From c7e45bf325622167c9eaf7ed153e0597238af381 Mon Sep 17 00:00:00 2001 From: Aaron Lew <64337293+aaronlew02@users.noreply.github.com> Date: Wed, 9 Sep 2026 09:39:10 -0400 Subject: [PATCH] refactor: extract sigstore-common module Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com> --- config/forbiddenApis.txt | 6 +- .../java/fuzzing/JsonCanonicalizerFuzzer.java | 4 +- settings.gradle.kts | 1 + sigstore-common/build.gradle.kts | 56 +++++++++++++++++ .../common}/forbidden/SuppressForbidden.java | 2 +- .../sigstore/common}/http/HttpClients.java | 4 +- .../dev/sigstore/common}/http/HttpParams.java | 4 +- .../dev/sigstore/common}/http/URIFormat.java | 4 +- .../http/UnsuccessfulResponseHandler.java | 2 +- .../common}/json/GsonByteArrayAdapter.java | 2 +- .../sigstore/common}/json/GsonChecked.java | 2 +- .../common}/json/JsonParseException.java | 2 +- .../json/canonicalizer/JsonCanonicalizer.java | 2 +- .../json/canonicalizer/NumberToJSON.java | 2 +- .../json/canonicalizer/package-info.java | 6 +- .../sigstore/common}/http/URIFormatTest.java | 2 +- .../http/UnsuccessfulResponseHandlerTest.java | 2 +- .../build.gradle.kts | 1 + .../build.gradle.kts | 1 + sigstore-java/build.gradle.kts | 15 +---- .../main/java/dev/sigstore/KeylessSigner.java | 2 +- .../java/dev/sigstore/KeylessVerifier.java | 2 +- .../dev/sigstore/bundle/BundleWriter.java | 2 +- .../java/dev/sigstore/dsse/InTotoPayload.java | 2 +- .../fulcio/client/FulcioClientGrpc.java | 3 +- .../fulcio/client/FulcioClientHttp.java | 6 +- .../{http => fulcio/client}/GrpcChannels.java | 3 +- .../java/dev/sigstore/json/GsonSupplier.java | 4 +- .../java/dev/sigstore/json/ProtoJson.java | 2 +- .../oidc/client/GithubActionsOidcClient.java | 4 +- .../sigstore/oidc/client/WebOidcClient.java | 6 +- .../sigstore/rekor/client/RekorClient.java | 2 +- .../rekor/client/RekorClientHttp.java | 8 +-- .../dev/sigstore/rekor/client/RekorEntry.java | 2 +- .../sigstore/rekor/client/RekorResponse.java | 2 +- .../dev/sigstore/rekor/client/RekorTypes.java | 2 +- .../rekor/v2/client/RekorV2ClientHttp.java | 8 +-- .../timestamp/client/TimestampClientHttp.java | 4 +- .../dev/sigstore/tuf/FileSystemTufStore.java | 2 +- .../java/dev/sigstore/tuf/HttpFetcher.java | 6 +- .../java/dev/sigstore/tuf/MetaFetcher.java | 2 +- .../java/dev/sigstore/tuf/MetaReader.java | 2 +- .../tuf/PassthroughCacheMetaStore.java | 2 +- .../dev/sigstore/tuf/SigstoreTufClient.java | 4 +- .../dev/sigstore/tuf/TrustedMetaStore.java | 2 +- .../main/java/dev/sigstore/tuf/Updater.java | 2 +- .../sigstore/tuf/json/TufGsonSupplier.java | 6 +- .../java/dev/sigstore/tuf/model/Root.java | 2 +- .../dev/sigstore/tuf/model/SignedTufMeta.java | 4 +- .../java/dev/sigstore/tuf/model/Snapshot.java | 2 +- .../java/dev/sigstore/tuf/model/Targets.java | 2 +- .../dev/sigstore/tuf/model/Timestamp.java | 2 +- .../test/java/dev/sigstore/KeylessTest.java | 2 +- .../fulcio/client/FulcioClientTest.java | 2 +- .../dev/sigstore/json/GsonSupplierTest.java | 2 + .../dev/sigstore/testing/FulcioWrapper.java | 2 +- .../java/dev/sigstore/tuf/UpdaterTest.java | 4 +- .../tuf/json/TufGsonSupplierTest.java | 4 +- .../tuf/model/TestTufJsonLoading.java | 2 +- sigstore-maven-plugin/build.gradle.kts | 1 + .../plugin/test/MavenTestProject.java | 62 ++++++++++++++++--- .../src/test/resources/maven/settings.xml | 14 ++--- .../sigstore/testkit/tuf/TestResources.java | 2 +- 63 files changed, 206 insertions(+), 115 deletions(-) create mode 100644 sigstore-common/build.gradle.kts rename {sigstore-java/src/main/java/dev/sigstore => sigstore-common/src/main/java/dev/sigstore/common}/forbidden/SuppressForbidden.java (96%) rename {sigstore-java/src/main/java/dev/sigstore => sigstore-common/src/main/java/dev/sigstore/common}/http/HttpClients.java (97%) rename {sigstore-java/src/main/java/dev/sigstore => sigstore-common/src/main/java/dev/sigstore/common}/http/HttpParams.java (95%) rename {sigstore-java/src/main/java/dev/sigstore => sigstore-common/src/main/java/dev/sigstore/common}/http/URIFormat.java (96%) rename {sigstore-java/src/main/java/dev/sigstore => sigstore-common/src/main/java/dev/sigstore/common}/http/UnsuccessfulResponseHandler.java (99%) rename {sigstore-java/src/main/java/dev/sigstore => sigstore-common/src/main/java/dev/sigstore/common}/json/GsonByteArrayAdapter.java (97%) rename {sigstore-java/src/main/java/dev/sigstore => sigstore-common/src/main/java/dev/sigstore/common}/json/GsonChecked.java (98%) rename {sigstore-java/src/main/java/dev/sigstore => sigstore-common/src/main/java/dev/sigstore/common}/json/JsonParseException.java (95%) rename {sigstore-java/src/main/java/dev/sigstore => sigstore-common/src/main/java/dev/sigstore/common}/json/canonicalizer/JsonCanonicalizer.java (99%) rename {sigstore-java/src/main/java/dev/sigstore => sigstore-common/src/main/java/dev/sigstore/common}/json/canonicalizer/NumberToJSON.java (99%) rename {sigstore-java/src/main/java/dev/sigstore => sigstore-common/src/main/java/dev/sigstore/common}/json/canonicalizer/package-info.java (73%) rename {sigstore-java/src/test/java/dev/sigstore => sigstore-common/src/test/java/dev/sigstore/common}/http/URIFormatTest.java (99%) rename {sigstore-java/src/test/java/dev/sigstore => sigstore-common/src/test/java/dev/sigstore/common}/http/UnsuccessfulResponseHandlerTest.java (99%) rename sigstore-java/src/main/java/dev/sigstore/{http => fulcio/client}/GrpcChannels.java (96%) diff --git a/config/forbiddenApis.txt b/config/forbiddenApis.txt index 26e39614d..7e07a5d4b 100644 --- a/config/forbiddenApis.txt +++ b/config/forbiddenApis.txt @@ -1,5 +1,5 @@ com.google.protobuf.util.JsonFormat#parser() @ Use dev.sigstore.json.ProtoJson#parser() instead -dev.sigstore.http.HttpClients#newHttpTransport(dev.sigstore.http.HttpParams) @ Use dev.sigstore.http.HttpClients#newRequestFactory(...) instead +dev.sigstore.common.http.HttpClients#newHttpTransport(dev.sigstore.common.http.HttpParams) @ Use dev.sigstore.common.http.HttpClients#newRequestFactory(...) instead com.google.gson.GsonBuilder @ Use dev.sigstore.json.GsonSupplier.GSON instead -java.net.URI#resolve(java.lang.String) @ Use dev.sigstore.http.URIFormat#appendPath(java.net.URI, java.lang.String) instead -java.net.URI#resolve(java.net.URI) @ Use dev.sigstore.http.URIFormat#appendPath(java.net.URI, java.lang.String) instead +java.net.URI#resolve(java.lang.String) @ Use dev.sigstore.common.http.URIFormat#appendPath(java.net.URI, java.lang.String) instead +java.net.URI#resolve(java.net.URI) @ Use dev.sigstore.common.http.URIFormat#appendPath(java.net.URI, java.lang.String) instead diff --git a/fuzzing/src/main/java/fuzzing/JsonCanonicalizerFuzzer.java b/fuzzing/src/main/java/fuzzing/JsonCanonicalizerFuzzer.java index 0d8df8de8..88c04d6fd 100644 --- a/fuzzing/src/main/java/fuzzing/JsonCanonicalizerFuzzer.java +++ b/fuzzing/src/main/java/fuzzing/JsonCanonicalizerFuzzer.java @@ -16,8 +16,8 @@ package fuzzing; import com.code_intelligence.jazzer.api.FuzzedDataProvider; -import dev.sigstore.json.canonicalizer.JsonCanonicalizer; -import dev.sigstore.json.canonicalizer.NumberToJSON; +import dev.sigstore.common.json.canonicalizer.JsonCanonicalizer; +import dev.sigstore.common.json.canonicalizer.NumberToJSON; import java.io.IOException; import java.nio.charset.StandardCharsets; diff --git a/settings.gradle.kts b/settings.gradle.kts index 484c5b53b..5500514d8 100644 --- a/settings.gradle.kts +++ b/settings.gradle.kts @@ -13,6 +13,7 @@ if (!System.getenv("CIFUZZ").equals("true", ignoreCase = true) && JavaVersion.cu includeBuild("build-logic-commons") includeBuild("build-logic") +include("sigstore-common") include("sigstore-java") include("sigstore-gradle:sigstore-gradle-sign-base-plugin") include("sigstore-gradle:sigstore-gradle-sign-plugin") diff --git a/sigstore-common/build.gradle.kts b/sigstore-common/build.gradle.kts new file mode 100644 index 000000000..84d8b8055 --- /dev/null +++ b/sigstore-common/build.gradle.kts @@ -0,0 +1,56 @@ +plugins { + id("build-logic.java-published-library") + id("build-logic.test-junit5") + id("build-logic.build-info") +} + +description = "Common utilities for Sigstore Java" + +tasks.jar { + manifest { + attributes["Automatic-Module-Name"] = "dev.sigstore.common" + } +} + +dependencies { + compileOnly("org.immutables:value-annotations:2.12.2") + annotationProcessor("org.immutables:value:2.12.2") + api(platform("com.google.http-client:google-http-client-bom:2.2.0")) + api("com.google.http-client:google-http-client-apache-v5") + api("com.google.http-client:google-http-client-gson") + + api("io.github.erdtman:java-json-canonicalization:1.1") + api("com.google.code.gson:gson:2.14.0") + implementation("com.google.guava:guava:33.7.1-jre") + + testImplementation(platform("org.junit:junit-bom:5.14.4")) + testRuntimeOnly("org.junit.jupiter:junit-jupiter-engine") + testImplementation("org.assertj:assertj-core:3.27.7") + testImplementation(platform("org.mockito:mockito-bom:5.23.0")) + testImplementation("org.mockito:mockito-core") + testImplementation("org.mockito:mockito-junit-jupiter") +} + +forbiddenApis { + signaturesFiles = files("$rootDir/config/forbiddenApis.txt") + suppressAnnotations = setOf("dev.sigstore.common.forbidden.SuppressForbidden") + ignoreSignaturesOfMissingClasses = true +} + +tasks.generateBuildInfo { + packageName.set("dev.sigstore.common.buildinfo") +} + +spotless { + java { + targetExclude( + "build/**/*.java", + "src/*/java/dev/sigstore/common/json/canonicalizer/*.java", + ) + } + format("webPki", com.diffplug.gradle.spotless.JavaExtension::class.java) { + googleJavaFormat("1.35.0") + licenseHeaderFile("$rootDir/config/webPKILicenseHeader") + target("src/*/java/dev/sigstore/common/json/canonicalizer/*.java") + } +} diff --git a/sigstore-java/src/main/java/dev/sigstore/forbidden/SuppressForbidden.java b/sigstore-common/src/main/java/dev/sigstore/common/forbidden/SuppressForbidden.java similarity index 96% rename from sigstore-java/src/main/java/dev/sigstore/forbidden/SuppressForbidden.java rename to sigstore-common/src/main/java/dev/sigstore/common/forbidden/SuppressForbidden.java index 33bb9e77c..638ff9aec 100644 --- a/sigstore-java/src/main/java/dev/sigstore/forbidden/SuppressForbidden.java +++ b/sigstore-common/src/main/java/dev/sigstore/common/forbidden/SuppressForbidden.java @@ -13,7 +13,7 @@ * See the License for the specific language governing permissions and * limitations under the License. */ -package dev.sigstore.forbidden; +package dev.sigstore.common.forbidden; import java.lang.annotation.ElementType; import java.lang.annotation.Retention; diff --git a/sigstore-java/src/main/java/dev/sigstore/http/HttpClients.java b/sigstore-common/src/main/java/dev/sigstore/common/http/HttpClients.java similarity index 97% rename from sigstore-java/src/main/java/dev/sigstore/http/HttpClients.java rename to sigstore-common/src/main/java/dev/sigstore/common/http/HttpClients.java index 1c62d7213..93025125e 100644 --- a/sigstore-java/src/main/java/dev/sigstore/http/HttpClients.java +++ b/sigstore-common/src/main/java/dev/sigstore/common/http/HttpClients.java @@ -13,7 +13,7 @@ * See the License for the specific language governing permissions and * limitations under the License. */ -package dev.sigstore.http; +package dev.sigstore.common.http; import com.google.api.client.http.HttpBackOffIOExceptionHandler; import com.google.api.client.http.HttpRequestFactory; @@ -21,7 +21,7 @@ import com.google.api.client.http.apache.v5.Apache5HttpTransport; import com.google.api.client.util.ExponentialBackOff; import com.google.api.client.util.ObjectParser; -import dev.sigstore.forbidden.SuppressForbidden; +import dev.sigstore.common.forbidden.SuppressForbidden; import javax.annotation.Nullable; import org.apache.hc.client5.http.config.ConnectionConfig; import org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManagerBuilder; diff --git a/sigstore-java/src/main/java/dev/sigstore/http/HttpParams.java b/sigstore-common/src/main/java/dev/sigstore/common/http/HttpParams.java similarity index 95% rename from sigstore-java/src/main/java/dev/sigstore/http/HttpParams.java rename to sigstore-common/src/main/java/dev/sigstore/common/http/HttpParams.java index acef7d9db..007f67d22 100644 --- a/sigstore-java/src/main/java/dev/sigstore/http/HttpParams.java +++ b/sigstore-common/src/main/java/dev/sigstore/common/http/HttpParams.java @@ -13,10 +13,10 @@ * See the License for the specific language governing permissions and * limitations under the License. */ -package dev.sigstore.http; +package dev.sigstore.common.http; import com.google.api.client.util.Preconditions; -import dev.sigstore.buildinfo.BuildInfo; +import dev.sigstore.common.buildinfo.BuildInfo; import org.immutables.value.Value; /** diff --git a/sigstore-java/src/main/java/dev/sigstore/http/URIFormat.java b/sigstore-common/src/main/java/dev/sigstore/common/http/URIFormat.java similarity index 96% rename from sigstore-java/src/main/java/dev/sigstore/http/URIFormat.java rename to sigstore-common/src/main/java/dev/sigstore/common/http/URIFormat.java index 10ac3f33f..985ed57fc 100644 --- a/sigstore-java/src/main/java/dev/sigstore/http/URIFormat.java +++ b/sigstore-common/src/main/java/dev/sigstore/common/http/URIFormat.java @@ -13,9 +13,9 @@ * See the License for the specific language governing permissions and * limitations under the License. */ -package dev.sigstore.http; +package dev.sigstore.common.http; -import dev.sigstore.forbidden.SuppressForbidden; +import dev.sigstore.common.forbidden.SuppressForbidden; import java.net.URI; import java.net.URISyntaxException; diff --git a/sigstore-java/src/main/java/dev/sigstore/http/UnsuccessfulResponseHandler.java b/sigstore-common/src/main/java/dev/sigstore/common/http/UnsuccessfulResponseHandler.java similarity index 99% rename from sigstore-java/src/main/java/dev/sigstore/http/UnsuccessfulResponseHandler.java rename to sigstore-common/src/main/java/dev/sigstore/common/http/UnsuccessfulResponseHandler.java index 4ff50eec6..969509f20 100644 --- a/sigstore-java/src/main/java/dev/sigstore/http/UnsuccessfulResponseHandler.java +++ b/sigstore-common/src/main/java/dev/sigstore/common/http/UnsuccessfulResponseHandler.java @@ -13,7 +13,7 @@ * See the License for the specific language governing permissions and * limitations under the License. */ -package dev.sigstore.http; +package dev.sigstore.common.http; import com.google.api.client.http.HttpRequest; import com.google.api.client.http.HttpResponse; diff --git a/sigstore-java/src/main/java/dev/sigstore/json/GsonByteArrayAdapter.java