fix(models): remove dead try/except in ClientTrustConfig.from_tuf - #1715
Open
xovishnukosuri wants to merge 2 commits into
Open
xovishnukosuri wants to merge 2 commits into
xovishnukosuri wants to merge 2 commits into
Conversation
…entities Fulcio ignores the CSR subject field entirely and derives the certificate identity from the OIDC token directly. Embedding the actual identity claim in the CSR's EMAIL_ADDRESS attribute causes failures when the claim contains non-ASCII characters (e.g. emojis in GitHub Actions environment names), since the field is encoded as IA5String which only allows ASCII. Replace the identity value with a fixed stub "user@example.com" so that CSR construction succeeds regardless of the claim content. Fixes sigstore#1507 Signed-off-by: Vishnu Kosuri <xovishnukosuri@gmail.com>
The try/except block around get_signing_config_path() caught TUFError only to re-raise it with `raise e`, which resets the traceback to the re-raise site and hides the actual failure location. Since nothing else is done in the handler, the block serves no purpose. Remove it and drop the now-unused TUFError import. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
ClientTrustConfig.from_tufwraps theget_signing_config_pathcall in a try/except that catchesTUFErrorand immediately re-raises it withraise e:Why this is a bug
raise eresets the exception's__traceback__to the re-raise site, so the traceback shown to the user points at line 972 inmodels.pyinstead of the actual failure location insideget_signing_config_path()orfrom_json(). This makes TUF errors harder to diagnose.Since the handler does nothing beyond re-raising, the entire try/except block is dead code. The exception propagates identically without it, and bare propagation preserves the original traceback.
Change
Remove the try/except block and drop the now-unused
TUFErrorimport.All 174 unit tests pass.