Misleading error message when trust store is not configured #699
Description
What is the areas you experience the issue in?
Notation CLI
What is not working as expected?
I didn't configure trust store and run notation verify command directly. The error message was too general and misleading, see the following
$ notation verify $IMAGE
Error: signature verification failed for all the signatures associated with localhost:5001/net-monitor@sha256:8456f085dd609fd12cdebc5f80b6f33f25f670a7a9a03c8fa750b8aee0c4d657
With -v flag used, the detailed reason was shown.
$ notation verify $IMAGE -v
INFO Checking whether signature verification should be skipped or not
INFO Trust policy configuration: &{Name:policy-1 RegistryScopes:[localhost:5001/net-monitor] SignatureVerification:{VerificationLevel:strict Override:map[]} TrustStores:[ca:mystore] TrustedIdentities:[*]}
INFO Check over. Trust policy is not configured to skip signature verification
INFO Processing signature with manifest mediaType: application/vnd.oci.image.manifest.v1+json and digest: sha256:7aa4005f01c913531e1ac58176d2cc25ba9f5849ab07eb430dab2e1e04ddeff0
INFO Trust policy configuration: &{Name:policy-1 RegistryScopes:[localhost:5001/net-monitor] SignatureVerification:{VerificationLevel:strict Override:map[]} TrustStores:[ca:mystore] TrustedIdentities:[*]}
ERRO authenticity validation failed. Failure reason: error while loading the trust store, "/home/yizha1/.config/notation/truststore/x509/ca/mystore" does not exist
WARN Signature sha256:7aa4005f01c913531e1ac58176d2cc25ba9f5849ab07eb430dab2e1e04ddeff0 failed verification with error: error while loading the trust store, "/home/yizha1/.config/notation/truststore/x509/ca/mystore" does not exist
Error: signature verification failed for all the signatures associated with localhost:5001/net-monitor@sha256:8456f085dd609fd12cdebc5f80b6f33f25f670a7a9a03c8fa750b8aee0c4d657
What did you expect to happen?
The proposed error messages could be
$ notation verify $IMAGE
Error: the trust store with the name mystore of type ca doesn't exist. Use command "notation cert add" to add the trust store to verify $IMAGE
How can we reproduce it?
- Configure trust policy with non-existing trust store for verifying the image
- Run
notation verify $imagecommand
Describe your environment
Windows WSL2
What is the version of your Notation CLI or Notation Library?
Notation v1.0.0-rc.7