feat: add a method for parsing the descriptor from a payload#261
feat: add a method for parsing the descriptor from a payload#261byronchien wants to merge 2 commits intonotaryproject:mainfrom
Conversation
patrickzheng200
left a comment
patrickzheng200
left a comment
There was a problem hiding this comment.
Just an open discussion, where are we using this new method? Looks like it's a helper function but not used in notation.go.
Signed-off-by: Byron Chien <chienb@amazon.com>
byronchien
force-pushed
the
parse-descriptor
branch
from
72707ab to
e8ad1c5
Compare
using this function in inspect (PR here). Added the helper in notation-go rather than notation since it relies on a type not exported from notation-go (envelope.Payload). |
Signed-off-by: Byron Chien <chienb@amazon.com>
I see. IMO, |
makes sense, will add the struct and helper to notation instead |
|
|
||
| // GetDescriptorFromPayload parses a signature payload and returns the descriptor | ||
| // that was signed. | ||
| func GetDescriptorFromPayload(payload *signature.Payload) (*ocispec.Descriptor, error) { |
There was a problem hiding this comment.
According to effective go, Get prefix should be dropped.
| func GetDescriptorFromPayload(payload *signature.Payload) (*ocispec.Descriptor, error) { | |
| func DescriptorFromPayload(payload *signature.Payload) (*ocispec.Descriptor, error) { |
| // GetDescriptorFromPayload parses a signature payload and returns the descriptor | ||
| // that was signed. |
There was a problem hiding this comment.
Note: the descriptor was signed but may not be trusted.
|
|
||
| // GetDescriptorFromPayload parses a signature payload and returns the descriptor | ||
| // that was signed. | ||
| func GetDescriptorFromPayload(payload *signature.Payload) (*ocispec.Descriptor, error) { |
There was a problem hiding this comment.
The word Payload in DescriptorFromPayload is too broad. Consider DescriptorFromSignaturePayload.
|
|
||
| var parsedPayload envelope.Payload | ||
|
|
||
| err := json.Unmarshal(payload.Content, &parsedPayload) |
There was a problem hiding this comment.
Security concern: payload media type is not checked before parsing.
There was a problem hiding this comment.
can parse the payload to an intermediate struct to check mediatype before parsing to the final payload struct.
shizhMSFT
changed the title
|
added DescriptorFromSignaturePayload to notation in #528 |
4 participants
Adds a helper to get the descriptor from the payload. Needed here instead of in notation-core-go since the payload needs to be parsed to envelope.Payload (in notation-go internal)
suggested order for review: notation-go #261 (this one) => notation-core-go #111 => notation #527 =>notation #528
Signed-off-by: Byron Chien chienb@amazon.com