Data race in FetchSignaturesForReference

[RTann]

Description

For each fetched signature, a new goroutine is spawned here. Each of these goroutines use the same err error variable, originally declared here.

To make it a bit easier to read, I will copy and paste the code below:

g.Go(func() error {
	signatures[i].Payload, err = sig.Payload()
	if err != nil {
		return err
	}
	signatures[i].Base64Signature, err = sig.Base64Signature()
	if err != nil {
		return err
	}
	signatures[i].Cert, err = sig.Cert()
	if err != nil {
		return err
	}
	signatures[i].Chain, err = sig.Chain()
	if err != nil {
		return err
	}
	signatures[i].Bundle, err = sig.Bundle()
	return err
})

We can see that we always use the same err in each goroutine, as = is used. This can lead to a race condition where errors are never propagated. For example, say we have two signatures, so two goroutines. It is possible that something like signatures[i].Payload, err = sig.Payload() is called and returns an error for one goroutine, but before it checks if err != nil, we context switch to the other goroutine which gives us err = nil in signatures[i].Payload, err = sig.Payload(). Then, we will never catch the error in either goroutine.

Version

I am using v1.12.1, but from what I can tell, this has been around since this PR, which has been around since v1.2.1.

[RTann]

#2283