From d0cc9853c9b8175638c78e06dce3255617c4c263 Mon Sep 17 00:00:00 2001
From: Chris Burns <29541485+ChrisJBurns@users.noreply.github.com>
Date: Fri, 9 Jun 2023 22:59:23 +0100
Subject: [PATCH] feat: adds no cert found on sig exit code (#3038)

Signed-off-by: ChrisJBurns <29541485+ChrisJBurns@users.noreply.github.com>
---
 cmd/cosign/errors/exit_code_lookup.go | 9 +++++++++
 cmd/cosign/errors/exit_codes.go       | 3 +++
 doc/cosign_exit_codes.md              | 1 +
 pkg/cosign/errors.go                  | 8 ++++++++
 pkg/cosign/verify.go                  | 3 +--
 5 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/cmd/cosign/errors/exit_code_lookup.go b/cmd/cosign/errors/exit_code_lookup.go
index 7408195166c..93d097ab79a 100644
--- a/cmd/cosign/errors/exit_code_lookup.go
+++ b/cmd/cosign/errors/exit_code_lookup.go
@@ -34,6 +34,10 @@ func LookupExitCodeForError(err interface{ error }) int {
 		return ImageWithoutSignature
 	}
 
+	if noCertificateFoundOnSignature(err) {
+		return NoCertificateFoundOnSignature
+	}
+
 	// we want to return exit code = `1` at this point because there is
 	// no valid exit code found for the error type passed, so we default to 1.
 	return 1
@@ -53,3 +57,8 @@ func noSignaturesFoundError(err interface{ error }) bool {
 	var errNoSignaturesFound *cosignError.ErrNoSignaturesFound
 	return errors.As(err, &errNoSignaturesFound)
 }
+
+func noCertificateFoundOnSignature(err interface{ error }) bool {
+	var errNoCertificateFoundOnSignature *cosignError.ErrNoCertificateFoundOnSignature
+	return errors.As(err, &errNoCertificateFoundOnSignature)
+}
diff --git a/cmd/cosign/errors/exit_codes.go b/cmd/cosign/errors/exit_codes.go
index 5454198e20d..62287694d3e 100644
--- a/cmd/cosign/errors/exit_codes.go
+++ b/cmd/cosign/errors/exit_codes.go
@@ -33,3 +33,6 @@ const NonExistentTag = 11
 
 // Error verifying image due to no matching signature
 const NoMatchingSignature = 12
+
+// Error verifying image due to no certificate found on signature
+const NoCertificateFoundOnSignature = 13
diff --git a/doc/cosign_exit_codes.md b/doc/cosign_exit_codes.md
index 5548c6634af..1ebaf2013c8 100644
--- a/doc/cosign_exit_codes.md
+++ b/doc/cosign_exit_codes.md
@@ -7,3 +7,4 @@
 | 10 | Error verifying image due to no signature|
 | 11 | Error verifying image due to non-existent tag|
 | 12 | Error verifying image due to no matching signature|
+| 13 | Error verifying image due to no certificate found on signature|
diff --git a/pkg/cosign/errors.go b/pkg/cosign/errors.go
index 6d7251a62a2..0fe40c40808 100644
--- a/pkg/cosign/errors.go
+++ b/pkg/cosign/errors.go
@@ -67,3 +67,11 @@ type ErrNoMatchingAttestations struct {
 func (e *ErrNoMatchingAttestations) Error() string {
 	return e.err.Error()
 }
+
+type ErrNoCertificateFoundOnSignature struct {
+	err error
+}
+
+func (e *ErrNoCertificateFoundOnSignature) Error() string {
+	return e.err.Error()
+}
diff --git a/pkg/cosign/verify.go b/pkg/cosign/verify.go
index 865414b8562..9d7af1ec828 100644
--- a/pkg/cosign/verify.go
+++ b/pkg/cosign/verify.go
@@ -689,8 +689,7 @@ func verifyInternal(ctx context.Context, sig oci.Signature, h v1.Hash,
 			return false, err
 		}
 		if cert == nil {
-			// TODO: add error type instead of blank string
-			return false, ThrowError(&VerificationFailure{
+			return false, ThrowError(&ErrNoCertificateFoundOnSignature{
 				fmt.Errorf("no certificate found on signature"),
 			})
 		}