search

in-toto / witness

Witness is a pluggable framework for software supply chain risk management. It automates, normalizes, and verifies software artifact provenance.
https://witness.dev
Apache License 2.0
415 stars 59 forks source link

[Bug]: Using artifactsFrom fails when backrefs don't exist #416

Open jkjell opened 8 months ago

jkjell commented 8 months ago

What steps did you take and what happened:

When using a policy with artifactsFrom for two or more attestations using only the products and materials attestors (or anything other combination that doesn't generate backrefs), the policy verification fails.

What did you expect to happen:

The policy should pass.

Anything else you would like to add:

Additional details in CNCF Slack: https://cloud-native.slack.com/archives/C068F87H1MF/p1710785890611579