Panic: nil pointer dereference in archivista client during verify #591
Description
Description
witness verify panics with nil pointer dereference when loading policy from local file without archivista configuration.
Steps to Reproduce
witness verify -k pubkey.pem -p policy-signed.json -a attestation.att -f artifact.txtError
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x2 addr=0x10 pc=0x100542f58]
goroutine 1 [running]:
github.com/in-toto/go-witness/archivista.(*Client).archivistaRequestOpts(...)
github.com/in-toto/[email protected]/archivista/client.go:56
github.com/in-toto/go-witness/archivista.(*Client).Download(...)
github.com/in-toto/[email protected]/archivista/download.go:25 +0x38
github.com/in-toto/witness/internal/policy.LoadPolicy(...)
github.com/in-toto/witness/internal/policy/policy.go:47 +0x288
Environment
- go-witness: v0.9.1
- OS: macOS (Darwin 24.6.0)
Expected Behavior
Verification should succeed or fail gracefully without panic when archivista is not configured.
Workaround
Using the actual artifact file (instead of unrelated file) in -f flag avoids the panic.