Language: Go
Label: vulnerable
CWE: CWE-617 \u2014 Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Code:
func (v V002Entry) Verifier() (pki.PublicKey, error) {
	if v.IntotoObj.Content == nil || v.IntotoObj.Content.Envelope == nil {
		return nil, errors.New("intoto v0.0.2 entry not initialized")
	}

	sigs := v.IntotoObj.Content.Envelope.Signatures
	if len(sigs) == 0 {
		return nil, errors.New("no signatures found on intoto entry")
	}

	return x509.NewPublicKey(bytes.NewReader(v.IntotoObj.Content.Envelope.Signatures[0].PublicKey))
}