Repository: cli/cli
File: pkg/cmd/attestation/verification/policy.go (Go)

Code before:
	if c.SANRegex == "" && c.SAN == "" {
		return fmt.Errorf("SANRegex or SAN must be set")
	}
	return nil
}

func (c EnforcementCriteria) BuildPolicyInformation() string {
	template :=
		`
The following policy criteria will be enforced against all attestations:
- Predicate type must match %s
- Signing certificate's OIDC issuer must match %s
- Artifact must be built in an organization whose URI is %s`

	info := fmt.Sprintf(template, c.PredicateType, c.Certificate.Issuer, c.Certificate.SourceRepositoryOwnerURI)

	if c.Certificate.SourceRepositoryURI != "" {
		info += fmt.Sprintf("\n- Artifact built in a repository whose URI is %s", c.Certificate.SourceRepositoryURI)
	}

	if c.Certificate.RunnerEnvironment == GitHubRunner {
		info += "\n- Attestation must have been generated by an Action workflow executed in a GitHub hosted runner"
	}

	if c.SAN != "" {
		info += fmt.Sprintf("\n- Signing certificate must have a Subject Alternative Name matching the exact value %s", c.SAN)
	} else if c.SANRegex != "" {
		info += fmt.Sprintf("\n- Signing certificate must have a Subject Alternative Name matching the regex %s", c.SANRegex)
	}

	return info
}

func (c EnforcementCriteria) BuildPolicyInformationForTable() [][]string {
	predicateInfo := []string{"Predicate type", c.PredicateType}
	issuerInfo := []string{"Issuer", c.Certificate.Issuer}
	ownerURIInfo := []string{"SourceRepositoryOwnerURI", c.Certificate.SourceRepositoryOwnerURI}
	info := [][]string{predicateInfo, issuerInfo, ownerURIInfo}

	if c.Certificate.SourceRepositoryURI != "" {
		sourceRepoURIInfo := []string{"SourceRepositoryURI", c.Certificate.SourceRepositoryURI}
		info = append(info, sourceRepoURIInfo)
	}

	if c.Certificate.RunnerEnvironment == GitHubRunner {
		runnerInfo := []string{"RunnerEnvironment", c.Certificate.RunnerEnvironment}
		info = append(info, runnerInfo)
	}

	if c.SAN != "" {
		sanInfo := []string{"SAN", c.SAN}

Review comment (suggestion):
```suggestion
		info += fmt.Sprintf("\n- Signing certificate Subject Alternative Name must match %s", c.SAN)
```

Code after:
	}
	if c.SANRegex == "" && c.SAN == "" {
		return fmt.Errorf("SANRegex or SAN must be set")
	}
	return nil
}

func (c EnforcementCriteria) BuildPolicyInformation() string {
	policyAttr := make([][]string, 0, 6)

	policyAttr = appendStr(policyAttr, "- OIDC Issuer must match", c.Certificate.Issuer)
	if c.Certificate.RunnerEnvironment == GitHubRunner {
		policyAttr = appendStr(policyAttr, "- Action workflow Runner Environment must match ", GitHubRunner)
	}

	policyAttr = appendStr(policyAttr, "- Source Repository Owner URI must match", c.Certificate.SourceRepositoryOwnerURI)

	if c.Certificate.SourceRepositoryURI != "" {
		policyAttr = appendStr(policyAttr, "- Source Repository URI must match", c.Certificate.SourceRepositoryURI)
	}

	policyAttr = appendStr(policyAttr, "- Predicate type must match", c.PredicateType)

	if c.SAN != "" {
		policyAttr = appendStr(policyAttr, "- Subject Alternative Name must match", c.SAN)
	} else if c.SANRegex != "" {
		policyAttr = appendStr(policyAttr, "- Subject Alternative Name must match regex", c.SANRegex)
	}

	maxColLen := 0
	for _, attr := range policyAttr {
		if len(attr[0]) > maxColLen {
			maxColLen = len(attr[0])
		}
	}

	policyInfo := ""
	for _, attr := range policyAttr {
		dots := strings.Repeat(".", maxColLen-len(attr[0]))
		policyInfo += fmt.Sprintf("%s:%s %s\n", attr[0], dots, attr[1])
	}

	return policyInfo
}

func appendStr(arr [][]string, a, b string) [][]string {
	return append(arr, []string{a, b})
}