[series/3.6.x] Better error when verifying rekorv2 entries#1565
Conversation
Currently the error is technically correct but confusing
"VerificationError: not enough sources of verified time"
Replace that with:
ERROR The provided bundle contains a transparency log entry that is incompatible with
this version of sigstore-python. Please upgrade your verifying client.
Additional context:
Expected log entry version 0.0.1, got 0.0.2
For detailed error information, run sigstore with the `--verbose` flag.
Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
1228979 to
a550c33
Compare
|
FYI @di we discussed this on friday, it does look like the error could be better here. |
woodruffw
left a comment
There was a problem hiding this comment.
LGTM!
@jku out of curiosity, do you have thoughts on how long the 3.6.x series should be maintained? My first intuition here is to say that we should stop doing QOL improvements to it pretty soon now that 4.x is released, but I imagine there's still a significant usage tail that we need to move over to 4.x. Curious what you think.
di
left a comment
There was a problem hiding this comment.
(we should do the same for the 4.x series as well...)
|
@woodruffw, @jku has put together a nice set of client stats here, as expected the 3.x series has a lot of usage (seems like this is mostly due to gh-actions-pypi-publish using this version) IMO, we mostly just need a 3.x release with a useful error message when verifying newer entries (which this PR resolves). I don't think we need to maintain this series beyond that. |
I think this is fine, I don't think there's anything else we need to get into a 3.x release. |
Speaking of cryptography version pin bumps: should we do that in 3.6.6 or no? On one hand we would like library users to upgrade to sigstore 4.0 but I also recognise how very annoying a library pinning another library (especially cryptography) is... |
I will make a PR of that but either way works for me. |
This is a forward port of sigstore#1565 to future proof the error message. Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
….0 (#1569) * models: Forward-port the entry kind version error improvement This is a forward port of #1565 to future proof the error message. Signed-off-by: Jussi Kukkonen <jkukkonen@google.com> * Changelog: Update for 4.1.0 Add missing entries, also add the 3.6.6 changelog from series/3.6.x Signed-off-by: Jussi Kukkonen <jkukkonen@google.com> * Bump version to 4.1.0 Signed-off-by: Jussi Kukkonen <jkukkonen@google.com> --------- Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
New error looks like this (the format is the same as some existing bundle errors):
Fixes #1564.