diff --git a/pkg/cmd/attestation/verification/extensions.go b/pkg/cmd/attestation/verification/extensions.go index 274e833c4..4c748e3e9 100644 --- a/pkg/cmd/attestation/verification/extensions.go +++ b/pkg/cmd/attestation/verification/extensions.go @@ -16,17 +16,20 @@ func VerifyCertExtensions(results []*AttestationProcessingResult, tenant, owner, return errors.New("no attestations proccessing results") } + var lastErr error for _, attestation := range results { - if err := verifyCertExtension(attestation, tenant, owner, repo, issuer); err == nil { + err := verifyCertExtension(attestation, tenant, owner, repo, issuer) + if err == nil { // if at least one attestation is verified, we're good as verification // is defined as successful if at least one attestation is verified return nil } + lastErr = err } // if we have exited the for loop without returning early due to successful // verification, we need to return an error - return ErrNoAttestationsVerified + return lastErr } func verifyCertExtension(attestation *AttestationProcessingResult, tenant, owner, repo, issuer string) error { diff --git a/pkg/cmd/attestation/verification/sigstore.go b/pkg/cmd/attestation/verification/sigstore.go index 1577ff663..825f9da1c 100644 --- a/pkg/cmd/attestation/verification/sigstore.go +++ b/pkg/cmd/attestation/verification/sigstore.go @@ -199,22 +199,27 @@ func (v *LiveSigstoreVerifier) verify(attestation *api.Attestation, policy verif } func (v *LiveSigstoreVerifier) Verify(attestations []*api.Attestation, policy verify.PolicyBuilder) ([]*AttestationProcessingResult, error) { - results := make([]*AttestationProcessingResult, 0) + if len(attestations) == 0 { + return nil, ErrNoAttestationsVerified + } + results := make([]*AttestationProcessingResult, 0) + var lastError error totalAttestations := len(attestations) for i, a := range attestations { v.config.Logger.VerbosePrintf("Verifying attestation %d/%d against the configured Sigstore trust roots\n", i+1, totalAttestations) apr, err := v.verify(a, policy) if err != nil { - // move onto the next attestation if verification fails + lastError = err + // move onto the next attestation in the for loop if verification fails continue } results = append(results, apr) } if len(results) == 0 { - return nil, ErrNoAttestationsVerified + return nil, lastError } return results, nil