{"record":{"id":"516625c4159c34c5","repo":"aaif-goose/goose","slug":"e","errorCode":null,"errorMessage":"{e}","messagePattern":"\\{e\\}","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"crates/goose-cli/src/commands/update.rs","lineNumber":171,"sourceCode":"    }\n\n    req.send().await.context(\"Failed to fetch attestations\")\n}\n\n// Verify a single attestation bundle against the artifact digest and workflow.\nfn verify_bundle(\n    bundle_json: &serde_json::Value,\n    artifact_digest: Sha256Hash,\n    policy: &VerificationPolicy,\n    trusted_root: &TrustedRoot,\n    workflow: &str,\n) -> Result<()> {\n    let bundle_str = serde_json::to_string(bundle_json)?;\n    let bundle = Bundle::from_json(&bundle_str)\n        .map_err(|e| anyhow::anyhow!(\"Failed to parse bundle: {e}\"))?;\n\n    let result = sigstore_verify::verify(artifact_digest, &bundle, policy, trusted_root)\n        .map_err(|e| anyhow::anyhow!(\"{e}\"))?;\n\n    let identity = result\n        .identity\n        .as_deref()\n        .ok_or_else(|| anyhow::anyhow!(\"No identity in certificate\"))?;\n\n    let expected = format!(\"/.github/workflows/{workflow}\");\n    if !identity.contains(&expected) {\n        bail!(\"Workflow mismatch: expected {workflow}, got {identity}\");\n    }\n\n    Ok(())\n}\n\n/// Returns `Ok(())` when the downloaded archive has verified provenance.\nasync fn verify_provenance(archive_data: &[u8], tag: &str) -> Result<()> {\n    let digest = sha256_hex(archive_data);\n    println!(\"Archive SHA-256: {digest}\");","sourceCodeStart":153,"sourceCodeEnd":189,"githubUrl":"https://github.com/aaif-goose/goose/blob/3810898a7447ec3299be72e223d3570a7aabf0ab/crates/goose-cli/src/commands/update.rs#L153-L189","documentation":"Passthrough of the failure from sigstore_verify::verify: the bundle parsed fine but cryptographic verification failed — artifact digest mismatch, certificate chain not rooted in the pinned trusted root, expired certificates, or policy rejection. In verify_provenance this per-bundle error is captured and ultimately surfaces inside the final 'Sigstore verification failed' message.","triggerScenarios":"Archive bytes do not match the digest signed in the attestation (corrupted or tampered download); attestation signed by a key/cert outside goose's trusted root; replayed bundle from a different release; expired Fulcio cert at verification time.","commonSituations":"MITM'd or mirrored downloads; cached/partial downloads resumed incorrectly; release published with unsigned or mis-signed provenance; system clock badly wrong.","solutions":["Treat as a hard stop — never bypass or downgrade the verification","Delete any cached download and re-run `goose update` from a trusted network","Verify the artifact manually with slsa-verifier against the official GitHub release to confirm","If manual verification also fails, report possible tampering to the goose maintainers"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"match sigstore_verify::verify(digest, &bundle, &policy, &trusted_root) {\n    Ok(result) => { /* continue with identity check */ }\n    Err(e) => {\n        // fail closed: log and abort; never proceed with an unverified artifact\n        anyhow::bail!(\"provenance verification failed: {e}\");\n    }\n}","preventionTips":["Never catch-and-continue on verification errors — abort the update entirely","Verify suspicious artifacts independently with slsa-verifier before reporting","Check the system clock; wildly wrong time can fail otherwise-valid certificates"],"tags":["sigstore","security","supply-chain","update"],"backgroundTag":null,"analyzedSha":"3810898a7447ec3299be72e223d3570a7aabf0ab","analyzedAt":"2026-08-16T10:14:26.282Z","schemaVersion":2},"datasetVersion":"2026-08-16T13:17:31.715Z"}