skip var substitution in attestations
@@ -91,12 +91,25 @@ func appendError(resp *response.EngineResponse, rule *v1.Rule, msg string, statu
}
func substituteVariables(rule *v1.Rule, ctx context.EvalInterface, logger logr.Logger) (*v1.Rule, error) {
- ruleCopy, err := variables.SubstituteAllInRule(logger, ctx, *rule.DeepCopy())
+
+ // remove attestations as variables are not substituted in them
+ ruleCopy := rule.DeepCopy()
+ for _, iv := range ruleCopy.VerifyImages {
+ iv.Attestations = nil
+ }
+
+ var err error
+ *ruleCopy, err = variables.SubstituteAllInRule(logger, ctx, *ruleCopy)
if err != nil {
return nil, err
}
- return &ruleCopy, nil
+ // replace attestations
+ for i, _ := range rule.VerifyImages {
+ ruleCopy.VerifyImages[i].Attestations = rule.VerifyImages[i].Attestations
+ }
+
+ return ruleCopy, nil
}
type imageVerifier struct {
