Gracefully handle failed GitHub verifier initialization caused by missing trusted root - #13624
Merged
Merged
Conversation
Signed-off-by: Meredith Lancaster <malancas@github.com>
malancas
marked this pull request as ready for review
July 10, 2026 17:48
Contributor
|
Thanks for your pull request! Unfortunately, it doesn't meet the requirements for review:
Please update your PR to address the above. This PR will be automatically closed in 4 days if these requirements are not met. Full contribution requirements
|
Contributor
There was a problem hiding this comment.
Pull request overview
This pull request updates the attestation Sigstore verification flow to avoid a nil-pointer panic when the GitHub verifier fails to initialize, returning a user-facing error instead.
Changes:
- Add a nil check for the GitHub verifier in
chooseVerifierand return a descriptive error when unavailable. - Add a unit test covering the nil-GitHub-verifier selection path.
- Add an integration test to ensure verification returns an error (and does not panic) when the GitHub verifier is unavailable.
Show a summary per file
| File | Description |
|---|---|
pkg/cmd/attestation/verification/sigstore.go |
Returns an error (instead of later panicking) when the GitHub verifier is nil. |
pkg/cmd/attestation/verification/sigstore_test.go |
Adds a unit test to assert chooseVerifier errors when GitHub verifier is nil. |
pkg/cmd/attestation/verification/sigstore_integration_test.go |
Adds an integration regression test asserting no panic and an appropriate error when GitHub verifier is unavailable. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 3/3 changed files
- Comments generated: 1
- Review effort level: Low
babakks
requested changes
Jul 10, 2026
babakks
left a comment
Member
There was a problem hiding this comment.
Looks good, just a small change. Sorry for the delayed review.
| }) | ||
| require.NoError(t, err) | ||
|
|
||
| require.NotPanics(t, func() { |
Member
There was a problem hiding this comment.
Let's not use "NotPanics". The call should normally happen and the returned error asserted against the expected message.
Signed-off-by: Meredith Lancaster <malancas@github.com>
… into handle-missing-trusted-root
babakks
approved these changes
Jul 10, 2026
pabrahamsson
pushed a commit
to pabrahamsson/containers
that referenced
this pull request
Aug 3, 2026
This PR contains the following updates: | Package | Update | Change | OpenSSF | |---|---|---|---| | [cli/cli](https://github.com/cli/cli) | minor | `2.96.0` → `2.97.0` | [](https://securityscorecards.dev/viewer/?uri=github.com/cli/cli) | --- ### Release Notes <details> <summary>cli/cli (cli/cli)</summary> ### [`v2.97.0`](https://github.com/cli/cli/releases/tag/v2.97.0): GitHub CLI 2.97.0 [Compare Source](cli/cli@v2.96.0...v2.97.0) #### Security Four security vulnerabilities have been identified, and fixed, in this release. Users are advised to update gh to version `v2.97.0` as soon as possible. Several commands (including `gh gist view`, `gh api`, `gh pr diff`, `gh release download --output -`, `gh codespace logs`, `gh skills preview`, and `gh agent-task view`/`create`) printed externally controlled content without neutralizing terminal escape sequences, allowing escape sequence injection into a user's terminal. See <GHSA-3m3g-3wcr-px46> for more information. Some request URLs were built without escaping their variable path components, so a value containing URL path metacharacters could alter the request path and cause `gh` to address a different resource than intended. See <GHSA-4fjg-2h4q-fwg3> for more information. `gh auth status` (without `--show-token`) could print a portion of the authentication token in plaintext for token types whose format contains an underscore after the prefix, such as `github_pat_*`, `ghs_*`, and `ghu_*`. See <GHSA-cg6r-mpgc-h9mm> for more information. `gh attestation verify` built the certificate matcher from `--signer-repo` and `--signer-workflow` without escaping regex metacharacters, so a lookalike repository or workflow name could satisfy a matcher