github.com/vchain-us/vcn@v0.9.11-0.20210921212052-a2484d23c0b3/pkg/cmd/sign/sign.go

/*
 * Copyright (c) 2018-2020 vChain, Inc. All Rights Reserved.
 * This software is released under GPL3.
 * The full license information can be found under:
 * https://www.gnu.org/licenses/gpl-3.0.en.html
 *
 */

package sign

import (
	"bufio"
	"errors"
	"fmt"
	"os"
	"path/filepath"
	"strings"

	"github.com/vchain-us/vcn/pkg/signature"

	"github.com/caarlos0/spin"
	"github.com/fatih/color"
	"github.com/schollz/progressbar/v3"
	"github.com/spf13/cobra"
	"github.com/spf13/viper"
	"github.com/vchain-us/vcn/pkg/extractor/wildcard"
	"golang.org/x/crypto/ssh/terminal"

	"github.com/vchain-us/ledger-compliance-go/schema"
	"github.com/vchain-us/vcn/internal/assert"
	vcnerr "github.com/vchain-us/vcn/internal/errors"
	"github.com/vchain-us/vcn/pkg/api"
	"github.com/vchain-us/vcn/pkg/bom"
	"github.com/vchain-us/vcn/pkg/bom/artifact"
	"github.com/vchain-us/vcn/pkg/bom/docker"
	"github.com/vchain-us/vcn/pkg/cicontext"
	"github.com/vchain-us/vcn/pkg/cmd/internal/cli"
	"github.com/vchain-us/vcn/pkg/cmd/internal/types"
	"github.com/vchain-us/vcn/pkg/cmd/verify"
	"github.com/vchain-us/vcn/pkg/extractor"
	"github.com/vchain-us/vcn/pkg/extractor/dir"
	"github.com/vchain-us/vcn/pkg/meta"
	"github.com/vchain-us/vcn/pkg/store"
	"github.com/vchain-us/vcn/pkg/uri"
)

const longDescFooter = `

VCN_NOTARIZATION_PASSWORD env var can be used to pass the
required notarization password in a non-interactive environment.
`

const helpMsgFooter = `
ARG must be one of:
  wildcard
  file
  directory
  file://<file>
  dir://<directory>
  git://<repository>
  docker://<image>
  podman://<image>
  wildcard://"*"
  javacom://<java project component>
  nodecom://<node component>
  gocom://<Go module in name@version format>
  pythoncom://<Python module in name@version format>
  dotnetcom://<.Net module in name@version format>
`

// NewCommand returns the cobra command for `vcn sign`
func NewCommand() *cobra.Command {
	cmd := makeCommand()
	cmd.Flags().Bool("create-alert", false, "if set, an alert will be created (config will be stored into the .vcn dir)")
	cmd.Flags().String("alert-name", "", "set the alert name (ignored if --create-alert is not set)")
	cmd.Flags().String("alert-email", "", "set the alert email recipient (ignored if --create-alert is not set)")
	cmd.Flags().Bool("bom", false, "auto-notarize asset dependencies and link dependencies to the asset")
	cmd.Flags().String("bom-file", "", "use specified BoM file rather than resolve dependencies")
	cmd.Flags().String("bom-signerID", "", "signerID to use for authenticating dependencies")
	cmd.Flags().Bool("bom-deps-only", false, "notarize only the dependencies, not the asset")
	cmd.Flags().StringSlice("bom-container-binary", []string{}, "list of binaries to be executed inside the container - only the relevant dependencies will be processed")
	cmd.Flags().StringSlice("bom-hashes", []string{}, "hashes of the dependencies (disables automatic dependency resolution)")
	cmd.Flags().Uint("bom-batch-size", 10, "By default BoM dependencies are authenticated/notarized in batches of up to 10 dependencies each. Use this flag to set a different batch size. A value of 0 will disable batching (all dependencies will be authenticated/notarized at once).")
	// BoM output options
	cmd.Flags().Bool("bom-debug", false, "show extra debug info for BoM processing, also disable progress indicators")
	cmd.Flags().String("bom-spdx", "", "name of the file to output BoM in SPDX format")
	cmd.Flags().String("bom-cyclonedx-json", "", "name of the file to output BoM in CycloneDX JSON format")
	cmd.Flags().String("bom-cyclonedx-xml", "", "name of the file to output BoM in CycloneDX XML format")
	return cmd
}

func makeCommand() *cobra.Command {
	cmd := &cobra.Command{
		Use:     "notarize",
		Aliases: []string{"n", "sign", "s"},
		Short:   "Notarize an asset onto the blockchain",
		Long: `
Notarize an asset onto the blockchain.

