PR sigstore#1252 review suggestions fixed

* no need for zipped file
* remve un needed method

Author: anthonydahanne

sigstore-java/src/main/java/dev/sigstore/fulcio/client/FulcioVerifier.java

@@ -94,11 +94,6 @@ private FulcioVerifier(
     this.ctVerifier = ctVerifier;
   }
 
-  @VisibleForTesting
-  void verifySct(CertPath fullCertPath) throws FulcioVerificationException {
-    verifySct(fullCertPath, CTLogOptions.builder().isEnabled(true).build());
-  }
-
   @VisibleForTesting
   void verifySct(CertPath fullCertPath, CTLogOptions ctLogOptions)
       throws FulcioVerificationException {

sigstore-java/src/test/java/dev/sigstore/KeylessVerifierTest.java

@@ -37,8 +37,6 @@
 import java.security.cert.X509Certificate;
 import java.util.List;
 import java.util.stream.Stream;
-import java.util.zip.ZipEntry;
-import java.util.zip.ZipInputStream;
 import org.hamcrest.CoreMatchers;
 import org.hamcrest.MatcherAssert;
 import org.junit.jupiter.api.Assertions;
@@ -421,9 +419,7 @@ public void verifyCertificateMatches_noneMatch() throws Exception {
                             .issuer(StringMatcher.string("not-match-again"))
                             .build())));
     Assertions.assertEquals(
-        "No provided certificate identities matched values in certificate: [{issuer:'String:"
-            + " not-match',san:'String: not-match'},{issuer:'String: not-match-again',san:'String:"
-            + " not-match-again'}]",
+        "No provided certificate identities matched values in certificate: [{issuer:'String: not-match',san:'String: not-match'},{issuer:'String: not-match-again',san:'String: not-match-again'}]",
         ex.getMessage());
   }
 
@@ -887,22 +883,11 @@ public void testVerify_wrongArtifactHashAlgorithm() throws Exception {
             "Provided artifact digest does not match digest used for verification"));
   }
 
-  // The fixture below is a real SLSA build-provenance attestation produced by GitHub Actions for a
-  // *private* repository. Attestations for private repositories are signed by GitHub's own Sigstore
-  // instance, which (unlike the public-good instance) does not publish to a transparency log and
-  // does not use certificate transparency: the bundle carries zero tlog entries and relies on a
-  // signed RFC 3161 timestamp for trusted time, and the trust root that GitHub distributes for it
-  // (via `gh attestation trusted-root`) contains zero CT logs. Verifying such a bundle therefore
-  // requires a policy that disables both transparency-log and certificate-transparency checks.
-  //
-  // The zip file contains two files:
-  //   - attestation.sigstore.json : the sigstore bundle (DSSE, in-toto SLSA provenance predicate)
-  //   - trusted_root.jsonl        : the trust roots as JSON Lines. `gh attestation trusted-root`
-  //                                 emits more than one (public-good and GitHub); sigstore-java
-  //                                 consumes a single trust root, so the tests below select the
-  //                                 GitHub one (the line describing the fulcio.githubapp.com CA).
-  private static final String GH_PRIVATE_ATTESTATION_ZIP =
-      "dev/sigstore/samples/bundles/bundle-github-private-no-tlog.zip";
+  // A real SLSA build-provenance attestation from a GitHub *private* repository: no
+  // transparency-log entry, no CT log, signed RFC 3161 timestamp only. See the README in the
+  // fixture directory for provenance and how it was obtained.
+  private static final String GH_PRIVATE_DIR =
+      "dev/sigstore/samples/bundles/github-private-no-tlog/";
   private static final String GH_PRIVATE_SIGNER_SAN =
       "https://github.com/neverendingsupport/slsa-attestations/.github/workflows/attest.yml@9f6d9dc1bfc02986955721eb15f89ad618f1cedb";
   private static final String GH_PRIVATE_OIDC_ISSUER =
@@ -980,15 +965,15 @@ private static ImmutableVerificationOptions.Builder gitHubPrivateOptions() {
   private static Bundle gitHubPrivateBundle() throws Exception {
     return Bundle.from(
         new StringReader(
-            new String(
-                readZipEntry(GH_PRIVATE_ATTESTATION_ZIP, "attestation.sigstore.json"),
+            Resources.toString(
+                Resources.getResource(GH_PRIVATE_DIR + "attestation.sigstore.json"),
                 StandardCharsets.UTF_8)));
   }
 
