Merge branch 'main' into chore/cifuzz-perms

Author: arpitjain099

.github/workflows/ci.yaml

@@ -46,7 +46,7 @@ jobs:
           21
         distribution: 'temurin'
     - name: Setup Go environment
-      uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
+      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
       with:
         go-version: '1.25.x'
 

scripts/change_version.sh

@@ -6,6 +6,14 @@
 # this script is simple and should work for most usecases, but it may break if we do weird things
 set -Eeo pipefail
 
+sedi() {
+  if [ "$(uname)" = "Darwin" ]; then
+    sed -i "" "$@"
+  else
+    sed -i "$@"
+  fi
+}
+
 old_version=$(grep "^version=" gradle.properties | cut -d'=' -f2)
 other_old_version=$(grep "sigstoreJavaVersion.convention" sigstore-gradle/sigstore-gradle-sign-base-plugin/src/main/kotlin/dev/sigstore/sign/SigstoreSignExtension.kt | cut -d'"' -f2)
 if [[ "$old_version" != "$other_old_version" ]]; then
@@ -20,12 +28,12 @@ echo "old  : $old_version"
 echo "new  : $new_version"
 read -r -p "Run update? [y/N]: " yn
 go=${yn:-"n"}
-if [ "${go,,}" != "y" ]; then
+if [ "$go" != "y" ] && [ "$go" != "Y" ]; then
   echo "aborting"
   exit
 fi
 
 # update to latest dev version (change update_versions.sh if you change this section)
-sed -i "s/\(sigstoreJavaVersion.convention(\"\)$old_version/\1$new_version/" sigstore-gradle/sigstore-gradle-sign-base-plugin/src/main/kotlin/dev/sigstore/sign/SigstoreSignExtension.kt
-sed -i "s/version=$old_version/version=$new_version/" gradle.properties
+sedi "s/\(sigstoreJavaVersion.convention(\"\)$old_version/\1$new_version/" sigstore-gradle/sigstore-gradle-sign-base-plugin/src/main/kotlin/dev/sigstore/sign/SigstoreSignExtension.kt
+sedi "s/version=$old_version/version=$new_version/" gradle.properties
 

scripts/update_versions.sh

@@ -5,6 +5,14 @@
 # this script is simple and should work for most usecases, but it may break if we do weird things
 set -Eeo pipefail
 
+sedi() {
+  if [ "$(uname)" = "Darwin" ]; then
+    sed -i "" "$@"
+  else
+    sed -i "$@"
+  fi
+}
+
 calculated_release_version=$(grep "^version=" gradle.properties | cut -d'=' -f2)
 read -r -p "Enter released version [${calculated_release_version}]: " vin
 release_version=${vin:-${calculated_release_version}}
@@ -23,21 +31,21 @@ echo "latest  : $release_version"
 echo "next    : $next_version"
 read -r -p "Run update? [y/N]: " yn
 go=${yn:-"n"}
-if [ "${go,,}" != "y" ]; then
+if [ "$go" != "y" ] && [ "$go" != "Y" ]; then
   echo "aborting"
   exit
 fi
 
 # sed below is probably accepting .'s in versions as regex any chars, but this works for our purposes
 
 # updates to new release version
-sed -i "s/\(sigstore-gradle-sign-plugin:\)$previous_version/\1$release_version/" build-logic/publishing/build.gradle.kts
-sed -i "s/\(<version>\)$previous_version/\1$release_version/" sigstore-maven-plugin/README.md
-sed -i "s/\(dev.sigstore.sign\") version \"\)$previous_version/\1$release_version/" sigstore-gradle/README.md
-sed -i "s/\(sigstore.version.*\)$previous_version/\1$release_version/" examples/hello-world/build.gradle.kts
-sed -i "s/\(<sigstore.version>\)$previous_version/\1$release_version/" examples/hello-world/pom.xml
+sedi "s/\(sigstore-gradle-sign-plugin:\)$previous_version/\1$release_version/" build-logic/publishing/build.gradle.kts
+sedi "s/\(<version>\)$previous_version/\1$release_version/" sigstore-maven-plugin/README.md
+sedi "s/\(dev.sigstore.sign\") version \"\)$previous_version/\1$release_version/" sigstore-gradle/README.md
+sedi "s/\(sigstore.version.*\)$previous_version/\1$release_version/" examples/hello-world/build.gradle.kts
+sedi "s/\(<sigstore.version>\)$previous_version/\1$release_version/" examples/hello-world/pom.xml
 
 # update to latest dev version (change change_version.sh if you change this section)
-sed -i "s/\(sigstoreJavaVersion.convention(\"\)$release_version/\1$next_version/" sigstore-gradle/sigstore-gradle-sign-base-plugin/src/main/kotlin/dev/sigstore/sign/SigstoreSignExtension.kt
-sed -i "s/version=$release_version/version=$next_version/" gradle.properties
+sedi "s/\(sigstoreJavaVersion.convention(\"\)$release_version/\1$next_version/" sigstore-gradle/sigstore-gradle-sign-base-plugin/src/main/kotlin/dev/sigstore/sign/SigstoreSignExtension.kt
+sedi "s/version=$release_version/version=$next_version/" gradle.properties
 

sigstore-java/src/main/java/dev/sigstore/encryption/signers/EcdsaVerifier.java

@@ -15,15 +15,18 @@
  */
 package dev.sigstore.encryption.signers;
 
