Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Dependency verification report should be more explicit when key download failed #12919

Open
eskatos opened this issue Apr 27, 2020 · 0 comments
Labels
a:bug in:dependency-verification trustkey truststore checksum signature

Comments

@eskatos
Copy link
Member

eskatos commented Apr 27, 2020

This issue is about enhancing the dependency verification report to better explain failures to download a verification key.

Expected Behavior

When dependency verification fails because a key couldn't be downloaded from a server, the report should say something like:

Key xyz (not found or failed to download) couldn't be downloaded from any key server

Current Behavior

When dependency verification fails because a key couldn't be downloaded from a server, the report currently says:

Key xyz (not found) couldn't be found in any key server

even though they key is present in the key server but the underlying problem is that the key server didn't respond. This is confusing.

Context

Happened on CI

Steps to Reproduce

Not that easy with a valid key identifier because key servers sporadically fail to respond.
Using a non existent key server URL should do.

@octylFractal octylFractal added in:dependency-verification trustkey truststore checksum signature and removed in:dependency-management DO NOT USE labels Nov 8, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
a:bug in:dependency-verification trustkey truststore checksum signature
Projects
None yet
Development

No branches or pull requests

3 participants