Remove notation validation to avoid panics #4962
Conversation
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
| name: "invalid trust policy json", | ||
| args: fmt.Sprintf("create secret notation notation-config --ca-cert-file=%s --trust-policy-file=%s", t.TempDir(), invalidJson), | ||
| assert: assertError(fmt.Sprintf("failed to unmarshal trust policy %s: json: cannot unmarshal string into Go value of type trustpolicy.Document", invalidJson)), | ||
| }, |
There was a problem hiding this comment.
Instead of removing all these, how about vendoring the notation-go code temporarily until the upstream fix is available for us to use?
I gave it a try to see if we can vendor minimal code and got it working with the attached diff. It's a lot to be pasted in a comment. It has references to the upstream code from where they are taken and reference to the PR that will make them not required. It is based on the flux2 latest main branch and can be applied with git apply notation-trustpolicy-validate.diff.txt.
notation-trustpolicy-validate.diff.txt
I think it's simpler to replace the vendored code with upstream than to introduce removed validation and test cases at some time in the future.
|
Thanks to @JasonTheDeveloper we'll have a fix upstream. We can close this PR once the notation-go is released. |
Fix: #4961