Skip to content

refactor: extract sigstore-tuf module - #1289

Open
aaronlew02 wants to merge 1 commit into
mainfrom
extract-sigstore-tuf
Open

refactor: extract sigstore-tuf module#1289
aaronlew02 wants to merge 1 commit into
mainfrom
extract-sigstore-tuf

Conversation

@aaronlew02

@aaronlew02 aaronlew02 commented Sep 9, 2026

Copy link
Copy Markdown
Collaborator

Summary

This change extracts the TUF engine (including the updater, provider, models, and verifiers) into its own :sigstore-tuf module.

@aaronlew02
aaronlew02 added this pull request to stack #1290 September 9, 2026 18:37
@aaronlew02
aaronlew02 force-pushed the extract-sigstore-tuf branch 2 times, most recently from 9f0f109 to 97d2668 Compare September 16, 2026 19:07
@aaronlew02
aaronlew02 force-pushed the extract-sigstore-tuf branch from 97d2668 to b570d14 Compare October 19, 2026 14:26
@aaronlew02
aaronlew02 force-pushed the extract-sigstore-tuf branch from b570d14 to b87ddfb Compare October 19, 2026 14:59
@aaronlew02
aaronlew02 force-pushed the extract-sigstore-tuf branch 2 times, most recently from a5b8d4c to b9cdf14 Compare October 19, 2026 15:28
@aaronlew02
aaronlew02 force-pushed the extract-sigstore-tuf branch from b9cdf14 to 6af0906 Compare October 19, 2026 15:35
@aaronlew02
aaronlew02 force-pushed the extract-sigstore-tuf branch 2 times, most recently from 4775de0 to 84e9c43 Compare October 19, 2026 17:26
@aaronlew02
aaronlew02 force-pushed the extract-sigstore-tuf branch from 84e9c43 to 9efa314 Compare October 19, 2026 18:05
@aaronlew02
aaronlew02 force-pushed the extract-sigstore-tuf branch from 9efa314 to 180ba4b Compare October 26, 2026 15:24
@aaronlew02
aaronlew02 force-pushed the extract-sigstore-tuf branch from 180ba4b to 80e1626 Compare October 26, 2026 15:50
@aaronlew02
aaronlew02 force-pushed the extract-sigstore-tuf branch 2 times, most recently from 25d9285 to 7147062 Compare October 26, 2026 20:38
@aaronlew02
aaronlew02 removed this pull request from stack #1328 October 28, 2026 13:54
@aaronlew02
aaronlew02 added this pull request to stack #1331 October 28, 2026 13:58
@aaronlew02
aaronlew02 force-pushed the extract-sigstore-tuf branch from 7147062 to 23e4d6c Compare October 28, 2026 14:05
Base automatically changed from extract-sigstore-common to main October 29, 2026 15:52
@aaronlew02
aaronlew02 force-pushed the extract-sigstore-tuf branch from 23e4d6c to ca3a982 Compare October 29, 2026 15:52
@aaronlew02
aaronlew02 marked this pull request as ready for review October 29, 2026 17:25
@loosebazooka

loosebazooka commented Oct 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

going through this now, worth fixing the dependency version drift in the meantime... alternatively we could explore using a version catalog to prevent this issue.

@loosebazooka

loosebazooka commented Oct 29, 2026

Copy link
Copy Markdown
Member

We need to update our module test for this new module. It seems like there may be some conflicting packages (SigstoreTufClient might need to move to a different package).

