Error message when using invalid trust policy is not user friendly

[jeremyrickard]

What is the areas you experience the issue in?

Notation CLI

What is not working as expected?

I created a trust policy like:

{
    "version": "1.0",
    "trustPolicies": [
        {
            "name": "upstream",
            "registryScopes": [ "*" ],
            "signatureVerification": {
                "level" : "strict"
            },
            "trustStores": [ "blah" ],
            "trustedIdentities": [
                "*"
            ]
        }
    ]
}

After attempting to verify an image with this policy, I encountered the following error:

$ notation verify <image>
panic: runtime error: slice bounds out of range [:-1]

goroutine 1 [running]:
github.com/notaryproject/notation-go/verification.validateTrustStore({{0xc0003953a8, 0x8}, {0xc000032a00, 0x1, 0x4}, {{0xc0003953c0, 0x6}, 0x0}, {0xc000032a80, 0x1, ...}, ...})
        /home/runner/go/pkg/mod/github.com/notaryproject/[email protected]/verification/policy.go:135 +0x1d2
github.com/notaryproject/notation-go/verification.(*PolicyDocument).ValidatePolicyDocument(0xc0005b3050)
        /home/runner/go/pkg/mod/github.com/notaryproject/[email protected]/verification/policy.go:185 +0x418
github.com/notaryproject/notation-go/verification.NewVerifier({0x92cdc0?, 0xc0005b4180})
        /home/runner/go/pkg/mod/github.com/notaryproject/[email protected]/verification/verifier.go:34 +0x53
main.getVerifier(0xc0002e4900?, {{0x7ffdc0036943, 0x13}, {0x7ffdc0036957, 0xf}, {0xc0003801e1, 0x47}})
        /home/runner/work/notation/notation/cmd/notation/verify.go:82 +0x13a
main.runVerify(0xc0002e4900, 0xc00007a1e0)
        /home/runner/work/notation/notation/cmd/notation/verify.go:55 +0xcf
main.verifyCommand.func2(0xc0002e4900?, {0xc0003bc9e0?, 0x1?, 0x1?})
        /home/runner/work/notation/notation/cmd/notation/verify.go:39 +0x1d
github.com/spf13/cobra.(*Command).execute(0xc0002e4900, {0xc0003bc9b0, 0x1, 0x1})
        /home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:916 +0x862
github.com/spf13/cobra.(*Command).ExecuteC(0xc0002e4300)
        /home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:1044 +0x3bd
github.com/spf13/cobra.(*Command).Execute(...)
        /home/runner/go/pkg/mod/github.com/spf13/[email protected]/command.go:968
main.main()
        /home/runner/work/notation/notation/cmd/notation/main.go:27 +0x176

The error was caused by not having the trust store in the form "ca:blah". This error message is extremely unfriendly and the notation client should do more validation of the trust policy to provide a better user experience. I figured out my issue by reading the notation-go code, which should not be required.

What did you expect to happen?

An informative error message would be provided.

How can we reproduce it?

Create a trust policy like the example above

Describe your environment

WSL + Windows 11

What is the version of your Notation CLI or Notation Library?

notation version
Notation: Notary v2, A tool to sign, store, and verify artifacts.

Version: 0.12.0-beta.1
Go version: go1.19.2
Git commit: 965a0b7

[yizha1]

@jeremyrickard Thanks for reporting the issue. we did some improvements on output messages in upcoming rc.1 release. Besides that, new options --debug and --verbose will be added in rc.1 for notation sign and notation verify command, so that user can view more logs for information and troubleshooting.

[patrickzheng200]

This issue is resolved in the RC-1 version. And the error message will be improved in RC-2 by this PR in notation-go.

[patrickzheng200]

Closing this issue as it's resolved.