   private static KeylessVerifier gitHubPrivateVerifier(Path tempDir) throws Exception {
     var jsonl =
-        new String(
-            readZipEntry(GH_PRIVATE_ATTESTATION_ZIP, "trusted_root.jsonl"), StandardCharsets.UTF_8);
+        Resources.toString(
+            Resources.getResource(GH_PRIVATE_DIR + "trusted_root.jsonl"), StandardCharsets.UTF_8);
     var gitHubTrustedRoot =
         jsonl
             .lines()
@@ -1003,16 +988,4 @@ private static KeylessVerifier gitHubPrivateVerifier(Path tempDir) throws Except
         .trustedRootProvider(TrustedRootProvider.from(trustedRootPath))
         .build();
   }
-
-  private static byte[] readZipEntry(String zipResource, String entryName) throws Exception {
-    try (var zis = new ZipInputStream(Resources.getResource(zipResource).openStream())) {
-      ZipEntry entry;
-      while ((entry = zis.getNextEntry()) != null) {
-        if (entry.getName().equals(entryName)) {
-          return zis.readAllBytes();
-        }
-      }
-    }
-    throw new IllegalStateException("entry '" + entryName + "' not found in " + zipResource);
-  }
 }

sigstore-java/src/test/java/dev/sigstore/fulcio/client/FulcioVerifierTest.java

@@ -16,6 +16,8 @@
 package dev.sigstore.fulcio.client;
 
 import com.google.common.io.Resources;
+import dev.sigstore.ImmutableCTLogOptions;
+import dev.sigstore.VerificationOptions.CTLogOptions;
 import dev.sigstore.bundle.Bundle;
 import dev.sigstore.encryption.certificates.Certificates;
 import dev.sigstore.trustroot.ImmutableLogId;
@@ -26,6 +28,7 @@
 import java.nio.charset.StandardCharsets;
 import java.util.Collections;
 import java.util.List;
+import org.jspecify.annotations.NonNull;
 import org.junit.jupiter.api.Assertions;
 import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.Test;
@@ -81,7 +84,7 @@ public void testVerifySct_noSct() throws Exception {
     var fulcioVerifier = FulcioVerifier.newFulcioVerifier(trustRoot);
 
     try {
-      fulcioVerifier.verifySct(signingCertificate);
+      fulcioVerifier.verifySct(signingCertificate, enabledCTLog());
       Assertions.fail();
     } catch (FulcioVerificationException fve) {
       Assertions.assertEquals("No valid SCTs were found during verification", fve.getMessage());
@@ -122,7 +125,12 @@ public void invalidEmbeddedSct() throws Exception {
 
     var fve =
         Assertions.assertThrows(
-            FulcioVerificationException.class, () -> fulcioVerifier.verifySct(signingCertificate));
+            FulcioVerificationException.class,
+            () -> fulcioVerifier.verifySct(signingCertificate, enabledCTLog()));
     Assertions.assertEquals("No valid SCTs were found, all(1) SCTs were invalid", fve.getMessage());
   }
+
+  private static @NonNull ImmutableCTLogOptions enabledCTLog() {
+    return CTLogOptions.builder().isEnabled(true).build();
+  }
 }

sigstore-java/src/test/resources/dev/sigstore/samples/bundles/bundle-github-private-no-tlog.zip

@@ -0,0 +1,51 @@
+# GitHub private-repo attestation (no transparency log)
+
+`attestation.sigstore.json` and `trusted_root.jsonl` are a real SLSA build-provenance
+attestation produced by GitHub Actions for a **private** repository.
+
+Attestations for private repositories are signed by GitHub's own Sigstore instance,
+which — unlike the public-good instance — does **not** publish to a transparency log and
+does **not** use certificate transparency:
+
+- the bundle carries **zero** transparency-log entries and relies on a signed RFC 3161
+  timestamp for trusted time;
+- the trust root GitHub distributes for it contains **zero** CT logs.
+
+Verifying such a bundle therefore requires a policy that disables both transparency-log
+and certificate-transparency checks (`VerificationOptions` with `TLogOptions` /
+`CTLogOptions` `isEnabled(false)`). See `KeylessVerifierTest`.
+
+## Files
+
+- `attestation.sigstore.json` — the Sigstore bundle (DSSE envelope, in-toto SLSA
+  provenance predicate).
+- `trusted_root.jsonl` — trust roots as JSON Lines. `gh attestation trusted-root` emits
+  more than one (public-good first, then GitHub). sigstore-java consumes a single trust
+  root, so the test selects the GitHub one (the line describing the `fulcio.githubapp.com`
+  CA).
+
+## How this fixture was obtained
+
+Both files are the unmodified output of the `gh` CLI, run against a **private**
+repository whose build had already produced a SLSA build-provenance attestation for a
+released artifact.
+
+Download the attestation bundle for the built artifact, scoping the lookup to its private
+repository:
+
+```sh
+gh attestation download <artifact-file> --repo <owner>/<private-repo>
+```
+
+This writes a `sha256-<digest>.jsonl` file in the current directory containing the
+Sigstore bundle; it is copied verbatim to `attestation.sigstore.json`.
+
+Fetch the matching trust roots (public-good instance first, then GitHub's instance):
+
+```sh
+gh attestation trusted-root > trusted_root.jsonl
+```
+
+Any private repository with a build-provenance attestation reproduces an equivalent
+fixture: because the repository is private, GitHub signs it with its own Sigstore
+instance, so the resulting bundle carries no transparency-log entries.

