fix(cmd/verify): automatically leverage attestation subjects to resolve artifactsFrom #758
Open
Jaydeep869 wants to merge 3 commits intoin-toto:mainfrom
Open
fix(cmd/verify): automatically leverage attestation subjects to resolve artifactsFrom #758Jaydeep869 wants to merge 3 commits intoin-toto:mainfrom
Jaydeep869 wants to merge 3 commits intoin-toto:mainfrom
Conversation
…ve artifactsFrom When users provide explicit attestations via the '-a' flag, the verifier would previously fail to map materials to products across steps utilizing the 'artifactsFrom' directive unless explicit backrefs were stored. This commit implements a graceful wrapper. It securely parses DSSE envelopes for any attestations passed via '-a' and artificially populates the search pool with their respective subjects. This effectively auto-resolves downstream materials to upstream products, eliminating the need to manually pass old hashes using the '-s' parameter. Signed-off-by: jaydeep869 <jaydeeppokhariya2106@gmail.com>
✅ Deploy Preview for witness-project ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
…rations Signed-off-by: jaydeep869 <jaydeeppokhariya2106@gmail.com>
jkjell
reviewed
Apr 20, 2026
Member
jkjell
left a comment
jkjell
left a comment
There was a problem hiding this comment.
This looks great! Would you be able to add a unit test for the new function and an integration test showing this working with two local attestations?
Thanks!
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does / why we need it
When utilizing the
artifactsFromdirective with purelymaterialsandproductsattestators, policy verification fails downstream because these types do not contain explicit backrefs intrinsically tying their step to the downstream step artifact. This decouples the sourceproductsfrom the destinationmaterials, causing the verifier to only use the modified artifact's hash (-f) as the subject and essentially ignoring the original inputs. Users were forced to manually re-inject the older hashes utilizing-s <hash>.Rather than fundamentally rewriting the verifier engine in
in-toto/go-witnessto bypass backrefs, this PR bridges the gap automatically at the CLI level.Specifically, this commit introduces an
extractSubjectsFromAttestationshelper natively into thewitness verifycommand incmd/verify.go. Any file passed securely via the-aattestation flag is naturally decompressed, its.Statement.Subject.Digestpayloads are enumerated, and its respective artifact hashes are converted intocryptoutil.DigestSetobjects.These extracted arrays are organically appended behind the scenes directly to the subject search pool (
vo.AdditionalSubjects) alongside the final-fartifact representation. This completely automates the-smanual bypass technique originally discussed in #416.Which issue(s) this PR fixes (optional)
Fixes #416
Acceptance Criteria Met
Special notes for your reviewer:
Tested locally against DSSE artifacts. This automates passing the subjects explicitly via
-swhenever-ais provided, preventing the trace from breaking downstream.