refactor: extract sigstore-common module

config/forbiddenApis.txt

@@ -1,5 +1,5 @@
 com.google.protobuf.util.JsonFormat#parser() @ Use dev.sigstore.json.ProtoJson#parser() instead
-dev.sigstore.http.HttpClients#newHttpTransport(dev.sigstore.http.HttpParams) @ Use dev.sigstore.http.HttpClients#newRequestFactory(...) instead
+dev.sigstore.common.http.HttpClients#newHttpTransport(dev.sigstore.common.http.HttpParams) @ Use dev.sigstore.common.http.HttpClients#newRequestFactory(...) instead
 com.google.gson.GsonBuilder @ Use dev.sigstore.json.GsonSupplier.GSON instead
-java.net.URI#resolve(java.lang.String) @ Use dev.sigstore.http.URIFormat#appendPath(java.net.URI, java.lang.String) instead
-java.net.URI#resolve(java.net.URI) @ Use dev.sigstore.http.URIFormat#appendPath(java.net.URI, java.lang.String) instead
+java.net.URI#resolve(java.lang.String) @ Use dev.sigstore.common.http.URIFormat#appendPath(java.net.URI, java.lang.String) instead
+java.net.URI#resolve(java.net.URI) @ Use dev.sigstore.common.http.URIFormat#appendPath(java.net.URI, java.lang.String) instead

fuzzing/src/main/java/fuzzing/JsonCanonicalizerFuzzer.java

@@ -16,8 +16,8 @@
 package fuzzing;
 
 import com.code_intelligence.jazzer.api.FuzzedDataProvider;
-import dev.sigstore.json.canonicalizer.JsonCanonicalizer;
-import dev.sigstore.json.canonicalizer.NumberToJSON;
+import dev.sigstore.common.json.canonicalizer.JsonCanonicalizer;
+import dev.sigstore.common.json.canonicalizer.NumberToJSON;
 import java.io.IOException;
 import java.nio.charset.StandardCharsets;
 

settings.gradle.kts

@@ -13,6 +13,7 @@ if (!System.getenv("CIFUZZ").equals("true", ignoreCase = true) && JavaVersion.cu
 includeBuild("build-logic-commons")
 includeBuild("build-logic")
 
+include("sigstore-common")
 include("sigstore-java")
 include("sigstore-gradle:sigstore-gradle-sign-base-plugin")
 include("sigstore-gradle:sigstore-gradle-sign-plugin")

sigstore-common/build.gradle.kts

@@ -0,0 +1,56 @@
+plugins {
+    id("build-logic.java-published-library")
+    id("build-logic.test-junit5")
+    id("build-logic.build-info")
+}
+
+description = "Common utilities for Sigstore Java"
+
+tasks.jar {
+    manifest {
+        attributes["Automatic-Module-Name"] = "dev.sigstore.common"
+    }
+}
+
+dependencies {
+    compileOnly("org.immutables:value-annotations:2.12.2")
+    annotationProcessor("org.immutables:value:2.12.2")
+    api(platform("com.google.http-client:google-http-client-bom:2.2.0"))
+    api("com.google.http-client:google-http-client-apache-v5")
+    api("com.google.http-client:google-http-client-gson")
+
+    api("io.github.erdtman:java-json-canonicalization:1.1")
+    api("com.google.code.gson:gson:2.14.0")
+    implementation("com.google.guava:guava:33.7.1-jre")
+
+    testImplementation(platform("org.junit:junit-bom:5.14.4"))
+    testRuntimeOnly("org.junit.jupiter:junit-jupiter-engine")
+    testImplementation("org.assertj:assertj-core:3.27.7")
+    testImplementation(platform("org.mockito:mockito-bom:5.23.0"))
+    testImplementation("org.mockito:mockito-core")
+    testImplementation("org.mockito:mockito-junit-jupiter")
+}
+
+forbiddenApis {
+    signaturesFiles = files("$rootDir/config/forbiddenApis.txt")
+    suppressAnnotations = setOf("dev.sigstore.common.forbidden.SuppressForbidden")
+    ignoreSignaturesOfMissingClasses = true
+}
+
+tasks.generateBuildInfo {
+    packageName.set("dev.sigstore.common.buildinfo")
+}
+
+spotless {
+    java {
+        targetExclude(
+            "build/**/*.java",
+            "src/*/java/dev/sigstore/common/json/canonicalizer/*.java",
+        )
+    }
+    format("webPki", com.diffplug.gradle.spotless.JavaExtension::class.java) {
+        googleJavaFormat("1.35.0")
+        licenseHeaderFile("$rootDir/config/webPKILicenseHeader")
+        target("src/*/java/dev/sigstore/common/json/canonicalizer/*.java")
+    }
+}