Notarization calculates the SHA-256 hash of a digital asset
(file, directory, container's image).
The hash (not the asset) and the desired status of TRUSTED are then
cryptographically signed by the signer's secret (private key).
Next, these signed objects are sent to the blockchain where the signer’s
trust level and a timestamp are added.
When complete, a new blockchain entry is created that binds the asset’s
signed hash, signed status, level, and timestamp together.

Note that your assets will not be uploaded. They will be processed locally.

Assets are referenced by passed ARG with notarization only accepting
1 ARG at a time.

Pipe mode:
If '-' is provided (echo my-file | vcn n -) stdin is read and parsed. Only pipe ARGs are processed.

Environment variables:
VCN_USER=
VCN_PASSWORD=
VCN_NOTARIZATION_PASSWORD=
VCN_NOTARIZATION_PASSWORD_EMPTY=
VCN_OTP=
VCN_OTP_EMPTY=
VCN_LC_HOST=
VCN_LC_PORT=
VCN_LC_CERT=
VCN_LC_SKIP_TLS_VERIFY=false
VCN_LC_NO_TLS=false
VCN_LC_API_KEY=
VCN_SIGNING_PUB_KEY_FILE=
VCN_SIGNING_PUB_KEY=
VCN_ENFORCE_SIGNATURE_VERIFY=
` + helpMsgFooter,
		PreRunE: func(cmd *cobra.Command, args []string) error {
			return viper.BindPFlags(cmd.Flags())
		},
		RunE: func(cmd *cobra.Command, args []string) error {
			if pipeMode() && len(args) > 0 && args[0] == "-" {
				args = make([]string, 0)
				scanner := bufio.NewScanner(os.Stdin)
				scanner.Split(bufio.ScanWords)
				for scanner.Scan() {
					token := scanner.Bytes()
					args = append(args, string(token))
				}
				if err := scanner.Err(); err != nil {
					return fmt.Errorf("error parsing stdin input: %s", err)
				}
			}
			return runSignWithState(cmd, args, meta.StatusTrusted)
		},
		Args: noArgsWhenHashOrPipe,
		Example: `vcn notarize my-file"
vcn notarize -r "*.md"
echo my-file | vcn n -`,
	}

	cmd.Flags().VarP(make(mapOpts), "attr", "a", "add user defined attributes (repeat --attr for multiple entries). Special attributes: allowdownload=user1,user2 forbids attachments downloads for the CNIL specified user(name)s")
	cmd.Flags().Bool("ci-attr", false, meta.VcnLcCIAttribDesc)
	cmd.Flags().StringP("name", "n", "", "set the asset name")
	cmd.Flags().BoolP("public", "p", false, "when notarized as public, the asset name and metadata will be visible to everyone")
	cmd.Flags().String("hash", "", "specify the hash instead of using an asset, if set no ARG(s) can be used")
	cmd.Flags().Bool("no-ignore-file", false, "if set, .vcnignore will be not written inside the targeted dir (affects dir:// only)")
	cmd.Flags().Bool("read-only", false, "if set, no files will be written into the targeted dir (affects dir:// only)")
	cmd.Flags().BoolP("recursive", "r", false, "if set, wildcard usage will walk inside subdirectories of provided path")
	cmd.Flags().String("lc-host", "", meta.VcnLcHostFlagDesc)
	cmd.Flags().String("lc-port", "443", meta.VcnLcPortFlagDesc)
	cmd.Flags().String("lc-cert", "", meta.VcnLcCertPathDesc)
	cmd.Flags().Bool("lc-skip-tls-verify", false, meta.VcnLcSkipTlsVerifyDesc)
	cmd.Flags().Bool("lc-no-tls", false, meta.VcnLcNoTlsDesc)
	cmd.Flags().String("lc-api-key", "", meta.VcnLcApiKeyDesc)
	cmd.Flags().StringArray("attach", nil, meta.VcnLcAttachDesc)
	cmd.Flags().Bool("bom-cascade", false, "cascade the operation to all assets that include the asset being processed")
	cmd.Flags().Bool("bom-force", false, "force notarization of untrusted dependencies, force cascade operation")
	cmd.Flags().Bool("bom-container-hash", false, "when --bom-container-binary is specified, use container image hash, not binary hash")
	cmd.Flags().String("github-token", "", "Github OAuth token for querying BoM Github package details. Either authenticated or not, requests are subject to Github limits")

