Add retry logic when fetching TUF content in `gh attestation` commands #10943

malancas · 2025-05-07T15:19:25Z

Fixes #10756

This implements retry logic when fetching TUF content in gh attestation commands.

Signed-off-by: Meredith Lancaster <malancas@github.com>

malancas · 2025-05-27T16:17:35Z

pkg/cmd/attestation/inspect/inspect_test.go

-	bundlePath = test.NormalizeRelativePath("../test/data/sigstore-js-2.1.0-bundle.json")
-)
-
-func TestNewInspectCmd(t *testing.T) {


Cleaned up this test and moved it to pkg/cmd/attestation/inspect/inspect_interation_test.go since it requires an internet connection.

malancas · 2025-05-27T16:33:27Z

pkg/cmd/attestation/verification/tuf.go

 	opts.CacheValidity = 1

+	// configure fetcher timeout and retry
+	f := fetcher.NewDefaultFetcher()


@BagToad go-tuf is now imported as direct dependency because I call this fetcher.NewDefaultFetcher constructor from the library

malancas · 2025-05-27T16:34:06Z

pkg/cmd/attestation/verification/tuf.go

+	// configure fetcher timeout and retry
+	f := fetcher.NewDefaultFetcher()
+	f.SetHTTPClient(hc)
+	retryOptions := []backoff.RetryOption{backoff.WithMaxTries(3)}


cenkalti/backoff is also now direct because I call backoff.RetryOptions.

BagToad · 2025-05-28T16:18:45Z

go.mod

 	github.com/cenkalti/backoff/v4 v4.3.0
+	github.com/cenkalti/backoff/v5 v5.0.2


I wonder if actually we need both of these

BagToad

LGTM

bdehamer

LGTM

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [cli/cli](https://github.com/cli/cli) | minor | `v2.73.0` -> `v2.74.1` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>cli/cli (cli/cli)</summary> ### [`v2.74.1`](https://github.com/cli/cli/releases/tag/v2.74.1): GitHub CLI 2.74.1 [Compare Source](cli/cli@v2.74.0...v2.74.1) #### What's Changed - Document support for `@copilot` in `gh [pr|issue] edit --add-assignee` and `--remove-assignee` by [@timrogers](https://github.com/timrogers) in cli/cli#11056 - Fix pr edit when URL is provided by [@williammartin](https://github.com/williammartin) in cli/cli#11057 - Fix const in MR finder tests by [@babakks](https://github.com/babakks) in cli/cli#11091 **Full Changelog**: cli/cli@v2.74.0...v2.74.1 ### [`v2.74.0`](https://github.com/cli/cli/releases/tag/v2.74.0): GitHub CLI 2.74.0 [Compare Source](cli/cli@v2.73.0...v2.74.0) #### Security A security vulnerability has been identified in a core `gh` dependency, `go-gh`, where an attacker-controlled GitHub Enterprise Server could result in executing arbitrary commands on a user's machine by replacing HTTP URLs provided by GitHub with local file paths for browsing. This issue is addressed in this `gh` release by updating `go-gh` to a fixed version. For more information, see GHSA-g9f5-x53j-h563 #### What's changed ##### ✨ Features - Add `preview prompter` command by [@BagToad](https://github.com/BagToad) in cli/cli#10745 - \[gh run watch] Support `--compact` flag by [@iamazeem](https://github.com/iamazeem) in cli/cli#10629 - Fix brew update notifications by [@BagToad](https://github.com/BagToad) in cli/cli#11024 ##### 🐛 Fixes - Revert "\[gh config] Escape pipe symbol in Long desc for website manual" by [@BagToad](https://github.com/BagToad) in cli/cli#11004 - Fix formatting in allowed values for `gh config --help` by [@BagToad](https://github.com/BagToad) in cli/cli#11003 - fix: `gh gist edit` panic when no file in a gist by [@phanen](https://github.com/phanen) in cli/cli#10627 - Add retry logic when fetching TUF content in `gh attestation` commands by [@malancas](https://github.com/malancas) in cli/cli#10943 ##### 📚 Docs & Chores - Update README.md by [@irhdab](https://github.com/irhdab) in cli/cli#11022 - Add tests for `RenderJobs` and `RenderJobsCompact` by [@babakks](https://github.com/babakks) in cli/cli#11013 - Add example usage of `--head` option to `pr list` docs by [@babakks](https://github.com/babakks) in cli/cli#10979 - Mention `pr create` will print the created MR's URL by [@babakks](https://github.com/babakks) in cli/cli#10980 - Add Digest to ReleaseAsset struct by [@bdehamer](https://github.com/bdehamer) in cli/cli#11030 #####

