chainloop-dev/chainloop

Problem When a remote attestation is started with chainloop attestation init and then resumed later (attestation add, status or push) with a different token, the control plane returns an internal server error. The error is also reported to Sentry: *errors.errorString: failed to decrypt attestation state: incorrect passphrase File "pkg/servicelogger/logger.go", line 60, in LogAndMaskErr File "app/controlplane/internal/service/service.go", line 559, in handleUseCaseErr File "app/controlplane/internal/service/attestationstate.go", line 143, in (*AttestationStateService).Read ... Cause The attestation state is encrypted at rest. The key is derived from the bearer token of the request (encryptionPassphrase in app/controlplane/internal/service/attestationstate.go). If the next command uses a different token, for example a new or rotated API token, the passphrase changes and decrypt in app/controlplane/pkg/biz/attestationstate.go returns incorrect passphrase. That error is a plain fm

What Annotation names currently only accept word characters, so my_annotation is valid but my-annotation is rejected. Contract names and material names both allow hyphens, so this is an inconsistency rather than a deliberate restriction — users coming from either of those naturally reach for a hyphen and get a validation error. Where app/controlplane/api/workflowcontract/v1/crafting_schema.proto: message Annotation { string name = 1 [(buf.validate.field).string.pattern = "^[\\w]+$"]; // Single word optionally separated with _ // This value can be set in the contract or provided during the attestation string value = 2; } ^[\w]+$ matches letters, digits and underscore. Hyphen is not in the class. Suggested change Widen the pattern to allow hyphens, keeping it consistent with how other names are validated, and update the trailing comment so it no longer says underscores only. Things to check while making the change: Regenerate the protobuf code after editing the .proto (the gener