Repository navigation
fix(cli): fail attestation verify when the bundle was never verified - #3398
Merged
jiparis merged 1 commit intoSep 4, 2026
Merged
Conversation
`chainloop attestation verify` exited 0 while warning that the attestation couldn't be verified, so CI steps gating on the exit code accepted bundles that carry no verification material, or that were checked against a control plane with no trusted root configured. The verify command now returns an error in both cases, and the strict and best-effort verification paths are separated so `workflow run describe` keeps reporting an unverifiable attestation as simply not verified. Fixes chainloop-dev#3397 Assisted-by: Claude Code Signed-off-by: Jose I. Paris <jiparis@chainloop.dev> Chainloop-Trace-Sessions: 79994894-21cb-4afa-91e5-682eb64c2817
Contributor
AI Session Checks — 🟢 90% · ✅ 0 failing
|
| Status | Attribution | File | Lines |
|---|---|---|---|
| created | ai | app/cli/pkg/action/attestation_verify_test.go |
+143 / -0 |
| modified | ai | app/cli/pkg/action/attestation_verify.go |
+44 / -20 |
| created | ai | app/cli/pkg/action/testdata/bundle_invalid.json |
+17 / -0 |
| created | ai | app/cli/pkg/action/testdata/bundle_valid.json |
+17 / -0 |
| modified | ai | app/cli/cmd/attestation_verify.go |
+4 / -8 |
| created | ai | app/cli/pkg/action/testdata/bundle_valid_nomaterial.json |
+12 / -0 |
Policies (4)
| Status | Policy | Material | Messages |
|---|---|---|---|
| ✅ Passed | ai-config-ai-agents-allowed |
ai-coding-session-799948 |
- |
| ✅ Passed | ai-config-no-dangerous-commands |
ai-coding-session-799948 |
- |
| ✅ Passed | ai-config-no-secrets |
ai-coding-session-799948 |
- |
| ✅ Passed | ai-config-mcp-servers-allowed |
ai-coding-session-799948 |
- |
Security Checks — ✅ 8 passing
✅ secret-scan
| Status | Policy | Messages |
|---|---|---|
| ✅ Passed | secrets-detection |
- |
✅ sast-scan
| Status | Policy | Messages |
|---|---|---|
| ✅ Passed | owasp-top10-2025 |
- |
| ✅ Passed | sast |
- |
| ✅ Passed | cwe-top25 |
- |
| ✅ Passed | cwe-top26-40-cusp |
- |
✅ iac-scan
| Status | Policy | Messages |
|---|---|---|
| ✅ Passed | iac-misconfiguration |
- |
PR info
| Status | Policy | Messages |
|---|---|---|
| ✅ Passed | pr-description-required |
- |
| ✅ Passed | pr-user-story-linked |
- |
⏭️ 2 scans not applied
| Scan | Reason |
|---|---|
vulnerability-scan |
no manifest/lockfile changed |
github-actions-scan |
no workflow files changed |
Powered by Chainloop and Chainloop Trace
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
All reported issues were addressed across 6 files
Heads up: you’re close to your included review allowance. Set a flex budget so reviews don’t pause.
Re-trigger cubic
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #3397
chainloop attestation verifyexited with code 0 while warning that the attestation couldn't be verified, so CI steps that gate on the exit code accepted bundles that were never verified. This happened when the bundle carries no verification material, and when the control plane has no trusted root configured.The verify command now fails in both cases, with an error that distinguishes an attestation that was never verified from one that failed verification.
The strict and best-effort verification paths are separated, so
workflow run describekeeps its current behaviour: an attestation that cannot be verified is reported as not verified without failing the command, and can still fall back to key-based envelope verification.AI disclosure: this change was produced with the assistance of Claude Code.