diff --git a/cmd/cosign/errors/exit_code_lookup.go b/cmd/cosign/errors/exit_code_lookup.go index 7408195166c..93d097ab79a 100644 --- a/cmd/cosign/errors/exit_code_lookup.go +++ b/cmd/cosign/errors/exit_code_lookup.go @@ -34,6 +34,10 @@ func LookupExitCodeForError(err interface{ error }) int { return ImageWithoutSignature } + if noCertificateFoundOnSignature(err) { + return NoCertificateFoundOnSignature + } + // we want to return exit code = `1` at this point because there is // no valid exit code found for the error type passed, so we default to 1. return 1 @@ -53,3 +57,8 @@ func noSignaturesFoundError(err interface{ error }) bool { var errNoSignaturesFound *cosignError.ErrNoSignaturesFound return errors.As(err, &errNoSignaturesFound) } + +func noCertificateFoundOnSignature(err interface{ error }) bool { + var errNoCertificateFoundOnSignature *cosignError.ErrNoCertificateFoundOnSignature + return errors.As(err, &errNoCertificateFoundOnSignature) +} diff --git a/cmd/cosign/errors/exit_codes.go b/cmd/cosign/errors/exit_codes.go index 5454198e20d..62287694d3e 100644 --- a/cmd/cosign/errors/exit_codes.go +++ b/cmd/cosign/errors/exit_codes.go @@ -33,3 +33,6 @@ const NonExistentTag = 11 // Error verifying image due to no matching signature const NoMatchingSignature = 12 + +// Error verifying image due to no certificate found on signature +const NoCertificateFoundOnSignature = 13 diff --git a/doc/cosign_exit_codes.md b/doc/cosign_exit_codes.md index 5548c6634af..1ebaf2013c8 100644 --- a/doc/cosign_exit_codes.md +++ b/doc/cosign_exit_codes.md @@ -7,3 +7,4 @@ | 10 | Error verifying image due to no signature| | 11 | Error verifying image due to non-existent tag| | 12 | Error verifying image due to no matching signature| +| 13 | Error verifying image due to no certificate found on signature| diff --git a/pkg/cosign/errors.go b/pkg/cosign/errors.go index 6d7251a62a2..0fe40c40808 100644 --- a/pkg/cosign/errors.go +++ b/pkg/cosign/errors.go @@ -67,3 +67,11 @@ type ErrNoMatchingAttestations struct { func (e *ErrNoMatchingAttestations) Error() string { return e.err.Error() } + +type ErrNoCertificateFoundOnSignature struct { + err error +} + +func (e *ErrNoCertificateFoundOnSignature) Error() string { + return e.err.Error() +} diff --git a/pkg/cosign/verify.go b/pkg/cosign/verify.go index 865414b8562..9d7af1ec828 100644 --- a/pkg/cosign/verify.go +++ b/pkg/cosign/verify.go @@ -689,8 +689,7 @@ func verifyInternal(ctx context.Context, sig oci.Signature, h v1.Hash, return false, err } if cert == nil { - // TODO: add error type instead of blank string - return false, ThrowError(&VerificationFailure{ + return false, ThrowError(&ErrNoCertificateFoundOnSignature{ fmt.Errorf("no certificate found on signature"), }) }