intended for a trusted signer and bypass attestation verification. See <GHSA-mm27-mwq9-fr5g> for more information. #### Address project fields and items by name in `gh project` `gh project item-edit` and `gh project item-list` can now reference project fields and single-select options by name: ```shell # Set an item's field by name gh project item-edit 1 --owner monalisa --url <url> --field "Status" --value "In Progress" # Show named fields as extra columns gh project item-list 1 --owner "@me" --field "Status" --field "Priority" ``` #### What's Changed ##### ✨ Features - Add name-based resolution to `gh project item-edit` by [@​zwick](https://github.com/zwick) in [#​13807](cli/cli#13807) - Add named field columns to `gh project item-list` by [@​zwick](https://github.com/zwick) in [#​13823](cli/cli#13823) - Add Grok skill host support by [@​tommaso-moro](https://github.com/tommaso-moro) in [#​13864](cli/cli#13864) - Replace Windsurf with Devin in `gh skill` agents by [@​tommaso-moro](https://github.com/tommaso-moro) in [#​13987](cli/cli#13987) ##### 🐛 Fixes - Gracefully handle failed GitHub verifier initialization caused by a missing trusted root by [@​malancas](https://github.com/malancas) in [#​13624](cli/cli#13624) - Bump keyring operation timeout from 3s to 60s so interactive unlock prompts have time to complete by [@​kofuk](https://github.com/kofuk) in [#​13787](cli/cli#13787) - Fix skill picker label wrapping by [@​tommaso-moro](https://github.com/tommaso-moro) in [#​13967](cli/cli#13967) ##### 📚 Docs & Chores - Bump Go to 1.26.5 by [@​github-actions](https://github.com/github-actions)\[bot] in [#​13817](cli/cli#13817) - Add `OWNER/REPO` format hint to the `gh search --repo` flag by [@​BagToad](https://github.com/BagToad) in [#​13922](cli/cli#13922) - Present by-name `item-edit` as the first-class project flow in docs by [@​Solaris-star](https://github.com/Solaris-star) in [#​13927](cli/cli#13927) - Add a macOS keyring security doc by [@​williammartin](https://github.com/williammartin) in [#​13960](cli/cli#13960) - Add a code review agent skill by [@​BagToad](https://github.com/BagToad) in [#​14003](cli/cli#14003) - Establish a pull request template for scale by [@​BagToad](https://github.com/BagToad) in [#​14004](cli/cli#14004) - Add an agentic issue-triage workflow by [@​lukewar](https://github.com/lukewar) in [#​13777](cli/cli#13777) - Use the Actions token for Copilot inference in the issue-triage workflow by [@​tidy-dev](https://github.com/tidy-dev) in [#​13830](cli/cli#13830) - Refresh the issue-triage agentic workflow to gh-aw v0.83.1 by [@​alondahari](https://github.com/alondahari) in [#​13949](cli/cli#13949) - Add a dependabot-triage agentic workflow by [@​williammartin](https://github.com/williammartin) in [#​13985](cli/cli#13985) - Harden the deployment workflow by [@​niik](https://github.com/niik) in [#​13780](cli/cli#13780) - Replace `SITE_DEPLOY_PAT` with the gh-cli-site-deployer App by [@​williammartin](https://github.com/williammartin) in [#​13492](cli/cli#13492) - Group CodeQL Dependabot updates by [@​williammartin](https://github.com/williammartin) in [#​13943](cli/cli#13943) - Remove a dead CODEOWNERS rule for the non-existent `pkg/cmd/release/attestation/` by [@​kobihikri](https://github.com/kobihikri) in [#​13886](cli/cli#13886) - Fix typos in code and documentation by [@​pstoeckle](https://github.com/pstoeckle) in [#​13940](cli/cli#13940) - Fix duplicated-word typos in comments by [@​SORBELLOSTEFANIE](https://github.com/SORBELLOSTEFANIE) in [#​13900](cli/cli#13900) #####Dependencies - chore(deps): bump charm.land/lipgloss/v2 from 2.0.4 to 2.0.5 by [@​dependabot](https://github.com/dependabot) in [#​13790](cli/cli#13790) - chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0 by [@​dependabot](https://github.com/dependabot) in [#​13789](cli/cli#13789) - chore(deps): bump <https://github.com/klauspost/compress> from 1.18.6 to 1.19.0 by [@​dependabot](https://github.com/dependabot) in [#​13791](cli/cli#13791) - chore(deps): bump charm.land/bubbletea/v2 from 2.0.7 to 2.0.8 