b/sigstore-common/src/main/java/dev/sigstore/common/json/GsonByteArrayAdapter.java similarity index 97% rename from sigstore-java/src/main/java/dev/sigstore/json/GsonByteArrayAdapter.java rename to sigstore-common/src/main/java/dev/sigstore/common/json/GsonByteArrayAdapter.java index ec75ee5aa..1e35f2f96 100644 --- a/sigstore-java/src/main/java/dev/sigstore/json/GsonByteArrayAdapter.java +++ b/sigstore-common/src/main/java/dev/sigstore/common/json/GsonByteArrayAdapter.java @@ -13,7 +13,7 @@ * See the License for the specific language governing permissions and * limitations under the License. */ -package dev.sigstore.json; +package dev.sigstore.common.json; import com.google.gson.JsonParseException; import com.google.gson.TypeAdapter; diff --git a/sigstore-java/src/main/java/dev/sigstore/json/GsonChecked.java b/sigstore-common/src/main/java/dev/sigstore/common/json/GsonChecked.java similarity index 98% rename from sigstore-java/src/main/java/dev/sigstore/json/GsonChecked.java rename to sigstore-common/src/main/java/dev/sigstore/common/json/GsonChecked.java index 43568b4ed..5a896a80d 100644 --- a/sigstore-java/src/main/java/dev/sigstore/json/GsonChecked.java +++ b/sigstore-common/src/main/java/dev/sigstore/common/json/GsonChecked.java @@ -13,7 +13,7 @@ * See the License for the specific language governing permissions and * limitations under the License. */ -package dev.sigstore.json; +package dev.sigstore.common.json; import com.google.gson.Gson; import com.google.gson.JsonElement; diff --git a/sigstore-java/src/main/java/dev/sigstore/json/JsonParseException.java b/sigstore-common/src/main/java/dev/sigstore/common/json/JsonParseException.java similarity index 95% rename from sigstore-java/src/main/java/dev/sigstore/json/JsonParseException.java rename to sigstore-common/src/main/java/dev/sigstore/common/json/JsonParseException.java index c6dd2154c..a90d36f12 100644 --- a/sigstore-java/src/main/java/dev/sigstore/json/JsonParseException.java +++ b/sigstore-common/src/main/java/dev/sigstore/common/json/JsonParseException.java @@ -13,7 +13,7 @@ * See the License for the specific language governing permissions and * limitations under the License. */ -package dev.sigstore.json; +package dev.sigstore.common.json; public class JsonParseException extends Exception { public JsonParseException(Throwable cause) { diff --git a/sigstore-java/src/main/java/dev/sigstore/json/canonicalizer/JsonCanonicalizer.java b/sigstore-common/src/main/java/dev/sigstore/common/json/canonicalizer/JsonCanonicalizer.java similarity index 99% rename from sigstore-java/src/main/java/dev/sigstore/json/canonicalizer/JsonCanonicalizer.java rename to sigstore-common/src/main/java/dev/sigstore/common/json/canonicalizer/JsonCanonicalizer.java index 1a4cf66a6..08d7f40b7 100644 --- a/sigstore-java/src/main/java/dev/sigstore/json/canonicalizer/JsonCanonicalizer.java +++ b/sigstore-common/src/main/java/dev/sigstore/common/json/canonicalizer/JsonCanonicalizer.java @@ -14,7 +14,7 @@ * See the License for the specific language governing permissions and * limitations under the License. */ -package dev.sigstore.json.canonicalizer; +package dev.sigstore.common.json.canonicalizer; import java.io.IOException; import java.nio.charset.StandardCharsets; diff --git a/sigstore-java/src/main/java/dev/sigstore/json/canonicalizer/NumberToJSON.java b/sigstore-common/src/main/java/dev/sigstore/common/json/canonicalizer/NumberToJSON.java similarity index 99% rename from sigstore-java/src/main/java/dev/sigstore/json/canonicalizer/NumberToJSON.java rename to sigstore-common/src/main/java/dev/sigstore/common/json/canonicalizer/NumberToJSON.java index 0e23bec27..f8a1ec86e 100644 --- a/sigstore-java/src/main/java/dev/sigstore/json/canonicalizer/NumberToJSON.java +++ b/sigstore-common/src/main/java/dev/sigstore/common/json/canonicalizer/NumberToJSON.java @@ -14,7 +14,7 @@ * See the License for the specific language governing permissions and * limitations under the License. */ -package dev.sigstore.json.canonicalizer; +package dev.sigstore.common.json.canonicalizer; import java.io.IOException; import java.math.BigInteger; diff --git a/sigstore-java/src/main/java/dev/sigstore/json/canonicalizer/package-info.java b/sigstore-common/src/main/java/dev/sigstore/common/json/canonicalizer/package-info.java similarity index 73% rename from sigstore-java/src/main/java/dev/sigstore/json/canonicalizer/package-info.java rename to sigstore-common/src/main/java/dev/sigstore/common/json/canonicalizer/package-info.java index db878d935..a3eb2a67a 100644 --- a/sigstore-java/src/main/java/dev/sigstore/json/canonicalizer/package-info.java +++ b/sigstore-common/src/main/java/dev/sigstore/common/json/canonicalizer/package-info.java @@ -7,7 +7,7 @@ * thread and related * issue. * - *

There is just a minor edit to {@link dev.sigstore.json.canonicalizer.JsonCanonicalizer} line - * 43. + *

There is just a minor edit to {@link dev.sigstore.common.json.canonicalizer.JsonCanonicalizer} + * line 43. */ -package dev.sigstore.json.canonicalizer; +package dev.sigstore.common.json.canonicalizer; diff --git a/sigstore-java/src/test/java/dev/sigstore/http/URIFormatTest.java b/sigstore-common/src/test/java/dev/sigstore/common/http/URIFormatTest.java similarity index 99% rename from sigstore-java/src/test/java/dev/sigstore/http/URIFormatTest.java rename to sigstore-common/src/test/java/dev/sigstore/common/http/URIFormatTest.java index ade2b9285..26e21be89 100644 --- a/sigstore-java/src/test/java/dev/sigstore/http/URIFormatTest.java +++ b/sigstore-common/src/test/java/dev/sigstore/common/http/URIFormatTest.java @@ -13,7 +13,7 @@ * See the License for the specific language governing permissions and * limitations under the License. */ -package dev.sigstore.http; +package dev.sigstore.common.http; import static org.junit.jupiter.api.Assertions.assertEquals; diff --git a/sigstore-java/src/test/java/dev/sigstore/http/UnsuccessfulResponseHandlerTest.java b/sigstore-common/src/test/java/dev/sigstore/common/http/UnsuccessfulResponseHandlerTest.java similarity index 99% rename from sigstore-java/src/test/java/dev/sigstore/http/UnsuccessfulResponseHandlerTest.java rename to sigstore-common/src/test/java/dev/sigstore/common/http/UnsuccessfulResponseHandlerTest.java index c9869b961..7fcfecd69 100644 --- a/sigstore-java/src/test/java/dev/sigstore/http/UnsuccessfulResponseHandlerTest.java +++ b/sigstore-common/src/test/java/dev/sigstore/common/http/UnsuccessfulResponseHandlerTest.java @@ -13,7 +13,7 @@ * See the License for the specific language governing permissions and * limitations under the License. */ -package dev.sigstore.http; +package dev.sigstore.common.http; import com.google.api.client.http.HttpHeaders; import com.google.api.client.http.HttpResponse; diff --git a/sigstore-gradle/sigstore-gradle-sign-base-plugin/build.gradle.kts b/sigstore-gradle/sigstore-gradle-sign-base-plugin/build.gradle.kts index 8ef4908f0..2237a79a1 100644 --- a/sigstore-gradle/sigstore-gradle-sign-base-plugin/build.gradle.kts +++ b/sigstore-gradle/sigstore-gradle-sign-base-plugin/build.gradle.kts @@ -8,6 +8,7 @@ description = "Gradle plugin with the base set of tasks and configurations for S dependencies { compileOnly(project(":sigstore-java")) + sigstoreJavaRuntime(project(":sigstore-common")) sigstoreJavaRuntime(project(":sigstore-java")) { because("Test code needs access locally-built sigstore-java as a Maven repository") } diff --git a/sigstore-gradle/sigstore-gradle-sign-plugin/build.gradle.kts b/sigstore-gradle/sigstore-gradle-sign-plugin/build.gradle.kts index 2b5133ce2..028eeb95c 100644 --- a/sigstore-gradle/sigstore-gradle-sign-plugin/build.gradle.kts +++ b/sigstore-gradle/sigstore-gradle-sign-plugin/build.gradle.kts @@ -8,6 +8,7 @@ description = "Gradle plugin to that automatically signs all Publications in Sig dependencies { api(project(":sigstore-gradle:sigstore-gradle-sign-base-plugin")) + sigstoreJavaRuntime(project(":sigstore-common")) sigstoreJavaRuntime(project(":sigstore-java")) { because("Test code needs access locally-built sigstore-java as a Maven repository") } diff --git a/sigstore-java/build.gradle.kts b/sigstore-java/build.gradle.kts index 73f04c444..5610836ac 100644 --- a/sigstore-java/build.gradle.kts +++ b/sigstore-java/build.gradle.kts @@ -3,7 +3,6 @@ import com.google.protobuf.gradle.id plugins { id("build-logic.java-published-library") id("build-logic.test-junit5") - id("build-logic.build-info") id("org.jsonschema2dataclass") version "5.0.0" id("com.google.protobuf") version "0.10.0" } @@ -18,6 +17,8 @@ tasks.jar { } dependencies { + api(project(":sigstore-common")) + compileOnly("org.immutables:gson:2.12.2") compileOnly("org.immutables:value-annotations:2.12.2") annotationProcessor("org.immutables:value:2.12.2") @@ -95,7 +96,6 @@ spotless { targetExclude( "build/**/*.java", "src/*/java/dev/sigstore/encryption/certificates/transparency/*.java", - "src/*/java/dev/sigstore/json/canonicalizer/*.java", ) } format("conscrypt", com.diffplug.gradle.spotless.JavaExtension::class.java) { @@ -103,11 +103,6 @@ spotless { licenseHeaderFile("$rootDir/config/conscryptLicenseHeader") target("src/*/java/dev/sigstore/encryption/certificates/transparency/*.java") } - format("webPki", com.diffplug.gradle.spotless.JavaExtension::class.java) { - googleJavaFormat("1.35.0") - licenseHeaderFile("$rootDir/config/webPKILicenseHeader") - target("src/*/java/dev/sigstore/json/canonicalizer/*.java") - } } jsonSchema2Pojo { @@ -126,14 +121,10 @@ forbiddenApis { // Don't allow sigstore-java developers to directly call JsonFormat.parser(), use our wrapper instead // which allows for ignored fields. signaturesFiles = files("$rootDir/config/forbiddenApis.txt") - suppressAnnotations = setOf("dev.sigstore.forbidden.SuppressForbidden") + suppressAnnotations = setOf("dev.sigstore.common.forbidden.SuppressForbidden") } // TODO: keep until these code gen plugins explicitly declare dependencies tasks.named("sourcesJar") { dependsOn("generateJsonSchema2DataClassConfigRekor") } - -tasks.generateBuildInfo { - packageName.set("dev.sigstore.buildinfo") -} diff --git a/sigstore-java/src/main/java/dev/sigstore/KeylessSigner.java b/sigstore-java/src/main/java/dev/sigstore/KeylessSigner.java index 218affb88..4bcf6c27b 100644 --- a/sigstore-java/src/main/java/dev/sigstore/KeylessSigner.java +++ b/sigstore-java/src/main/java/dev/sigstore/KeylessSigner.java @@ -28,6 +28,7 @@ import dev.sigstore.bundle.ImmutableDsseEnvelope; import dev.sigstore.bundle.ImmutableSignature; import dev.sigstore.bundle.ImmutableTimestamp; +import dev.sigstore.common.json.JsonParseException; import dev.sigstore.dsse.InTotoPayload; import dev.sigstore.encryption.Hashers; import dev.sigstore.encryption.certificates.Certificates; @@ -38,7 +39,6 @@ import dev.sigstore.fulcio.client.FulcioClientGrpc; import dev.sigstore.fulcio.client.FulcioVerificationException; import dev.sigstore.fulcio.client.FulcioVerifier; -import dev.sigstore.json.JsonParseException; import dev.sigstore.oidc.client.OidcClients; import dev.sigstore.oidc.client.OidcException; import dev.sigstore.oidc.client.OidcToken; diff --git a/sigstore-java/src/main/java/dev/sigstore/KeylessVerifier.java b/sigstore-java/src/main/java/dev/sigstore/KeylessVerifier.java index 2f57d30fb..fe62f6661 100644 --- a/sigstore-java/src/main/java/dev/sigstore/KeylessVerifier.java +++ b/sigstore-java/src/main/java/dev/sigstore/KeylessVerifier.java @@ -23,13 +23,13 @@ import dev.sigstore.bundle.Bundle; import dev.sigstore.bundle.Bundle.DsseEnvelope; import dev.sigstore.bundle.Bundle.MessageSignature; +import dev.sigstore.common.json.JsonParseException; import dev.sigstore.dsse.InTotoPayload; import dev.sigstore.encryption.Hashers; import dev.sigstore.encryption.certificates.Certificates; import dev.sigstore.encryption.signers.Verifiers; import dev.sigstore.fulcio.client.FulcioVerificationException; import dev.sigstore.fulcio.client.FulcioVerifier; -import dev.sigstore.json.JsonParseException; import dev.sigstore.proto.ProtoMutators; import dev.sigstore.proto.rekor.v2.HashedRekordLogEntryV002; import dev.sigstore.proto.rekor.v2.Signature; diff --git a/sigstore-java/src/main/java/dev/sigstore/bundle/BundleWriter.java b/sigstore-java/src/main/java/dev/sigstore/bundle/BundleWriter.java index f0a889c37..e869c316b 100644 --- a/sigstore-java/src/main/java/dev/sigstore/bundle/BundleWriter.java +++ b/sigstore-java/src/main/java/dev/sigstore/bundle/BundleWriter.java @@ -19,7 +19,7 @@ import com.google.protobuf.ByteString; import com.google.protobuf.InvalidProtocolBufferException; import com.google.protobuf.util.JsonFormat; -import dev.sigstore.json.JsonParseException; +import dev.sigstore.common.json.JsonParseException; import dev.sigstore.proto.ProtoMutators; import dev.sigstore.proto.bundle.v1.TimestampVerificationData; import dev.sigstore.proto.bundle.v1.VerificationMaterial; diff --git a/sigstore-java/src/main/java/dev/sigstore/dsse/InTotoPayload.java b/sigstore-java/src/main/java/dev/sigstore/dsse/InTotoPayload.java index 1b0721695..c3df6ec01 100644 --- a/sigstore-java/src/main/java/dev/sigstore/dsse/InTotoPayload.java +++ b/sigstore-java/src/main/java/dev/sigstore/dsse/InTotoPayload.java @@ -19,7 +19,7 @@ import com.google.gson.JsonElement; import dev.sigstore.bundle.Bundle.DsseEnvelope; -import dev.sigstore.json.JsonParseException; +import dev.sigstore.common.json.JsonParseException; import java.util.List; import java.util.Map; import org.immutables.gson.Gson; diff --git a/sigstore-java/src/main/java/dev/sigstore/fulcio/client/FulcioClientGrpc.java b/sigstore-java/src/main/java/dev/sigstore/fulcio/client/FulcioClientGrpc.java index 778e5038f..66ff842b7 100644 --- a/sigstore-java/src/main/java/dev/sigstore/fulcio/client/FulcioClientGrpc.java +++ b/sigstore-java/src/main/java/dev/sigstore/fulcio/client/FulcioClientGrpc.java @@ -19,13 +19,12 @@ import com.google.api.client.util.Preconditions; import com.google.protobuf.ByteString; +import dev.sigstore.common.http.HttpParams; import dev.sigstore.fulcio.v2.CAGrpc; import dev.sigstore.fulcio.v2.CreateSigningCertificateRequest; import dev.sigstore.fulcio.v2.Credentials; import dev.sigstore.fulcio.v2.PublicKey; import dev.sigstore.fulcio.v2.PublicKeyRequest; -import dev.sigstore.http.GrpcChannels; -import dev.sigstore.http.HttpParams; import dev.sigstore.trustroot.Service; import java.net.URI; import java.security.cert.CertPath; diff --git a/sigstore-java/src/main/java/dev/sigstore/fulcio/client/FulcioClientHttp.java