From 9a5d9b8faa6f4a0e25d2547e0025735b34cc2417 Mon Sep 17 00:00:00 2001
From: Miguel Martinez Trivino <miguel@chainloop.dev>
Date: Mon, 16 Mar 2026 19:23:24 +0100
Subject: [PATCH] fix(cli): allow equal signs in annotation values

Split annotation strings on only the first '=' so values containing '='
(e.g. URLs with query parameters) are accepted.

Fixes #2866

Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>
---
 app/cli/cmd/attestation.go      |  4 ++--
 app/cli/cmd/attestation_test.go | 15 ++++++++++++++-
 2 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/app/cli/cmd/attestation.go b/app/cli/cmd/attestation.go
index e78815ea5..f8cc3bd22 100644
--- a/app/cli/cmd/attestation.go
+++ b/app/cli/cmd/attestation.go
@@ -109,8 +109,8 @@ func orgFromLocalState(customPath string) string {
 func extractAnnotations(annotationsFlag []string) (map[string]string, error) {
 	var annotations = make(map[string]string)
 	for _, annotation := range annotationsFlag {
-		kv := strings.Split(annotation, "=")
-		if len(kv) != 2 {
+		kv := strings.SplitN(annotation, "=", 2)
+		if len(kv) < 2 {
 			return nil, fmt.Errorf("invalid annotation %q, the format must be key=value", annotation)
 		}
 		annotations[kv[0]] = kv[1]
diff --git a/app/cli/cmd/attestation_test.go b/app/cli/cmd/attestation_test.go
index 48562b462..686df0dff 100644
--- a/app/cli/cmd/attestation_test.go
+++ b/app/cli/cmd/attestation_test.go
@@ -118,7 +118,20 @@ func TestExtractAnnotations(t *testing.T) {
 				"foo=bar",
 				"baz=qux=qux",
 			},
-			wantErr: true,
+			want: map[string]string{
+				"foo": "bar",
+				"baz": "qux=qux",
+			},
+			wantErr: false,
+		},
+		{
+			input: []string{
+				"url=https://example.com/path?id=123&foo=bar",
+			},
+			want: map[string]string{
+				"url": "https://example.com/path?id=123&foo=bar",
+			},
+			wantErr: false,
 		},
 	}