Fix the slsa source loop of doom (#401)

* policy: downgrade to actual SLSA level instead of error

Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>

* Surface Shortfall in new AttestRevision result

Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>

* support exit codes in subcommands

Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>

* Add --silent-downgrade and exit 2 on shortfall

Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>

* update checklevel and checktag for new return

Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>

* Test wrapped error codes

Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>

* Fix misspel flagged by the linter

Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>

---------

Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>

Author: puerco

internal/cmd/checklevel.go

@@ -93,19 +93,26 @@ This is meant to be run within the corresponding GitHub Actions workflow.`,
 
 			pe := policy.NewPolicyEvaluator()
 			pe.UseLocalPolicy = opts.useLocalPolicy
-			verifiedLevels, policyPath, err := pe.EvaluateControl(cmd.Context(), opts.GetRepository(), opts.GetBranch(), controlStatus)
+			result, err := pe.EvaluateControl(cmd.Context(), opts.GetRepository(), opts.GetBranch(), controlStatus)
 			if err != nil {
 				return err
 			}
-			for _, level := range verifiedLevels {
+			for _, level := range result.VerifiedLevels {
 				if slsa.IsSlsaSourceLevel(level) {
 					fmt.Print(level)
 					break
 				}
 			}
 
+			// The achieved level can be below the policy target, surface it as a
+			// warning here (checklevel only reports, it does not gate on it).
+			if result.Shortfall != nil {
+				fmt.Fprintf(os.Stderr, "\nwarning: policy target level %s not met; achieved %s: %s\n",
+					result.Shortfall.TargetLevel, result.Shortfall.AchievedLevel, result.Shortfall.Reason)
+			}
+
 			unsignedVsa, err := attest.CreateUnsignedSourceVsa(
-				opts.GetBranch(), opts.GetCommit(), verifiedLevels, policyPath,
+				opts.GetBranch(), opts.GetCommit(), result.VerifiedLevels, result.PolicyPath,
 			)
 			if err != nil {
 				return err

internal/cmd/checklevelprov.go

@@ -6,6 +6,7 @@ package cmd
 import (
 	"errors"
 	"fmt"
+	"os"
 	"slices"
 	"strings"
 
@@ -60,6 +61,7 @@ type checkLevelProvOpts struct {
 	outputUnsignedBundle string
 	outputSignedBundle   string
 	useLocalPolicy       string
+	silentDowngrade      bool
 }
 
 func (clp *checkLevelProvOpts) Validate() error {
@@ -78,6 +80,7 @@ func (clp *checkLevelProvOpts) AddFlags(cmd *cobra.Command) {
 	cmd.PersistentFlags().StringVar(&clp.outputUnsignedBundle, "output_unsigned_bundle", "", "The path to write a bundle of unsigned attestations.")
 	cmd.PersistentFlags().StringVar(&clp.outputSignedBundle, "output_signed_bundle", "", "The path to write a bundle of signed attestations.")
 	cmd.PersistentFlags().StringVar(&clp.useLocalPolicy, "use_local_policy", "", "UNSAFE: Use the policy at this local path instead of the official one.")
+	cmd.PersistentFlags().BoolVar(&clp.silentDowngrade, "silent-downgrade", false, "Exit 0 when the SLSA level is below the policy target (still attests).")
 }
 
 func addCheckLevelProv(parentCmd *cobra.Command) {
@@ -162,7 +165,7 @@ and pushed to its remote (--push=note).
 			}
 
 			// Attest the commit passing the options
-			verifiedLevels, err := srctool.AttestRevision(
+			result, err := srctool.AttestRevision(
 				cmd.Context(), opts.GetBranch(), opts.GetRevision(),
 				sourcetool.WithLocalPolicy(opts.useLocalPolicy),
 				sourcetool.WithOutputPath(outputPath),
@@ -174,7 +177,24 @@ and pushed to its remote (--push=note).
 				return fmt.Errorf("attesting commit: %w", err)
 			}
 
-			fmt.Print(verifiedLevels.Levels())
+			fmt.Print(result.VerifiedLevels.Levels())
+
+			// The attestations are generated (and optionally pushed) regardless
+			// of the policy outcome. If the achieved level is below the policy
+			// target return exit code 2 or just a warning when --silent-downgrade
+			// is set.
+			if result.Shortfall != nil {
+				msg := fmt.Sprintf(
+					"policy target level %s not met; achieved %s: %s",
+					result.Shortfall.TargetLevel, result.Shortfall.AchievedLevel, result.Shortfall.Reason,
+				)
+				if opts.silentDowngrade {
+					fmt.Fprintf(os.Stderr, "warning: %s\n", msg)
+					return nil
+				}
+				return &exitError{code: 2, err: errors.New(msg)}
+			}
+
 			return nil
 		},
 	}

