sbp opened a new issue, #1366:
URL: https://github.com/apache/tooling-trusted-releases/issues/1366
We only did a quick review of this in triage and it seemed plausible. Would
it be possible for you to give it a full review please, @alitheg?
-----
| Attribute | Details |
|---|---|
| **Severity** | High |
| **Verdict** | CONFIRMED |
| **Category** | correctness |
| **File** | `models/api.py:1025` |
| **Source** | chunk-33 |
**Description**
validator() validates input via ResultsAdapter, which is the discriminated
union `Results` keyed on the `endpoint` literal. DistributeSshRegisterResults
(endpoint "/distribute/ssh/register") is NOT a member of the Results union
(lines 956-1002). When validate_distribution_ssh_register is called on an
otherwise-valid response, ResultsAdapter.validate_python raises a pydantic
ValidationError because "/distribute/ssh/register" is not a recognized
discriminator value — so the response for the distribute/ssh/register endpoint
can never be validated successfully. Every other validator (e.g.
DistributeStatusUpdateResults, DistributionRecordFromWorkflowResults,
PolicyGetResults are similarly absent but have no validator wired up) targets a
class present in the union; this one is the exception.
**Evidence**
`validate_distribution_ssh_register =
validator(DistributeSshRegisterResults) at line 1025;
DistributeSshRegisterResults defined at lines 145-150 with endpoint
Literal["/distribute/ssh/register"]; the Results union (956-1002) does not
include DistributeSshRegisterResults, and ResultsAdapter =
pydantic.TypeAdapter(Results) (1004) is what validator() calls (1009).`
**Verification — CONFIRMED**
- **Trigger:** Call validate_distribution_ssh_register on a valid response
dict {"endpoint": "/distribute/ssh/register", "fingerprint": ..., "project":
..., "expires": ...}; ResultsAdapter.validate_python raises
pydantic.ValidationError because "/distribute/ssh/register" is not a
discriminator tag in the Results union.
- **Reasoning:** DistributeSshRegisterResults (endpoint
"/distribute/ssh/register") is genuinely absent from the Results union at lines
956-1002, yet validator() routes all input through ResultsAdapter, so the
discriminated-union lookup fails before the isinstance check; every other wired
validator targets a class present in the union, making this one always-failing.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
