search

in-toto / witness

Witness is a pluggable framework for software supply chain risk management. It automates, normalizes, and verifies software artifact provenance.
https://witness.dev
Apache License 2.0
416 stars 60 forks source link

[Bug]: Always-run attestor type duplication #374

Closed Strakeln closed 10 months ago

Strakeln commented 10 months ago

What steps did you take and what happened:

If a user specifies one of the always-run attestor types (product and material), the specified attestor type is run twice.

Example:

witness run -a product -s test -k key.pem -o output.json --echo "hello" >test.txt

INFO Starting material attestor...
INFO Starting command-run attestor...
INFO Starting product attestor...
INFO Starting product attestor...

Note the duplicate "starting product attestor" statement. In the resulting attestation, there are two product attestors. Same behavior applies if you specify the material attestor.

What did you expect to happen:

INFO Starting material attestor...
INFO Starting command-run attestor...
INFO Starting product attestor...

(and the resulting output attestation to only have one product attestation)

Environment:

ChaosInTheCRD commented 10 months ago

Hi @Strakeln 👋

So this is actually an issue that has been folded out, but it hasn't yet made its way out in the form of a release. You can see the fix here. If you'd like, you can also validate that the problem is gone by running go run . run ... in the project directory if you have it cloned 😄.

Hopefull that answers your question, and if you want to know anything else please feel free to update this issue. Also pleae let me know if you are happy for me to close the issue (might be worth waiting if you want to run the main branch code locally).

Strakeln commented 10 months ago

Excellent news, @ChaosInTheCRD - thanks for the update. I am good with you closing the issue. Thanks!