Merge pull request #1201 from sigstore/ts-algo-reg

Ts algo reg

Author: loosebazooka

sigstore-java/src/main/java/dev/sigstore/KeylessSigner.java

@@ -59,7 +59,6 @@
 import dev.sigstore.rekor.client.RekorVerifier;
 import dev.sigstore.rekor.v2.client.RekorV2Client;
 import dev.sigstore.rekor.v2.client.RekorV2ClientHttp;
-import dev.sigstore.timestamp.client.HashAlgorithm;
 import dev.sigstore.timestamp.client.ImmutableTimestampRequest;
 import dev.sigstore.timestamp.client.TimestampClient;
 import dev.sigstore.timestamp.client.TimestampClientHttp;
@@ -472,7 +471,7 @@ public List<Bundle> sign(List<byte[]> artifactDigests) throws KeylessSignerExcep
 
         var tsReq =
             ImmutableTimestampRequest.builder()
-                .hashAlgorithm(HashAlgorithm.from(signingAlgorithm.getHashAlgorithm()))
+                .hashAlgorithm(signingAlgorithm.getHashAlgorithm())
                 .hash(signatureDigest)
                 .build();
 
@@ -804,7 +803,7 @@ public Bundle attest(String payload) throws KeylessSignerException {
 
     var tsReq =
         ImmutableTimestampRequest.builder()
-            .hashAlgorithm(HashAlgorithm.from(signingAlgorithm.getHashAlgorithm()))
+            .hashAlgorithm(signingAlgorithm.getHashAlgorithm())
             .hash(signatureDigest)
             .build();
 

sigstore-java/src/main/java/dev/sigstore/timestamp/client/HashAlgorithm.java

@@ -16,53 +16,38 @@
 package dev.sigstore.timestamp.client;
 
 import dev.sigstore.AlgorithmRegistry;
+import dev.sigstore.UnsupportedAlgorithmException;
 import org.bouncycastle.asn1.ASN1ObjectIdentifier;
 import org.bouncycastle.tsp.TSPAlgorithms;
 
 /** Supported hash algorithms for timestamp requests. */
-public enum HashAlgorithm {
-  SHA256("SHA256", TSPAlgorithms.SHA256),
-  SHA384("SHA384", TSPAlgorithms.SHA384),
-  SHA512("SHA512", TSPAlgorithms.SHA512);
+public class HashAlgorithm {
+  private HashAlgorithm() {}
 
-  private final String algorithmName;
-  private final ASN1ObjectIdentifier oid;
-
-  HashAlgorithm(String algorithmName, ASN1ObjectIdentifier oid) {
-    this.algorithmName = algorithmName;
-    this.oid = oid;
-  }
-
-  public String getAlgorithmName() {
-    return algorithmName;
-  }
-
-  public ASN1ObjectIdentifier getOid() {
-    return oid;
-  }
-
-  public static HashAlgorithm from(ASN1ObjectIdentifier oid)
-      throws UnsupportedHashAlgorithmException {
-    for (HashAlgorithm value : values()) {
-      if (value.getOid().equals(oid)) {
-        return value;
-      }
-    }
-    throw new UnsupportedHashAlgorithmException(oid.getId());
-  }
-
-  // this is just temporary to avoid messing with the timestamp package too much while we
-  // transition, this enum
-  // should really just be using AlgorithmRegistry as much as possible
-  public static HashAlgorithm from(AlgorithmRegistry.HashAlgorithm hashAlgorithm) {
+  public static ASN1ObjectIdentifier toOid(AlgorithmRegistry.HashAlgorithm hashAlgorithm) {
     switch (hashAlgorithm) {
       case SHA2_256:
-        return SHA256;
+        return TSPAlgorithms.SHA256;
       case SHA2_384:
-        return SHA384;
+        return TSPAlgorithms.SHA384;
       case SHA2_512:
-        return SHA512;
+        return TSPAlgorithms.SHA512;
     }
     throw new IllegalArgumentException();
   }
+
+  public static AlgorithmRegistry.HashAlgorithm fromOid(ASN1ObjectIdentifier oid)
+      throws UnsupportedAlgorithmException {
+    if (oid.equals(TSPAlgorithms.SHA256)) {
+      return AlgorithmRegistry.HashAlgorithm.SHA2_256;
+    }
+    if (oid.equals(TSPAlgorithms.SHA384)) {
+      return AlgorithmRegistry.HashAlgorithm.SHA2_384;
+    }
+    if (oid.equals(TSPAlgorithms.SHA512)) {
+      return AlgorithmRegistry.HashAlgorithm.SHA2_512;
+    }
+    throw new UnsupportedAlgorithmException(
+        "Unsupported timestamp hashing algorithm oid: " + oid.getId());
+  }
 }