sigstore-java/src/test/resources/dev/sigstore/samples/bundles/github-private-no-tlog/README.md

@@ -0,0 +1 @@
+{"mediaType":"application/vnd.dev.sigstore.bundle.v0.3+json","verificationMaterial":{"certificate":{"rawBytes":"MIIHQDCCBsagAwIBAgIUa39WPiLHvriy0BbZ+r6W6E9QoX8wCgYIKoZIzj0EAwMwODEVMBMGA1UEChMMR2l0SHViLCBJbmMuMR8wHQYDVQQDExZGdWxjaW8gSW50ZXJtZWRpYXRlIGwyMB4XDTI2MDcyNDE1MzAyN1oXDTI2MDcyNDE1NDAyN1owADBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABCzR6pDNd61vOrLV+lssLkX83Dw/zNGKEprrEfInxjWcASil70eYKlWm5UdtMpb9rYKMGU2s2mlx56bQZzuJsl2jggXkMIIF4DAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwMwHQYDVR0OBBYEFA5tlV/Yh7mAI5usmY0iLk9s+ErMMB8GA1UdIwQYMBaAFIHjTsG/Xu4ILqbvj2S+p69FoJvPMIGMBgNVHREBAf8EgYEwf4Z9aHR0cHM6Ly9naXRodWIuY29tL25ldmVyZW5kaW5nc3VwcG9ydC9zbHNhLWF0dGVzdGF0aW9ucy8uZ2l0aHViL3dvcmtmbG93cy9hdHRlc3QueW1sQDlmNmQ5ZGMxYmZjMDI5ODY5NTU3MjFlYjE1Zjg5YWQ2MThmMWNlZGIwOQYKKwYBBAGDvzABAQQraHR0cHM6Ly90b2tlbi5hY3Rpb25zLmdpdGh1YnVzZXJjb250ZW50LmNvbTASBgorBgEEAYO/MAECBARwdXNoMDYGCisGAQQBg78wAQMEKGNhMzQyZTU2Nzg3OTg2Y2Q0ZThkZmMwYzg4MzA2OTY3MTZkM2I0NDEwFQYKKwYBBAGDvzABBAQHUmVsZWFzZTA0BgorBgEEAYO/MAEFBCZuZXZlcmVuZGluZ3N1cHBvcnQvbmVzLWphdmEtdGVzdC1saWItYTAjBgorBgEEAYO/MAEGBBVyZWZzL3RhZ3MvbmVzLXYxLjAuMTIwOwYKKwYBBAGDvzABCAQtDCtodHRwczovL3Rva2VuLmFjdGlvbnMuZ2l0aHVidXNlcmNvbnRlbnQuY29tMIGNBgorBgEEAYO/MAEJBH8MfWh0dHBzOi8vZ2l0aHViLmNvbS9uZXZlcmVuZGluZ3N1cHBvcnQvc2xzYS1hdHRlc3RhdGlvbnMvLmdpdGh1Yi93b3JrZmxvd3MvYXR0ZXN0LnltbEA5ZjZkOWRjMWJmYzAyOTg2OTU1NzIxZWIxNWY4OWFkNjE4ZjFjZWRiMDgGCisGAQQBg78wAQoEKgwoOWY2ZDlkYzFiZmMwMjk4Njk1NTcyMWViMTVmODlhZDYxOGYxY2VkYjAdBgorBgEEAYO/MAELBA8MDWdpdGh1Yi1ob3N0ZWQwSQYKKwYBBAGDvzABDAQ7DDlodHRwczovL2dpdGh1Yi5jb20vbmV2ZXJlbmRpbmdzdXBwb3J0L25lcy1qYXZhLXRlc3QtbGliLWEwOAYKKwYBBAGDvzABDQQqDChjYTM0MmU1Njc4Nzk4NmNkNGU4ZGZjMGM4ODMwNjk2NzE2ZDNiNDQxMCUGCisGAQQBg78wAQ4EFwwVcmVmcy90YWdzL25lcy