fix: create a valid unsigned signature placeholder #1763
Conversation
Reader into_builder now perserves reader context into the generated builder. There is no longer a need to disable verify_after_reading before calling from_archive.
This changes sign_claim_placeholder() to create properly formatted but unsigned COSE_Sign1 structures instead of raw placeholder bytes. This eliminates CBOR parsing errors when loading archives. Key changes: - sign_claim_placeholder() now returns Result<Vec<u8>> - Creates valid COSE_Sign1 with proper headers and detached payload - Iteratively calculates signature field size to match target total size - Ensures placeholder and real signature are exactly the same size - Updated 8 call sites to handle Result return type Benefits: - No CBOR parsing errors - placeholders are valid CBOR/COSE - Maintains patching mechanism - placeholder bytes still searchable - Architecturally correct - represents actual unsigned manifest - All 500+ tests pass including archive tests
Codecov Report❌ Patch coverage is
Additional details and impacted files☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Merging this PR will degrade performance by 10.19%
Performance Changes
Comparing 
Footnotes
|
|
This is an interesting question. It comes back to how stringent checks should be for "work in progress" data, no? The default certificate may be a thing, but what happens if it gets revoked? Then you get invalid errors again, that's expected. But what would it mean for your work in progress (the archives)? Could you still use them? Would you still want to use them, or does it mean they should get thrown away? Deciding that may help answering the overall root question here. Thoughts @gpeacock ? |
Our current placeholders for unsigned signatures are not valid cbor and thus will generate parsing errors if you try to validate them. That wasn't a problem when the placeholder was just a temporary placeholder, but since we want to have unsigned archives, it would be nice if we could validate one of these and generate a signature error rather than a cbor parse error.
I'm not sure this is the answer. The better answer may be to always sign with some kind of temporary cert. But then we need a cert in the codebase or default settings.