PR sigstore#1252 review suggestions fixed

* Only when there are no CT Logs (private deployment) we can skip SCT verification

Author: anthonydahanne

sigstore-java/src/main/java/dev/sigstore/KeylessVerifier.java

@@ -132,9 +132,8 @@ public Builder trustedRootProvider(TrustedRootProvider trustedRootProvider) {
   private AlgorithmRegistry.HashAlgorithm findHashAlgorithm(Bundle bundle)
       throws KeylessVerificationException {
     try {
-      // rekor 0.0.1 hashedrekord entries encode the hash algorithm in the entry itself. Others
-      // (rekor 0.0.2, a bundle with no transparency-log entry) derive it from the signing
-      // certificate's public key.
+      // special case hashedrekord:0.0.1 and dsse:0.0.1 which may contain legacy public key to hash
+      // algorithm mappings
       if (!bundle.getEntries().isEmpty()) {
         var rekorEntry = bundle.getEntries().get(0);
         var body = rekorEntry.getBodyDecoded();

sigstore-java/src/main/java/dev/sigstore/bundle/BundleReader.java

@@ -50,7 +50,6 @@ static Bundle readBundle(Reader jsonReader) throws BundleParseException {
 
     bundleBuilder.mediaType(protoBundle.getMediaType());
 
-    // A bundle may skip tlog entries in private environments that don't require them.
     for (var bundleEntry : protoBundle.getVerificationMaterial().getTlogEntriesList()) {
       if (!bundleEntry.hasInclusionProof()) {
         // all consumed bundles must have an inclusion proof

sigstore-java/src/main/java/dev/sigstore/fulcio/client/FulcioVerifier.java

@@ -96,7 +96,17 @@ private FulcioVerifier(
 
   @VisibleForTesting
   void verifySct(CertPath fullCertPath) throws FulcioVerificationException {
-    if (ctLogs.size() == 0) {
+    verifySct(fullCertPath, CTLogOptions.builder().isEnabled(true).build());
+  }
+
+  @VisibleForTesting
+  void verifySct(CertPath fullCertPath, CTLogOptions ctLogOptions)
+      throws FulcioVerificationException {
+    if (ctLogs.isEmpty()) {
+      // Only when there are no CT Logs (private deployment) we can skip SCT verification
+      if (!ctLogOptions.isEnabled()) {
+        return;
+      }
       throw new FulcioVerificationException("No ct logs were provided to verifier");
     }
 
@@ -155,16 +165,13 @@ public void verifySigningCertificate(CertPath signingCertificate)
   }
 
   /**
-   * Verify a signing certificate, applying the given certificate-transparency policy. When SCT
-   * verification is disabled (ex: a private deployment without CT logs) the SCT check is skipped.
+   * Verify a signing certificate, applying the given certificate-transparency policy (see {@link
+   * #verifySct(CertPath, CTLogOptions)}).
    */
   public void verifySigningCertificate(CertPath signingCertificate, CTLogOptions ctLogOptions)
       throws FulcioVerificationException, IOException {
     CertPath fullCertPath = validateCertPath(signingCertificate);
-    if (!ctLogOptions.isEnabled()) {
-      return;
-    }
-    verifySct(fullCertPath);
+    verifySct(fullCertPath, ctLogOptions);
   }
 
   public CertPath trimTrustedParent(CertPath signingCertificate)