-
Notifications
You must be signed in to change notification settings - Fork 140
Add a Name field to the TargetFile struct #2068
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
@bkabrda please sign the DCO |
42c53ed
to
c3a271b
Compare
@cpanato Will do. I accidentally reset my Git signing config and I am struggling to get it to work again, but I should have it ready soon. |
c3a271b
to
85b7015
Compare
@cpanato done, I guess the DCO check didn't register me uploading the new public key to my GH account, so it might need to be rerun now (?) The GH UI is already telling me that the commit is "Verified", so I think I'm all set on my side. |
you need to sign off the commit
|
Signed-off-by: Slavek Kabrda <bkabrda@redhat.com>
85b7015
to
33bf7f1
Compare
@cpanato I think I forgot to force push, sorry. Should be all ok now. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This TUF client is deprecated but this is fine for fixing the bug. The longer-term fix is to migrate to the TUF v2 client and TrustedRoot, but this is of course a larger fix.
Summary
This PR is related to sigstore/cosign#4098 - in order to fix that issue, the cosign code has to access the target name to see if it's one of the "fallbacks" or not (and treat it accordingly as explained in the linked issue).
I really wanted to keep this change contained to cosign codebase itself, but I just couldn't find a way to do this; I think adding this small PR here shouldn't hurt, as it is fully backwards compatible.
Release Note
Added a
Name
field to theTargetFile
structDocumentation
I believe this PR doesn't require any documentation update