sigstore-java/src/main/java/dev/sigstore/timestamp/client/TimestampClientHttp.java

@@ -81,7 +81,7 @@ public TimestampResponse timestamp(TimestampRequest tsReq) throws TimestampExcep
     TimeStampRequestGenerator bcTsReqGen = new TimeStampRequestGenerator();
 
     // Prepare and send the timestamp request
-    var bcAlgorithmOid = tsReq.getHashAlgorithm().getOid();
+    var bcAlgorithmOid = HashAlgorithm.toOid(tsReq.getHashAlgorithm());
     var artifactHashBytes = tsReq.getHash();
     var nonce = tsReq.getNonce();
     bcTsReqGen.setCertReq(tsReq.requestCertificates());

sigstore-java/src/main/java/dev/sigstore/timestamp/client/TimestampRequest.java

@@ -15,6 +15,7 @@
  */
 package dev.sigstore.timestamp.client;
 
+import dev.sigstore.AlgorithmRegistry;
 import java.math.BigInteger;
 import java.security.SecureRandom;
 import org.immutables.value.Value;
@@ -23,7 +24,7 @@
 @Immutable
 public interface TimestampRequest {
   /** The hash algorithm used to hash the artifact. */
-  HashAlgorithm getHashAlgorithm();
+  AlgorithmRegistry.HashAlgorithm getHashAlgorithm();
 
   /**
    * The hash of the artifact to be timestamped. For sigstore-java, this typically refers to the

sigstore-java/src/main/java/dev/sigstore/timestamp/client/TimestampVerifier.java

@@ -15,7 +15,9 @@
  */
 package dev.sigstore.timestamp.client;
 
-import com.google.common.hash.Hashing;
+import dev.sigstore.AlgorithmRegistry;
+import dev.sigstore.UnsupportedAlgorithmException;
+import dev.sigstore.encryption.Hashers;
 import dev.sigstore.encryption.certificates.Certificates;
 import dev.sigstore.trustroot.CertificateAuthority;
 import dev.sigstore.trustroot.SigstoreTrustedRoot;
@@ -147,26 +149,13 @@ public void verify(TimestampResponse tsResp, byte[] artifact)
 
     // Validate the message imprint digest in the token
     var oid = tsToken.getTimeStampInfo().getMessageImprintAlgOID();
-    HashAlgorithm hashAlgorithm;
+    AlgorithmRegistry.HashAlgorithm hashAlgorithm;
     try {
-      hashAlgorithm = HashAlgorithm.from(oid);
-    } catch (UnsupportedHashAlgorithmException e) {
+      hashAlgorithm = HashAlgorithm.fromOid(oid);
+    } catch (UnsupportedAlgorithmException e) {
       throw new TimestampVerificationException(e);
     }
-    byte[] artifactDigest;
-    switch (hashAlgorithm) {
-      case SHA256:
-        artifactDigest = Hashing.sha256().hashBytes(artifact).asBytes();
-        break;
-      case SHA384:
-        artifactDigest = Hashing.sha384().hashBytes(artifact).asBytes();
-        break;
-      case SHA512:
-        artifactDigest = Hashing.sha512().hashBytes(artifact).asBytes();
-        break;
-      default:
-        throw new IllegalStateException(); // We shouldn't be here.
-    }
+    byte[] artifactDigest = Hashers.from(hashAlgorithm).hashBytes(artifact).asBytes();
     validateTokenMessageImprintDigest(tsToken, artifactDigest);
   }
 

sigstore-java/src/main/java/dev/sigstore/timestamp/client/UnsupportedHashAlgorithmException.java

