Fail when signature contains error

release-engineering · Jan 28, 2025 · f2e3c01 · f2e3c01
1 parent 6679ba1
commit f2e3c01
Showing 1 changed file with 11 additions and 0 deletions.
diff --git a/src/pubtools/_quay/signer_wrapper.py b/src/pubtools/_quay/signer_wrapper.py
@@ -150,6 +150,7 @@ def _sign_containers(
         )
         if signed["signer_result"]["status"] != "ok":
             raise SigningError(signed["signer_result"]["error_message"])
+
         for sign_entry in sign_entries:
             LOG.info(
                 "Signed %s(%s) with %s in %s",
@@ -314,9 +315,16 @@ def _run_store_signed(self, signed_results: Dict[str, Any]) -> None:
         LOG.info("Sending new signatures to Pyxis")
 
         signatures: List[Dict[str, Any]] = []
+        error = False
+
         for reference, op_res in zip(
             signed_results["operation"]["references"], signed_results["operation_results"]
         ):
+            if op_res[0]['msg']['errors']:
+                LOG.error(f"Error signing {reference}: {op_res[0]['msg']['errors']}")
+                error = True
+                continue
+
             signatures.append(
                 {
                     "manifest_digest": op_res[0]["msg"]["manifest_digest"],
@@ -326,6 +334,8 @@ def _run_store_signed(self, signed_results: Dict[str, Any]) -> None:
                     "signature_data": op_res[0]["msg"]["signed_claim"],
                 }
             )
+        if error:
+            raise SigningError("Error signing some references")
 
         for sig in signatures:
             LOG.debug(
@@ -353,6 +363,7 @@ def _run_store_signed(self, signed_results: Dict[str, Any]) -> None:
                 env_vars,
                 False,
             )
+        return True
 
     def _run_remove_signatures(self, signatures_to_remove: List[str]) -> None:
         """Remove signatures from the sigstore.