sigstore-java/src/main/java/dev/sigstore/forbidden/SuppressForbidden.java → sigstore-common/src/main/java/dev/sigstore/common/forbidden/SuppressForbidden.java

@@ -13,7 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package dev.sigstore.forbidden;
+package dev.sigstore.common.forbidden;
 
 import java.lang.annotation.ElementType;
 import java.lang.annotation.Retention;

sigstore-java/src/main/java/dev/sigstore/http/HttpClients.java → sigstore-common/src/main/java/dev/sigstore/common/http/HttpClients.java

@@ -13,15 +13,15 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package dev.sigstore.http;
+package dev.sigstore.common.http;
 
 import com.google.api.client.http.HttpBackOffIOExceptionHandler;
 import com.google.api.client.http.HttpRequestFactory;
 import com.google.api.client.http.HttpTransport;
 import com.google.api.client.http.apache.v5.Apache5HttpTransport;
 import com.google.api.client.util.ExponentialBackOff;
 import com.google.api.client.util.ObjectParser;
-import dev.sigstore.forbidden.SuppressForbidden;
+import dev.sigstore.common.forbidden.SuppressForbidden;
 import javax.annotation.Nullable;
 import org.apache.hc.client5.http.config.ConnectionConfig;
 import org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManagerBuilder;

sigstore-java/src/main/java/dev/sigstore/http/HttpParams.java → sigstore-common/src/main/java/dev/sigstore/common/http/HttpParams.java

@@ -13,10 +13,10 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package dev.sigstore.http;
+package dev.sigstore.common.http;
 
 import com.google.api.client.util.Preconditions;
-import dev.sigstore.buildinfo.BuildInfo;
+import dev.sigstore.common.buildinfo.BuildInfo;
 import org.immutables.value.Value;
 
 /**

sigstore-java/src/main/java/dev/sigstore/http/URIFormat.java → sigstore-common/src/main/java/dev/sigstore/common/http/URIFormat.java

@@ -13,9 +13,9 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package dev.sigstore.http;
+package dev.sigstore.common.http;
 
-import dev.sigstore.forbidden.SuppressForbidden;
+import dev.sigstore.common.forbidden.SuppressForbidden;
 import java.net.URI;
 import java.net.URISyntaxException;
 

sigstore-java/src/main/java/dev/sigstore/http/UnsuccessfulResponseHandler.java → sigstore-common/src/main/java/dev/sigstore/common/http/UnsuccessfulResponseHandler.java

@@ -13,7 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package dev.sigstore.http;
+package dev.sigstore.common.http;
 
 import com.google.api.client.http.HttpRequest;
 import com.google.api.client.http.HttpResponse;

sigstore-java/src/main/java/dev/sigstore/json/GsonByteArrayAdapter.java → sigstore-common/src/main/java/dev/sigstore/common/json/GsonByteArrayAdapter.java

@@ -13,7 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package dev.sigstore.json;
+package dev.sigstore.common.json;
 
 import com.google.gson.JsonParseException;
 import com.google.gson.TypeAdapter;

sigstore-java/src/main/java/dev/sigstore/json/GsonChecked.java → sigstore-common/src/main/java/dev/sigstore/common/json/GsonChecked.java

