Closed 8R0WNI3 closed 1 month ago
Instead, rather fail verification
generally +1. However, I would personally prefer the sign
command to at most emit a warning (which may be escalated to an error) upon validation error. At least, please offer a flag to ignore validation errors (motivation being identical to https://github.com/open-component-model/ocm/issues/755 (there should always be an override option for emergencies)
What happened: When executing
ocm sign componentversions
on a component descriptor which contains multiple resources which share the same name and haveextraIdentity
explicitly set to{}
, all resources have theversion
property added to theextraIdentity
field except the last resource of that name (which is reasonable since the last resource is unique withoutextraIdentity
being set as soon as all other resources have theirversion
property added to it).What you expected to happen: Don't silently add properties to the
extraIdentity
field duringocm sign
command (and certainly not inconsistently). Instead, rather fail verification.How to reproduce it (as minimally and precisely as possible): Example component descriptor which has to be signed using
ocm sign componentversions
command:Anything else we need to know:
Environment: