+1) > v.config.MaxVerifiers && v.config.MaxVerifiers >= 0 {
			log.G(ctx).Warnf("image verifiers are being skipped since directory %v has %v entries, more than configured max of %v verifiers", v.config.BinDir, len(entries), v.config.MaxVerifiers)
			break
		}

		bin := entry.Name()
		start := time.Now()
		exitCode, vr, err := v.runVerifier(ctx, bin, name, desc)
		runtime := time.Since(start)
		if err != nil {
			return nil, fmt.Errorf("failed to call verifier %v (runtime %v): %w", bin, runtime, err)
		}

		if exitCode != 0 {
			return &imageverifier.Judgement{
				OK:     false,
				Reason: fmt.Sprintf("verifier %v rejected image (exit code %v): %v", bin, exitCode, vr),
			}, nil
		}

		if i > 0 {
			reason.WriteString(", ")
		}
		fmt.Fprintf(reason, "%v => %v", bin, vr)
	}

	return &imageverifier.Judgement{
		OK:     true,
		Reason: reason.String(),
	}, nil
}

func (v *ImageVerifier) runVerifier(ctx context.Context, bin string, imageName string, desc ocispec.Descriptor) (exitCode int, reason string, err error) {
	ctx, cancel := context.WithTimeout(ctx, tomlext.ToStdTime(v.config.PerVerifierTimeout))
	defer cancel()

	binPath := filepath.Join(v.config.BinDir, bin)
	args := []string{
		"-name", imageName,
		"-digest", desc.Digest.String(),
		"-stdin-media-type", ocispec.MediaTypeDescriptor,
	}

	cmd := exec.CommandContext(ctx, binPath, args...)

	// We construct our own pipes instead of using the default StdinPipe,
	// StoutPipe, and StderrPipe in order to set timeouts on reads and writes.
	stdinRead, stdinWrite, err := os.Pipe()
	if err != nil {

Review comment (suggestion):
Alternatively (if we want to avoid the overhead of `Fprintf`);

```go
reason.WriteString(bin + " => " + vr)
```

Code after:
	reason := &strings.Builder{}
	for i, entry := range entries {
		if (i+1) > v.config.MaxVerifiers && v.config.MaxVerifiers >= 0 {
			log.G(ctx).Warnf("image verifiers are being skipped since directory %v has %v entries, more than configured max of %v verifiers", v.config.BinDir, len(entries), v.config.MaxVerifiers)
			break
		}

		bin := entry.Name()
		start := time.Now()
		exitCode, vr, err := v.runVerifier(ctx, bin, name, desc)
		runtime := time.Since(start)
		if err != nil {
			return nil, fmt.Errorf("failed to call verifier %v (runtime %v): %w", bin, runtime, err)
		}

		if exitCode != 0 {
			return &imageverifier.Judgement{
				OK:     false,
				Reason: fmt.Sprintf("verifier %v rejected image (exit code %v): %v", bin, exitCode, vr),
			}, nil
		}

		if i > 0 {
			reason.WriteString(", ")
		}
		reason.WriteString(bin + " => " + vr)
	}

	return &imageverifier.Judgement{
		OK:     true,
		Reason: reason.String(),
	}, nil
}

func (v *ImageVerifier) runVerifier(ctx context.Context, bin string, imageName string, desc ocispec.Descriptor) (exitCode int, reason string, err error) {
	ctx, cancel := context.WithTimeout(ctx, tomlext.ToStdTime(v.config.PerVerifierTimeout))
	defer cancel()

	binPath := filepath.Join(v.config.BinDir, bin)
	args := []string{
		"-name", imageName,
		"-digest", desc.Digest.String(),
		"-stdin-media-type", ocispec.MediaTypeDescriptor,
	}

	cmd := exec.CommandContext(ctx, binPath, args...)

	// We construct our own pipes instead of using the default StdinPipe,
	// StoutPipe, and StderrPipe in order to set timeouts on reads and writes.
	stdinRead, stdinWrite, err := os.Pipe()
	if err != nil {