Improve case of possible wrong instance on verify #1510
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This is not foolproof but it does work when e.g. a bundle is
signed with "--staging" and verified without it:
$ sigstore verify identity ...
[16:09:18] WARNING A certificate chain was not valid, are you using the correct Sigstore _cli.py:1095
instance?
ERROR FAIL: sign-main-rekorv1/README.md _cli.py:1098
$
In practice if TSA cert validation fails we take that as a hint that this
might be a case of wrong instance (because that's the first use case of
trusted root certs).
Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
|
Maybe I went a little too far in removing details from the error putput. Could output one line of error details and then a separate hint |
|
Ok, I changed the output so there is a little more. This is what it looks like now if I try to verify a staging bundle without specifying
|
Make the output more useful when TSA cert cannot be verified Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
ac66c62 to
c2a3624
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #1487