in-toto / witness

Witness is a pluggable framework for software supply chain risk management. It automates, normalizes, and verifies software artifact provenance.
https://witness.dev
Apache License 2.0
416 stars 60 forks source link

Getting started example doesn't work - "failed to load signers" #287

Closed matglas closed 1 year ago

matglas commented 1 year ago

When I follow the getting started in a clean ubuntu docker container or on my Mac I am not able to get it to work.

$ witness run --step build -o test-att.json -- echo "hello $(date)" > artifact
INFO    Using config file: .witness.yaml             
ERROR   failed to load signers

When I ran the following it worked.

$ witness run --step build -o test-att.json -k testkey.pem -- echo "hello $(date)" > artifact
matglas commented 1 year ago

After going thru the code and seeing how the config is loaded into the flags I change the key setting in my config file from

run:
    key: testkey.pem

to

run:
    signer-file-key-path: testkey.pem

Then it worked.

I think that with an update to the example that would help new users to get familiar quicker.