	cmd.SetUsageTemplate(
		strings.Replace(cmd.UsageTemplate(), "{{.UseLine}}", "{{.UseLine}} ARG", 1),
	)
	cmd.Flags().String("signing-pub-key-file", "", meta.VcnSigningPubKeyFileNameDesc)
	cmd.Flags().String("signing-pub-key", "", meta.VcnSigningPubKeyDesc)
	cmd.Flags().Bool("enforce-signature-verify", false, meta.VcnEnforceSignatureVerifyDesc)
	cmd.Flags().Bool("compress", false, "store all specified attachments as a single ZIP archive")

	return cmd
}

func runSignWithState(cmd *cobra.Command, args []string, state meta.Status) error {
	// default extractors options
	extractorOptions := []extractor.Option{}

	noIgnoreFile, err := cmd.Flags().GetBool("no-ignore-file")
	if err != nil {
		return err
	}
	readOnly, err := cmd.Flags().GetBool("read-only")
	if err != nil {
		return err
	}
	if readOnly {
		noIgnoreFile = true
	}
	if !noIgnoreFile {
		extractorOptions = append(extractorOptions, dir.WithIgnoreFileInit())
		extractorOptions = append(extractorOptions, dir.WithSkipIgnoreFileErr())
	}

	recursive, err := cmd.Flags().GetBool("recursive")
	if err != nil {
		return err
	}
	if recursive {
		extractorOptions = append(extractorOptions, wildcard.WithRecursive())
	}
	var alert *alertOptions
	if hasCreateAlert := cmd.Flags().Lookup("create-alert"); hasCreateAlert != nil {
		createAlert, err := cmd.Flags().GetBool("create-alert")
		if err != nil {
			return err
		}
		if createAlert {
			alert = &alertOptions{
				arg: args[0],
			}
			alert.name, _ = cmd.Flags().GetString("alert-name")
			if err != nil {
				return err
			}
			alert.email, _ = cmd.Flags().GetString("alert-email")
			if err != nil {
				return err
			}
		}
	}

	var hash string
	if hashFlag := cmd.Flags().Lookup("hash"); hashFlag != nil {
		var err error
		hash, err = cmd.Flags().GetString("hash")
		if err != nil {
			return err
		}
	}

	public, err := cmd.Flags().GetBool("public")
	if err != nil {
		return err
	}

	output, err := cmd.Flags().GetString("output")
	if err != nil {
		return err
	}

	silentMode, err := cmd.Flags().GetBool("silent")
	if err != nil {
		return err
	}

	name, err := cmd.Flags().GetString("name")
	if err != nil {
		return err
	}

	metadata := cmd.Flags().Lookup("attr").Value.(mapOpts).StringToInterface()