by [@​dependabot](https://github.com/dependabot) in [#​13800](cli/cli#13800) - chore(deps): bump golang.org/x/text from 0.38.0 to 0.39.0 by [@​dependabot](https://github.com/dependabot) in [#​13812](cli/cli#13812) - chore(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 by [@​dependabot](https://github.com/dependabot) in [#​13821](cli/cli#13821) - chore(deps): bump github/codeql-action/analyze from 4.36.2 to 4.36.3 by [@​dependabot](https://github.com/dependabot) in [#​13801](cli/cli#13801) - chore(deps): bump github/gh-aw-actions/setup from 0.81.6 to 0.82.2 by [@​dependabot](https://github.com/dependabot) in [#​13832](cli/cli#13832) - chore(deps): bump charm.land/bubbles/v2 from 2.1.0 to 2.1.1 by [@​dependabot](https://github.com/dependabot) in [#​13813](cli/cli#13813) - chore(deps): bump golang.org/x/sync from 0.21.0 to 0.22.0 by [@​dependabot](https://github.com/dependabot) in [#​13822](cli/cli#13822) - chore(deps): bump github/gh-aw-actions/setup from 0.82.2 to 0.82.3 by [@​dependabot](https://github.com/dependabot) in [#​13843](cli/cli#13843) - chore(deps): bump actions/cache/restore from 5.0.5 to 6.1.0 by [@​dependabot](https://github.com/dependabot) in [#​13841](cli/cli#13841) - chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 by [@​dependabot](https://github.com/dependabot) in [#​13867](cli/cli#13867) - chore(deps): bump github/codeql-action/analyze from 4.36.3 to 4.37.0 by [@​dependabot](https://github.com/dependabot) in [#​13869](cli/cli#13869) - chore(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.0 by [@​dependabot](https://github.com/dependabot) in [#​13868](cli/cli#13868) - chore(deps): bump github/codeql-action/init from 4.36.3 to 4.37.1 by [@​dependabot](https://github.com/dependabot) in [#​13870](cli/cli#13870) - chore(deps): bump <https://github.com/yuin/goldmark> from 1.8.2 to 1.8.4 by [@​dependabot](https://github.com/dependabot) in [#​13888](cli/cli#13888) - chore(deps): bump <https://github.com/sigstore/sigstore-go> from 1.2.1 to 1.2.2 by [@​dependabot](https://github.com/dependabot) in [#​13842](cli/cli#13842) - chore(deps): bump github/gh-aw-actions/setup from 0.82.3 to 0.82.8 by [@​dependabot](https://github.com/dependabot) in [#​13877](cli/cli#13877) - chore(deps): bump actions/setup-go from 6.5.0 to 7.0.0 by [@​dependabot](https://github.com/dependabot) in [#​13933](cli/cli#13933) - chore(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 by [@​dependabot](https://github.com/dependabot) in [#​13934](cli/cli#13934) - chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 by [@​dependabot](https://github.com/dependabot) in [#​13936](cli/cli#13936) - chore(deps): bump actions/attest from 4.1.1 to 4.2.0 by [@​dependabot](https://github.com/dependabot) in [#​13935](cli/cli#13935) - chore(deps): bump <https://github.com/mattn/go-isatty> from 0.0.22 to 0.0.23 by [@​dependabot](https://github.com/dependabot) in [#​13937](cli/cli#13937) - chore(deps): bump github/gh-aw-actions/setup from 0.82.8 to 0.82.13 by [@​dependabot](https://github.com/dependabot) in [#​13938](cli/cli#13938) - chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 by [@​dependabot](https://github.com/dependabot) in [#​13941](cli/cli#13941) - chore(deps): bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.1 by [@​dependabot](https://github.com/dependabot) in [#​13942](cli/cli#13942) - chore(deps): bump <https://github.com/gabriel-vasile/mimetype> from 1.4.13 to 1.4.14 by [@​dependabot](https://github.com/dependabot) in [#​13944](cli/cli#13944) - chore(deps): bump nodeselector/setup-apple-codesign from [`ab275d0`](cli/cli@ab275d0) to [`309922b`](cli/cli@309922b) by [@​dependabot](https://github.com/dependabot) in [#​13878](cli/cli#13878) - chore(deps): bump <https://github.com/klauspost/compress> from 1.19.0 to 1.19.1 by [@​dependabot](https://github.com/dependabot) in [#​13950](cli/cli#13950) - chore(deps): bump github/gh-aw-actions/setup from 0.82.13 to 0.82.14 by [@​dependabot](https://github.com/dependabot) in [#​13951](cli/cli#13951) - chore(deps): bump the codeql-actions group