Misleading error message when trying to deploy an app with an unsigned image in a project that has ImageAllowRules.

[sangee2004]

acorn version v0.6.0-93-gd9de8c30+d9de8c30

Steps to reproduce the problem:
Create ImageAllowRules:

kind: ImageAllowRules
metadata:
  name: testrules-project
  namespace: testp1
signatures:
  rules:
    - signedBy:
        anyOf:
          - |
            -----BEGIN PUBLIC KEY-----
            MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEn3TS2G8lKMA2B6CT9mWZ3H6Z4k/h
            5RvYIFIPNvExwsV40B9xi3v2jBF2ODSINhPxHJOAs+eHZW3AitIwthqOsQ==
            -----END PUBLIC KEY-----
        allOf: []
      annotations:
        match:
          tag: ok

Deploy an app with image that is not signed.
We are not allowed to deploy app as expected with following error message:

acorn run -n mytes3 docker.io/sangeetha/<image>:latest
  ✗  ERROR:  App.api.acorn.io "mytes3" is invalid: spec.image: Invalid value: "docker.io/sangeetha/<image>:latest": disallowed by imageAllowRules: error verifying image docker.io/sangeetha/mydeletecheck:latest against testp1/testrules-project.signatures.anyOf.*: error verifying image docker.io/sangeetha/mydeletecheck:latest against testp1/testrules-project.signatures.anyOf.0: no matching signatures: expected signature artifact index.docker.io/sangeetha/mydeletecheck:sha256-47a8d83df3aef36b48a15415549e6487ddb94075c77e0d7f33894685e8bcce4e.sig not found

Error message repeats the errors about signature twice , there is no information about missing tag "ok" and having the expected signature artifact info is confusing.

[iwilltry42]

That error message actually says, that there is not signature artifact at all for the target image:

expected signature artifact index.docker.io/sangeetha/mydeletecheck:sha256-47a8d83df3aef36b48a15415549e6487ddb94075c77e0d7f33894685e8bcce4e.sig not found

Since there's no signature artifact, there's nothing to unpack and check for annotations, so it doesn't even get to check the annotations.

[iwilltry42]

@sangee2004 is this still valid after the recent large changes to IARs?

[sangee2004]

Blocked on - #1970

[sangee2004]

Tested with acorn version v0.8.0-rc4+b6a95e8a

Error message presented to user when trying to deploy an app that he chooses not to allow is as expected.

acorn run -n hello3 sangeeth/myfirstacorn:v0.0.1
  ✗  ERROR:  GET https://index.docker.io/v2/sangeeth/myfirstacorn/manifests/v0.0.1: UNAUTHORIZED: authentication required; [map[Action:pull Class: Name:sangeeth/myfirstacorn Type:repository]]
sangeethahariharan@Sangeethas-MacBook-Pro example1 % acorn run -n hello3 sangeetha/myfirstacorn:v0.0.1
  •  WARNING:  This application would like to use the image 'sangeetha/myfirstacorn:v0.0.1'.
                 This image is not trusted by any image allow rules in this project.
                 This could be VERY DANGEROUS to the cluster if you do not trust this
                 application. If you are unsure say no.

? Do you want to allow this app to use this (POTENTIALLY DANGEROUS) image? NO
  ✗  ERROR:  image <sangeetha/myfirstacorn:v0.0.1> is not allowed by any ImageAllowRule in this project