fix nil-pointer error when artifact-hash is passed without artifact

[dsa0x]

Summary

This PR fixes a nil pointer error that occurs when the artifact-hash is passed to the verify command, but the artifact is not. All entry types excluding the HashRekord require the artifact.

For example, a command like rekor-cli verify --artifact-hash 12decf1b0f659fd90988454b75ebsdfb32abfabbc1a3adf3a293e17fj480213f4
results in the below error

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x13591dd]

goroutine 1 [running]:
net/url.(*URL).IsAbs(0x0)
	/sdk/go1.18/src/net/url/url.go:1048 +0x1d
github.com/sigstore/rekor/pkg/types/rekord/v0%2e0%2e1.V001Entry.CreateFromArtifactProperties({{0x0, 0x0}}, {0x1f6fdd0, 0xc00013c000}, {{0x0, 0x0, 0x0}, 0x0, {0x7ff7bfeff355, 0x40}, ...})
	/Users/rekor/pkg/types/rekord/v0.0.1/entry.go:346 +0x1c5
github.com/sigstore/rekor/pkg/types/rekord.(*BaseRekordType).CreateProposedEntry(0xc000153a40, {0x1f6fdd0, 0xc00013c000}, {0x1e972c4, 0x5}, {{0x0, 0x0, 0x0}, 0x0, {0x7ff7bfeff355, ...}, ...})
	/Users/rekor/pkg/types/rekord/rekord.go:69 +0x315
github.com/sigstore/rekor/pkg/types.NewProposedEntry({0x1f6fdd0, 0xc00013c000}, {0x1e9ef76, 0x6}, {0x0, 0x0}, {{0x0, 0x0, 0x0}, 0x0, ...})
	/Users/rekor/pkg/types/entries.go:57 +0x1c6
github.com/sigstore/rekor/cmd/rekor-cli/app.glob..func12({0xc000153520, 0x0, 0x2})
	/Users/rekor/cmd/rekor-cli/app/verify.go:118 +0x7ef
github.com/sigstore/rekor/cmd/rekor-cli/app/format.WrapCmd.func1(0x24c7620, {0xc000153520, 0x0, 0x2})
	/Users/rekor/cmd/rekor-cli/app/format/wrap.go:33 +0x86
github.com/spf13/cobra.(*Command).execute(0x24c7620, {0xc000153500, 0x2, 0x2})
	/go/pkg/mod/github.com/spf13/cobra@v1.5.0/command.go:876 +0xbb3
github.com/spf13/cobra.(*Command).ExecuteC(0x24c6720)
	/go/pkg/mod/github.com/spf13/cobra@v1.5.0/command.go:990 +0x8b3
github.com/spf13/cobra.(*Command).Execute(0x24c6720)
	/go/pkg/mod/github.com/spf13/cobra@v1.5.0/command.go:918 +0x2f
github.com/sigstore/rekor/cmd/rekor-cli/app.Execute()
	/Users/rekor/cmd/rekor-cli/app/root.go:53 +0x25
main.main()
	/Users/rekor/cmd/rekor-cli/main.go:21 +0x17

Release Note

Documentation

[dsa0x]

cc @bobcallaway

[codecov-commenter]

Codecov Report

Merging #965 (f1e4d7f) into main (921c478) will decrease coverage by 0.10%.
The diff coverage is 0.00%.

@@            Coverage Diff             @@
##             main     #965      +/-   ##
==========================================
- Coverage   48.20%   48.10%   -0.11%     
==========================================
  Files          61       61              
  Lines        5383     5401      +18     
==========================================
+ Hits         2595     2598       +3     
- Misses       2506     2522      +16     
+ Partials      282      281       -1     

Impacted Files	Coverage Δ
pkg/types/alpine/v0.0.1/entry.go	54.77% <0.00%> (+0.57%)	⬆️
pkg/types/helm/v0.0.1/entry.go	48.29% <0.00%> (-0.63%)	⬇️
pkg/types/jar/v0.0.1/entry.go	38.83% <0.00%> (-0.58%)	⬇️
pkg/types/rekord/v0.0.1/entry.go	48.34% <0.00%> (-0.49%)	⬇️
pkg/types/rpm/v0.0.1/entry.go	55.59% <0.00%> (-0.66%)	⬇️
pkg/types/tuf/v0.0.1/entry.go	41.86% <0.00%> (-0.52%)	⬇️

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

[asraa]

How does this work with HashedRekord which only requires an artifact hash but not the full artifact?

[dsa0x]

How does this work with HashedRekord which only requires an artifact hash but not the full artifact?

Thanks for the callout @asraa. I wasn't aware of that. I took a look at all the different type implementation, and saw that only HashedRekord doesn't require the artifact. However, i found prior art in some types, where the path is checked in the CreateFromArtifactProperties method.

rekor/pkg/types/cose/v0.0.1/entry.go

Lines 307 to 309 in 234afe7

	if props.ArtifactPath == nil {
	return nil, errors.New("path to artifact file must be specified")
	}

I'll do the same for the HashedRekord and other types that relies on the artifact.

[asraa]

Thanks for the quick change!

I believe this fixes your nil-ptr error, and helps ensure that if artifactBytes aren't set for the entry then artifact path must be

[bobcallaway]

lgtm as well