	// @todo use dependency injection
	cs := cicontext.NewContextSaver()

	if viper.GetBool("ci-attr") {
		cicontext.ExtendMetadata(metadata, cs.GetCIContextMetadata())
	}

	cmd.SilenceUsage = true

	lcHost := viper.GetString("lc-host")
	lcPort := viper.GetString("lc-port")
	lcCert := viper.GetString("lc-cert")
	skipTlsVerify := viper.GetBool("lc-skip-tls-verify")
	noTls := viper.GetBool("lc-no-tls")
	lcApiKey := viper.GetString("lc-api-key")

	lcVerbose := viper.GetBool("verbose")

	signingPubKey, skipLocalPubKeyComp, err := signature.PrepareSignatureParams(
		viper.GetString("signing-pub-key"),
		viper.GetString("signing-pub-key-file"))
	if err != nil {
		return err
	}
	enforceSignatureVerify := viper.GetBool("enforce-signature-verify")

	// todo add attachment validator. Deny ":" misuses in input string
	attachments, err := cmd.Flags().GetStringArray("attach")
	if err != nil {
		return err
	}

	if lcApiKey == "" && lcHost != "" {
		return vcnerr.ErrNoLcApiKeyEnv
	}

	//check if an lcUser is present inside the context
	var lcUser *api.LcUser
	uif, err := api.GetUserFromContext(store.Config().CurrentContext, lcApiKey, "", signingPubKey)
	if err != nil {
		return err
	}
	if lctmp, ok := uif.(*api.LcUser); ok {
		lcUser = lctmp
	}

	// It uses flags for CNC context client constructor if at least host and apikey are provided
	if lcHost != "" && lcApiKey != "" {
		// client from context could be override by the one created from local flags
		lcUser, err = api.NewLcUser(lcApiKey, "", lcHost, lcPort, lcCert, skipTlsVerify, noTls, signingPubKey)
		if err != nil {
			return err
		} // Store the new config
		if err := store.SaveConfig(); err != nil {
			return err
		}
	}

	// any set `--bom-xxx` option implies bom mode
	bomFlag := viper.GetBool("bom") ||
		viper.IsSet("bom-file") ||
		viper.IsSet("bom-signerID") ||
		viper.IsSet("bom-deps-only") ||
		viper.IsSet("bom-spdx") ||
		viper.IsSet("bom-cyclonedx-json") ||
		viper.IsSet("bom-cyclonedx-xml") ||
		viper.IsSet("bom-container-binary") ||
		viper.IsSet("bom-container-hash") ||
		viper.IsSet("bom-batch-size")

	artifacts := make([]*api.Artifact, 0, 1)
	if lcUser != nil {
		err = lcUser.Client.Connect()
		if err != nil {
			return err
		}

		for attr := range metadata {
			if attr == "allowdownload" {
				err := lcUser.RequireFeatOrErr(schema.FeatAllowDownload)
				if err != nil {
					return err
				}
				break
			}
		}

		if !skipLocalPubKeyComp {
			err = lcUser.CheckConnectionPublicKey(enforceSignatureVerify)
			if err != nil {
				return err
			}
		}

		var bomText string
		bomFile := viper.GetString("bom-file")

		if bomFlag {
			err := lcUser.RequireFeatOrErr(schema.FeatBoM)
			if err != nil {
				return err
			}
		}
		outputOpts := artifact.Progress
		if viper.GetBool("silent") || output != "" {
			outputOpts = artifact.Silent
		} else if viper.GetBool("bom-debug") {
			outputOpts = artifact.Debug
		}

		var bomArtifact artifact.Artifact
		if bomFlag && !viper.IsSet("bom-hashes") {
			// if bom-file specified, use BoM data from file, otherwise resolve dependencies
			if bomFile == "" {
				if len(args) != 1 {
					return fmt.Errorf("--bom option can be used only with single asset")
				}
				path := args[0]
				u, err := uri.Parse(path)
				if err != nil {
					return err
				}
				if _, ok := bom.BomSchemes[u.Scheme]; !ok {
					return fmt.Errorf("unsupported URI %s for --bom option", path)
				}
				if u.Scheme != "" {
					path = strings.TrimPrefix(u.Opaque, "//")
				}
				if u.Scheme == "docker" {
					binaries := viper.GetStringSlice("bom-container-binary")
					dockerArtifact, err := docker.New(path, binaries)
					if err != nil {
						return err
					}
					if !viper.GetBool("bom-container-hash") && len(binaries) > 0 {
						// use binary hash rather than container hash
						if len(binaries) != 1 {
							return errors.New("cannot use binary hash when several binaries are specified. Use --bom-container-hash option to use container hash")
						}
						// setting hash disables hash calculation from container image
						hash, err = dockerArtifact.FileHash(binaries[0])
						if err != nil {
							return err
						}
						name = filepath.Base(binaries[0])
					}
					bomArtifact = dockerArtifact
				} else {
					path, err = filepath.Abs(path)
					if err != nil {
						return err
					}
					bomArtifact = bom.New(path)
				}
				if bomArtifact == nil {
					return fmt.Errorf("unsupported asset format/language")
				}
			} else {
				bomArtifact, err = artifact.Load(bomFile)
				if err != nil {
					return fmt.Errorf("cannot load BoM from file: %w", err)
				}
			}

			if outputOpts != artifact.Silent {
				fmt.Printf("Resolving dependencies...\n")
			}
			deps, err := bomArtifact.ResolveDependencies(outputOpts)
			if err != nil {
				return fmt.Errorf("cannot get dependencies: %w", err)
			}

			bomBatchSize := int(viper.GetUint("bom-batch-size"))

			bomText, err = notarizeDeps(lcUser, deps, outputOpts, bomArtifact.Type(), bomBatchSize)
			if err != nil {
				return err
			}

			if bomFile != "" {
				// just to keep BoM file current
				err = artifact.Store(bomArtifact, bomFile)
				if err != nil {
					// show warning, but not error, because notarization succeeded
					fmt.Printf("Cannot store actual BoM: %v", err)
				}
			}

			err = bom.Output(bomArtifact) // process all possible BoM output options
			if err != nil {
				// show warning, but not error, because authentication finished
				fmt.Println(err)
			}
			if outputOpts != artifact.Silent {
				artifact.Display(bomArtifact, artifact.ColNameVersion|artifact.ColHash|artifact.ColTrustLevel)
			}
		}

		// Dependencies specified as hashes, not resolved
		if viper.IsSet("bom-hashes") {
			// TODO: Is it correct that BoM output is not allowed for hashes?
			if viper.IsSet("bom-deps-only") ||
				viper.IsSet("bom-spdx") ||
				viper.IsSet("bom-cyclonedx-json") ||
				viper.IsSet("bom-cyclonedx-xml") {
				return fmt.Errorf("bom-hashes option cannot be combined with bom-deps-only or any BoM output option")
			}
			hashes := viper.GetStringSlice("bom-hashes")

			signerID := viper.GetString("bom-signerID")
			if signerID == "" {
				signerID = api.GetSignerIDByApiKey(lcUser.Client.ApiKey)
			}

			bomText, err = bomHashes(lcUser, signerID, output, hashes)
			if err != nil {
				return err
			}
		}

		// notarize the asset if not instructed otherwise
		if !viper.GetBool("bom-deps-only") {
			if hash != "" {
				hash = strings.ToLower(hash)
				// Load existing artifact, if any, otherwise use an empty artifact
				if ar, _, err := lcUser.LoadArtifact(hash, "", "", 0, nil); err == nil && ar != nil {
					artifacts = append(artifacts, &api.Artifact{
						Kind:        ar.Kind,
						Name:        ar.Name,
						Hash:        ar.Hash,
						Size:        ar.Size,
						ContentType: ar.ContentType,
						Metadata:    ar.Metadata,
					})
				} else {
					if name == "" {
						return fmt.Errorf("please set an asset name, by using --name")
					}
					artifacts = append(artifacts, &api.Artifact{Hash: hash})
				}
			} else {
				artifacts, err = extractor.Extract(args, extractorOptions...)
				if err != nil {
					return err
				}
			}
			err = LcSign(lcUser, artifacts, state, output, name, metadata, attachments, lcVerbose, bomText)
			if err != nil {
				return err
			}
		}