b/sigstore-java/src/main/java/dev/sigstore/fulcio/client/FulcioClientHttp.java index 7baa591fd..f4d69bfa7 100644 --- a/sigstore-java/src/main/java/dev/sigstore/fulcio/client/FulcioClientHttp.java +++ b/sigstore-java/src/main/java/dev/sigstore/fulcio/client/FulcioClientHttp.java @@ -24,13 +24,13 @@ import com.google.protobuf.ByteString; import com.google.protobuf.InvalidProtocolBufferException; import com.google.protobuf.util.JsonFormat; +import dev.sigstore.common.http.HttpClients; +import dev.sigstore.common.http.HttpParams; +import dev.sigstore.common.http.URIFormat; import dev.sigstore.fulcio.v2.CreateSigningCertificateRequest; import dev.sigstore.fulcio.v2.PublicKey; import dev.sigstore.fulcio.v2.PublicKeyRequest; import dev.sigstore.fulcio.v2.SigningCertificate; -import dev.sigstore.http.HttpClients; -import dev.sigstore.http.HttpParams; -import dev.sigstore.http.URIFormat; import dev.sigstore.json.ProtoJson; import dev.sigstore.trustroot.Service; import java.io.IOException; diff --git a/sigstore-java/src/main/java/dev/sigstore/http/GrpcChannels.java b/sigstore-java/src/main/java/dev/sigstore/fulcio/client/GrpcChannels.java similarity index 96% rename from sigstore-java/src/main/java/dev/sigstore/http/GrpcChannels.java rename to sigstore-java/src/main/java/dev/sigstore/fulcio/client/GrpcChannels.java index 3990c331a..9158c9938 100644 --- a/sigstore-java/src/main/java/dev/sigstore/http/GrpcChannels.java +++ b/sigstore-java/src/main/java/dev/sigstore/fulcio/client/GrpcChannels.java @@ -13,8 +13,9 @@ * See the License for the specific language governing permissions and * limitations under the License. */ -package dev.sigstore.http; +package dev.sigstore.fulcio.client; +import dev.sigstore.common.http.HttpParams; import io.grpc.ManagedChannel; import io.grpc.ManagedChannelBuilder; import java.net.URI; diff --git a/sigstore-java/src/main/java/dev/sigstore/json/GsonSupplier.java b/sigstore-java/src/main/java/dev/sigstore/json/GsonSupplier.java index e7e476f05..57f9bebb6 100644 --- a/sigstore-java/src/main/java/dev/sigstore/json/GsonSupplier.java +++ b/sigstore-java/src/main/java/dev/sigstore/json/GsonSupplier.java @@ -16,8 +16,10 @@ package dev.sigstore.json; import com.google.gson.*; +import dev.sigstore.common.forbidden.SuppressForbidden; +import dev.sigstore.common.json.GsonByteArrayAdapter; +import dev.sigstore.common.json.GsonChecked; import dev.sigstore.dsse.GsonAdaptersInTotoPayload; -import dev.sigstore.forbidden.SuppressForbidden; import dev.sigstore.rekor.client.GsonAdaptersRekorEntry; import dev.sigstore.rekor.client.GsonAdaptersRekorEntryBody; import java.time.LocalDateTime; diff --git a/sigstore-java/src/main/java/dev/sigstore/json/ProtoJson.java b/sigstore-java/src/main/java/dev/sigstore/json/ProtoJson.java index 72ae57185..a89ffbc81 100644 --- a/sigstore-java/src/main/java/dev/sigstore/json/ProtoJson.java +++ b/sigstore-java/src/main/java/dev/sigstore/json/ProtoJson.java @@ -16,7 +16,7 @@ package dev.sigstore.json; import com.google.protobuf.util.JsonFormat; -import dev.sigstore.forbidden.SuppressForbidden; +import dev.sigstore.common.forbidden.SuppressForbidden; /** Use this instead of JsonFormat to pick up default formatter options for sigstore-java. */ public class ProtoJson { diff --git a/sigstore-java/src/main/java/dev/sigstore/oidc/client/GithubActionsOidcClient.java b/sigstore-java/src/main/java/dev/sigstore/oidc/client/GithubActionsOidcClient.java index ef507dc87..aa911bd6c 100644 --- a/sigstore-java/src/main/java/dev/sigstore/oidc/client/GithubActionsOidcClient.java +++ b/sigstore-java/src/main/java/dev/sigstore/oidc/client/GithubActionsOidcClient.java @@ -20,8 +20,8 @@ import com.google.api.client.json.gson.GsonFactory; import com.google.api.client.json.webtoken.JsonWebSignature; import com.google.api.client.util.Key; -import dev.sigstore.http.HttpClients; -import dev.sigstore.http.HttpParams; +import dev.sigstore.common.http.HttpClients; +import dev.sigstore.common.http.HttpParams; import io.grpc.Internal; import java.io.IOException; import java.util.Map; diff --git a/sigstore-java/src/main/java/dev/sigstore/oidc/client/WebOidcClient.java b/sigstore-java/src/main/java/dev/sigstore/oidc/client/WebOidcClient.java index c1039ba58..fea974218 100644 --- a/sigstore-java/src/main/java/dev/sigstore/oidc/client/WebOidcClient.java +++ b/sigstore-java/src/main/java/dev/sigstore/oidc/client/WebOidcClient.java @@ -33,9 +33,9 @@ import com.google.api.client.util.Preconditions; import com.google.api.client.util.store.DataStoreFactory; import com.google.api.client.util.store.MemoryDataStoreFactory; -import dev.sigstore.forbidden.SuppressForbidden; -import dev.sigstore.http.HttpClients; -import dev.sigstore.http.HttpParams; +import dev.sigstore.common.forbidden.SuppressForbidden; +import dev.sigstore.common.http.HttpClients; +import dev.sigstore.common.http.HttpParams; import dev.sigstore.trustroot.Service; import java.io.IOException; import java.net.URI; diff --git a/sigstore-java/src/main/java/dev/sigstore/rekor/client/RekorClient.java b/sigstore-java/src/main/java/dev/sigstore/rekor/client/RekorClient.java index 3f81fb6cd..13c8d8c6a 100644 --- a/sigstore-java/src/main/java/dev/sigstore/rekor/client/RekorClient.java +++ b/sigstore-java/src/main/java/dev/sigstore/rekor/client/RekorClient.java @@ -15,7 +15,7 @@ */ package dev.sigstore.rekor.client; -import dev.sigstore.json.JsonParseException; +import dev.sigstore.common.json.JsonParseException; import java.io.IOException; import java.util.List; import java.util.Optional; diff --git a/sigstore-java/src/main/java/dev/sigstore/rekor/client/RekorClientHttp.java b/sigstore-java/src/main/java/dev/sigstore/rekor/client/RekorClientHttp.java index 67dd0b4e4..3dfaaaa19 100644 --- a/sigstore-java/src/main/java/dev/sigstore/rekor/client/RekorClientHttp.java +++ b/sigstore-java/src/main/java/dev/sigstore/rekor/client/RekorClientHttp.java @@ -23,10 +23,10 @@ import com.google.api.client.http.HttpResponse; import com.google.api.client.http.HttpResponseException; import com.google.api.client.util.Preconditions; -import dev.sigstore.http.HttpClients; -import dev.sigstore.http.HttpParams; -import dev.sigstore.http.URIFormat; -import dev.sigstore.json.JsonParseException; +import dev.sigstore.common.http.HttpClients; +import dev.sigstore.common.http.HttpParams; +import dev.sigstore.common.http.URIFormat; +import dev.sigstore.common.json.JsonParseException; import dev.sigstore.trustroot.Service; import java.io.IOException; import java.net.URI; diff --git a/sigstore-java/src/main/java/dev/sigstore/rekor/client/RekorEntry.java b/sigstore-java/src/main/java/dev/sigstore/rekor/client/RekorEntry.java index 80e2bfe55..e5a21e87e 100644 --- a/sigstore-java/src/main/java/dev/sigstore/rekor/client/RekorEntry.java +++ b/sigstore-java/src/main/java/dev/sigstore/rekor/client/RekorEntry.java @@ -19,7 +19,7 @@ import static java.nio.charset.StandardCharsets.UTF_8; import com.google.protobuf.InvalidProtocolBufferException; -import dev.sigstore.json.JsonParseException; +import dev.sigstore.common.json.JsonParseException; import dev.sigstore.json.ProtoJson; import dev.sigstore.proto.ProtoMutators; import dev.sigstore.proto.rekor.v1.TransparencyLogEntry; diff --git