12MS4wLjEyMBoGCisGAQQBg78wAQ8EDAwKMTI5NjQyODQxNzA1BgorBgEEAYO/MAEQBCcMJWh0dHBzOi8vZ2l0aHViLmNvbS9uZXZlcmVuZGluZ3N1cHBvcnQwGQYKKwYBBAGDvzABEQQLDAkxMTMzOTQzOTYwgYEGCisGAQQBg78wARIEcwxxaHR0cHM6Ly9naXRodWIuY29tL25ldmVyZW5kaW5nc3VwcG9ydC9uZXMtamF2YS10ZXN0LWxpYi1hLy5naXRodWIvd29ya2Zsb3dzL25lcy1yZWxlYXNlLnltbEByZWZzL3RhZ3MvbmVzLXYxLjAuMTIwOAYKKwYBBAGDvzABEwQqDChjYTM0MmU1Njc4Nzk4NmNkNGU4ZGZjMGM4ODMwNjk2NzE2ZDNiNDQxMBQGCisGAQQBg78wARQEBgwEcHVzaDBtBgorBgEEAYO/MAEVBF8MXWh0dHBzOi8vZ2l0aHViLmNvbS9uZXZlcmVuZGluZ3N1cHBvcnQvbmVzLWphdmEtdGVzdC1saWItYS9hY3Rpb25zL3J1bnMvMzAwNjY2OTg5NzUvYXR0ZW1wdHMvMzAXBgorBgEEAYO/MAEWBAkMB3ByaXZhdGUwVQYKKwYBBAGDvzABGARHDEVyZXBvOm5ldmVyZW5kaW5nc3VwcG9ydC9uZXMtamF2YS10ZXN0LWxpYi1hOnJlZjpyZWZzL3RhZ3MvbmVzLXYxLjAuMTIwCgYIKoZIzj0EAwMDaAAwZQIxAJ6aTFDtBXArjgKmtzRRnqGgoPgGG2/0O38NJQtadgIiZebfw188PcS9TeHVUncQgQIwQEyyaxjimHq5q6BWFQeyNholRT4XJ6qyTcyogoy1oIDF8LmH6KfQoQHGUynIcMF/"},"timestampVerificationData":{"rfc3161Timestamps":[{"signedTimestamp":"MIIC0TADAgEAMIICyAYJKoZIhvcNAQcCoIICuTCCArUCAQMxDTALBglghkgBZQMEAgIwgbsGCyqGSIb3DQEJEAEEoIGrBIGoMIGlAgEBBgkrBgEEAYO/MAIwMTANBglghkgBZQMEAgEFAAQg9wRSwDiSoN/9BVtwwSPSLO0VhDm7CDR9dC2EqM3UH1oCFFcFv2bliQEgqQF2Vgm7oJaQMxN1GA8yMDI2MDcyNDE1MzAyN1owAwIBAaA2pDQwMjEVMBMGA1UEChMMR2l0SHViLCBJbmMuMRkwFwYDVQQDExBUU0EgVGltZXN0YW1waW5noAAxggHfMIIB2wIBATBKMDIxFTATBgNVBAoTDEdpdEh1YiwgSW5jLjEZMBcGA1UEAxMQVFNBIGludGVybWVkaWF0ZQIUFzPb1un+DvofqFPzAXiB5slHM1IwCwYJYIZIAWUDBAICoIIBBTAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQAQQwHAYJKoZIhvcNAQkFMQ8XDTI2MDcyNDE1MzAyN1owPwYJKoZIhvcNAQkEMTIEML0bFLAXQTUhJhhV64ysYiaE+dW8+W9to5DmKcWO+rvX76ZmjMmuwm3OJBi9YKlQGzCBhwYLKoZIhvcNAQkQAi8xeDB2MHQwcgQgRBbIrnMUamOhN8LlW+jecOPJrzBzvzmLqrqo2wgXztcwTjA2pDQwMjEVMBMGA1UEChMMR2l0SHViLCBJbmMuMRkwFwYDVQQDExBUU0EgaW50ZXJtZWRpYXRlAhQXM9vW6f4O+h+oU/MBeIHmyUczUjAKBggqhkjOPQQDAwRoMGYCMQCwdP5T8aUvaO0OUpW5m4gTHVjKe9XfCm0nU+xzBFRuuCclWgGdHVfgL1uEF/7TzoYCMQCr8X65t64LlX6sMFfsmeskPlxglNomGSgiEVTBpiJk91WTgGdM717fc2+u8C83Dko="}]}},"dsseEnvelope":{"payload":"eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJzdWJqZWN0IjpbeyJuYW1lIjoiYS1tb2R1bGUtMS0xLjAuMC1uZXMtamF2YS10ZXN0LWxpYi1hLTEuMC4xMi1zb3VyY2VzLmphciIsImRpZ2VzdCI6eyJzaGEyNTYiOiIxMzgyODBmZDMzMDJiOTcwNjU5NjYyMTc2MTk0NWExYWU5NThmOTNhMTVlNDM3MmRkYWU0ZmMwMGE5M2IwOWEyIn19LHsibmFtZSI6ImEtbW9kdWxlLTEtMS4wLjAtbmVzLWphdmEtdGVzdC1saWItYS0xLjAuMTIuamFyIiwiZGlnZXN0Ijp7InNoYTI1NiI6ImNhYTAxNWVmNjllOWJjMzFhNDEzMjJkNmM3MTU2M2VkOTYwMGM3NWJiOTg4ZTRkNjM5YjFlZGM1Nzg1ODA1NTEifX0seyJuYW1lIjoiYS1tb2R1bGUtMS0xLjAuMC1uZXMtamF2YS10ZXN0LWxpYi1hLTEuMC4xMi5wb20iLCJkaWdlc3QiOnsic2hhMjU2IjoiYWZlOGIxMzZlY2VhZjRkNzgxYWM4MDYwNGRiZTc0OGVlNDZhNDA3NDYyZjNjM2EzOTUyYjFhOGM2MzA3ZGQ0NSJ9fSx7Im5hbWUiOiJhLW1vZHVsZS0yLTEuMC4wLW5lcy1qYXZhLXRlc3QtbGliLWEtMS4wLjEyLXNvdXJjZXMuamFyIiwiZGlnZXN0Ijp7InNoYTI1NiI6Ijk4NzBmZWZlYjE5OWU2ZWVhN2VlNWQ2Yjc5NjNiODg5NzEyZDAzNTk0Y2I4YmYxZDg2NjE1OTczYmIzMWM5YTcifX0seyJuYW1lIjoiYS1tb2R1bGUtMi0xLjAuMC1uZXMtamF2YS10ZXN0LWxpYi1hLTEuMC4xMi5qYXIiLCJkaWdlc3QiOnsic2hhMjU2IjoiMjY3ZmQ1NzUzMjExYzM2MjVhMDA3NWVlODFlMzM5MmI0OWQxNmJkMjNmNTk1OTIyYzQwNDI0OWQ3MWQwMzllMCJ9fSx7Im5hbWUiOiJhLW1vZHVsZS0yLTEuMC4wLW5lcy1qYXZhLXRlc3QtbGliLWEtMS4wLjEyLnBvbSIsImRpZ2VzdCI6eyJzaGEyNTYiOiI0NmQwN2NkOTA2NGI4NzFlMTY2ZjYwMDQ3MmMwMDc1YzEwMzMyNTc5NjlkYjIwODdmODNiYzFiNTRjZGM4NzMzIn19LHsibmFtZSI6ImEtbW9kdWxlLTMtMS4wLjAtbmVzLWphdmEtdGVzdC1saWItYS0xLjAuMTItc291cmNlcy5qYXIiLCJkaWdlc3QiOnsic2hhMjU2IjoiMGQyYzEwNjEwN2ZjM2ViOTdjZTZlMjFjNWVkMTkxMmJmZTY3NzRlNGNkNTc4Yjc0NGFmMzQzNTYxYjVkNTk3MSJ9fSx7Im5hbWUiOiJhLW1vZHVsZS0zLTEuMC4wLW5lcy1qYXZhLXRlc3QtbGliLWEtMS4wLjEyLmphciIsImRpZ2VzdCI6eyJzaGEyNTYiOiI0N2I2ZTA0YTFkYzQ5YjBiMzUzYmNiODA2NjQxMWQwMDE0MWViYWVkMGZhMjA4NmE2NTJjOTUzNDJhOGJiMTRhIn19LHsibmFtZSI6ImEtbW9kdWxlLTMtMS4wLjAtbmVzLWphdmEtdGVzdC1saWItYS0xLjAuMTIucG9tIiwiZGlnZXN0Ijp7InNoYTI1NiI6IjQ4NGNmMzE4ODYwYmUwODFjZDVlNGM4YzkwMmRkNGRmYjlhMWViN2NjZDBhZTliMzQ0MzFlZjEwMGUxNzIxZWIifX0seyJuYW1lIjoibmVzLWphdmEtdGVzdC1saWItYS0xLjAuMC1uZXMtamF2YS10ZXN0LWxpYi1hLTEuMC4xMi5wb20iLCJkaWdlc3QiOnsic2hhMjU2IjoiNWI4NTExNDExNTFkYmM5MzVlMzMyZDQ0ZTMwNTcxOTJkODc5YmNiYWQ3ZTA1Zjc5MjZkMzVlMzdjOTVmOTg0NiJ9fV0sInByZWRpY2F0ZVR5cGUiOiJodHRwczovL3Nsc2EuZGV2L3Byb3ZlbmFuY2UvdjEiLCJwcmVkaWNhdGUiOnsiYnVpbGREZWZpbml0aW9uIjp7ImJ1aWxkVHlwZSI6Imh0dHBzOi8vYWN0aW9ucy5naXRodWIuaW8vYnVpbGR0eXBlcy93b3JrZmxvdy92MSIsImV4dGVybmFsUGFyYW1ldGVycyI6eyJ3b3JrZmxvdyI6eyJyZWYiOiJyZWZzL3RhZ3MvbmVzLXYxLjAuMTIiLCJyZXBvc2l0b3J5IjoiaHR0cHM6Ly9naXRodWIuY29tL25ldmVyZW5kaW5nc3VwcG9ydC9uZXMtamF2YS10ZXN0LWxpYi1hIiwicGF0aCI6Ii5naXRodWIvd29ya2Zsb3dzL25lcy1yZWxlYXNlLnltbCJ9fSwiaW50ZXJuYWxQYXJhbWV0ZXJzIjp7ImdpdGh1YiI6eyJldmVudF9uYW1lIjoicHVzaCIsInJlcG9zaXRvcnlfaWQiOiIxMjk2NDI4NDE3IiwicmVwb3NpdG9yeV9vd25lcl9pZCI6IjExMzM5NDM5NiIsInJ1bm5lcl9lbnZpcm9ubWVudCI6ImdpdGh1Yi1ob3N0ZWQifX0sInJlc29sdmVkRGVwZW5kZW5jaWVzIjpbeyJ1cmkiOiJnaXQraHR0cHM6Ly9naXRodWIuY29tL25ldmVyZW5kaW5nc3VwcG9ydC9uZXMtamF2YS10ZXN0LWxpYi1hQHJlZnMvdGFncy9uZXMtdjEuMC4xMiIsImRpZ2VzdCI6eyJnaXRDb21taXQiOiJjYTM0MmU1Njc4Nzk4NmNkNGU4ZGZjMGM4ODMwNjk2NzE2ZDNiNDQxIn19XX0sInJ1bkRldGFpbHMiOnsiYnVpbGRlciI6eyJpZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9uZXZlcmVuZGluZ3N1cHBvcnQvc2xzYS1hdHRlc3RhdGlvbnMvLmdpdGh1Yi93b3JrZmxvd3MvYXR0ZXN0LnltbEA5ZjZkOWRjMWJmYzAyOTg2OTU1NzIxZWIxNWY4OWFkNjE4ZjFjZWRiIn0sIm1ldGFkYXRhIjp7Imludm9jYXRpb25JZCI6Imh0dHBzOi8vZ2l0aHViLmNvbS9uZXZlcmVuZGluZ3N1cHBvcnQvbmVzLWphdmEtdGVzdC1saWItYS9hY3Rpb25zL3J1bnMvMzAwNjY2OTg5NzUvYXR0ZW1wdHMvMyJ9fX19","payloadType":"application/vnd.in-toto+json","signatures":[{"sig":"MEYCIQCdMQAky8sN1kNzf0XmENcKFvUbANBpcUL1Dnx+0nV7NwIhAOz95buyD0Px3atfL85VsJTYehZQAsRC/8HLvTEdAhlL"}]}}