Repository: cli/cli
File: pkg/cmd/attestation/verify/verify.go (Go)

Code before:
		}

		if c.IsBundleProvided() {
			opts.Logger.Printf(opts.Logger.ColorScheme.Red("✗ Loading attestations from %s failed\n"), artifact.URL)
		} else if c.UseBundleFromRegistry {
			opts.Logger.Println(opts.Logger.ColorScheme.Red("✗ Loading attestations from OCI registry failed"))
		} else {
			opts.Logger.Println(opts.Logger.ColorScheme.Red("✗ Loading attestations from GitHub API failed"))
		}
		return err
	}

	pluralAttestation := text.Pluralize(len(attestations), "attestation")
	if c.IsBundleProvided() {
		opts.Logger.Printf("Loaded %s from %s\n", pluralAttestation, opts.BundlePath)
	} else if c.UseBundleFromRegistry {
		opts.Logger.Printf("Loaded %s from %s\n", pluralAttestation, opts.ArtifactPath)
	} else {
		opts.Logger.Printf("Loaded %s from GitHub API\n", pluralAttestation)
	}

	// Apply predicate type filter to returned attestations
	filteredAttestations := verification.FilterAttestations(opts.PredicateType, attestations)
	if len(filteredAttestations) == 0 {
		opts.Logger.Printf(opts.Logger.ColorScheme.Red("✗ No attestations found with predicate type: %s\n"), opts.PredicateType)
		return err
	}
	attestations = filteredAttestations

	policy, err := buildVerifyPolicy(opts, *artifact)
	if err != nil {
		opts.Logger.Println(opts.Logger.ColorScheme.Red("✗ Failed to build verification policy"))
		return err
	}

	opts.Logger.VerbosePrintf("Verifying attestations with predicate type: %s\n", opts.PredicateType)

	sigstoreRes := opts.SigstoreVerifier.Verify(attestations, policy)
	if sigstoreRes.Error != nil {
		opts.Logger.Println(opts.Logger.ColorScheme.Red("✗ Verification failed"))
		return sigstoreRes.Error
	}

	// Verify extensions
	if err := verification.VerifyCertExtensions(sigstoreRes.VerifyResults, opts.Tenant, opts.Owner, opts.Repo, opts.OIDCIssuer); err != nil {
		opts.Logger.Println(opts.Logger.ColorScheme.Red("✗ Verification failed"))
		return err
	}

	opts.Logger.Println(opts.Logger.ColorScheme.Green("✓ Verification succeeded!\n"))


Review comment (suggestion):
this is fine for now, but let's think about how to humanize this – i.e. distinguishing between "no attestations found" and "we only found the following predicate types", upon which we can offer some hints on how to tweak the command.

when we next chat, i have Some Ideas on how to organize this 🤔

Code after:
		if ok := errors.Is(err, api.ErrNoAttestations{}); ok {
			opts.Logger.Printf(opts.Logger.ColorScheme.Red("✗ No attestations found for subject %s\n"), artifact.DigestWithAlg())
			return err
		}

		if c.IsBundleProvided() {
			opts.Logger.Printf(opts.Logger.ColorScheme.Red("✗ Loading attestations from %s failed\n"), artifact.URL)
		} else if c.UseBundleFromRegistry {
			opts.Logger.Println(opts.Logger.ColorScheme.Red("✗ Loading attestations from OCI registry failed"))
		} else {
			opts.Logger.Println(opts.Logger.ColorScheme.Red("✗ Loading attestations from GitHub API failed"))
		}
		return err
	}

	pluralAttestation := text.Pluralize(len(attestations), "attestation")
	if c.IsBundleProvided() {
		opts.Logger.Printf("Loaded %s from %s\n", pluralAttestation, opts.BundlePath)
	} else if c.UseBundleFromRegistry {
		opts.Logger.Printf("Loaded %s from %s\n", pluralAttestation, opts.ArtifactPath)
	} else {
		opts.Logger.Printf("Loaded %s from GitHub API\n", pluralAttestation)
	}

	// Apply predicate type filter to returned attestations
	filteredAttestations := verification.FilterAttestations(opts.PredicateType, attestations)
	if len(filteredAttestations) == 0 {
		opts.Logger.Printf(opts.Logger.ColorScheme.Red("✗ No attestations found with predicate type: %s\n"), opts.PredicateType)
		return err
	}
	attestations = filteredAttestations

	policy, err := buildVerifyPolicy(opts, *artifact)
	if err != nil {
		opts.Logger.Println(opts.Logger.ColorScheme.Red("✗ Failed to build verification policy"))
		return err
	}

	opts.Logger.VerbosePrintf("Verifying attestations with predicate type: %s\n", opts.PredicateType)

	sigstoreRes := opts.SigstoreVerifier.Verify(attestations, policy)
	if sigstoreRes.Error != nil {
		opts.Logger.Println(opts.Logger.ColorScheme.Red("✗ Verification failed"))
		return sigstoreRes.Error
	}

	// Verify extensions
	if err := verification.VerifyCertExtensions(sigstoreRes.VerifyResults, opts.Tenant, opts.Owner, opts.Repo, opts.OIDCIssuer); err != nil {
		opts.Logger.Println(opts.Logger.ColorScheme.Red("✗ Verification failed"))
		return err
	}