in-toto / archivista

Archivista is a graph and storage service for in-toto attestations. Archivista enables the discovery and retrieval of attestations for software artifacts.
Apache License 2.0
62 stars 23 forks source link

Fix DSSE Signature KeyID compatiblity with Sigstore signatures #362

Closed kairoaraujo closed 1 month ago

kairoaraujo commented 1 month ago

What this PR does / why we need it

Using sigstore to sign some metadata, a key ID isn't part of the resulting date.

Archivista cannot handle it on upload, getting a key id length error when it's blank.

The DSSE specification allows key id to be blank.

Fixes #321

Acceptance Criteria Met

Special notes for your reviewer:

The last commit is only auto-generated code.

codecov[bot] commented 1 month ago

Codecov Report

Attention: Patch coverage is 0.93458% with 106 lines in your changes missing coverage. Please review.

Project coverage is 1.62%. Comparing base (a035c62) to head (1355ca8). Report is 153 commits behind head on main.

Files Patch % Lines
ent/attestation_query.go 0.00% 10 Missing :warning:
ent/attestationcollection_query.go 0.00% 10 Missing :warning:
ent/attestationpolicy_query.go 0.00% 10 Missing :warning:
ent/dsse_query.go 0.00% 10 Missing :warning:
ent/payloaddigest_query.go 0.00% 10 Missing :warning:
ent/signature_query.go 0.00% 10 Missing :warning:
ent/statement_query.go 0.00% 10 Missing :warning:
ent/subject_query.go 0.00% 10 Missing :warning:
ent/subjectdigest_query.go 0.00% 10 Missing :warning:
ent/timestamp_query.go 0.00% 10 Missing :warning:
... and 4 more
Additional details and impacted files ```diff @@ Coverage Diff @@ ## main #362 +/- ## ========================================== - Coverage 82.40% 1.62% -80.78% ========================================== Files 10 120 +110 Lines 358 28845 +28487 ========================================== + Hits 295 468 +173 - Misses 43 28320 +28277 - Partials 20 57 +37 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.