From 6223a53d73703dbfa4494544c546b83679687fbf Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Thu, 21 Aug 2025 22:45:31 +0000 Subject: [PATCH 1/3] Generate licenses - 89512590addc159fff0f13acca811d803d592ff9 --- third-party-licenses.darwin.md | 2 +- third-party-licenses.linux.md | 2 +- third-party-licenses.windows.md | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/third-party-licenses.darwin.md b/third-party-licenses.darwin.md index 0f84c9ff327..d6215162171 100644 --- a/third-party-licenses.darwin.md +++ b/third-party-licenses.darwin.md @@ -95,7 +95,7 @@ Some packages may only be included on certain architectures or operating systems - [github.com/go-openapi/strfmt](https://pkg.go.dev/github.com/go-openapi/strfmt) ([Apache-2.0](https://github.com/go-openapi/strfmt/blob/v0.23.0/LICENSE)) - [github.com/go-openapi/swag](https://pkg.go.dev/github.com/go-openapi/swag) ([Apache-2.0](https://github.com/go-openapi/swag/blob/v0.23.1/LICENSE)) - [github.com/go-openapi/validate](https://pkg.go.dev/github.com/go-openapi/validate) ([Apache-2.0](https://github.com/go-openapi/validate/blob/v0.24.0/LICENSE)) -- [github.com/go-viper/mapstructure/v2](https://pkg.go.dev/github.com/go-viper/mapstructure/v2) ([MIT](https://github.com/go-viper/mapstructure/blob/v2.3.0/LICENSE)) +- [github.com/go-viper/mapstructure/v2](https://pkg.go.dev/github.com/go-viper/mapstructure/v2) ([MIT](https://github.com/go-viper/mapstructure/blob/v2.4.0/LICENSE)) - [github.com/golang/groupcache/lru](https://pkg.go.dev/github.com/golang/groupcache/lru) ([Apache-2.0](https://github.com/golang/groupcache/blob/2c02b8208cf8/LICENSE)) - [github.com/golang/snappy](https://pkg.go.dev/github.com/golang/snappy) ([BSD-3-Clause](https://github.com/golang/snappy/blob/v1.0.0/LICENSE)) - [github.com/google/certificate-transparency-go](https://pkg.go.dev/github.com/google/certificate-transparency-go) ([Apache-2.0](https://github.com/google/certificate-transparency-go/blob/v1.3.2/LICENSE)) diff --git a/third-party-licenses.linux.md b/third-party-licenses.linux.md index 3281ddfe18f..afc9d9c921d 100644 --- a/third-party-licenses.linux.md +++ b/third-party-licenses.linux.md @@ -94,7 +94,7 @@ Some packages may only be included on certain architectures or operating systems - [github.com/go-openapi/strfmt](https://pkg.go.dev/github.com/go-openapi/strfmt) ([Apache-2.0](https://github.com/go-openapi/strfmt/blob/v0.23.0/LICENSE)) - [github.com/go-openapi/swag](https://pkg.go.dev/github.com/go-openapi/swag) ([Apache-2.0](https://github.com/go-openapi/swag/blob/v0.23.1/LICENSE)) - [github.com/go-openapi/validate](https://pkg.go.dev/github.com/go-openapi/validate) ([Apache-2.0](https://github.com/go-openapi/validate/blob/v0.24.0/LICENSE)) -- [github.com/go-viper/mapstructure/v2](https://pkg.go.dev/github.com/go-viper/mapstructure/v2) ([MIT](https://github.com/go-viper/mapstructure/blob/v2.3.0/LICENSE)) +- [github.com/go-viper/mapstructure/v2](https://pkg.go.dev/github.com/go-viper/mapstructure/v2) ([MIT](https://github.com/go-viper/mapstructure/blob/v2.4.0/LICENSE)) - [github.com/godbus/dbus/v5](https://pkg.go.dev/github.com/godbus/dbus/v5) ([BSD-2-Clause](https://github.com/godbus/dbus/blob/v5.1.0/LICENSE)) - [github.com/golang/groupcache/lru](https://pkg.go.dev/github.com/golang/groupcache/lru) ([Apache-2.0](https://github.com/golang/groupcache/blob/2c02b8208cf8/LICENSE)) - [github.com/golang/snappy](https://pkg.go.dev/github.com/golang/snappy) ([BSD-3-Clause](https://github.com/golang/snappy/blob/v1.0.0/LICENSE)) diff --git a/third-party-licenses.windows.md b/third-party-licenses.windows.md index 52e6d759b82..d0ff854aa05 100644 --- a/third-party-licenses.windows.md +++ b/third-party-licenses.windows.md @@ -96,7 +96,7 @@ Some packages may only be included on certain architectures or operating systems - [github.com/go-openapi/strfmt](https://pkg.go.dev/github.com/go-openapi/strfmt) ([Apache-2.0](https://github.com/go-openapi/strfmt/blob/v0.23.0/LICENSE)) - [github.com/go-openapi/swag](https://pkg.go.dev/github.com/go-openapi/swag) ([Apache-2.0](https://github.com/go-openapi/swag/blob/v0.23.1/LICENSE)) - [github.com/go-openapi/validate](https://pkg.go.dev/github.com/go-openapi/validate) ([Apache-2.0](https://github.com/go-openapi/validate/blob/v0.24.0/LICENSE)) -- [github.com/go-viper/mapstructure/v2](https://pkg.go.dev/github.com/go-viper/mapstructure/v2) ([MIT](https://github.com/go-viper/mapstructure/blob/v2.3.0/LICENSE)) +- [github.com/go-viper/mapstructure/v2](https://pkg.go.dev/github.com/go-viper/mapstructure/v2) ([MIT](https://github.com/go-viper/mapstructure/blob/v2.4.0/LICENSE)) - [github.com/golang/groupcache/lru](https://pkg.go.dev/github.com/golang/groupcache/lru) ([Apache-2.0](https://github.com/golang/groupcache/blob/2c02b8208cf8/LICENSE)) - [github.com/golang/snappy](https://pkg.go.dev/github.com/golang/snappy) ([BSD-3-Clause](https://github.com/golang/snappy/blob/v1.0.0/LICENSE)) - [github.com/google/certificate-transparency-go](https://pkg.go.dev/github.com/google/certificate-transparency-go) ([Apache-2.0](https://github.com/google/certificate-transparency-go/blob/v1.3.2/LICENSE)) From 3fed6efdc6f1c116b462eb30d196613acb03724d Mon Sep 17 00:00:00 2001 From: Meredith Lancaster Date: Tue, 9 Jun 2026 11:27:53 -0700 Subject: [PATCH 2/3] return error if GitHub verifier is not available Signed-off-by: Meredith Lancaster --- pkg/cmd/attestation/verification/sigstore.go | 3 +++ .../verification/sigstore_integration_test.go | 25 +++++++++++++++++++ .../attestation/verification/sigstore_test.go | 14 +++++++++++ 3 files changed, 42 insertions(+) diff --git a/pkg/cmd/attestation/verification/sigstore.go b/pkg/cmd/attestation/verification/sigstore.go index 7ab3e083172..60c347ef88d 100644 --- a/pkg/cmd/attestation/verification/sigstore.go +++ b/pkg/cmd/attestation/verification/sigstore.go @@ -223,6 +223,9 @@ func (v *LiveSigstoreVerifier) chooseVerifier(issuer string) (*verify.Verifier, } return v.PublicGood, nil case GitHubIssuerOrg: + if v.GitHub == nil { + return nil, fmt.Errorf("GitHub verifier is not available (initialization may have failed)") + } return v.GitHub, nil default: return nil, fmt.Errorf("leaf certificate issuer is not recognized") diff --git a/pkg/cmd/attestation/verification/sigstore_integration_test.go b/pkg/cmd/attestation/verification/sigstore_integration_test.go index daa948b950c..0e8fa49301e 100644 --- a/pkg/cmd/attestation/verification/sigstore_integration_test.go +++ b/pkg/cmd/attestation/verification/sigstore_integration_test.go @@ -144,6 +144,31 @@ func TestLiveSigstoreVerifier(t *testing.T) { require.Len(t, results, 2) require.NoError(t, err) }) + + t.Run("returns an error instead of panicking when the GitHub verifier failed to initialize", func(t *testing.T) { + githubArtifactPath := test.NormalizeRelativePath("../test/data/github_provenance_demo-0.0.12-py3-none-any.whl") + githubArtifact, err := artifact.NewDigestedArtifact(nil, githubArtifactPath, "sha256") + require.NoError(t, err) + + githubPolicy := buildPolicy(t, *githubArtifact) + attestations := getAttestationsFor(t, "../test/data/github_provenance_demo-0.0.12-py3-none-any-bundle.jsonl") + + verifier, err := NewLiveSigstoreVerifier(SigstoreConfig{ + ExternalHttpClient: http.DefaultClient, + Logger: io.NewTestHandler(), + TrustDomain: "missing-trust-domain", + TUFMetadataDir: o.Some(t.TempDir()), + }) + require.NoError(t, err) + + require.NotPanics(t, func() { + results, verifyErr := verifier.Verify(attestations, githubPolicy) + require.Nil(t, results) + require.Error(t, verifyErr) + require.ErrorContains(t, verifyErr, "failed to choose verifier based on provided bundle issuer") + require.ErrorContains(t, verifyErr, "GitHub verifier is not available") + }) + }) } func publicGoodPolicy(t *testing.T) verify.PolicyBuilder { diff --git a/pkg/cmd/attestation/verification/sigstore_test.go b/pkg/cmd/attestation/verification/sigstore_test.go index 1f7c925ba24..ae9a502dc99 100644 --- a/pkg/cmd/attestation/verification/sigstore_test.go +++ b/pkg/cmd/attestation/verification/sigstore_test.go @@ -27,6 +27,20 @@ func TestChooseVerifierWithNilPublicGood(t *testing.T) { require.ErrorContains(t, err, "public good verifier is not available") } +func TestChooseVerifierWithNilGitHub(t *testing.T) { + verifier := &LiveSigstoreVerifier{ + Logger: io.NewTestHandler(), + NoPublicGood: false, + PublicGood: nil, + GitHub: nil, // Simulate failed GitHub verifier initialization + } + + _, err := verifier.chooseVerifier(GitHubIssuerOrg) + + require.Error(t, err) + require.ErrorContains(t, err, "GitHub verifier is not available") +} + // TestChooseVerifierUnrecognizedIssuer tests that an error is returned // for unrecognized issuers. func TestChooseVerifierUnrecognizedIssuer(t *testing.T) { From d58ad9cba6c69d2eff1ec323523df3a8375d9169 Mon Sep 17 00:00:00 2001 From: Meredith Lancaster Date: Fri, 10 Jul 2026 11:12:22 -0700 Subject: [PATCH 3/3] drop notPanics assertion Signed-off-by: Meredith Lancaster --- .../verification/sigstore_integration_test.go | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/pkg/cmd/attestation/verification/sigstore_integration_test.go b/pkg/cmd/attestation/verification/sigstore_integration_test.go index 0e8fa49301e..0ba343898a2 100644 --- a/pkg/cmd/attestation/verification/sigstore_integration_test.go +++ b/pkg/cmd/attestation/verification/sigstore_integration_test.go @@ -160,14 +160,11 @@ func TestLiveSigstoreVerifier(t *testing.T) { TUFMetadataDir: o.Some(t.TempDir()), }) require.NoError(t, err) - - require.NotPanics(t, func() { - results, verifyErr := verifier.Verify(attestations, githubPolicy) - require.Nil(t, results) - require.Error(t, verifyErr) - require.ErrorContains(t, verifyErr, "failed to choose verifier based on provided bundle issuer") - require.ErrorContains(t, verifyErr, "GitHub verifier is not available") - }) + results, verifyErr := verifier.Verify(attestations, githubPolicy) + require.Nil(t, results) + require.Error(t, verifyErr) + require.ErrorContains(t, verifyErr, "failed to choose verifier based on provided bundle issuer") + require.ErrorContains(t, verifyErr, "GitHub verifier is not available") }) }