Fix a sync filtered cosign without sigstore issue

fixes: #1759
pulp · Sep 2, 2024 · 6afb2f7 · 6afb2f7
1 parent 0406fa2
commit 6afb2f7
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/CHANGES/1759.bugfix b/CHANGES/1759.bugfix
@@ -0,0 +1,2 @@
+Fixed an issue where trying to sync a filtered content with cosign signature, from a remote
+without sigstore, and defined as `signed_only: true` could fail sometimes.
diff --git a/pulp_container/app/tasks/sync_stages.py b/pulp_container/app/tasks/sync_stages.py
@@ -147,13 +147,14 @@ async def run(self):
                 content_data, raw_text_data, response = await artifact
 
                 digest = calculate_digest(raw_text_data)
+                tag_name = response.url.split("/")[-1]
 
                 # Look for cosign signatures
                 # cosign signature has a tag convention 'sha256-1234.sig'
                 if self.signed_only and not signature_source:
                     if (
                         not (tag_name.endswith(".sig") and tag_name.startswith("sha256-"))
-                        and f"sha256-{digest}.sig" not in tag_list
+                        and f"sha256-{digest.removeprefix('sha256:')}.sig" not in tag_list
                     ):
                         # skip this tag, there is no corresponding signature
                         log.info(
@@ -168,7 +169,6 @@ async def run(self):
                 media_type = determine_media_type(content_data, response)
                 validate_manifest(content_data, media_type, digest)
 
-                tag_name = response.url.split("/")[-1]
                 tag_dc = DeclarativeContent(Tag(name=tag_name))
 
                 if media_type in (MEDIA_TYPE.MANIFEST_LIST, MEDIA_TYPE.INDEX_OCI):
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		Fixed an issue where trying to sync a filtered content with cosign signature, from a remote
		without sigstore, and defined as `signed_only: true` could fail sometimes.