chains
chains copied to clipboard
Do not initialize Rekor client if transparency is not enabled.
Expected Behavior
Rekor client should not be initialized if transparency is not enable.
Actual Behavior
Rekor client is initialized even if config.transparency.enabled is false. In current setup the default value of config.transparency.url is "https://rekor.sigstore.dev" and as such the rekor client initialization passes. If url was set to another value, even nil, then the signing will fail on rekor initialization. Also due this we initialize a mock rekor in many of the testcases where rekor is not needed. Example: signing_test.go:TestTaskRunSigner_SignTaskRun which does not need or test rekor.
Fix: Initialize rekor only if config.transparency.enabled is true.