Standards-conformance follow-up from testifysec/judge#5559.
The signed predicate (incl. inline leaves) is serialized with Go encoding/json (struct field order + (digest,path) array sort), NOT RFC 8785 JCS. Byte-stable for a single Go producer+verifier, but a non-Go verifier, transparency-log ingestion, a future map-valued field, default HTML-escaping of <,>,&, or 2^53-boundary number formatting would re-canonicalize differently and break signature re-verification.
A conforming JCS canonicalizer already exists in-tree at plugins/attestors/structured-data/internal/canonical/canonical.go.
Decision: adopt JCS for the predicate body before signing (set SetEscapeHTML(false)), OR formally pin the current Go-encoder determinism as the written spec (struct field order normative, leaves sorted (digest,path), HTML-escaping off) + a golden-bytes regression test. Affects all attestors' signing path — do as its own PR, not folded into #5559.
Standards-conformance follow-up from testifysec/judge#5559.
The signed predicate (incl. inline leaves) is serialized with Go
encoding/json(struct field order + (digest,path) array sort), NOT RFC 8785 JCS. Byte-stable for a single Go producer+verifier, but a non-Go verifier, transparency-log ingestion, a future map-valued field, default HTML-escaping of <,>,&, or 2^53-boundary number formatting would re-canonicalize differently and break signature re-verification.A conforming JCS canonicalizer already exists in-tree at
plugins/attestors/structured-data/internal/canonical/canonical.go.Decision: adopt JCS for the predicate body before signing (set
SetEscapeHTML(false)), OR formally pin the current Go-encoder determinism as the written spec (struct field order normative, leaves sorted (digest,path), HTML-escaping off) + a golden-bytes regression test. Affects all attestors' signing path — do as its own PR, not folded into #5559.