• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

• Add caching layer for verify_image results using sync.Map and singleflight.Group
• Cache key combines image reference and SHA256 hash of verification options
• Prevents redundant signature verification across multiple policy evaluations
• Add comprehensive test coverage for cache hit/miss scenarios

Implement verify_image caching with singleflight deduplication

• Add sync.Map and singleflight.Group package imports for caching infrastructure
• Introduce global verifyImageCache and verifyImageFlight variables for cross-evaluation caching
• Refactor sigstoreVerifyImage to check cache first, then use singleflight for deduplication
• Extract core verification logic into new doVerifyImage function
• Add buildCacheKey function that combines ref and SHA256 hash of options
• Add ClearCaches utility function for testing purposes

internal/rego/sigstore/sigstore.go

Add comprehensive cache behavior test coverage

• Add ClearCaches() call in existing TestSigstoreVerifyImage test setup
• Add new TestVerifyImageCache test function with four test cases
• Test cache hit when same ref and opts are used multiple times
• Test cache miss when different ref is used with same opts
• Test cache miss when different opts are used with same ref
• Test that ClearCaches forces re-verification of previously cached results

internal/rego/sigstore/sigstore_test.go

Description

verify_image stores results in the global cache unconditionally, including failure results
(success=false) returned via signatureFailedResult. This can turn transient verification errors
into persistent failures for the lifetime of the process, preventing retries in later policy
evaluations/workers.

Code

internal/rego/sigstore/sigstore.go[R141-150]

+	resultIface, err, _ := verifyImageFlight.Do(cacheKey, func() (interface{}, error) {
+		return doVerifyImage(bctx, logger, uri, optsTerm)
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	result := resultIface.(*ast.Term)
+	verifyImageCache.Store(cacheKey, result)
+	return result, nil

Evidence

sigstoreVerifyImage stores whatever doVerifyImage returns into verifyImageCache without
checking if verification succeeded. doVerifyImage converts errors into a normal result term via
signatureFailedResult (not a Go error), so failures will be cached too. In contrast, other global
caches (OCI) only store successful results and return nil on errors, avoiding caching transient
failures.

internal/rego/sigstore/sigstore.go[131-150]
internal/rego/sigstore/sigstore.go[156-174]
internal/rego/sigstore/sigstore.go[350-379]
internal/rego/oci/oci.go[570-623]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`ec.sigstore.verify_image` unconditionally caches the returned result term, including failure results. This can make transient verification failures persist across later policy evaluations within the same process.

### Issue Context
`doVerifyImage` converts errors into a normal `{success:false, errors:[...]}` term via `signatureFailedResult`, so the cache sees failures as valid values to store.

### Fix Focus Areas
- internal/rego/sigstore/sigstore.go[131-150]
- internal/rego/sigstore/sigstore.go[350-379]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Description

Cache key uses only the first 8 bytes (64 bits) of SHA-256 over optsTerm.String(). While
collisions are unlikely in typical runs, a collision would cause results computed with different
verification options to be reused incorrectly.

Code

internal/rego/sigstore/sigstore.go[R180-184]

+func buildCacheKey(ref string, optsTerm *ast.Term) string {
+	h := sha256.Sum256([]byte(optsTerm.String()))
+	optsHash := hex.EncodeToString(h[:8]) // First 8 bytes is enough for dedup
+	return ref + "|" + optsHash
+}

Evidence

buildCacheKey intentionally truncates SHA-256 to 8 bytes before hex encoding, reducing the
collision resistance of the cache key and risking incorrect cache hits across different option sets.

internal/rego/sigstore/sigstore.go[180-184]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`buildCacheKey` truncates SHA-256 to 8 bytes, which increases the chance of key collisions and incorrect cache hits across different verification options.

### Issue Context
Even if collisions are rare in practice, a collision would reuse a verification result computed under different trust/verification settings.

### Fix Focus Areas
- internal/rego/sigstore/sigstore.go[180-184]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Description

This file documents that rego builtins must not return Go errors, but the new wrapper returns `nil,
err when singleflight.Do` returns an error. This risks inconsistent behavior vs the rest of the
file’s patterns and may cause evaluation failures in unexpected error cases.

Code

internal/rego/sigstore/sigstore.go[R141-146]

+	resultIface, err, _ := verifyImageFlight.Do(cacheKey, func() (interface{}, error) {
+		return doVerifyImage(bctx, logger, uri, optsTerm)
+	})
+	if err != nil {
+		return nil, err
+	}

Evidence

The file header explicitly states these builtins should not return errors. The new wrapper adds an
explicit error-return branch if singleflight returns an error, which conflicts with the documented
behavior and with the rest of the function’s approach of returning structured failure terms.

internal/rego/sigstore/sigstore.go[17-19]
internal/rego/sigstore/sigstore.go[141-146]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`sigstoreVerifyImage` now has a code path that returns a non-nil Go error, contradicting the file’s documented builtin contract.

### Issue Context
This codebase intentionally returns structured `{success:false, errors:[...]}` terms instead of Go errors for rego builtins.

### Fix Focus Areas
- internal/rego/sigstore/sigstore.go[17-19]
- internal/rego/sigstore/sigstore.go[141-150]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Walkthrough

The PR adds verification result caching to sigstore.VerifyImage builtin. A SHA-512 hash of the options term combined with the image reference forms the cache key. Concurrent requests for the same key are deduplicated via singleflight to avoid redundant verifications. The ClearCaches() function enables test isolation, and comprehensive tests validate cache behavior across reference changes, option variations, and cache clearing.

Changes

Sigstore verification caching

🎯 3 (Moderate) | ⏱️ ~25 minutes

❌ Failed checks (1 warning)

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

• X
• Mastodon
• Reddit
• LinkedIn