func (pc *PolicyContext) GetSignaturesWithAcceptedAuthor(ctx context.Context, image types.UnparsedImage) (sigs []*Signature, finalErr error) {
	if err := pc.changeState(pcReady, pcInUse); err != nil {
		return nil, err
	}
	defer func() {
		if err := pc.changeState(pcInUse, pcReady); err != nil {
			sigs = nil
			finalErr = err
		}
	}()

	logrus.Debugf("GetSignaturesWithAcceptedAuthor for image %s", policyIdentityLogName(image.Reference()))
	reqs := pc.requirementsForImageRef(image.Reference())

	// FIXME: rename Signatures to UnverifiedSignatures
	// FIXME: pass context.Context
	unverifiedSignatures, err := image.Signatures(ctx)
	if err != nil {
		return nil, err
	}

	res := make([]*Signature, 0, len(unverifiedSignatures))
	for sigNumber, sig := range unverifiedSignatures {
		var acceptedSig *Signature // non-nil if accepted
		rejected := false
		// FIXME? Say more about the contents of the signature, i.e. parse it even before verification?!
		logrus.Debugf("Evaluating signature %d:", sigNumber)
	interpretingReqs:
		for reqNumber, req := range reqs {
			// FIXME: Log the requirement itself? For now, we use just the number.
			// FIXME: supply state
			switch res, as, err := req.isSignatureAuthorAccepted(ctx, image, sig); res {
			case sarAccepted:
				if as == nil { // Coverage: this should never happen
					logrus.Debugf(" Requirement %d: internal inconsistency: sarAccepted but no parsed contents", reqNumber)
					rejected = true
					break interpretingReqs
				}
				logrus.Debugf(" Requirement %d: signature accepted", reqNumber)
				if acceptedSig == nil {
					acceptedSig = as
				} else if *as != *acceptedSig { // Coverage: this should never happen
					// Huh?! Two ways of verifying the same signature blob resulted in two different parses of its already accepted contents?
					logrus.Debugf(" Requirement %d: internal inconsistency: sarAccepted but different parsed contents", reqNumber)
					rejected = true
					acceptedSig = nil
					break interpretingReqs
				}
			case sarRejected:
				logrus.Debugf(" Requirement %d: signature rejected: %s", reqNumber, err.Error())
				rejected = true
				break interpretingReqs
			case sarUnknown:
				if err != nil { // Coverage: this should never happen
					logrus.Debugf(" Requirement %d: internal inconsistency: sarUnknown but an error message %s", reqNumber, err.Error())
					rejected = true
					break interpretingReqs
				}
				logrus.Debugf(" Requirement %d: signature state unknown, continuing", reqNumber)
			default: // Coverage: this should never happen
				logrus.Debugf(" Requirement %d: internal inconsistency: unknown result %#v", reqNumber, string(res))
				rejected = true
				break interpretingReqs
			}
		}
		// This also handles the (invalid) case of empty reqs, by rejecting the signature.
		if acceptedSig != nil && !rejected {
			logrus.Debugf(" Overall: OK, signature accepted")
			res = append(res, acceptedSig)
		} else {
			logrus.Debugf(" Overall: Signature not accepted")
		}
	}
	return res, nil
}
func (pc *PolicyContext) GetSignaturesWithAcceptedAuthor(ctx context.Context, image types.UnparsedImage) (sigs []*Signature, finalErr error) {
	if err := pc.changeState(pcReady, pcInUse); err != nil {
		return nil, err
	}
	defer func() {
		if err := pc.changeState(pcInUse, pcReady); err != nil {
			sigs = nil
			finalErr = err
		}
	}()

	logrus.Debugf("GetSignaturesWithAcceptedAuthor for image %s", policyIdentityLogName(image.Reference()))
	reqs := pc.requirementsForImageRef(image.Reference())

	
	
	unverifiedSignatures, err := image.Signatures(ctx)
	if err != nil {
		return nil, err
	}

	res := make([]*Signature, 0, len(unverifiedSignatures))
	for sigNumber, sig := range unverifiedSignatures {
		var acceptedSig *Signature 
		rejected := false
		
		logrus.Debugf("Evaluating signature %d:", sigNumber)
	interpretingReqs:
		for reqNumber, req := range reqs {
			
			
			switch res, as, err := req.isSignatureAuthorAccepted(ctx, image, sig); res {
			case sarAccepted:
				if as == nil { 
					logrus.Debugf(" Requirement %d: internal inconsistency: sarAccepted but no parsed contents", reqNumber)
					rejected = true
					break interpretingReqs
				}
				logrus.Debugf(" Requirement %d: signature accepted", reqNumber)
				if acceptedSig == nil {
					acceptedSig = as
				} else if *as != *acceptedSig { 
					
