move cleanUpTrustpolicy call to Options func.

Signed-off-by: Jagpreet Singh Tamber <[email protected]>

Author: jagpreetstamber

internal/controller/helmchart_controller.go

@@ -1402,12 +1402,12 @@ func (r *HelmChartReconciler) makeVerifiers(ctx context.Context, obj *helmv1.Hel
 		}
 
 		defaultNotaryOciOpts := []notation.Options{
+			notation.WithLogger(ctrl.LoggerFrom(ctx)),
 			notation.WithTrustStore(&doc),
 			notation.WithRemoteOptions(verifyOpts...),
 			notation.WithAuth(clientOpts.Authenticator),
 			notation.WithKeychain(clientOpts.Keychain),
 			notation.WithInsecureRegistry(clientOpts.Insecure),
-			notation.WithLogger(ctrl.LoggerFrom(ctx)),
 		}
 
 		for k, data := range pubSecret.Data {

internal/controller/ocirepository_controller.go

@@ -730,12 +730,12 @@ func (r *OCIRepositoryReconciler) verifySignature(ctx context.Context, obj *ociv
 		verifiedResult := soci.VerificationResultFailed
 
 		defaultNotationOciOpts := []notation.Options{
+			notation.WithLogger(ctrl.LoggerFrom(ctx)),
 			notation.WithTrustStore(&doc),
 			notation.WithRemoteOptions(opt...),
 			notation.WithAuth(auth),
 			notation.WithKeychain(keychain),
 			notation.WithInsecureRegistry(obj.Spec.Insecure),
-			notation.WithLogger(ctrl.LoggerFrom(ctx)),
 		}
 
 		for k, data := range pubSecret.Data {

internal/oci/notation/notation.go

@@ -71,7 +71,7 @@ func WithInsecureRegistry(insecure bool) Options {
 // WithTrustStore sets the trust store configuration.
 func WithTrustStore(trustStore *trustpolicy.Document) Options {
 	return func(opts *options) {
-		opts.trustPolicy = trustStore
+		opts.trustPolicy = cleanTrustPolicy(trustStore, opts.logger)
 	}
 }
 
@@ -165,7 +165,7 @@ func NewNotationVerifier(opts ...Options) (*NotationVerifier, error) {
 		cert: o.rootCertificate,
 	}
 
-	trustpolicy := cleanTrustPolicy(o.trustPolicy, o.logger)
+	trustpolicy := o.trustPolicy
 	if trustpolicy == nil {
 		return nil, fmt.Errorf("trust policy cannot be empty")
 	}