General information:
- Version (tag or commit):
36d782ffb2ca3adbffcdce1fd971c23319dd4469
- Operating system (Linux/Mac/Windows): Mac
- Go version: go1.26.4
- Go build flags (if any): none
Description of the bug:
For a step whose functionaries are a mix of pubkeys and certificate constraints, VerifyLinkSignatureThesholds returns success or a "not enough links" error non-deterministically for the same valid input.
The cause is that isAuthorizedSignature is declared once before the per-link loop instead of inside it (in_toto/verifylib.go:563), so after a pubkey link sets it true, later certificate-functionary links skip verification. Whether a certificate link counts toward the threshold then depends on whether it is iterated before or after a pubkey link.
Reproduction: build one link signed by a pubkey functionary and one signed by a certificate functionary, put both in a step with Threshold: 2, and run VerifyLinkSignatureThesholds repeatedly. Result over 50 runs of the same input:
over 50 runs of the SAME valid input: pass(threshold met)=4 fail(false-reject)=46
A self-contained test is in the PR.
This is not a verification bypass (an unauthorized link is never accepted). The effect is that a valid supply chain intermittently fails verification.
Anything special you want to tell us?
Fix is one line: move isAuthorizedSignature := false inside the per-link loop so it resets each iteration. PR attached.
General information:
36d782ffb2ca3adbffcdce1fd971c23319dd4469Description of the bug:
For a step whose functionaries are a mix of
pubkeysand certificate constraints,VerifyLinkSignatureThesholdsreturns success or a "not enough links" error non-deterministically for the same valid input.The cause is that
isAuthorizedSignatureis declared once before the per-link loop instead of inside it (in_toto/verifylib.go:563), so after a pubkey link sets it true, later certificate-functionary links skip verification. Whether a certificate link counts toward the threshold then depends on whether it is iterated before or after a pubkey link.Reproduction: build one link signed by a pubkey functionary and one signed by a certificate functionary, put both in a step with
Threshold: 2, and runVerifyLinkSignatureThesholdsrepeatedly. Result over 50 runs of the same input:A self-contained test is in the PR.
This is not a verification bypass (an unauthorized link is never accepted). The effect is that a valid supply chain intermittently fails verification.
Anything special you want to tell us?
Fix is one line: move
isAuthorizedSignature := falseinside the per-link loop so it resets each iteration. PR attached.