+import dev.sigstore.AlgorithmRegistry;
 import java.security.*;
 
 /** ECDSA verifier, instantiated by {@link Verifiers#newVerifier(PublicKey)}. */
 public class EcdsaVerifier implements Verifier {
 
   private final PublicKey publicKey;
+  private final AlgorithmRegistry.HashAlgorithm hashAlgorithm;
 
-  EcdsaVerifier(PublicKey publicKey) {
+  EcdsaVerifier(PublicKey publicKey, AlgorithmRegistry.HashAlgorithm hashAlgorithm) {
     this.publicKey = publicKey;
+    this.hashAlgorithm = hashAlgorithm;
   }
 
   @Override
@@ -34,7 +37,7 @@ public PublicKey getPublicKey() {
   @Override
   public boolean verify(byte[] artifact, byte[] signature)
       throws NoSuchAlgorithmException, InvalidKeyException, SignatureException {
-    var verifier = Signature.getInstance("SHA256withECDSA");
+    var verifier = Signature.getInstance(hashAlgorithm + "withECDSA");
     verifier.initVerify(publicKey);
     verifier.update(artifact);
     return verifier.verify(signature);

sigstore-java/src/main/java/dev/sigstore/encryption/signers/RsaVerifier.java

@@ -15,15 +15,18 @@
  */
 package dev.sigstore.encryption.signers;
 
+import dev.sigstore.AlgorithmRegistry;
 import java.security.*;
 
 /** RSA verifier, instantiated by {@link Verifiers#newVerifier(PublicKey)}. */
 public class RsaVerifier implements Verifier {
 
   private final PublicKey publicKey;
+  private final AlgorithmRegistry.HashAlgorithm hashAlgorithm;
 
-  RsaVerifier(PublicKey publicKey) {
+  RsaVerifier(PublicKey publicKey, AlgorithmRegistry.HashAlgorithm hashAlgorithm) {
     this.publicKey = publicKey;
+    this.hashAlgorithm = hashAlgorithm;
   }
 
   @Override
@@ -34,7 +37,7 @@ public PublicKey getPublicKey() {
   @Override
   public boolean verify(byte[] artifact, byte[] signature)
       throws NoSuchAlgorithmException, InvalidKeyException, SignatureException {
-    var verifier = Signature.getInstance("SHA256withRSA");
+    var verifier = Signature.getInstance(hashAlgorithm + "withRSA");
     verifier.initVerify(publicKey);
     verifier.update(artifact);
     return verifier.verify(signature);

sigstore-java/src/main/java/dev/sigstore/encryption/signers/Verifiers.java

@@ -15,6 +15,7 @@
  */
 package dev.sigstore.encryption.signers;
 
+import dev.sigstore.AlgorithmRegistry;
 import java.security.NoSuchAlgorithmException;
 import java.security.PublicKey;
 import org.bouncycastle.asn1.ASN1ObjectIdentifier;
@@ -25,10 +26,10 @@ public class Verifiers {
   /** Returns a new verifier for the provided public key to use during verification. */
   public static Verifier newVerifier(PublicKey publicKey) throws NoSuchAlgorithmException {
     if (publicKey.getAlgorithm().equals("RSA")) {
-      return new RsaVerifier(publicKey);
+      return new RsaVerifier(publicKey, AlgorithmRegistry.HashAlgorithm.SHA2_256);
     }
     if (publicKey.getAlgorithm().equals("EC") || publicKey.getAlgorithm().equals("ECDSA")) {
-      return new EcdsaVerifier(publicKey);
+      return new EcdsaVerifier(publicKey, AlgorithmRegistry.HashAlgorithm.SHA2_256);
     }
     if (publicKey.getAlgorithm().equals("Ed25519")) {
       return new Ed25519Verifier(publicKey);

sigstore-testkit/src/main/java/dev/sigstore/testkit/oidc/ConformanceTestingTokenProvider.java

@@ -30,18 +30,26 @@
  */
 public class ConformanceTestingTokenProvider implements TokenStringOidcClient.TokenStringProvider {
 
-  public static ConformanceTestingTokenProvider newProvider() {
-    return new ConformanceTestingTokenProvider();
+  public static ConformanceTestingTokenProvider newProviderFromGithub() {
+    return new ConformanceTestingTokenProvider(
+        "https://raw.githubusercontent.com/sigstore-conformance/extremely-dangerous-public-oidc-beacon/refs/heads/current-token/oidc-token.txt");
   }
 
-  private ConformanceTestingTokenProvider() {}
+  public static ConformanceTestingTokenProvider newProviderFromGcp() {
+    return new ConformanceTestingTokenProvider(
+        "https://storage.googleapis.com/sigstore-conformance-testing-token/untrusted-testing-token.txt");
+  }
+
+  private final String tokenUrl;
+
+  private ConformanceTestingTokenProvider(String tokenUrl) {
+    this.tokenUrl = tokenUrl;
+  }
 
   @Override
   public String getTokenString() throws Exception {
     HttpClient client = HttpClient.newBuilder().followRedirects(HttpClient.Redirect.NORMAL).build();
-    URI fileUri =
-        new URI(
-            "https://raw.githubusercontent.com/sigstore-conformance/extremely-dangerous-public-oidc-beacon/refs/heads/current-token/oidc-token.txt");
+    URI fileUri = new URI(tokenUrl);
     HttpRequest request =
         HttpRequest.newBuilder()
             .uri(fileUri)