A minimal example of not requiring auth for some cases of gh attestation verify #8995
Conversation
|
Hi! Thanks for the pull request. Please ensure that this change is linked to an issue by mentioning an issue number in the description of the pull request. If this pull request would close the issue, please put the word 'Fixes' before the issue number somewhere in the pull request body. If this is a tiny change like fixing a typo, feel free to ignore this message. |
|
|
||
| authOk := cmdutil.CheckAuth(factoryConfig) | ||
| if !authOk { | ||
| return fmt.Errorf("Please supply a bundle or authenticate to gh") |
There was a problem hiding this comment.
I thought about using pkg/cmd/root/help.go:authHelp() here but, (1) importing root here would create a circular dependency and (2) it's a private function. I'm open to feedback here!
There was a problem hiding this comment.
Realistically if we go down this route I'd imagine that we have something like cmderrs package used like cmderrs.AuthRequired or something like that.
The main change is previously we always instantiated a TUF client for the public good and GitHub Sigstore instances. Now we only instantiate the TUF client we need, or no client if we are provided a custom trusted root. Note that `gh attestation verify` still requires authentication, that is being addressed in cli#8995. Some other changes are coming along for the ride: - Set TUF cache validity to 1 day, to help serial verification - Attempt to infer verification policy based on custom trusted root - Make command output more friendly if you leave off required arguments Signed-off-by: Zach Steindler <steiza@github.com>
|
@steiza @williammartin : Wanting to compare this with a generic solution, I believe #9000 could satisfy in a more generic manner. Outside of writing tests as the auth checking logic doesn't have any, I tried reproducing the user workflow using local build. |
|
Closing in favour of #9000, thanks! |
If the user does not supply a bundle, then we call a GitHub REST API to fetch the bundle. However, if the user does supply a bundle,
gh attestation verifydoesn't make any GitHub REST API calls, and so the user does not need to be authenticated.