		// cascade processing
		if viper.GetBool("bom-cascade") && (state == meta.StatusUntrusted || state == meta.StatusUnsupported || state == meta.StatusTrusted) {
			err = bomCascade(lcUser, artifacts, output, state, lcVerbose)
			if err != nil {
				return err
			}
		}

		return nil
	}

	// User
	if err := assert.UserLogin(); err != nil {
		return err
	}
	u, ok := uif.(*api.User)
	if !ok {
		return fmt.Errorf("cannot load the current user")
	}

	// Make the artifact to be signed

	if hash != "" {
		if alert != nil {
			return fmt.Errorf("cannot use --create-alert with --hash")
		}
		hash = strings.ToLower(hash)
		// Load existing artifact, if any, otherwise use an empty artifact
		if ar, err := u.LoadArtifact(hash); err == nil && ar != nil {
			artifacts = []*api.Artifact{ar.Artifact()}
		} else {
			if name == "" {
				return fmt.Errorf("please set an asset name, by using --name")
			}
			artifacts = []*api.Artifact{{Hash: hash}}
		}
	} else {
		// Extract artifact from arg
		artifacts, err = extractor.Extract(args, extractorOptions...)
		if err != nil {
			return err
		}
	}

	if artifacts == nil {
		return fmt.Errorf("unable to process the input asset provided")
	}

	if len(artifacts) == 1 {
		// Override the asset's name, if provided by --name
		if name != "" {
			artifacts[0].Name = name
		}
	}

	for _, a := range artifacts {
		// Copy user provided custom attributes
		a.Metadata.SetValues(metadata)

		err := sign(*u, *a, state, meta.VisibilityForFlag(public), output, silentMode, readOnly, alert)
		if err != nil {
			return err
		}
	}

	return nil
}

func sign(u api.User, a api.Artifact, state meta.Status, visibility meta.Visibility, output string, silent bool, readOnly bool, alert *alertOptions) error {

	if output == "" {
		color.Set(meta.StyleAffordance())
		fmt.Print("Your assets will not be uploaded. They will be processed locally.")
		color.Unset()
		fmt.Println()
		fmt.Println()
		fmt.Println("Signer:\t" + u.Email())
	}

	hook := newHook(&a)

	s := spin.New("%s Notarization in progress...")
	s.Set(spin.Spin1)

	var verification *api.BlockchainVerification
	var err error

	for i := 1; true; i++ {
		var passphrase string
		var interactive bool
		passphrase, interactive, err = cli.ProvidePassphrase()
		if err != nil {
			return err
		}

		if output == "" && !silent {
			s.Start()
		}

		var keyin string
		var offline bool
		keyin, _, offline, err = u.Secret()
		if err != nil {
			return err
		}
		if offline {
			return fmt.Errorf("offline secret is not supported by the current vcn version")
		}

		verification, err = u.Sign(
			a,
			api.SignWithStatus(state),
			api.SignWithVisibility(visibility),
			api.SignWithKey(keyin, passphrase),
		)

		if err != nil && i >= 3 {
			s.Stop()
			return fmt.Errorf("too many failed attempts: %s", err)
		}

		if interactive && err == api.WrongPassphraseErr {
			s.Stop()
			fmt.Printf("\nError: %s, please try again\n\n", err.Error())
			continue
		}
		break
	}

	s.Stop()

	if err != nil {
		return err
	}

	// once transaction is confirmed we don't want to show errors, just print warnings instead.

	// todo(ameingast/leogr): remove redundant event - need backend improvement
	api.TrackPublisher(&u, meta.VcnSignEvent)
	api.TrackSign(&u, a.Hash, a.Name, state)

	err = hook.finalize(verification, readOnly)
	if err != nil {
		return cli.PrintWarning(output, err.Error())
	}

	if output == "" {
		fmt.Println()
	}

	artifact, err := api.LoadArtifact(&u, a.Hash, verification.MetaHash())
	if err != nil {
		return cli.PrintWarning(output, err.Error())
	}

	cli.Print(output, types.NewResult(&a, artifact, verification))

	if alert != nil {
		if err := handleAlert(alert, u, a, *verification, output); err != nil {
			return cli.PrintWarning(output, err.Error())
		}
	}

