nebius/SWE-rebench-V2-PRs huggingface dataset:
Repository: sse-secure-systems/connaisseur
Pull request #1624 (2024-05-24 09:37:22)

fix: error handling for DER formated keys
When using a nv1 validator and provide DER formated keys, Connaisseur panics as it tries to load a nil key. This has been fix with a fitting error message.

fixes #1594

## Checklist
<!--- Mark as done if a point is not necessary. Feel free to reach out if help on any items in the checklist is needed. -->

- [x] PR is rebased to/aimed at branch `develop`
- [x] PR follows [Contributing Guide](https://github.com/sse-secure-systems/connaisseur/blob/master/docs/CONTRIBUTING.md)
- [x] Added tests (if necessary)
- [x] Extended README/Documentation (if necessary)
- [x] Adjusted versions of image and Helm chart in `Chart.yaml` (if necessary)



Patch:
diff --git a/internal/validator/notaryv1/notaryv1_validator.go b/internal/validator/notaryv1/notaryv1_validator.go
index cda636ff..f53435f8 100644
--- a/internal/validator/notaryv1/notaryv1_validator.go
+++ b/internal/validator/notaryv1/notaryv1_validator.go
@@ -215,6 +215,9 @@ func (nv1v *NotaryV1Validator) trustRootKeys(keyRef string) ([]data.PublicKey, e
 
 	for _, tr := range trs {
 		pubDecode, rest := pem.Decode([]byte(tr.Key))
+		if pubDecode == nil {
+			return nil, fmt.Errorf("error decoding public key %s: wrong format, provide a PEM encoded public key", tr.Name)
+		}
 		pub, err := x509.ParsePKIXPublicKey(pubDecode.Bytes)
 		if err != nil {
 			return nil, fmt.Errorf("error parsing public key %s: %s", tr.Name, err)


Test patch:
diff --git a/internal/validator/notaryv1/notaryv1_validator_test.go b/internal/validator/notaryv1/notaryv1_validator_test.go
index acd18112..e3ceb1af 100644
--- a/internal/validator/notaryv1/notaryv1_validator_test.go
+++ b/internal/validator/notaryv1/notaryv1_validator_test.go
@@ -277,6 +277,14 @@ func TestValidateImage(t *testing.T) {
 			"",
 			"doesn't match given digest",
 		},
+		{ // 16: Root key in DER format
+			"15_DER_key_format",
+			"never-expire-image:sign",
+			"default",
+			[]string{},
+			"sha256:a154797b8300165956ee1f16d98f3a1426301c1168f0462c73ce9bc03361cabf",
+			"wrong format, provide a PEM encoded public key",
+		},
 	}
 
 	for idx, tc := range testCases {
diff --git a/test/testdata/notaryv1/15_DER_key_format.yaml b/test/testdata/notaryv1/15_DER_key_format.yaml
new file mode 100644
index 00000000..e249243c
--- /dev/null
+++ b/test/testdata/notaryv1/15_DER_key_format.yaml
@@ -0,0 +1,8 @@
+name: default
+type: notaryv1
+host: notary.docker.io
+trustRoots:
+  - name: default
+    key: |
+      MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEUaqgujac1VCdaGHKQMKoDn6/deWJ
+      8cCzsnDqGDgjPBayhJCQiI/qN+iBWEUPM7BkrCyDS878h+qd/MdZS22XwA==
Repository: prql/prql
Pull request #483 (2022-05-14 18:42:43)

Remove one more parse_tree test


Patch:
diff --git a/prql-compiler/src/parser.rs b/prql-compiler/src/parser.rs
index ae528bd9..6ebd5976 100644
--- a/prql-compiler/src/parser.rs
+++ b/prql-compiler/src/parser.rs
@@ -631,7 +631,15 @@ Canada
         Literal:
           Float: 23.6
         "###);
-        assert_yaml_snapshot!(ast_of_string(r#"2 + 2"#, Rule::expr)?);
+        assert_yaml_snapshot!(ast_of_string(r#"2 + 2"#, Rule::expr)?, @r###"
+        ---
+        Expr:
+          - Literal:
+              Integer: 2
+          - Operator: +
+          - Literal:
+              Integer: 2
+        "###);
         Ok(())
     }
 


Test patch:
diff --git a/prql-compiler/src/snapshots/prql_compiler__parser__test__parse_number-3.snap b/prql-compiler/src/snapshots/prql_compiler__parser__test__parse_number-3.snap
deleted file mode 100644
index 14cff45e..00000000
--- a/prql-compiler/src/snapshots/prql_compiler__parser__test__parse_number-3.snap
+++ /dev/null
@@ -1,11 +0,0 @@
----
-source: prql-compiler/src/parser.rs
-expression: "ast_of_string(r#\"2 + 2\"#, Rule::expr)?"
----
-Expr:
-  - Literal:
-      Integer: 2
-  - Operator: +
-  - Literal:
-      Integer: 2
-