Dependencies - Bump `go-gh` to v2.12.1 by [@BagToad](https://github.com/BagToad) in cli/cli#11043 - chore(deps): bump github.com/gabriel-vasile/mimetype from 1.4.8 to 1.4.9 by [@dependabot](https://github.com/dependabot) in cli/cli#10825 - Update sigstore-go dependency to v1.0.0 by [@malancas](https://github.com/malancas) in cli/cli#11028 - chore(deps): bump github.com/sigstore/protobuf-specs from 0.4.1 to 0.4.2 by [@dependabot](https://github.com/dependabot) in cli/cli#10999 - chore(deps): bump github.com/yuin/goldmark from 1.7.8 to 1.7.12 by [@dependabot](https://github.com/dependabot) in cli/cli#11032 #### New Contributors - [@irhdab](https://github.com/irhdab) made their first contribution in cli/cli#11022 - [@phanen](https://github.com/phanen) made their first contribution in cli/cli#10627 **Full Changelog**: cli/cli@v2.73.0...v2.74.0 </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

malancas added 5 commits April 24, 2025 08:55

create fetcher with custom http client and retry options

fcd23dc

Signed-off-by: Meredith Lancaster <malancas@github.com>

Merge branch 'trunk' into gh-attestation-tuf-client-retry

c5a2def

get latest go-tuf version

2b1ec2f

Signed-off-by: Meredith Lancaster <malancas@github.com>

get the latest go-tuf release

d606882

Signed-off-by: Meredith Lancaster <malancas@github.com>

pass http client for use with tuf

6b22675

Signed-off-by: Meredith Lancaster <malancas@github.com>

malancas temporarily deployed to cli-automation May 7, 2025 15:19 — with GitHub Actions Inactive

malancas added 10 commits May 7, 2025 16:41

set custom fetcher in options

9092a43

Signed-off-by: Meredith Lancaster <malancas@github.com>

fetch http client from factory

874c1b9

Signed-off-by: Meredith Lancaster <malancas@github.com>

move live inspect test to integration test file

1c28a7a

Signed-off-by: Meredith Lancaster <malancas@github.com>

alphabetize fields

456e641

Signed-off-by: Meredith Lancaster <malancas@github.com>

simplify test

ec5f108

Signed-off-by: Meredith Lancaster <malancas@github.com>

add missing http client field in sigstoreConfig

3637f5a

Signed-off-by: Meredith Lancaster <malancas@github.com>

include http client in verifier setup

c0701c8

Signed-off-by: Meredith Lancaster <malancas@github.com>

use constructor

75f72bc

Signed-off-by: Meredith Lancaster <malancas@github.com>

import sigstore-go at a more recent commit

3950e84

Signed-off-by: Meredith Lancaster <malancas@github.com>

Merge branch 'trunk' into gh-attestation-tuf-client-retry

f2f769c

malancas commented May 27, 2025

View reviewed changes

malancas marked this pull request as ready for review May 27, 2025 16:31

malancas requested review from a team as code owners May 27, 2025 16:31

malancas requested a review from BagToad May 27, 2025 16:31

malancas temporarily deployed to cli-automation May 27, 2025 16:31 — with GitHub Actions Inactive

cliAutomation added the external pull request originating outside of the CLI core team label May 27, 2025

malancas commented May 27, 2025

View reviewed changes

BagToad reviewed May 28, 2025

View reviewed changes

BagToad approved these changes May 28, 2025

View reviewed changes

Merge branch 'trunk' into gh-attestation-tuf-client-retry

23382f4

bdehamer approved these changes May 28, 2025

View reviewed changes

malancas merged commit c50cdbd into cli:trunk May 28, 2025
9 checks passed

malancas deleted the gh-attestation-tuf-client-retry branch May 28, 2025 22:56

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add retry logic when fetching TUF content in `gh attestation` commands #10943

Add retry logic when fetching TUF content in `gh attestation` commands #10943

Uh oh!

malancas commented May 7, 2025 •

edited

Loading

Uh oh!

malancas May 27, 2025

Uh oh!

malancas May 27, 2025

Uh oh!

malancas May 27, 2025

Uh oh!

BagToad May 28, 2025

Uh oh!

BagToad left a comment

Uh oh!

bdehamer left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		github.com/cenkalti/backoff/v4 v4.3.0
		github.com/cenkalti/backoff/v5 v5.0.2

Add retry logic when fetching TUF content in gh attestation commands #10943

Add retry logic when fetching TUF content in gh attestation commands #10943

Uh oh!

Conversation

malancas commented May 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

malancas May 27, 2025

Choose a reason for hiding this comment

Uh oh!

malancas May 27, 2025

Choose a reason for hiding this comment

Uh oh!

malancas May 27, 2025

Choose a reason for hiding this comment

Uh oh!

BagToad May 28, 2025

Choose a reason for hiding this comment

Uh oh!

BagToad left a comment

Choose a reason for hiding this comment

Uh oh!

bdehamer left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Add retry logic when fetching TUF content in `gh attestation` commands #10943

Add retry logic when fetching TUF content in `gh attestation` commands #10943

malancas commented May 7, 2025 •

edited

Loading