From 5a4ddb17c94ac7117844fe3a7dc320fce2ce2719 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Alexis=20M=C3=A9taireau?= Date: Wed, 12 Feb 2025 11:40:36 +0100 Subject: [PATCH] fixup! Download and verify cosign signatures --- dangerzone/updater/signatures.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/dangerzone/updater/signatures.py b/dangerzone/updater/signatures.py index 2385e9a..57b3d1d 100644 --- a/dangerzone/updater/signatures.py +++ b/dangerzone/updater/signatures.py @@ -255,6 +255,9 @@ def convert_oci_images_signatures( layers = signatures_manifest.get("layers", []) signatures = [_to_cosign_signature(layer) for layer in layers] + if not signatures: + raise errors.SignatureExtractionError() + payload_location = _get_blob(tmpdir, layers[0]["digest"]) with open(payload_location, "r") as f: payload = json.load(f)