	return nil
}

func pipeMode() bool {
	fileInfo, _ := os.Stdin.Stat()
	return fileInfo.Mode()&os.ModeCharDevice == 0
}

func notarizeDeps(lcUser *api.LcUser, deps []artifact.Dependency, outputOpts artifact.OutputOptions, artType string, batchSize int) (string, error) {
	if outputOpts != artifact.Silent {
		fmt.Printf("Authenticating dependencies...\n")
	}

	signerID := viper.GetString("bom-signerID")
	if signerID == "" {
		signerID = api.GetSignerIDByApiKey(lcUser.Client.ApiKey)
	}

	force := viper.GetBool("bom-force")

	var bar *progressbar.ProgressBar
	if len(deps) > 1 && outputOpts == artifact.Progress {
		bar = progressbar.Default(int64(len(deps)))
	}

	progressCallback := func(processedDeps []artifact.Dependency) {
		switch outputOpts {
		case artifact.Progress:
			if bar != nil {
				bar.Add(len(processedDeps))
			}
		case artifact.Debug:
			for _, d := range processedDeps {
				fmt.Printf("%s@%s (%s) - %s\n", d.Name, d.Version, d.Hash, artifact.TrustLevelName(d.TrustLevel))
			}
		}
	}

	errs, err := artifact.AuthenticateDependencies(lcUser, signerID, deps, batchSize, progressCallback)
	if err != nil {
		return "", fmt.Errorf("error authenticating dependencies: %w", err)
	}

	var msgs []string
	var depsToNotarize []*artifact.Dependency
	var kinds []string

	for i := range deps { // Authenticate mutates the dependency, so use the index
		if errs[i] != nil {
			return "", fmt.Errorf("cannot authenticate %s@%s dependency: %w",
				deps[i].SignerID, deps[i].Version, errs[i])
		}
		if deps[i].TrustLevel < artifact.Unknown {
			msgs = append(msgs, fmt.Sprintf("Dependency %s@%s trust level is %s",
				deps[i].Name, deps[i].Version, artifact.TrustLevelName(deps[i].TrustLevel)))
		}
		if deps[i].TrustLevel < artifact.Trusted {
			depsToNotarize = append(depsToNotarize, &deps[i])
			kinds = append(kinds, artType)
		}
	}

	if len(msgs) > 0 && !force {
		for _, msg := range msgs {
			fmt.Println(msg)
		}
		return "", fmt.Errorf("some dependencies have insufficient trust level and cannot be automatically notarized. You can override it with --bom-force option")
	}

	// notarize only the dependencies first to make sure all needed keys are present into DB before
	// adding key references to the index
	// we don't get here if 'force' flag isn't set and some dependencies are untrusted
	if len(depsToNotarize) > 0 {
		var bar *progressbar.ProgressBar
		if outputOpts != artifact.Silent {
			ds := "dependencies"
			if len(depsToNotarize) == 1 {
				ds = "dependency"
			}
			fmt.Printf("Notarizing %d %s ...\n", len(depsToNotarize), ds)
			if outputOpts == artifact.Progress {
				bar = progressbar.Default(int64(len(depsToNotarize)))
			}
		}

		progressCallbackN := func(processedDeps []*artifact.Dependency) {
			switch outputOpts {
			case artifact.Progress:
				if bar != nil {
					bar.Add(len(processedDeps))
				}
			case artifact.Debug:
				for _, d := range processedDeps {
					fmt.Printf("%s@%s (%s)\n", d.Name, d.Version, d.Hash)
				}
			}
		}

		errs, err = artifact.NotarizeDependencies(lcUser, kinds, depsToNotarize, batchSize, progressCallbackN)
		if err != nil {
			return "", fmt.Errorf("error notarizing dependencies: %w", err)
		}
		var errMsgs []string
		for _, e := range errs {
			if e != nil {
				errMsgs = append(errMsgs, e.Error())
			}
		}
		if len(errMsgs) > 0 {
			return "", fmt.Errorf("error notarizing (some) dependencies: %s", strings.Join(errMsgs, ", "))
		}
	} else {
		fmt.Printf("No dependencies require notarization\n")
	}

