verify: raise MetadataError instead of IndexError for trusted roots with no tlogs (#1822) - #1870
Open
agu2347 wants to merge 1 commit into
Open
verify: raise MetadataError instead of IndexError for trusted roots with no tlogs (#1822)#1870agu2347 wants to merge 1 commit into
agu2347 wants to merge 1 commit into
Conversation
…ith no tlogs (sigstore#1822) `Verifier.__init__` picks a Rekor base URL via `trusted_root._inner.tlogs[0].base_url`. If the given `trusted_root` has no transparency log entries, this raises a bare `IndexError` instead of a `sigstore.errors` exception. `Verifier` otherwise documents its failures as `VerificationError` (or subclasses), and callers that only catch that get an unhandled crash. This mirrors the existing, established pattern in `TrustedRoot` itself (`rekor_keyring` / `ct_keyring` / `get_fulcio_certs` all raise `MetadataError` when required trusted-root data is missing) -- per @woodruffw's comment on the issue, this is intentional (a Sigstore instance is expected to have at least one tlog) but should surface as "a more structured error" rather than an unhandled IndexError. Added two unit tests to test_verifier.py: * `Verifier(trusted_root=...)` raises `MetadataError` for a `trusted_root` with an empty `tlogs` list * `Verifier(trusted_root=...)` still succeeds and picks the first tlog's `base_url` when `tlogs` is non-empty, proving the new guard doesn't affect the happy path Fixes sigstore#1822
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bug
Verifier.__init__raises an unhandledIndexErrorwhen given atrusted_rootwith no transparency logs, instead of a documentedsigstore.errorsexception.Fixes #1822
Context
Per @woodruffw's comment on the issue: this is intentional (a Sigstore instance is expected to have at least one tlog), but "we could turn that into a more structured error."
Verifierdocuments its failures asVerificationError(or subclasses), so a caller catching only that gets an unhandled crash.Fix
TrustedRootalready has an established pattern for this exact situation --rekor_keyring(),ct_keyring(), andget_fulcio_certs()all raiseMetadataErrorwhen required data is missing from the trusted root (e.g."Did not find any Rekor keys in trusted root","Fulcio certificates not found in trusted root"). This PR applies the same pattern toVerifier.__init__: checktrusted_root._inner.tlogsbefore indexing into it, and raiseMetadataError("No transparency logs found in trusted root")instead of letting theIndexErrorpropagate.Testing
Added two unit tests to
test/unit/verify/test_verifier.py, usingpretend.stubfortrusted_rootto avoid any network dependency (matching the file's existing style for non-network tests):test_verifier_init_no_transparency_logs-- atrusted_rootwith an emptytlogslist raisesMetadataError.test_verifier_init_with_transparency_logs-- atrusted_rootwith atlogsentry still constructs successfully and picks itsbase_url, proving the new guard doesn't affect the happy path.Verified:
pytest test/unit --skip-staging -m "not production"passes 177/177 (175 existing + 2 new), 28 skipped (network-marked). Reverting justsigstore/verify/verifier.pyreproduces the exact reportedIndexErrorin the new negative test while the positive test still passes, confirming this is a genuine regression guard.ruff format --check,ruff check, andmypy sigstore/verify/verifier.py(the project's actualmake lintgate) are all clean.