					logrus.Debugf(" Requirement %d: internal inconsistency: sarAccepted but different parsed contents", reqNumber)
					rejected = true
					acceptedSig = nil
					break interpretingReqs
				}
			case sarRejected:
				logrus.Debugf(" Requirement %d: signature rejected: %s", reqNumber, err.Error())
				rejected = true
				break interpretingReqs
			case sarUnknown:
				if err != nil { 
					logrus.Debugf(" Requirement %d: internal inconsistency: sarUnknown but an error message %s", reqNumber, err.Error())
					rejected = true
					break interpretingReqs
				}
				logrus.Debugf(" Requirement %d: signature state unknown, continuing", reqNumber)
			default: 
				logrus.Debugf(" Requirement %d: internal inconsistency: unknown result %#v", reqNumber, string(res))
				rejected = true
				break interpretingReqs
			}
		}
		
		if acceptedSig != nil && !rejected {
			logrus.Debugf(" Overall: OK, signature accepted")
			res = append(res, acceptedSig)
		} else {
			logrus.Debugf(" Overall: Signature not accepted")
		}
	}
	return res, nil
}
func ( pc * PolicyContext ) GetSignaturesWithAcceptedAuthor ( ctx context . Context , image types . UnparsedImage ) ( sigs [ ] * Signature , finalErr error ) { if err := pc . changeState ( pcReady , pcInUse ) ; err != nil { return nil , err } defer func ( ) { if err := pc . changeState ( pcInUse , pcReady ) ; err != nil { sigs = nil finalErr = err } } ( ) logrus . Debugf ( " " , policyIdentityLogName ( image . Reference ( ) ) ) reqs := pc . requirementsForImageRef ( image . Reference ( ) ) // FIXME: rename Signatures to UnverifiedSignatures // FIXME: pass context.Context unverifiedSignatures , err := image . Signatures ( ctx ) if err != nil { return nil , err } res := make ( [ ] * Signature , 0 , len ( unverifiedSignatures ) ) for sigNumber , sig := range unverifiedSignatures { var acceptedSig * Signature // non-nil if accepted rejected := false // FIXME? Say more about the contents of the signature, i.e. parse it even before verification?! logrus . Debugf ( " " , sigNumber ) interpretingReqs : for reqNumber , req := range reqs { // FIXME: Log the requirement itself? For now, we use just the number. // FIXME: supply state switch res , as , err := req . isSignatureAuthorAccepted ( ctx , image , sig ) ; res { case sarAccepted : if as == nil { // Coverage: this should never happen logrus . Debugf ( " " , reqNumber ) rejected = true break interpretingReqs } logrus . Debugf ( " " , reqNumber ) if acceptedSig == nil { acceptedSig = as } else if * as != * acceptedSig { // Coverage: this should never happen // Huh?! Two ways of verifying the same signature blob resulted in two different parses of its already accepted contents? logrus . Debugf ( " " , reqNumber ) rejected = true acceptedSig = nil break interpretingReqs } case sarRejected : logrus . Debugf ( " " , reqNumber , err . Error ( ) ) rejected = true break interpretingReqs case sarUnknown : if err != nil { // Coverage: this should never happen logrus . Debugf ( " " , reqNumber , err . Error ( ) ) rejected = true break interpretingReqs } logrus . Debugf ( " " , reqNumber ) default : // Coverage: this should never happen logrus . Debugf ( " " , reqNumber , string ( res ) ) rejected = true break interpretingReqs } } // This also handles the (invalid) case of empty reqs, by rejecting the signature. if acceptedSig != nil && ! rejected { logrus . Debugf ( " " ) res = append ( res , acceptedSig ) } else { logrus . Debugf ( " " ) } } return res , nil }
// GetSignaturesWithAcceptedAuthor returns those signatures from an image
// for which the policy accepts the author (and which have been successfully
// verified).
// NOTE: This may legitimately return an empty list and no error, if the image
// has no signatures or only invalid signatures.
// WARNING: This makes the signature contents acceptable for futher processing,
// but it does not necessarily mean that the contents of the signature are
// consistent with local policy.
// For example:
// - Do not use a an existence of an accepted signature to determine whether to run
//   a container based on this image; use IsRunningImageAllowed instead.
// - Just because a signature is accepted does not automatically mean the contents of the
//   signature are authorized to run code as root, or to affect system or cluster configuration.
GetSignaturesWithAcceptedAuthor returns those signatures from an image for which the policy accepts the author ( and which have been successfully verified ) . NOTE : This may legitimately return an empty list and no error if the image has no signatures or only invalid signatures . WARNING : This makes the signature contents acceptable for futher processing but it does not necessarily mean that the contents of the signature are consistent with local policy . For example : - Do not use a an existence of an accepted signature to determine whether to run a container based on this image ; use IsRunningImageAllowed instead . - Just because a signature is accepted does not automatically mean the contents of the signature are authorized to run code as root or to affect system or cluster configuration .