admin/brew
1
0
Fork 0
Code Issues Packages Projects Releases 6 Wiki Activity

attestation: handle multiple subjects

Browse Source 
This should fix the behavior observed in
https://github.com/Homebrew/homebrew-core/issues/177384#issuecomment-2521141910
and below.

Signed-off-by: William Woodruff <william@yossarian.net>
This commit is contained in:
William Woodruff 2024-12-05 14:11:00 -05:00
parent eb2350901d
commit e5d47f85c9
No known key found for this signature in database
1 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
Library/Homebrew/attestation.rb
View File

@ -164,7 +164,10 @@ module Homebrew
# `gh attestation verify` returns a JSON array of one or more results, # `gh attestation verify` returns a JSON array of one or more results,
# for all attestations that match the input's digest. We want to additionally # for all attestations that match the input's digest. We want to additionally
# filter these down to just the attestation whose subject matches the bottle's name. # filter these down to just the attestation whose subject(s) contain the bottle's name.
# As of 2024-12-04 GitHub's Artifact Attestation feature can put multiple subjects
# in a single attestation, so we check every subject in each attestation
# and select the first attestation with a matching subject.
subject = bottle.filename.to_s if subject.blank? subject = bottle.filename.to_s if subject.blank?
attestation = if bottle.tag.to_sym == :all attestation = if bottle.tag.to_sym == :all
@ -175,12 +178,15 @@ module Homebrew
# This is sound insofar as the signature has already been verified. However, # This is sound insofar as the signature has already been verified. However,
# longer term, we should also directly attest to `:all`-tagged bottles. # longer term, we should also directly attest to `:all`-tagged bottles.
attestations.find do |a| attestations.find do |a|
actual_subject = a.dig("verificationResult", "statement", "subject", 0, "name") candidate_subjects = a.dig("verificationResult", "statement", "subject")
actual_subject.start_with? "#{bottle.filename.name}--#{bottle.filename.version}" candidate_subjects.any? do |candidate|
candidate["name"].start_with? "#{bottle.filename.name}--#{bottle.filename.version}"
end
end end
else else
attestations.find do |a| attestations.find do |a|
a.dig("verificationResult", "statement", "subject", 0, "name") == subject candidate_subjects = a.dig("verificationResult", "statement", "subject")
candidate_subjects.any? { |candidate| candidate["name"] == subject }
end end
end end