Description of issue::
Rethink the behavior of artifact rule path pattern filtering, especially if no artifacts are filtered by the pattern.
Current behavior:
All artifact rules take a pattern argument that is used to filter artifacts reported by a link.
If the pattern does not filter any artifacts the rules as practically not applied.
This issue was already pointed out in the discussion in in-toto/in-toto#43 and is also described in the docstrings of the artifact rules verification functions, e.g. for the MATCH rule:
https://github.com/in-toto/in-toto/blob/0beaf5b131b5860e8bf0bb059c9f97a0736851b2/in_toto/verifylib.py#L451-L461
Expected behavior:
Expected behavior is open for discussion. My suggestions:
- each pattern must match at least one artifact
- extend the rule syntax to indicate if the pattern can/must match
?, +, * artifact(s) (c.f. glob characters)
Description of issue::
Rethink the behavior of artifact rule path pattern filtering, especially if no artifacts are filtered by the pattern.
Current behavior:
All artifact rules take a
patternargument that is used to filter artifacts reported by a link.If the pattern does not filter any artifacts the rules as practically not applied.
This issue was already pointed out in the discussion in in-toto/in-toto#43 and is also described in the docstrings of the artifact rules verification functions, e.g. for the
MATCHrule:https://github.com/in-toto/in-toto/blob/0beaf5b131b5860e8bf0bb059c9f97a0736851b2/in_toto/verifylib.py#L451-L461
Expected behavior:
Expected behavior is open for discussion. My suggestions:
?,+,*artifact(s) (c.f. glob characters)