fix: use artifact filenames as keys for verifying jfrog assets in provenance_witness_l1_check #796
Conversation
oracle-contributor-agreement
bot
added
the
OCA Verified
tromai
changed the title
tromai
changed the title
…venance_witness_l1_check Signed-off-by: Trong Nhan Mai <trong.nhan.mai@oracle.com>
Signed-off-by: Trong Nhan Mai <trong.nhan.mai@oracle.com>
tromai
force-pushed
the
tromai/fix-look-up-table-for-provenance-discovery
branch
from
2464747 to
baf3691
Compare
|
Rebase to obtain the changes from #798 |
| look_up[subject["name"]] = {} | ||
| look_up[subject["name"]][subject["digest"]["sha256"]] = subject | ||
| # Get the artifact name, which should be the last part of the artifact subject value. | ||
| _, _, artifact_filename = subject["name"].rpartition("/") |
There was a problem hiding this comment.
This code splitting this string is assuming that the name is of the form https://witness.dev/attestations/product/v0.1/file:path/to/file. I know that this function is currently only called on a list that comes from extract_build_artifacts_from_witness_subjects, which currently only produces subjects of that form, but if that changes in future this code would silently break. I think it would be safer for this code to validate that it is a witness file subject before extracting the filename and throw an exception if it is not (which currently should never happen).
There was a problem hiding this comment.
That's a good point. I have added the validation here - c57936b
Signed-off-by: Trong Nhan Mai <trong.nhan.mai@oracle.com>
Signed-off-by: Trong Nhan Mai <trong.nhan.mai@oracle.com>
|
@tromai Not sure why |
Signed-off-by: Trong Nhan Mai <trong.nhan.mai@oracle.com>
Signed-off-by: Trong Nhan Mai <trong.nhan.mai@oracle.com>
…venance_witness_l1_check (#796) Signed-off-by: Trong Nhan Mai <trong.nhan.mai@oracle.com>
No description provided.