a/sigstore-java/src/main/java/dev/sigstore/rekor/client/RekorResponse.java b/sigstore-java/src/main/java/dev/sigstore/rekor/client/RekorResponse.java index 060f85e4b..df8a8c652 100644 --- a/sigstore-java/src/main/java/dev/sigstore/rekor/client/RekorResponse.java +++ b/sigstore-java/src/main/java/dev/sigstore/rekor/client/RekorResponse.java @@ -18,7 +18,7 @@ import static dev.sigstore.json.GsonSupplier.GSON; import com.google.common.reflect.TypeToken; -import dev.sigstore.json.JsonParseException; +import dev.sigstore.common.json.JsonParseException; import java.net.URI; import java.util.Map; import org.immutables.value.Value; diff --git a/sigstore-java/src/main/java/dev/sigstore/rekor/client/RekorTypes.java b/sigstore-java/src/main/java/dev/sigstore/rekor/client/RekorTypes.java index f6ac03e1f..f983f1b28 100644 --- a/sigstore-java/src/main/java/dev/sigstore/rekor/client/RekorTypes.java +++ b/sigstore-java/src/main/java/dev/sigstore/rekor/client/RekorTypes.java @@ -18,7 +18,7 @@ import static dev.sigstore.json.GsonSupplier.GSON; import com.google.protobuf.InvalidProtocolBufferException; -import dev.sigstore.json.JsonParseException; +import dev.sigstore.common.json.JsonParseException; import dev.sigstore.json.ProtoJson; import dev.sigstore.proto.rekor.v2.HashedRekordLogEntryV002; import dev.sigstore.rekor.dsse.v0_0_1.Dsse; diff --git a/sigstore-java/src/main/java/dev/sigstore/rekor/v2/client/RekorV2ClientHttp.java b/sigstore-java/src/main/java/dev/sigstore/rekor/v2/client/RekorV2ClientHttp.java index 2226475f0..dd929dcb2 100644 --- a/sigstore-java/src/main/java/dev/sigstore/rekor/v2/client/RekorV2ClientHttp.java +++ b/sigstore-java/src/main/java/dev/sigstore/rekor/v2/client/RekorV2ClientHttp.java @@ -21,10 +21,10 @@ import com.google.api.client.http.HttpResponse; import com.google.api.client.util.Preconditions; import com.google.protobuf.util.JsonFormat; -import dev.sigstore.http.HttpClients; -import dev.sigstore.http.HttpParams; -import dev.sigstore.http.ImmutableHttpParams; -import dev.sigstore.http.URIFormat; +import dev.sigstore.common.http.HttpClients; +import dev.sigstore.common.http.HttpParams; +import dev.sigstore.common.http.ImmutableHttpParams; +import dev.sigstore.common.http.URIFormat; import dev.sigstore.proto.rekor.v2.CreateEntryRequest; import dev.sigstore.proto.rekor.v2.HashedRekordRequestV002; import dev.sigstore.rekor.client.RekorEntry; diff --git a/sigstore-java/src/main/java/dev/sigstore/timestamp/client/TimestampClientHttp.java b/sigstore-java/src/main/java/dev/sigstore/timestamp/client/TimestampClientHttp.java index c028fc293..eff7080c1 100644 --- a/sigstore-java/src/main/java/dev/sigstore/timestamp/client/TimestampClientHttp.java +++ b/sigstore-java/src/main/java/dev/sigstore/timestamp/client/TimestampClientHttp.java @@ -21,8 +21,8 @@ import com.google.api.client.http.HttpResponse; import com.google.api.client.util.Preconditions; import com.google.common.annotations.VisibleForTesting; -import dev.sigstore.http.HttpClients; -import dev.sigstore.http.HttpParams; +import dev.sigstore.common.http.HttpClients; +import dev.sigstore.common.http.HttpParams; import dev.sigstore.trustroot.Service; import java.io.IOException; import java.net.URI; diff --git a/sigstore-java/src/main/java/dev/sigstore/tuf/FileSystemTufStore.java b/sigstore-java/src/main/java/dev/sigstore/tuf/FileSystemTufStore.java index b6f6111a9..744ba87ff 100644 --- a/sigstore-java/src/main/java/dev/sigstore/tuf/FileSystemTufStore.java +++ b/sigstore-java/src/main/java/dev/sigstore/tuf/FileSystemTufStore.java @@ -18,7 +18,7 @@ import static dev.sigstore.tuf.json.TufGsonSupplier.TUF_GSON; import com.google.common.annotations.VisibleForTesting; -import dev.sigstore.json.JsonParseException; +import dev.sigstore.common.json.JsonParseException; import dev.sigstore.tuf.model.*; import java.io.BufferedWriter; import java.io.IOException; diff --git a/sigstore-java/src/main/java/dev/sigstore/tuf/HttpFetcher.java b/sigstore-java/src/main/java/dev/sigstore/tuf/HttpFetcher.java index bdd873030..0d6c4c34f 100644 --- a/sigstore-java/src/main/java/dev/sigstore/tuf/HttpFetcher.java +++ b/sigstore-java/src/main/java/dev/sigstore/tuf/HttpFetcher.java @@ -18,9 +18,9 @@ import com.google.api.client.http.GenericUrl; import com.google.api.client.http.HttpRequestFactory; import com.google.api.client.json.gson.GsonFactory; -import dev.sigstore.http.HttpClients; -import dev.sigstore.http.HttpParams; -import dev.sigstore.http.URIFormat; +import dev.sigstore.common.http.HttpClients; +import dev.sigstore.common.http.HttpParams; +import dev.sigstore.common.http.URIFormat; import java.io.IOException; import java.net.URI; import java.util.Locale; diff --git a/sigstore-java/src/main/java/dev/sigstore/tuf/MetaFetcher.java b/sigstore-java/src/main/java/dev/sigstore/tuf/MetaFetcher.java index 220782f4c..ad43e421c 100644 --- a/sigstore-java/src/main/java/dev/sigstore/tuf/MetaFetcher.java +++ b/sigstore-java/src/main/java/dev/sigstore/tuf/MetaFetcher.java @@ -18,7 +18,7 @@ import static dev.sigstore.tuf.json.TufGsonSupplier.TUF_GSON; import com.google.common.base.Preconditions; -import dev.sigstore.json.JsonParseException; +import dev.sigstore.common.json.JsonParseException; import dev.sigstore.tuf.model.Root; import dev.sigstore.tuf.model.SignedTufMeta; import dev.sigstore.tuf.model.TufMeta; diff --git a/sigstore-java/src/main/java/dev/sigstore/tuf/MetaReader.java b/sigstore-java/src/main/java/dev/sigstore/tuf/MetaReader.java index d6bff800e..e22138643 100644 --- a/sigstore-java/src/main/java/dev/sigstore/tuf/MetaReader.java +++ b/sigstore-java/src/main/java/dev/sigstore/tuf/MetaReader.java @@ -15,7 +15,7 @@ */ package dev.sigstore.tuf; -import dev.sigstore.json.JsonParseException; +import dev.sigstore.common.json.JsonParseException; import dev.sigstore.tuf.model.SignedTufMeta; import dev.sigstore.tuf.model.TufMeta; import java.io.IOException; diff --git a/sigstore-java/src/main/java/dev/sigstore/tuf/PassthroughCacheMetaStore.java b/sigstore-java/src/main/java/dev/sigstore/tuf/PassthroughCacheMetaStore.java index e93a67f20..1f35ef3ed 100644 --- a/sigstore-java/src/main/java/dev/sigstore/tuf/PassthroughCacheMetaStore.java +++ b/sigstore-java/src/main/java/dev/sigstore/tuf/PassthroughCacheMetaStore.java @@ -15,7 +15,7 @@ */ package dev.sigstore.tuf; -import dev.sigstore.json.JsonParseException; +import dev.sigstore.common.json.JsonParseException; import dev.sigstore.tuf.model.SignedTufMeta; import dev.sigstore.tuf.model.TufMeta; import java.io.IOException; diff --git a/sigstore-java/src/main/java/dev/sigstore/tuf/SigstoreTufClient.java b/sigstore-java/src/main/java/dev/sigstore/tuf/SigstoreTufClient.java index 37d8bc01f..c10990930 100644 --- a/sigstore-java/src/main/java/dev/sigstore/tuf/SigstoreTufClient.java +++ b/sigstore-java/src/main/java/dev/sigstore/tuf/SigstoreTufClient.java @@ -17,8 +17,8 @@ import com.google.common.annotations.VisibleForTesting; import com.google.common.base.Preconditions; -import dev.sigstore.http.URIFormat; -import dev.sigstore.json.JsonParseException; +import dev.sigstore.common.http.URIFormat; +import dev.sigstore.common.json.JsonParseException; import dev.sigstore.trustroot.SigstoreConfigurationException; import dev.sigstore.trustroot.SigstoreSigningConfig; import