Repository: cli/cli
File: pkg/cmd/attestation/verification/policy.go (Go)

Code before:
	}
	return nil
}

func (c EnforcementCriteria) BuildPolicyInformation() string {
	template :=
		`
The following policy criteria will be enforced against all attestations:
- Predicate type must match %s
- Signing certificate's OIDC issuer must match %s
- Artifact must be built in an organization whose URI is %s`

	info := fmt.Sprintf(template, c.PredicateType, c.Certificate.Issuer, c.Certificate.SourceRepositoryOwnerURI)

	if c.Certificate.SourceRepositoryURI != "" {
		info += fmt.Sprintf("\n- Artifact built in a repository whose URI is %s", c.Certificate.SourceRepositoryURI)
	}

	if c.Certificate.RunnerEnvironment == GitHubRunner {
		info += "\n- Attestation must have been generated by an Action workflow executed in a GitHub hosted runner"
	}

	if c.SAN != "" {
		info += fmt.Sprintf("\n- Signing certificate must have a Subject Alternative Name matching the exact value %s", c.SAN)
	} else if c.SANRegex != "" {
		info += fmt.Sprintf("\n- Signing certificate must have a Subject Alternative Name matching the regex %s", c.SANRegex)
	}

	return info
}

func (c EnforcementCriteria) BuildPolicyInformationForTable() [][]string {
	predicateInfo := []string{"Predicate type", c.PredicateType}
	issuerInfo := []string{"Issuer", c.Certificate.Issuer}
	ownerURIInfo := []string{"SourceRepositoryOwnerURI", c.Certificate.SourceRepositoryOwnerURI}
	info := [][]string{predicateInfo, issuerInfo, ownerURIInfo}

	if c.Certificate.SourceRepositoryURI != "" {
		sourceRepoURIInfo := []string{"SourceRepositoryURI", c.Certificate.SourceRepositoryURI}
		info = append(info, sourceRepoURIInfo)
	}

	if c.Certificate.RunnerEnvironment == GitHubRunner {
		runnerInfo := []string{"RunnerEnvironment", c.Certificate.RunnerEnvironment}
		info = append(info, runnerInfo)
	}

	if c.SAN != "" {
		sanInfo := []string{"SAN", c.SAN}
		info = append(info, sanInfo)
	} else if c.SANRegex != "" {

Review comment (suggestion):
In addition to making this match the preceding comment, a thought that occurred to me is that it might read better if all of the 

"Signing certificate foo…"
"Signing certificate bar…"
"Signing certificate baz…"

came sequentially, rather than being mixed in with other statements

Code after:
		return fmt.Errorf("SANRegex or SAN must be set")
	}
	return nil
}

func (c EnforcementCriteria) BuildPolicyInformation() string {
	policyAttr := make([][]string, 0, 6)

	policyAttr = appendStr(policyAttr, "- OIDC Issuer must match", c.Certificate.Issuer)
	if c.Certificate.RunnerEnvironment == GitHubRunner {
		policyAttr = appendStr(policyAttr, "- Action workflow Runner Environment must match ", GitHubRunner)
	}

	policyAttr = appendStr(policyAttr, "- Source Repository Owner URI must match", c.Certificate.SourceRepositoryOwnerURI)

	if c.Certificate.SourceRepositoryURI != "" {
		policyAttr = appendStr(policyAttr, "- Source Repository URI must match", c.Certificate.SourceRepositoryURI)
	}

	policyAttr = appendStr(policyAttr, "- Predicate type must match", c.PredicateType)

	if c.SAN != "" {
		policyAttr = appendStr(policyAttr, "- Subject Alternative Name must match", c.SAN)
	} else if c.SANRegex != "" {
		policyAttr = appendStr(policyAttr, "- Subject Alternative Name must match regex", c.SANRegex)
	}

	maxColLen := 0
	for _, attr := range policyAttr {
		if len(attr[0]) > maxColLen {
			maxColLen = len(attr[0])
		}
	}

	policyInfo := ""
	for _, attr := range policyAttr {
		dots := strings.Repeat(".", maxColLen-len(attr[0]))
		policyInfo += fmt.Sprintf("%s:%s %s\n", attr[0], dots, attr[1])
	}

	return policyInfo
}

func appendStr(arr [][]string, a, b string) [][]string {
	return append(arr, []string{a, b})
}