[Feat]: Support wrapping non-zero exit codes

[adityasaky]

Describe the solution you'd like:

Support specific command runs to return non zero exit codes. Add --accept-exit-codes 0,2,100,101 (or similar) to witness run so valid non-zero exits are treated as command success.

User value:

[Why will this feature be valuable to you? Why will this be valuable to others?]

Security scanners use non-zero exit codes to report findings (not errors): oscap returns 2 for "vulnerabilities found", cinc-auditor returns 100 (skipped/waived) or 101 (failures found). Witness treats any non-zero as command failure and refuses to produce a signed collection.

Expected behavior:

When run with the new flag, witness produces a collection even when the executed command returns a non zero but explicitly allowed exit code.

Proposed solution:

[If you're able, describe possible solution workflow]

Anything else you would like to add:

N/A

Testing changes required:

Create a test binary to return specific exit codes for witness run tests to invoke.

Documentation changes required:

[List possible documentation changes required, if none please explain, if unsure assignee will assist]

Document the new flag.

[jkjell]

This is a great issue to think about.

witness run -s test -a environment -k testkey.pem -- bash -c "exit 42" returns 1.

Should it return 42 instead? What if there's an interrupt signal?

Based on how witness is frequently used, in CI systems, I think it makes sense for witness run to always pass through the exit code. If today we're always returning 1 instead of the actual exit code, I don't see that as a breaking change (especially for a pre-1.0 project 😅).

This leads to the 2nd question, should we create a signed attestations, regardless of the exit code?

Philosophically, I think it's fine to create the attestation in that case as it's only attesting to the failed command. It's trivial to write a policy that checks the exit code of the command-run attestation.

From a practical standpoint, I can see a lot of useless attestations created for failed jobs that aren't useful.

Bringing this back to the proposal, I like the idea of --accept-exit-codes and we may want to allow * as an option. For this feature or a separate one, what do you think about witness run always returning the actual exit code? Would you expect an exit code listed in --accept-exit-codes to be hidden by witness run and have it return 0 instead?

[mikhailswift]

I thought I had code to pass the exit code through and out, unless something in witness itself caused the error (failure to load key, write attestation, etc). It was my intent originally to do so, if not. I'll look a bit through the code to see if I'm misremembering