search

enterprise-contract / ec-cli

Enterprise Contract command line interface
https://enterprisecontract.dev/docs/ec-cli/main/index.html
Apache License 2.0
26 stars 23 forks source link

[BUG] Segfault validating OCI artifact #1671

Closed ralphbean closed 1 month ago

ralphbean commented 1 month ago

Describe the Bug

ec-cli seg faulted when I asked it to process an OCI artifact.

See more about the artifact at https://github.com/ralphbean/merlinite-poc

Steps to Reproduce

❯ IMAGE=quay.io/redhat-user-workloads/rhel-ai-poc-tenant/models/merlinite-poc:99232c2355efd09ef5d0f4aca4fe3e22a7849a92       
❯ ec validate image --image ${IMAGE} --ignore-rekor --policy github.com/enterprise-contract/config//redhat --public-key <(echo "${KONFLUX_PROD_KEY}") --info --output=text         
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x272db5d]

goroutine 1 [running]:
github.com/enterprise-contract/ec-cli/internal/applicationsnapshot.expandImageIndex({0x3f67ab0?, 0xc000d64c40?}, 0xc00078c370)
    github.com/enterprise-contract/ec-cli/internal/applicationsnapshot/input.go:226 +0x8dd
github.com/enterprise-contract/ec-cli/internal/applicationsnapshot.DetermineInputSpec({0x3f67ab0, 0xc000d64c40}, {{0x0, 0x0}, {0x0, 0x0}, {0x7fff3b411d8b, 0x6e}, {0x0, 0x0}, ...})
    github.com/enterprise-contract/ec-cli/internal/applicationsnapshot/input.go:167 +0x705
github.com/enterprise-contract/ec-cli/cmd/validate.validateImageCmd.func1(0xc000004f00, {0x33d4895?, 0x4?, 0x33d47c5?})
    github.com/enterprise-contract/ec-cli/cmd/validate/image.go:191 +0x126
github.com/spf13/cobra.(*Command).execute(0xc000004f00, {0xc000d78240, 0x9, 0x9})
    github.com/spf13/cobra@v1.8.0/command.go:968 +0xa36
github.com/spf13/cobra.(*Command).ExecuteC(0xc00019ef00)
    github.com/spf13/cobra@v1.8.0/command.go:1115 +0x3ff
github.com/spf13/cobra.(*Command).Execute(...)
    github.com/spf13/cobra@v1.8.0/command.go:1039
github.com/spf13/cobra.(*Command).ExecuteContext(0x0?, {0x3f679d0?, 0x5f5cfc0?})
    github.com/spf13/cobra@v1.8.0/command.go:1032 +0x47
github.com/enterprise-contract/ec-cli/cmd.Execute()
    github.com/enterprise-contract/ec-cli/cmd/root.go:43 +0x28
main.main()
    github.com/enterprise-contract/ec-cli/main.go:22 +0xf

Expected Behavior

I expected to see a list of failures so I could start to build a TODO list for what policy should look like for this kind of artifact.

Actual Behavior

Segfault. :)

Environment Details

This happened in both Konflux CI as well as on my local Fedora 40 system. Any other context about the problem here.