fix: panic with unsigned local image

[hectorj2f]

Signed-off-by: Hector Fernandez [email protected]

Summary

Fixes: #2655

For unsigned images when verified locally, the cli panics getting the signatures.

cosign verify --local-image ./localimage  --certificate-identity-regexp='.*'  --certificate-oidc-issuer-regexp='.*'
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x2 addr=0x30 pc=0x102bb700c]

goroutine 1 [running]:
github.com/sigstore/cosign/v2/pkg/cosign.verifySignatures({0x104929df0, 0x14000056080}, {0x0?, 0x0?}, {{0x103e019b5?, 0x14000faa800?}, {0x14001009900?, 0x1?}}, 0x1?)
	github.com/sigstore/cosign/v2/pkg/cosign/verify.go:548 +0x4c
github.com/sigstore/cosign/v2/pkg/cosign.VerifyLocalImageSignatures({0x104929df0, 0x14000056080}, {0x16db4f94e?, 0x140002c3f50?}, 0x140005ad840)
	github.com/sigstore/cosign/v2/pkg/cosign/verify.go:544 +0x1a0
github.com/sigstore/cosign/v2/cmd/cosign/cli/verify.(*VerifyCommand).Exec(0x140005ada10, {0x104929df0, 0x14000056080}, {0x140007ce5c0, 0x1, 0x14000184c80?})
	github.com/sigstore/cosign/v2/cmd/cosign/cli/verify/verify.go:263 +0xc90
github.com/sigstore/cosign/v2/cmd/cosign/cli.Verify.func1(0x14000825800, {0x140007ce5c0, 0x1, 0x4})
	github.com/sigstore/cosign/v2/cmd/cosign/cli/verify.go:132 +0x2c4
github.com/spf13/cobra.(*Command).execute(0x14000825800, {0x140007ce580, 0x4, 0x4})
	github.com/spf13/[email protected]/command.go:916 +0x5c8
github.com/spf13/cobra.(*Command).ExecuteC(0x14000456600)
	github.com/spf13/[email protected]/command.go:1044 +0x35c
github.com/spf13/cobra.(*Command).Execute(...)
	github.com/spf13/[email protected]/command.go:968
main.main()
	github.com/sigstore/cosign/v2/cmd/cosign/main.go:62 +0x58

while with this fix you get:

cosign verify --local-image ./localimage  --certificate-identity-regexp='.*'  --certificate-oidc-issuer-regexp='.*'
Error: no signatures associated with local image saved in ./localimage
main.go:63: error during command execution: no signatures associated with local image saved in ./localimage

Release Note

fix: panic when verifying unsigned local images

Documentation

[priyawadhwa]

thanks hector!