@@ -13,7 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package dev.sigstore.json;
+package dev.sigstore.common.json;
 
 import com.google.gson.Gson;
 import com.google.gson.JsonElement;

sigstore-java/src/main/java/dev/sigstore/json/JsonParseException.java → sigstore-common/src/main/java/dev/sigstore/common/json/JsonParseException.java

@@ -13,7 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package dev.sigstore.json;
+package dev.sigstore.common.json;
 
 public class JsonParseException extends Exception {
   public JsonParseException(Throwable cause) {

sigstore-java/src/main/java/dev/sigstore/json/canonicalizer/JsonCanonicalizer.java → sigstore-common/src/main/java/dev/sigstore/common/json/canonicalizer/JsonCanonicalizer.java

@@ -14,7 +14,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package dev.sigstore.json.canonicalizer;
+package dev.sigstore.common.json.canonicalizer;
 
 import java.io.IOException;
 import java.nio.charset.StandardCharsets;

sigstore-java/src/main/java/dev/sigstore/json/canonicalizer/NumberToJSON.java → sigstore-common/src/main/java/dev/sigstore/common/json/canonicalizer/NumberToJSON.java

@@ -14,7 +14,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package dev.sigstore.json.canonicalizer;
+package dev.sigstore.common.json.canonicalizer;
 
 import java.io.IOException;
 import java.math.BigInteger;

sigstore-java/src/main/java/dev/sigstore/json/canonicalizer/package-info.java → sigstore-common/src/main/java/dev/sigstore/common/json/canonicalizer/package-info.java

@@ -7,7 +7,7 @@
  * thread</a> and <a href="https://github.com/theupdateframework/python-tuf/issues/457">related
  * issue</a>.
  *
- * <p>There is just a minor edit to {@link dev.sigstore.json.canonicalizer.JsonCanonicalizer} line
- * 43.
+ * <p>There is just a minor edit to {@link dev.sigstore.common.json.canonicalizer.JsonCanonicalizer}
+ * line 43.
  */
-package dev.sigstore.json.canonicalizer;
+package dev.sigstore.common.json.canonicalizer;

sigstore-java/src/test/java/dev/sigstore/http/URIFormatTest.java → sigstore-common/src/test/java/dev/sigstore/common/http/URIFormatTest.java

@@ -13,7 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package dev.sigstore.http;
+package dev.sigstore.common.http;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
 

sigstore-java/src/test/java/dev/sigstore/http/UnsuccessfulResponseHandlerTest.java → sigstore-common/src/test/java/dev/sigstore/common/http/UnsuccessfulResponseHandlerTest.java

@@ -13,7 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package dev.sigstore.http;
+package dev.sigstore.common.http;
 
 import com.google.api.client.http.HttpHeaders;
 import com.google.api.client.http.HttpResponse;

sigstore-gradle/sigstore-gradle-sign-base-plugin/build.gradle.kts

@@ -8,6 +8,7 @@ description = "Gradle plugin with the base set of tasks and configurations for S
 dependencies {
     compileOnly(project(":sigstore-java"))
 
+    sigstoreJavaRuntime(project(":sigstore-common"))
     sigstoreJavaRuntime(project(":sigstore-java")) {
         because("Test code needs access locally-built sigstore-java as a Maven repository")
     }

sigstore-gradle/sigstore-gradle-sign-plugin/build.gradle.kts

@@ -8,6 +8,7 @@ description = "Gradle plugin to that automatically signs all Publications in Sig
 dependencies {
     api(project(":sigstore-gradle:sigstore-gradle-sign-base-plugin"))
 
+    sigstoreJavaRuntime(project(":sigstore-common"))
     sigstoreJavaRuntime(project(":sigstore-java")) {
         because("Test code needs access locally-built sigstore-java as a Maven repository")
     }

sigstore-java/build.gradle.kts

@@ -3,7 +3,6 @@ import com.google.protobuf.gradle.id
 plugins {
     id("build-logic.java-published-library")
     id("build-logic.test-junit5")
-    id("build-logic.build-info")
     id("org.jsonschema2dataclass") version "5.0.0"
     id("com.google.protobuf") version "0.10.0"
 }
@@ -18,6 +17,8 @@ tasks.jar {
 }
 
