fallback when vsa is not found

Author: joejstuart

cmd/validate/vsa.go

@@ -701,6 +701,8 @@ func processVSAResult(vsaResult *vsa.ValidationResult, imgStatus *ImageStatus, d
 	}
 
 	// Aggregate signature status
+	// When SignatureVerified is false, mark as NOT VERIFIED
+	// This covers both cases: signature verification failure and retrieval failure (no VSA to verify)
 	if !vsaResult.SignatureVerified {
 		data.SignatureStatus = "NOT VERIFIED"
 	}
@@ -745,9 +747,17 @@ func aggregateAllSectionsData(allResults []vsa.ComponentResult) AllSectionsData
 			Digest: shortDigest,
 		}
 
-		// Process VSA result
+		// Process VSA result (always process if available, even if there's an error)
 		if result.Result != nil {
 			processVSAResult(result.Result, &imgStatus, &data, shortDigest)
+		} else if result.Error != nil {
+			// If there's an error but no Result, create a status from the error
+			reason := extractReasonFromMessage(result.Error.Error())
+			imgStatus.VSAStatus = fmt.Sprintf("FAILED(reason=%s)", reason)
+			data.VSAFailed++
+			data.FallbackReasons[reason] = true
+			// When VSA retrieval fails, signature cannot be verified
+			data.SignatureStatus = "NOT VERIFIED"
 		}
 
 		// Handle fallback
@@ -1137,17 +1147,34 @@ func processSnapshotComponentWithWorkerContext(ctx context.Context, component ap
 	// Extract digest from ContainerImage
 	digest, err := vsa.ExtractDigestFromImageRef(component.ContainerImage)
 	if err != nil {
+		// Extract digest errors don't trigger fallback (invalid input)
 		return createErrorResult(component, fmt.Errorf("failed to extract digest: %w", err))
 	}
 
 	// Perform VSA validation
 	result, err := performVSAValidation(ctx, digest, data)
+
+	// Create ValidationResult from error if needed (for proper display)
 	if err != nil {
-		return createErrorResult(component, fmt.Errorf("VSA validation failed: %w", err))
+		// Create a ValidationResult from the error for proper display
+		errorResult := createValidationResultFromError(err)
+
+		// Check if fallback should be triggered BEFORE returning error
+		if data.fallbackToImageValidation && shouldTriggerFallbackForComponent(err, errorResult) {
+			return handleComponentFallback(ctx, component, data, errorResult, workerFallbackContext)
+		}
+
+		// Return error result with ValidationResult for proper display
+		return vsa.ComponentResult{
+			ComponentName: component.Name,
+			ImageRef:      component.ContainerImage,
+			Result:        errorResult,
+			Error:         fmt.Errorf("VSA validation failed: %w", err),
+		}
 	}
 
 	// Handle fallback if enabled and needed
-	if data.fallbackToImageValidation && shouldTriggerFallbackForComponent(err, result) {
+	if data.fallbackToImageValidation && shouldTriggerFallbackForComponent(nil, result) {
 		return handleComponentFallback(ctx, component, data, result, workerFallbackContext)
 	}
 
@@ -1232,13 +1259,45 @@ func handleComponentFallback(ctx context.Context, component app.SnapshotComponen
 
 // createErrorResult creates a ComponentResult with an error
 func createErrorResult(component app.SnapshotComponent, err error) vsa.ComponentResult {
+	// Create ValidationResult from error for proper display
+	errorResult := createValidationResultFromError(err)
 	return vsa.ComponentResult{
 		ComponentName: component.Name,
 		ImageRef:      component.ContainerImage,
+		Result:        errorResult,
 		Error:         err,
 	}
 }
 
+// createValidationResultFromError creates a ValidationResult from an error
+// This ensures proper display of VSA status even when validation fails
+func createValidationResultFromError(err error) *vsa.ValidationResult {
+	if err == nil {
+		return nil
+	}
+
+	// Determine reason code from error message
+	reasonCode := "retrieval_failed"
+	errMsg := err.Error()
+
+	// Check for specific error types
+	if strings.Contains(errMsg, "timeout") || strings.Contains(errMsg, "exceeded allowed execution time") {
+		reasonCode = "retrieval_failed"
+	} else if strings.Contains(errMsg, "no entries found") || strings.Contains(errMsg, "not found") {
+		reasonCode = "no_vsa"
+	} else if strings.Contains(errMsg, "signature") {
+		reasonCode = "retrieval_failed"
+	}
+
+	return &vsa.ValidationResult{
+		Passed:            false,
+		Message:           errMsg,
+		SignatureVerified: false, // When retrieval fails, signature cannot be verified
+		PredicateOutcome:  "",
+		ReasonCode:        reasonCode,
+	}
+}
+
 // OutputFormatter defines the interface for objects that can be formatted for output
 type OutputFormatter interface {
 	PrintJSON(writer io.Writer) error