Skip to content

Handle missing VSA when generating tag provenance #403

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
puerco merged 1 commit into from
Jun 5, 2026
Merged

Handle missing VSA when generating tag provenance #403

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions pkg/attest/provenance.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -347,6 +347,10 @@ func (a *Attester) CreateTagProvenance(ctx context.Context, branch *models.Branc

if vsaAtt == nil {
// TODO: If there's not a VSA, should we still issue provenance?
// No VSA for the tagged commit: return a nil statement so the caller can
// report it. This usually means the commit's source provenance was never
// generated (or could not be read) before the tag was created.
Debugf("no VSA found for tagged commit %s, cannot build tag provenance", tag.Commit.SHA)
return nil, nil
}

Expand Down
10 changes: 10 additions & 0 deletions pkg/sourcetool/tool.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -451,6 +451,16 @@ func (t *Tool) AttestRevision(
return nil, err
}

// Tag provenance is built from the VSA of the tagged commit. If that
// commit has no VSA, CreateTagProvenance returns a nil statement and here
// we fail with a clear message instead of a downstream "nil statement" error.
if prov == nil {
return nil, fmt.Errorf(
"no VSA found for tagged commit %s; ensure its source provenance was generated before tagging",
rev.GetCommit().SHA,
)
}

// 2. Run the provenance against the policy to determine the verified levels.
pe := policy.NewPolicyEvaluator()
pe.UseLocalPolicy = opts.LocalPolicy
Expand Down
Loading