 dependencies {
+    api(project(":sigstore-common"))
+
     compileOnly("org.immutables:gson:2.12.2")
     compileOnly("org.immutables:value-annotations:2.12.2")
     annotationProcessor("org.immutables:value:2.12.2")
@@ -95,19 +96,13 @@ spotless {
         targetExclude(
             "build/**/*.java",
             "src/*/java/dev/sigstore/encryption/certificates/transparency/*.java",
-            "src/*/java/dev/sigstore/json/canonicalizer/*.java",
         )
     }
     format("conscrypt", com.diffplug.gradle.spotless.JavaExtension::class.java) {
         googleJavaFormat("1.35.0")
         licenseHeaderFile("$rootDir/config/conscryptLicenseHeader")
         target("src/*/java/dev/sigstore/encryption/certificates/transparency/*.java")
     }
-    format("webPki", com.diffplug.gradle.spotless.JavaExtension::class.java) {
-        googleJavaFormat("1.35.0")
-        licenseHeaderFile("$rootDir/config/webPKILicenseHeader")
-        target("src/*/java/dev/sigstore/json/canonicalizer/*.java")
-    }
 }
 
 jsonSchema2Pojo {
@@ -126,14 +121,10 @@ forbiddenApis {
     // Don't allow sigstore-java developers to directly call JsonFormat.parser(), use our wrapper instead
     // which allows for ignored fields.
     signaturesFiles = files("$rootDir/config/forbiddenApis.txt")
-    suppressAnnotations = setOf("dev.sigstore.forbidden.SuppressForbidden")
+    suppressAnnotations = setOf("dev.sigstore.common.forbidden.SuppressForbidden")
 }
 
 // TODO: keep until these code gen plugins explicitly declare dependencies
 tasks.named("sourcesJar") {
     dependsOn("generateJsonSchema2DataClassConfigRekor")
 }
-
-tasks.generateBuildInfo {
-    packageName.set("dev.sigstore.buildinfo")
-}

sigstore-java/src/main/java/dev/sigstore/KeylessSigner.java

@@ -28,6 +28,7 @@
 import dev.sigstore.bundle.ImmutableDsseEnvelope;
 import dev.sigstore.bundle.ImmutableSignature;
 import dev.sigstore.bundle.ImmutableTimestamp;
+import dev.sigstore.common.json.JsonParseException;
 import dev.sigstore.dsse.InTotoPayload;
 import dev.sigstore.encryption.Hashers;
 import dev.sigstore.encryption.certificates.Certificates;
@@ -38,7 +39,6 @@
 import dev.sigstore.fulcio.client.FulcioClientGrpc;
 import dev.sigstore.fulcio.client.FulcioVerificationException;
 import dev.sigstore.fulcio.client.FulcioVerifier;
-import dev.sigstore.json.JsonParseException;
 import dev.sigstore.oidc.client.OidcClients;
 import dev.sigstore.oidc.client.OidcException;
 import dev.sigstore.oidc.client.OidcToken;

sigstore-java/src/main/java/dev/sigstore/KeylessVerifier.java

@@ -23,13 +23,13 @@
 import dev.sigstore.bundle.Bundle;
 import dev.sigstore.bundle.Bundle.DsseEnvelope;
 import dev.sigstore.bundle.Bundle.MessageSignature;
+import dev.sigstore.common.json.JsonParseException;
 import dev.sigstore.dsse.InTotoPayload;
 import dev.sigstore.encryption.Hashers;
 import dev.sigstore.encryption.certificates.Certificates;
 import dev.sigstore.encryption.signers.Verifiers;
 import dev.sigstore.fulcio.client.FulcioVerificationException;
 import dev.sigstore.fulcio.client.FulcioVerifier;
-import dev.sigstore.json.JsonParseException;
 import dev.sigstore.proto.ProtoMutators;
 import dev.sigstore.proto.rekor.v2.HashedRekordLogEntryV002;
 import dev.sigstore.proto.rekor.v2.Signature;

