search

cnabio / signy

Go implementation for CNAB content trust verification using TUF, Notary, and in-toto
MIT License
31 stars 11 forks source link

Cannot use a trust server that does not require authentication #43

Closed radu-matei closed 4 years ago

radu-matei commented 4 years ago

When using a local trust server, most of the time it will not require authentication. But the current implementation always requires credentials for the trust server, resulting in the following error:

cannot sign and publish trust data: cannot make transport: cannot get default credentials: authentication not found for trust server https://localhost:4443

This is coming from the TUF helper function that reads the Docker auth:

https://github.com/engineerd/signy/blob/d648918f7c6dadf8ddb4a15d71a6db86a323d02b/pkg/tuf/helpers.go#L229-L249

radu-matei commented 4 years ago

Trying to use a local instance of Notary that does not require authentication:

signy --tlscacert=$NOTARY_CA --server https://localhost:4443 sign testdata/cnab/bundle.json localhost:5000/thin-bundle:v1
Error: cannot sign and publish trust data: cannot make transport: cannot get default credentials: authentication not found for trust server https://localhost:4443
radu-matei commented 4 years ago

A simple workaround would be an --unsafe / --skip-auth flag that would skip the credential validation.

It would also be nice because using an unauthenticated server would be an explicit choice of the user.