internal/cmd/checktag.go

@@ -126,7 +126,7 @@ func addCheckTag(parentCmd *cobra.Command) {
 			}
 
 			// Attest the commit passing the options
-			verifiedLevels, err := srctool.AttestRevision(
+			result, err := srctool.AttestRevision(
 				cmd.Context(), opts.GetBranch(), opts.GetRevision(),
 				sourcetool.WithLocalPolicy(opts.useLocalPolicy),
 				sourcetool.WithOutputPath(outputPath),
@@ -138,7 +138,7 @@ func addCheckTag(parentCmd *cobra.Command) {
 				return fmt.Errorf("attesting commit: %w", err)
 			}
 
-			fmt.Print(verifiedLevels.Levels())
+			fmt.Print(result.VerifiedLevels.Levels())
 			return nil
 		},
 	}

internal/cmd/exiterror_test.go

@@ -0,0 +1,62 @@
+// SPDX-FileCopyrightText: Copyright 2026 The SLSA Authors
+// SPDX-License-Identifier: Apache-2.0
+
+package cmd
+
+import (
+	"errors"
+	"fmt"
+	"testing"
+)
+
+func TestExitErrorErrorAndUnwrap(t *testing.T) {
+	wrapped := errors.New("policy target level SLSA_SOURCE_LEVEL_3 not met")
+	ee := &exitError{code: 2, err: wrapped}
+
+	if ee.Error() != wrapped.Error() {
+		t.Errorf("Error() = %q, want %q", ee.Error(), wrapped.Error())
+	}
+	if !errors.Is(ee, wrapped) {
+		t.Errorf("errors.Is(exitError, wrapped) = false, want true (Unwrap should expose the wrapped error)")
+	}
+}
+
+func TestExitErrorExtraction(t *testing.T) {
+	t.Parallel()
+	for _, tt := range []struct {
+		name      string
+		err       error
+		wantMatch bool
+		wantCode  int
+	}{
+		{
+			name:      "direct exit error",
+			err:       &exitError{code: 2, err: errors.New("shortfall")},
+			wantMatch: true,
+			wantCode:  2,
+		},
+		{
+			name:      "wrapped exit error",
+			err:       fmt.Errorf("attesting commit: %w", &exitError{code: 2, err: errors.New("shortfall")}),
+			wantMatch: true,
+			wantCode:  2,
+		},
+		{
+			name:      "plain error falls through",
+			err:       errors.New("boom"),
+			wantMatch: false,
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			var ee *exitError
+			gotMatch := errors.As(tt.err, &ee)
+			if gotMatch != tt.wantMatch {
+				t.Fatalf("errors.As() = %v, want %v", gotMatch, tt.wantMatch)
+			}
+			if gotMatch && ee.code != tt.wantCode {
+				t.Errorf("exitError.code = %d, want %d", ee.code, tt.wantCode)
+			}
+		})
+	}
+}

internal/cmd/root.go

@@ -26,11 +26,23 @@ var githubToken string
 // 	return attest.NewBndVerifier(options)
 // }
 
+// exitError wraps an error together with an exit code so commands can
+// signal other failuresdistinct from a generic failure (exit 1).
+type exitError struct {
+	code int
+	err  error
+}
+
+func (e *exitError) Error() string { return e.err.Error() }
+func (e *exitError) Unwrap() error { return e.err }
+
 func buildRootCommand() *cobra.Command {
 	// rootCmd represents the base command when called without any subcommands
 	rootCmd := &cobra.Command{
-		Use:   "sourcetool",
-		Short: "A tool to manage SLSA Source in code repositories",
+		Use:           "sourcetool",
+		SilenceUsage:  true,
+		SilenceErrors: true,
+		Short:         "A tool to manage SLSA Source in code repositories",
 		Long: `
 SLSA sourcetool: Manage SLSA Source controls and data
 
@@ -89,10 +101,21 @@ controls and much more.
 // This is called by main.main(). It only needs to happen once to the rootCmd.
 func Execute() {
 	rootCmd := buildRootCommand()
-	if err := rootCmd.Execute(); err != nil {
-		fmt.Printf("Error: %v\n", err)
-		os.Exit(1)
+	err := rootCmd.Execute()
+	if err == nil {
+		return
 	}
+
+	// Subcommands may send a specific exit code by returning an *exitError.
+	// Everything else is a generic failure (exit 1).
+	var ee *exitError
+	if errors.As(err, &ee) {
+		fmt.Println(ee.Error())
+		os.Exit(ee.code)
+	}
+
+	fmt.Printf("Error: %v\n", err)
+	os.Exit(1)
 }
 
 func CheckAuth() (*auth.Authenticator, error) {