fix: require signed evidence provenance

2026-08-09 19:17:54 +02:00
parent df8dc1e219
commit e50aad7e41
2 changed files with 18 additions and 1 deletions
@@ -60,7 +60,12 @@ def _resolve_http_signed_url_files(value: Any) -> Any:
            return resolved
        if "urls" in resolved:
            raise ConfigError("HTTP signed URL file cannot be combined with urls")
-        if "provenance_urls" not in resolved:
+        provenance_urls = resolved.get("provenance_urls")
+        if (
+            not isinstance(provenance_urls, list)
+            or not provenance_urls
+            or any(not isinstance(item, str) or not item for item in provenance_urls)
+        ):
            raise ConfigError("HTTP signed URL file requires provenance_urls")
        path_value = resolved.pop("signed_urls_file")
        if not isinstance(path_value, str):