@@ -0,0 +1,58 @@
+/*
+ * Copyright 2026 The Sigstore Authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package dev.sigstore.timestamp.client;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+
+import dev.sigstore.AlgorithmRegistry;
+import dev.sigstore.UnsupportedAlgorithmException;
+import org.bouncycastle.asn1.ASN1ObjectIdentifier;
+import org.bouncycastle.tsp.TSPAlgorithms;
+import org.junit.jupiter.api.Test;
+
+public class HashAlgorithmTest {
+
+  @Test
+  public void toOid_success() {
+    assertEquals(
+        TSPAlgorithms.SHA256, HashAlgorithm.toOid(AlgorithmRegistry.HashAlgorithm.SHA2_256));
+    assertEquals(
+        TSPAlgorithms.SHA384, HashAlgorithm.toOid(AlgorithmRegistry.HashAlgorithm.SHA2_384));
+    assertEquals(
+        TSPAlgorithms.SHA512, HashAlgorithm.toOid(AlgorithmRegistry.HashAlgorithm.SHA2_512));
+  }
+
+  @Test
+  public void fromOid_success() throws Exception {
+    assertEquals(
+        AlgorithmRegistry.HashAlgorithm.SHA2_256, HashAlgorithm.fromOid(TSPAlgorithms.SHA256));
+    assertEquals(
+        AlgorithmRegistry.HashAlgorithm.SHA2_384, HashAlgorithm.fromOid(TSPAlgorithms.SHA384));
+    assertEquals(
+        AlgorithmRegistry.HashAlgorithm.SHA2_512, HashAlgorithm.fromOid(TSPAlgorithms.SHA512));
+  }
+
+  @Test
+  public void fromOid_unsupported() {
+    ASN1ObjectIdentifier unsupportedOid = new ASN1ObjectIdentifier("1.2.840.113549.2.5"); // MD5 OID
+    UnsupportedAlgorithmException exception =
+        assertThrows(
+            UnsupportedAlgorithmException.class, () -> HashAlgorithm.fromOid(unsupportedOid));
+    assertEquals(
+        "Unsupported timestamp hashing algorithm oid: 1.2.840.113549.2.5", exception.getMessage());
+  }
+}

sigstore-java/src/test/java/dev/sigstore/timestamp/client/HashAlgorithmTest.java

@@ -21,6 +21,7 @@
 import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
+import dev.sigstore.AlgorithmRegistry;
 import dev.sigstore.trustroot.Service;
 import dev.sigstore.tuf.SigstoreTufClient;
 import java.nio.charset.StandardCharsets;
@@ -45,7 +46,7 @@ public static void setup() throws Exception {
     tsReq =
         ImmutableTimestampRequest.builder()
             .hash(artifactHashBytes)
-            .hashAlgorithm(HashAlgorithm.SHA256)
+            .hashAlgorithm(AlgorithmRegistry.HashAlgorithm.SHA2_256)
             .build();
   }
 
@@ -74,7 +75,7 @@ public void timestamp_success() throws Exception {
 
     assertEquals(tsReq.getNonce(), tsInfo.getNonce());
 
-    var expectedOid = tsReq.getHashAlgorithm().getOid();
+    var expectedOid = HashAlgorithm.toOid(tsReq.getHashAlgorithm());
     assertEquals(expectedOid, tsInfo.getMessageImprintAlgOID());
   }
 
@@ -83,7 +84,7 @@ public void timestamp_failure_badResponse_incorrectDigestLength() throws Excepti
     var tsReqWithIncorrectDigestLength =
         ImmutableTimestampRequest.builder()
             .hash(tsReq.getHash())
-            .hashAlgorithm(HashAlgorithm.SHA512)
+            .hashAlgorithm(AlgorithmRegistry.HashAlgorithm.SHA2_512)
             .nonce(tsReq.getNonce())
             .build();