	var builder strings.Builder
	for i := range deps {
		// add dep key to BoM list for attaching
		fmt.Fprintf(&builder, "vcn.%s.%s\n", deps[i].SignerID, deps[i].Hash)
	}

	return builder.String(), nil
}

func bomHashes(lcUser *api.LcUser, signerID string, output string, hashes []string) (string, error) {
	var builder strings.Builder
	if output == "" {
		fmt.Println("Resolving hashes...")
	}
	for _, hash := range hashes {
		ar, verified, err := lcUser.LoadArtifact(hash, signerID, "", 0, nil)
		if err == api.ErrNotFound || ar.Status != meta.StatusTrusted {
			return "", fmt.Errorf("you can only add BoM hashes of known trusted artifacts (please notarize the artifact using vcn notarize) before adding it to --bom-hashes")
		}
		if err != nil {
			return "", err
		}
		if !verified {
			return "", fmt.Errorf("the ledger is compromised")
		}
		if output == "" {
			fmt.Printf("%s ==> %s", hash, ar.Name)
			ver, ok := ar.Metadata.Get("version", "").(string)
			if ok && ver != "" {
				fmt.Printf("@%s", ver)
			}
			fmt.Println()
		}

		fmt.Fprintf(&builder, "vcn.%s.%s\n", signerID, hash)
	}
	return builder.String(), nil
}

func bomCascade(lcUser *api.LcUser, artifacts []*api.Artifact, output string, state meta.Status, lcVerbose bool) error {
	signerID := api.GetSignerIDByApiKey(lcUser.Client.ApiKey)
	toProcess := make([]api.PackageDetails, 0)
	for _, ar := range artifacts {
		included, err := verify.GetIncluded(ar.Hash, signerID, lcUser)
		if err != nil {
			return fmt.Errorf("error finding assets for %s: %w", ar.Name, err)
		}
		toProcess = append(toProcess, included...)
	}
	cascaded := make([]*api.Artifact, 0)
	for _, asset := range toProcess {
		if asset.Status == state {
			continue
		}
		ar, _, err := lcUser.LoadArtifact(asset.Hash, "", "", 0, nil)
		if err != nil {
			return err
		}
		if ar == nil {
			return fmt.Errorf("cannot resolve artifact by hash %s", asset.Hash)
		}
		cascaded = append(cascaded, &api.Artifact{
			Kind:        ar.Kind,
			Name:        ar.Name,
			Hash:        ar.Hash,
			Size:        ar.Size,
			ContentType: ar.ContentType,
			Metadata:    ar.Metadata,
		})
	}
	if len(cascaded) > 0 && !viper.GetBool("bom-force") {
		if !terminal.IsTerminal(int(os.Stdout.Fd())) {
			return errors.New("run vcn interactively or specify --bom-force for cascade operations")
		}
		fmt.Printf("Following assets depend on assets being processed:\n")
		for _, asset := range cascaded {
			fmt.Printf("%s", asset.Name)
			ver, ok := asset.Metadata.Get("version", "").(string)
			if ok && ver != "" {
				fmt.Printf("@%s", ver)
			}
			fmt.Printf(" (%s)\n", asset.Hash)
		}
		actionMap := map[meta.Status]string{
			meta.StatusUntrusted:   "untrust",
			meta.StatusUnsupported: "unsupport",
			meta.StatusTrusted:     "notarize",
		}
		for {
			fmt.Printf("Are you sure you want to %s these assets? (y/N)", actionMap[state])
			var confirm string
			_, err := fmt.Scanln(&confirm)
			if err != nil {
				return err
			}
			confirm = strings.ToLower(strings.TrimSuffix(confirm, "\n"))
			if confirm == "y" {
				break
			}
			if confirm == "n" || confirm == "" {
				return errors.New("cascade operation aborted")
			}
			fmt.Println("please enter y or n")
		}
	}
	err := LcSign(lcUser, cascaded, state, output, "", nil, nil, lcVerbose, "")
	if err != nil {
		return err
	}
	return nil
}