with 3 updates by [@​dependabot](https://github.com/dependabot) in [#​13965](cli/cli#13965) - chore(deps): bump <https://github.com/mattn/go-isatty> from 0.0.23 to 0.0.24 by [@​dependabot](https://github.com/dependabot) in [#​13977](cli/cli#13977) - chore(deps): bump the codeql-actions group with 3 updates by [@​dependabot](https://github.com/dependabot) in [#​13978](cli/cli#13978) - chore(deps): bump <https://github.com/gabriel-vasile/mimetype> from 1.4.14 to 1.4.15 by [@​dependabot](https://github.com/dependabot) in [#​13976](cli/cli#13976) - chore(deps): bump github/gh-aw-actions/setup from 0.83.1 to 0.83.2 by [@​dependabot](https://github.com/dependabot) in [#​13979](cli/cli#13979) - chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.1 to 0.83.2 by [@​dependabot](https://github.com/dependabot) in [#​13980](cli/cli#13980) - chore(deps): bump actions/checkout from 6 to 7 by [@​dependabot](https://github.com/dependabot) in [#​13981](cli/cli#13981) - chore(deps): bump github/gh-aw-actions/setup from 0.83.2 to 0.83.3 by [@​dependabot](https://github.com/dependabot) in [#​13995](cli/cli#13995) - chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.2 to 0.83.3 by [@​dependabot](https://github.com/dependabot) in [#​13996](cli/cli#13996) - chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.3 to 0.83.4 by [@​dependabot](https://github.com/dependabot) in [#​14018](cli/cli#14018) #### New Contributors - [@​lukewar](https://github.com/lukewar) made their first contribution in [#​13777](cli/cli#13777) - [@​niik](https://github.com/niik) made their first contribution in [#​13780](cli/cli#13780) - [@​kofuk](https://github.com/kofuk) made their first contribution in [#​13787](cli/cli#13787) - [@​zwick](https://github.com/zwick) made their first contribution in [#​13807](cli/cli#13807) - [@​kobihikri](https://github.com/kobihikri) made their first contribution in [#​13886](cli/cli#13886) - [@​pstoeckle](https://github.com/pstoeckle) made their first contribution in [#​13940](cli/cli#13940) - [@​Solaris-star](https://github.com/Solaris-star) made their first contribution in [#​13927](cli/cli#13927) - [@​SORBELLOSTEFANIE](https://github.com/SORBELLOSTEFANIE) made their first contribution in [#​13900](cli/cli#13900) - [@​alondahari](https://github.com/alondahari) made their first contribution in [#​13949](cli/cli#13949) **Full Changelog**: <cli/cli@v2.96.0...v2.97.0> </details> --- ### Configuration 📅 **Schedule**: (in timezone America/New_York) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC41LjMiLCJ1cGRhdGVkSW5WZXIiOiI0NC41LjMiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=--> Reviewed-on: https://codeberg.org/pabrahamsson/containers/pulls/28
1 task
tmeijn
pushed a commit
to tmeijn/dotfiles
that referenced
this pull request
Aug 11, 2026
This MR contains the following updates: | Package | Update | Change | |---|---|---| | [cli/cli](https://github.com/cli/cli) | minor | `v2.96.0` → `v2.97.0` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>cli/cli (cli/cli)</summary> ### [`v2.97.0`](https://github.com/cli/cli/releases/tag/v2.97.0): GitHub CLI 2.97.0 [Compare Source](cli/cli@v2.96.0...v2.97.0) #### Security Four security vulnerabilities have been identified, and fixed, in this release. Users are advised to update gh to version `v2.97.0` as soon as possible. Several commands (including `gh gist view`, `gh api`, `gh pr diff`, `gh release download --output -`, `gh codespace logs`, `gh skills preview`, and `gh agent-task view`/`create`) printed externally controlled content without neutralizing terminal escape sequences, allowing escape sequence injection into a user's terminal. See <GHSA-3m3g-3wcr-px46> for more information. Some request URLs were built without escaping their variable path components, so a value containing URL path metacharacters could alter the request path and cause `gh` to address a different resource than intended. See <GHSA-4fjg-2h4q-fwg3> for more information. `gh auth status` (without `--show-token`) could print a portion of the authentication token in plaintext for token