dev.sigstore.trustroot.SigstoreTrustedRoot; diff --git a/sigstore-java/src/main/java/dev/sigstore/tuf/TrustedMetaStore.java b/sigstore-java/src/main/java/dev/sigstore/tuf/TrustedMetaStore.java index 3f032ca63..b5807a709 100644 --- a/sigstore-java/src/main/java/dev/sigstore/tuf/TrustedMetaStore.java +++ b/sigstore-java/src/main/java/dev/sigstore/tuf/TrustedMetaStore.java @@ -15,7 +15,7 @@ */ package dev.sigstore.tuf; -import dev.sigstore.json.JsonParseException; +import dev.sigstore.common.json.JsonParseException; import dev.sigstore.tuf.model.Root; import dev.sigstore.tuf.model.RootRole; import dev.sigstore.tuf.model.SignedTufMeta; diff --git a/sigstore-java/src/main/java/dev/sigstore/tuf/Updater.java b/sigstore-java/src/main/java/dev/sigstore/tuf/Updater.java index 36b6121df..ef4f31e6d 100644 --- a/sigstore-java/src/main/java/dev/sigstore/tuf/Updater.java +++ b/sigstore-java/src/main/java/dev/sigstore/tuf/Updater.java @@ -19,7 +19,7 @@ import com.google.common.annotations.VisibleForTesting; import com.google.common.hash.Hashing; -import dev.sigstore.json.JsonParseException; +import dev.sigstore.common.json.JsonParseException; import dev.sigstore.tuf.encryption.Verifiers; import dev.sigstore.tuf.model.*; import dev.sigstore.tuf.model.TargetMeta.TargetData; diff --git a/sigstore-java/src/main/java/dev/sigstore/tuf/json/TufGsonSupplier.java b/sigstore-java/src/main/java/dev/sigstore/tuf/json/TufGsonSupplier.java index 9bbf52a09..f12d6240e 100644 --- a/sigstore-java/src/main/java/dev/sigstore/tuf/json/TufGsonSupplier.java +++ b/sigstore-java/src/main/java/dev/sigstore/tuf/json/TufGsonSupplier.java @@ -17,9 +17,9 @@ import com.google.gson.GsonBuilder; import com.google.gson.JsonDeserializer; -import dev.sigstore.forbidden.SuppressForbidden; -import dev.sigstore.json.GsonByteArrayAdapter; -import dev.sigstore.json.GsonChecked; +import dev.sigstore.common.forbidden.SuppressForbidden; +import dev.sigstore.common.json.GsonByteArrayAdapter; +import dev.sigstore.common.json.GsonChecked; import dev.sigstore.tuf.model.*; import java.time.LocalDateTime; import java.time.ZonedDateTime; diff --git a/sigstore-java/src/main/java/dev/sigstore/tuf/model/Root.java b/sigstore-java/src/main/java/dev/sigstore/tuf/model/Root.java index 2adb30ddc..cdc8089fc 100644 --- a/sigstore-java/src/main/java/dev/sigstore/tuf/model/Root.java +++ b/sigstore-java/src/main/java/dev/sigstore/tuf/model/Root.java @@ -16,7 +16,7 @@ package dev.sigstore.tuf.model; import com.google.common.base.Preconditions; -import dev.sigstore.json.JsonParseException; +import dev.sigstore.common.json.JsonParseException; import org.immutables.gson.Gson; import org.immutables.value.Value; diff --git a/sigstore-java/src/main/java/dev/sigstore/tuf/model/SignedTufMeta.java b/sigstore-java/src/main/java/dev/sigstore/tuf/model/SignedTufMeta.java index 654114b28..1a8cacae2 100644 --- a/sigstore-java/src/main/java/dev/sigstore/tuf/model/SignedTufMeta.java +++ b/sigstore-java/src/main/java/dev/sigstore/tuf/model/SignedTufMeta.java @@ -16,8 +16,8 @@ package dev.sigstore.tuf.model; import com.google.gson.JsonElement; -import dev.sigstore.json.JsonParseException; -import dev.sigstore.json.canonicalizer.JsonCanonicalizer; +import dev.sigstore.common.json.JsonParseException; +import dev.sigstore.common.json.canonicalizer.JsonCanonicalizer; import dev.sigstore.tuf.json.TufGsonSupplier; import java.io.IOException; import java.util.List; diff --git a/sigstore-java/src/main/java/dev/sigstore/tuf/model/Snapshot.java b/sigstore-java/src/main/java/dev/sigstore/tuf/model/Snapshot.java index f4c0e2548..ac0b4216f 100644 --- a/sigstore-java/src/main/java/dev/sigstore/tuf/model/Snapshot.java +++ b/sigstore-java/src/main/java/dev/sigstore/tuf/model/Snapshot.java @@ -16,7 +16,7 @@ package dev.sigstore.tuf.model; import com.google.common.base.Preconditions; -import dev.sigstore.json.JsonParseException; +import dev.sigstore.common.json.JsonParseException; import org.immutables.gson.Gson; import org.immutables.value.Value; diff --git a/sigstore-java/src/main/java/dev/sigstore/tuf/model/Targets.java b/sigstore-java/src/main/java/dev/sigstore/tuf/model/Targets.java index ce199837e..083680830 100644 --- a/sigstore-java/src/main/java/dev/sigstore/tuf/model/Targets.java +++ b/sigstore-java/src/main/java/dev/sigstore/tuf/model/Targets.java @@ -16,7 +16,7 @@ package dev.sigstore.tuf.model; import com.google.common.base.Preconditions; -import dev.sigstore.json.JsonParseException; +import dev.sigstore.common.json.JsonParseException; import org.immutables.gson.Gson; import org.immutables.value.Value; diff --git a/sigstore-java/src/main/java/dev/sigstore/tuf/model/Timestamp.java b/sigstore-java/src/main/java/dev/sigstore/tuf/model/Timestamp.java index ce1fb6b87..1b422f044 100644 --- a/sigstore-java/src/main/java/dev/sigstore/tuf/model/Timestamp.java +++ b/sigstore-java/src/main/java/dev/sigstore/tuf/model/Timestamp.java @@ -16,7 +16,7 @@ package dev.sigstore.tuf.model; import com.google.common.base.Preconditions; -import dev.sigstore.json.JsonParseException; +import dev.sigstore.common.json.JsonParseException; import org.immutables.gson.Gson; import org.immutables.value.Value; diff --git a/sigstore-java/src/test/java/dev/sigstore/KeylessTest.java b/sigstore-java/src/test/java/dev/sigstore/KeylessTest.java index a5318e849..e2b2bf3ce 100644 --- a/sigstore-java/src/test/java/dev/sigstore/KeylessTest.java +++ b/sigstore-java/src/test/java/dev/sigstore/KeylessTest.java @@ -17,8 +17,8 @@ import com.google.common.hash.Hashing; import dev.sigstore.bundle.Bundle; +import dev.sigstore.common.json.JsonParseException; import dev.sigstore.dsse.InTotoPayload; -import dev.sigstore.json.JsonParseException; import dev.sigstore.oidc.client.OidcClients; import dev.sigstore.oidc.client.TokenStringOidcClient; import dev.sigstore.testkit.annotations.DisabledIfSkipStaging; diff --git a/sigstore-java/src/test/java/dev/sigstore/fulcio/client/FulcioClientTest.java b/sigstore-java/src/test/java/dev/sigstore/fulcio/client/FulcioClientTest.java index 32775c836..804bc4bcf 100644 --- a/sigstore-java/src/test/java/dev/sigstore/fulcio/client/FulcioClientTest.java +++ b/sigstore-java/src/test/java/dev/sigstore/fulcio/client/FulcioClientTest.java @@ -19,9 +19,9 @@ import com.google.common.io.Resources; import dev.sigstore.AlgorithmRegistry; +import dev.sigstore.common.http.HttpParams; import dev.sigstore.encryption.certificates.Certificates; import dev.sigstore.encryption.signers.Signers; -import dev.sigstore.http.HttpParams; import dev.sigstore.testing.FakeCTLogServer; import dev.sigstore.testing.FulcioWrapper; import dev.sigstore.testing.MockOAuth2ServerExtension; diff --git a/sigstore-java/src/test/java/dev/sigstore/json/GsonSupplierTest.java b/sigstore-java/src/test/java/dev/sigstore/json/GsonSupplierTest.java index d01440730..bc0b46884 100644 --- a/sigstore-java/src/test/java/dev/sigstore/json/GsonSupplierTest.java +++ b/sigstore-java/src/test/java/dev/sigstore/json/GsonSupplierTest.java @@ -17,6 +17,8 @@ import static dev.sigstore.json.GsonSupplier.GSON; +import dev.sigstore.common.json.GsonChecked; +import dev.sigstore.common.json.JsonParseException; import java.nio.charset.StandardCharsets; import org.junit.jupiter.api.Assertions; import org.junit.jupiter.api.Test; diff --git a/sigstore-java/src/test/java/dev/sigstore/testing/FulcioWrapper.java b/sigstore-java/src/test/java/dev/sigstore/testing/FulcioWrapper.java index 85c4a0785..62f2fa2ba 100644 --- a/sigstore-java/src/test/java/dev/sigstore/testing/FulcioWrapper.java +++ b/sigstore-java/src/test/java/dev/sigstore/testing/FulcioWrapper.java @@ -16,8 +16,8 @@ package dev.sigstore.testing; import com.google.gson.Gson; +import dev.sigstore.common.http.URIFormat; import dev.sigstore.encryption.certificates.Certificates; -import dev.sigstore.http.URIFormat; import dev.sigstore.trustroot.Service; import java.io.IOException; import java.net.URI; diff --git a/sigstore-java/src/test/java/dev/sigstore/tuf/UpdaterTest.java b/sigstore-java/src/test/java/dev/sigstore/tuf/UpdaterTest.java index 579477276..c7734cd10 100644 --- a/sigstore-java/src/test/java/dev/sigstore/tuf/UpdaterTest.java +++ b/sigstore-java/src/test/java/dev/sigstore/tuf/UpdaterTest.java @@ -27,8 +27,8 @@ import com.google.common.collect.ImmutableList; import com.google.common.collect.ImmutableMap; import com.google.common.io.Resources; -import dev.sigstore.http.URIFormat; -import dev.sigstore.json.JsonParseException; +import dev.sigstore.common.http.URIFormat; +import dev.sigstore.common.json.JsonParseException; import dev.sigstore.testkit.tuf.TestResources; import dev.sigstore.tuf.encryption.Verifier; import dev.sigstore.tuf.encryption.Verifiers; diff --git a/sigstore-java/src/test/java/dev/sigstore/tuf/json/TufGsonSupplierTest.java b/sigstore-java/src/test/java/dev/sigstore/tuf/json/TufGsonSupplierTest.java index 33ffda46a..ecee04f6e 100644 --- a/sigstore-java/src/test/java/dev/sigstore/tuf/json/TufGsonSupplierTest.java +++ b/sigstore-java/src/test/java/dev/sigstore/tuf/json/TufGsonSupplierTest.java @@ -17,8 +17,8 @@ import static dev.sigstore.tuf.json.TufGsonSupplier.TUF_GSON; -import dev.sigstore.json.GsonChecked; -import dev.sigstore.json.JsonParseException; +import dev.sigstore.common.json.GsonChecked; +import dev.sigstore.common.json.JsonParseException; import java.nio.charset.StandardCharsets; import java.time.LocalDateTime; import org.junit.jupiter.api.Assertions; diff --git a/sigstore-java/src/test/java/dev/sigstore/tuf/model/TestTufJsonLoading.java b/sigstore-java/src/test/java/dev/sigstore/tuf/model/TestTufJsonLoading.java index 21b34ca47..99c485087 100644 --- a/sigstore-java/src/test/java/dev/sigstore/tuf/model/TestTufJsonLoading.java +++ b/sigstore-java/src/test/java/dev/sigstore/tuf/model/TestTufJsonLoading.java @@ -20,7 +20,7 @@ import static org.junit.jupiter.api.Assertions.assertNotNull; import com.google.common.io.Resources; -import dev.sigstore.json.JsonParseException; +import dev.sigstore.common.json.JsonParseException; import dev.sigstore.tuf.model.TargetMeta.TargetData; import java.io.Reader; import java.nio.charset.Charset; diff --git a/sigstore-maven-plugin/build.gradle.kts b/sigstore-maven-plugin/build.gradle.kts index 1a02c28da..66facaff0 100644 --- a/sigstore-maven-plugin/build.gradle.kts +++ b/sigstore-maven-plugin/build.gradle.kts @@ -21,6 +21,7 @@ dependencies { testImplementation(project(":sigstore-testkit")) + sigstoreJavaRuntime(project(":sigstore-common")) sigstoreJavaRuntime(project(":sigstore-java")) { because("Test code needs access locally-built sigstore-java as a Maven repository") } diff --git a/sigstore-maven-plugin/src/test/java/dev/sigstore/plugin/test/MavenTestProject.java b/sigstore-maven-plugin/src/test/java/dev/sigstore/plugin/test/MavenTestProject.java index d8508f618..7d09813af 100644 --- a/sigstore-maven-plugin/src/test/java/dev/sigstore/plugin/test/MavenTestProject.java +++ b/sigstore-maven-plugin/src/test/java/dev/sigstore/plugin/test/MavenTestProject.java @@ -66,11 +66,11 @@ public Verifier newVerifier() throws IOException, VerificationException { .filter(p -> p.getFileName().toString().equals("pom.xml")) .collect(Collectors.toList()); for (var pomXml : pomXmls) { - Files.write( + Files.writeString( pomXml, - Files.readString(pomXml) - .replace("@PluginVersion@", pluginVersion) - .getBytes(StandardCharsets.UTF_8)); + Files.readString(pomXml, StandardCharsets.UTF_8) + .replace("@PluginVersion@", pluginVersion), + StandardCharsets.UTF_8); } } @@ -78,18 +78,60 @@ public Verifier newVerifier() throws IOException, VerificationException { if (localMavenRepoProp == null) { throw new RuntimeException("no local repo configured for maven test"); } - var localMavenRepo = "file:///" + Paths.get(localMavenRepoProp).toRealPath(); + var reposBuilder = new StringBuilder(); + var pluginReposBuilder = new StringBuilder(); + int idx = 0; + for (String pathStr : + localMavenRepoProp.split(java.util.regex.Pattern.quote(java.io.File.pathSeparator))) { + var repoUrl = "file:///" + Paths.get(pathStr).toRealPath(); + reposBuilder.append( + String.format( + java.util.Locale.ROOT, + """ + + local.central.%d + %s + + true + + + true + + + """, + idx, + repoUrl)); + pluginReposBuilder.append( + String.format( + java.util.Locale.ROOT, + """ + + local.central.%d + %s + + true + + + true + + + """, + idx, + repoUrl)); + idx++; + } var localMavenRepoPluginProp = System.getProperty("sigstore.test.local.maven.plugin.repo"); if (localMavenRepoPluginProp == null) { throw new RuntimeException("no local plugin repo configured for maven test"); } var localMavenPluginRepo = "file:///" + Paths.get(localMavenRepoPluginProp).toRealPath(); - Files.write( + Files.writeString( settingsXml.toPath(), - Files.readString(settingsXml.toPath()) - .replace("@localRepositoryUrl@", localMavenRepo) - .replace("@localPluginRepositoryUrl@", localMavenPluginRepo) - .getBytes(StandardCharsets.UTF_8)); + Files.readString(settingsXml.toPath(), StandardCharsets.UTF_8) + .replace("@localRepositories@", reposBuilder.toString()) + .replace("@localPluginRepositories@", pluginReposBuilder.toString()) + .replace("@localPluginRepositoryUrl@", localMavenPluginRepo), + StandardCharsets.UTF_8); Path projectRoot = Paths.get(testDir.toString(), PROJECTS_PATH_IN_RESOURCES, testProjectName); var verifier = new Verifier(projectRoot.toAbsolutePath().toString()); diff --git a/sigstore-maven-plugin/src/test/resources/maven/settings.xml b/sigstore-maven-plugin/src/test/resources/maven/settings.xml index ad7f5220a..a7dd383c9 100644 --- a/sigstore-maven-plugin/src/test/resources/maven/settings.xml +++ b/sigstore-maven-plugin/src/test/resources/maven/settings.xml @@ -22,17 +22,11 @@ true + +@localRepositories@ + - - local.central - @localRepositoryUrl@ - - true - - - true - - +@localPluginRepositories@ local.plugin.central @localPluginRepositoryUrl@ diff --git a/sigstore-testkit/src/main/java/dev/sigstore/testkit/tuf/TestResources.java b/sigstore-testkit/src/main/java/dev/sigstore/testkit/tuf/TestResources.java index 20638a262..c5ed15570 100644 --- a/sigstore-testkit/src/main/java/dev/sigstore/testkit/tuf/TestResources.java +++ b/sigstore-testkit/src/main/java/dev/sigstore/testkit/tuf/TestResources.java @@ -16,7 +16,7 @@ package dev.sigstore.testkit.tuf; import com.google.common.io.Resources; -import dev.sigstore.json.JsonParseException; +import dev.sigstore.common.json.JsonParseException; import dev.sigstore.tuf.json.TufGsonSupplier; import dev.sigstore.tuf.model.Root; import java.io.IOException;