feat: adds no cert found on sig exit code (#3038)

Signed-off-by: ChrisJBurns <29541485+ChrisJBurns@users.noreply.github.com>

cmd/cosign/errors/exit_code_lookup.go

@@ -34,6 +34,10 @@ func LookupExitCodeForError(err interface{ error }) int {
 		return ImageWithoutSignature
 	}
 
+	if noCertificateFoundOnSignature(err) {
+		return NoCertificateFoundOnSignature
+	}
+
 	// we want to return exit code = `1` at this point because there is
 	// no valid exit code found for the error type passed, so we default to 1.
 	return 1
@@ -53,3 +57,8 @@ func noSignaturesFoundError(err interface{ error }) bool {
 	var errNoSignaturesFound *cosignError.ErrNoSignaturesFound
 	return errors.As(err, &errNoSignaturesFound)
 }
+
+func noCertificateFoundOnSignature(err interface{ error }) bool {
+	var errNoCertificateFoundOnSignature *cosignError.ErrNoCertificateFoundOnSignature
+	return errors.As(err, &errNoCertificateFoundOnSignature)
+}

cmd/cosign/errors/exit_codes.go

@@ -33,3 +33,6 @@ const NonExistentTag = 11
 
 // Error verifying image due to no matching signature
 const NoMatchingSignature = 12
+
+// Error verifying image due to no certificate found on signature
+const NoCertificateFoundOnSignature = 13

pkg/cosign/errors.go

@@ -67,3 +67,11 @@ type ErrNoMatchingAttestations struct {
 func (e *ErrNoMatchingAttestations) Error() string {
 	return e.err.Error()
 }
+
+type ErrNoCertificateFoundOnSignature struct {
+	err error
+}
+
+func (e *ErrNoCertificateFoundOnSignature) Error() string {
+	return e.err.Error()
+}

pkg/cosign/verify.go

@@ -689,8 +689,7 @@ func verifyInternal(ctx context.Context, sig oci.Signature, h v1.Hash,
 			return false, err
 		}
 		if cert == nil {
-			// TODO: add error type instead of blank string
-			return false, ThrowError(&VerificationFailure{
+			return false, ThrowError(&ErrNoCertificateFoundOnSignature{
 				fmt.Errorf("no certificate found on signature"),
 			})
 		}