Attestation validation

[askkhan84]

If I have a Kyverno cluster policy for the admission controller that has for example the following attestation requirements:

- key: attestations
  value:
    - imageReference: "*"
      type: 
        - name: sbom/cyclone-dx
          conditions:
            all:
        - name: application/sarif+json
          conditions:
            all:
            - key: \{{ element.components[].licenses[].expression }}
              operator: AllNotIn
              value: ["GPL-2.0", "GPL-3.0"]

If the attestation exists in the OCI registry, it validates it and either allows or denies the admission. But if the attestation does not exist at all, it allows the pod admission. I would have thought it should reject the pod admission given it does not have the attestation. what is the explanation behind this design and any way to override it so if an attestation does not exist, pod admission should be rejected?

[JimBugwadia]

This is a bug, which needs to be fixed. Thanks for reporting it!

[vishal-chdhry]

looks like a missing if check when none of the attestations match, looking into it