types whose format contains an underscore after the prefix, such as `github_pat_*`, `ghs_*`, and `ghu_*`. See <GHSA-cg6r-mpgc-h9mm> for more information. `gh attestation verify` built the certificate matcher from `--signer-repo` and `--signer-workflow` without escaping regex metacharacters, so a lookalike repository or workflow name could satisfy a matcher intended for a trusted signer and bypass attestation verification. See <GHSA-mm27-mwq9-fr5g> for more information. #### Address project fields and items by name in `gh project` `gh project item-edit` and `gh project item-list` can now reference project fields and single-select options by name: ```shell # Set an item's field by name gh project item-edit 1 --owner monalisa --url <url> --field "Status" --value "In Progress" # Show named fields as extra columns gh project item-list 1 --owner "@​me" --field "Status" --field "Priority" ``` #### What's Changed ##### ✨ Features - Add name-based resolution to `gh project item-edit` by [@​zwick](https://github.com/zwick) in [#​13807](cli/cli#13807) - Add named field columns to `gh project item-list` by [@​zwick](https://github.com/zwick) in [#​13823](cli/cli#13823) - Add Grok skill host support by [@​tommaso-moro](https://github.com/tommaso-moro) in [#​13864](cli/cli#13864) - Replace Windsurf with Devin in `gh skill` agents by [@​tommaso-moro](https://github.com/tommaso-moro) in [#​13987](cli/cli#13987) ##### 🐛 Fixes - Gracefully handle failed GitHub verifier initialization caused by a missing trusted root by [@​malancas](https://github.com/malancas) in [#​13624](cli/cli#13624) - Bump keyring operation timeout from 3s to 60s so interactive unlock prompts have time to complete by [@​kofuk](https://github.com/kofuk) in [#​13787](cli/cli#13787) - Fix skill picker label wrapping by [@​tommaso-moro](https://github.com/tommaso-moro) in [#​13967](cli/cli#13967) ##### 📚 Docs & Chores - Bump Go to 1.26.5 by [@​github-actions](https://github.com/github-actions)\[bot] in [#​13817](cli/cli#13817) - Add `OWNER/REPO` format hint to the `gh search --repo` flag by [@​BagToad](https://github.com/BagToad) in [#​13922](cli/cli#13922) - Present by-name `item-edit` as the first-class project flow in docs by [@​Solaris-star](https://github.com/Solaris-star) in [#​13927](cli/cli#13927) - Add a macOS keyring security doc by [@​williammartin](https://github.com/williammartin) in [#​13960](cli/cli#13960) - Add a code review agent skill by [@​BagToad](https://github.com/BagToad) in [#​14003](cli/cli#14003) - Establish a pull request template for scale by [@​BagToad](https://github.com/BagToad) in [#​14004](cli/cli#14004) - Add an agentic issue-triage workflow by [@​lukewar](https://github.com/lukewar) in [#​13777](cli/cli#13777) - Use the Actions token for Copilot inference in the issue-triage workflow by [@​tidy-dev](https://github.com/tidy-dev) in [#​13830](cli/cli#13830) - Refresh the issue-triage agentic workflow to gh-aw v0.83.1 by [@​alondahari](https://github.com/alondahari) in [#​13949](cli/cli#13949) - Add a dependabot-triage agentic workflow by [@​williammartin](https://github.com/williammartin) in [#​13985](cli/cli#13985) - Harden the deployment workflow by [@​niik](https://github.com/niik) in [#​13780](cli/cli#13780) - Replace `SITE_DEPLOY_PAT` with the gh-cli-site-deployer App by [@​williammartin](https://github.com/williammartin) in [#​13492](cli/cli#13492) - Group CodeQL Dependabot updates by [@​williammartin](https://github.com/williammartin) in [#​13943](cli/cli#13943) - Remove a dead CODEOWNERS rule for the non-existent `pkg/cmd/release/attestation/` by [@​kobihikri](https://github.com/kobihikri) in [#​13886](cli/cli#13886) - Fix typos in code and documentation by [@​pstoeckle](https://github.com/pstoeckle) in [#​13940](cli/cli#13940) - Fix duplicated-word typos in comments by [@​SORBELLOSTEFANIE](https://github.com/SORBELLOSTEFANIE) in [#​13900](cli/cli#13900) #####
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Gracefully handle the failure to initialize the GitHub verifier when the trusted root is missing.