@aaronlew02
aaronlew02 force-pushed the extract-sigstore-tuf branch 2 times, most recently from 45304ac to 1f7b9f1 Compare October 30, 2026 19:50
@aaronlew02

aaronlew02 commented Oct 30, 2026

Copy link
Copy Markdown
Collaborator Author
  • Moved SigstoreTufClient from dev.sigstore.trustroot to new dev.sigstore.trustroot.tuf
  • Moved Sigstore TUF roots from src/main/resources/dev/sigstore/tuf to src/main/resources/dev/sigstore/trustroot/tuf
  • Added a TargetReader field to SigstoreTufClient to keep getTargetStore() and getMetaStore() package-private in the TUF Updater
  • Declared api("com.google.code.gson:gson:2.14.0") dependency in sigstore-tuf
  • Added sigstore-tuf to sandbox (module-test)
  • Moved TestResources from sigstore-tuf/src/test/java/dev/sigstore/testkit/tuf/ to sigstore-tuf/src/test/java/dev/sigstore/tuf/
  • Updated sigstore-tuf dependencies

@loosebazooka

loosebazooka commented Nov 2, 2026

Copy link
Copy Markdown
Member

Added a TargetReader field to SigstoreTufClient to keep getTargetStore() and getMetaStore() package-private in the TUF Updater

I don't think they have to be package private, lets skip this change for now. And maybe address it later?

@aaronlew02
aaronlew02 force-pushed the extract-sigstore-tuf branch from 1f7b9f1 to 99c5d93 Compare November 3, 2026 16:10
@aaronlew02

aaronlew02 commented Nov 3, 2026

Copy link
Copy Markdown
Collaborator Author

@loosebazooka I've reverted that change.

@aaronlew02
aaronlew02 force-pushed the extract-sigstore-tuf branch 2 times, most recently from c5f42c4 to d3b426f Compare November 3, 2026 18:57
loosebazooka
loosebazooka reviewed Nov 4, 2026
View reviewed changes

@loosebazooka loosebazooka left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

as a follow-up to this, we should consider how root.json is loaded for both staging and prod. Make sure those are module isolated (maybe even explore other hardening strategies here).

Comment thread sigstore-tuf/build.gradle.kts Resolved
Comment thread sigstore-tuf/build.gradle.kts Resolved
@aaronlew02
aaronlew02 force-pushed the extract-sigstore-tuf branch 2 times, most recently from ffaaa48 to dbc6acb Compare November 4, 2026 18:53
loosebazooka
loosebazooka reviewed Nov 4, 2026
View reviewed changes

@loosebazooka loosebazooka left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just some very minor things, then we can merge.

Comment thread sigstore-tuf/src/main/java/dev/sigstore/tuf/Updater.java Outdated
@@ -563,12 +563,12 @@ void downloadTarget(String targetName, TargetData targetData) throws IOException
}

@VisibleForTesting

@loosebazooka loosebazooka Nov 4, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is now visible outside of testing to SigstoreTufClient.

@aaronlew02 aaronlew02 Nov 5, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've removed the @VisibleForTesting annotation.

Comment thread sigstore-tuf/src/main/java/dev/sigstore/tuf/Updater.java Outdated

@VisibleForTesting
TrustedMetaStore getMetaStore() {
public TrustedMetaStore getMetaStore() {

@loosebazooka loosebazooka Nov 4, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks like this could've remained package private?

@aaronlew02 aaronlew02 Nov 5, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've made getMetaStore() package-private.

Comment thread sigstore-java/build.gradle.kts

dependencies {
api(project(":sigstore-common"))
api(project(":sigstore-tuf"))

@loosebazooka loosebazooka Nov 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

another thing to note is maybe we could initialize our SigstoreTufClient (in another PR) with a sigstore-java specific class instead of reaching into the TUF module, so this could remain implementation

@aaronlew02
aaronlew02 force-pushed the extract-sigstore-tuf branch from dbc6acb to f5c4093 Compare November 5, 2026 04:07
@aaronlew02
refactor: extract sigstore-tuf module
97037ad 
Signed-off-by: Aaron Lew <64337293+aaronlew02@users.noreply.github.com>
@aaronlew02
aaronlew02 force-pushed the extract-sigstore-tuf branch from f5c4093 to 97037ad Compare November 5, 2026 04:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@loosebazooka loosebazooka Awaiting requested review from loosebazooka

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@aaronlew02 @loosebazooka