sigstore-java/src/main/java/dev/sigstore/bundle/BundleWriter.java

@@ -19,7 +19,7 @@
 import com.google.protobuf.ByteString;
 import com.google.protobuf.InvalidProtocolBufferException;
 import com.google.protobuf.util.JsonFormat;
-import dev.sigstore.json.JsonParseException;
+import dev.sigstore.common.json.JsonParseException;
 import dev.sigstore.proto.ProtoMutators;
 import dev.sigstore.proto.bundle.v1.TimestampVerificationData;
 import dev.sigstore.proto.bundle.v1.VerificationMaterial;

sigstore-java/src/main/java/dev/sigstore/dsse/InTotoPayload.java

@@ -19,7 +19,7 @@
 
 import com.google.gson.JsonElement;
 import dev.sigstore.bundle.Bundle.DsseEnvelope;
-import dev.sigstore.json.JsonParseException;
+import dev.sigstore.common.json.JsonParseException;
 import java.util.List;
 import java.util.Map;
 import org.immutables.gson.Gson;

sigstore-java/src/main/java/dev/sigstore/fulcio/client/FulcioClientGrpc.java

@@ -19,13 +19,12 @@
 
 import com.google.api.client.util.Preconditions;
 import com.google.protobuf.ByteString;
+import dev.sigstore.common.http.HttpParams;
 import dev.sigstore.fulcio.v2.CAGrpc;
 import dev.sigstore.fulcio.v2.CreateSigningCertificateRequest;
 import dev.sigstore.fulcio.v2.Credentials;
 import dev.sigstore.fulcio.v2.PublicKey;
 import dev.sigstore.fulcio.v2.PublicKeyRequest;
-import dev.sigstore.http.GrpcChannels;
-import dev.sigstore.http.HttpParams;
 import dev.sigstore.trustroot.Service;
 import java.net.URI;
 import java.security.cert.CertPath;

sigstore-java/src/main/java/dev/sigstore/fulcio/client/FulcioClientHttp.java

@@ -24,13 +24,13 @@
 import com.google.protobuf.ByteString;
 import com.google.protobuf.InvalidProtocolBufferException;
 import com.google.protobuf.util.JsonFormat;
+import dev.sigstore.common.http.HttpClients;
+import dev.sigstore.common.http.HttpParams;
+import dev.sigstore.common.http.URIFormat;
 import dev.sigstore.fulcio.v2.CreateSigningCertificateRequest;
 import dev.sigstore.fulcio.v2.PublicKey;
 import dev.sigstore.fulcio.v2.PublicKeyRequest;
 import dev.sigstore.fulcio.v2.SigningCertificate;
-import dev.sigstore.http.HttpClients;
-import dev.sigstore.http.HttpParams;
-import dev.sigstore.http.URIFormat;
 import dev.sigstore.json.ProtoJson;
 import dev.sigstore.trustroot.Service;
 import java.io.IOException;

sigstore-java/src/main/java/dev/sigstore/http/GrpcChannels.java → sigstore-java/src/main/java/dev/sigstore/fulcio/client/GrpcChannels.java

@@ -13,8 +13,9 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package dev.sigstore.http;
+package dev.sigstore.fulcio.client;
 
+import dev.sigstore.common.http.HttpParams;
 import io.grpc.ManagedChannel;
 import io.grpc.ManagedChannelBuilder;
 import java.net.URI;

sigstore-java/src/main/java/dev/sigstore/json/GsonSupplier.java

@@ -16,8 +16,10 @@
 package dev.sigstore.json;
 
 import com.google.gson.*;
+import dev.sigstore.common.forbidden.SuppressForbidden;
+import dev.sigstore.common.json.GsonByteArrayAdapter;
+import dev.sigstore.common.json.GsonChecked;
 import dev.sigstore.dsse.GsonAdaptersInTotoPayload;
-import dev.sigstore.forbidden.SuppressForbidden;
 import dev.sigstore.rekor.client.GsonAdaptersRekorEntry;
 import dev.sigstore.rekor.client.GsonAdaptersRekorEntryBody;
 import java.time.LocalDateTime;