From b8c1d358dd6752f72545f5eedfea5d3ec21f6ba4 Mon Sep 17 00:00:00 2001 From: Nell Shamrell Date: Tue, 28 Jul 2026 19:10:07 +0000 Subject: [PATCH 1/2] Pin ko to v0.18.1 in CI to fix kodata symlink failures All e2e and build workflows install ko via ko-build/setup-ko without a version input, so they use setup-ko's default `latest-release`. ko v0.19.0 (ko-build/ko#1619) added a strict check that rejects kodata symlinks whose targets resolve outside the kodata directory. cmd/webhook/kodata contains such symlinks (HEAD/refs -> .git, LICENSE -> ../../../LICENSE, VENDOR-LICENSE -> ../../../third_party/VENDOR-LICENSE), so every `make ko-policy-controller` (ko resolve) now fails at the "Install policy-controller" step across all branches and PRs: tarring kodata: kodata symlink ".../cmd/webhook/kodata/HEAD" resolves to ".../.git/HEAD" which is outside the kodata root The upstream relaxation (ko-build/ko#1699, which widens the allowed root to the enclosing source tree) is merged but not yet released. As a temporary fix, pin setup-ko to ko v0.18.1 (the last release before the strict check) so CI is unblocked. Once a ko release includes #1699, remove the pin. Verified locally: ko v0.19.1 fails at kodata tarring exactly as CI does, while ko v0.18.1 packs kodata successfully. Removing only the .git symlinks is insufficient because ko v0.19.x then rejects LICENSE next, so pinning is the minimal correct fix. Stale "will use the latest release available for ko" comments are removed since ko is now pinned. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0ce53efa-a7e9-4046-a24e-34c406601950 Signed-off-by: Nell Shamrell --- .github/workflows/build.yaml | 8 +++++++- .github/workflows/kind-cluster-image-policy-no-tuf.yaml | 8 +++++++- .../workflows/kind-cluster-image-policy-trustroot.yaml | 8 +++++++- .github/workflows/kind-cluster-image-policy-tsa.yaml | 8 +++++++- .github/workflows/kind-cluster-image-policy.yaml | 8 +++++++- .github/workflows/kind-e2e-cosigned.yaml | 7 +++++++ .github/workflows/kind-e2e-trustroot-crd.yaml | 7 +++++++ .github/workflows/release-snapshot.yaml | 7 +++++++ .github/workflows/release.yaml | 7 +++++++ 9 files changed, 63 insertions(+), 5 deletions(-) diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index a23041496..9f9fccc28 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -43,8 +43,14 @@ jobs: go-version-file: './go.mod' check-latest: true - # will use the latest release available for ko - uses: ko-build/setup-ko@d006021bd0c28d1ce33a07e7943d48b079944c8d # v0.9 + with: + # Pin ko: v0.19.x (ko-build/ko#1619) rejects kodata symlinks that escape the + # kodata dir, breaking cmd/webhook/kodata (LICENSE, VENDOR-LICENSE, .git links) + # and thus every `ko resolve`/`make ko-policy-controller` run. The relaxation + # (ko-build/ko#1699) is merged upstream but unreleased. Temporary pin to the last + # release before the strict check; unpin once a ko release includes #1699. + version: v0.18.1 - uses: chainguard-dev/actions/goimports@05fbd381f7c158bd33c9bbf3a28f67852269fdf8 # v1.6.21 diff --git a/.github/workflows/kind-cluster-image-policy-no-tuf.yaml b/.github/workflows/kind-cluster-image-policy-no-tuf.yaml index f39ce3720..20b215bf6 100644 --- a/.github/workflows/kind-cluster-image-policy-no-tuf.yaml +++ b/.github/workflows/kind-cluster-image-policy-no-tuf.yaml @@ -100,8 +100,14 @@ jobs: go-version-file: './go.mod' check-latest: true - # will use the latest release available for ko - uses: ko-build/setup-ko@d006021bd0c28d1ce33a07e7943d48b079944c8d # v0.9 + with: + # Pin ko: v0.19.x (ko-build/ko#1619) rejects kodata symlinks that escape the + # kodata dir, breaking cmd/webhook/kodata (LICENSE, VENDOR-LICENSE, .git links) + # and thus every `ko resolve`/`make ko-policy-controller` run. The relaxation + # (ko-build/ko#1699) is merged upstream but unreleased. Temporary pin to the last + # release before the strict check; unpin once a ko release includes #1699. + version: v0.18.1 - uses: imranismail/setup-kustomize@53f941b41dca13ed61874bbc6b4b6e1562877530 # v3.0.0 diff --git a/.github/workflows/kind-cluster-image-policy-trustroot.yaml b/.github/workflows/kind-cluster-image-policy-trustroot.yaml index ba380dc68..46bff0fa6 100644 --- a/.github/workflows/kind-cluster-image-policy-trustroot.yaml +++ b/.github/workflows/kind-cluster-image-policy-trustroot.yaml @@ -105,8 +105,14 @@ jobs: go-version-file: './go.mod' check-latest: true - # will use the latest release available for ko - uses: ko-build/setup-ko@d006021bd0c28d1ce33a07e7943d48b079944c8d # v0.9 + with: + # Pin ko: v0.19.x (ko-build/ko#1619) rejects kodata symlinks that escape the + # kodata dir, breaking cmd/webhook/kodata (LICENSE, VENDOR-LICENSE, .git links) + # and thus every `ko resolve`/`make ko-policy-controller` run. The relaxation + # (ko-build/ko#1699) is merged upstream but unreleased. Temporary pin to the last + # release before the strict check; unpin once a ko release includes #1699. + version: v0.18.1 - uses: imranismail/setup-kustomize@53f941b41dca13ed61874bbc6b4b6e1562877530 # v3.0.0 diff --git a/.github/workflows/kind-cluster-image-policy-tsa.yaml b/.github/workflows/kind-cluster-image-policy-tsa.yaml index b3a2600e1..88dab0cca 100644 --- a/.github/workflows/kind-cluster-image-policy-tsa.yaml +++ b/.github/workflows/kind-cluster-image-policy-tsa.yaml @@ -100,8 +100,14 @@ jobs: go-version-file: './go.mod' check-latest: true - # will use the latest release available for ko - uses: ko-build/setup-ko@d006021bd0c28d1ce33a07e7943d48b079944c8d # v0.9 + with: + # Pin ko: v0.19.x (ko-build/ko#1619) rejects kodata symlinks that escape the + # kodata dir, breaking cmd/webhook/kodata (LICENSE, VENDOR-LICENSE, .git links) + # and thus every `ko resolve`/`make ko-policy-controller` run. The relaxation + # (ko-build/ko#1699) is merged upstream but unreleased. Temporary pin to the last + # release before the strict check; unpin once a ko release includes #1699. + version: v0.18.1 - uses: imranismail/setup-kustomize@53f941b41dca13ed61874bbc6b4b6e1562877530 # v3.0.0 diff --git a/.github/workflows/kind-cluster-image-policy.yaml b/.github/workflows/kind-cluster-image-policy.yaml index c38ec587e..91967734c 100644 --- a/.github/workflows/kind-cluster-image-policy.yaml +++ b/.github/workflows/kind-cluster-image-policy.yaml @@ -115,8 +115,14 @@ jobs: go-version-file: './go.mod' check-latest: true - # will use the latest release available for ko - uses: ko-build/setup-ko@d006021bd0c28d1ce33a07e7943d48b079944c8d # v0.9 + with: + # Pin ko: v0.19.x (ko-build/ko#1619) rejects kodata symlinks that escape the + # kodata dir, breaking cmd/webhook/kodata (LICENSE, VENDOR-LICENSE, .git links) + # and thus every `ko resolve`/`make ko-policy-controller` run. The relaxation + # (ko-build/ko#1699) is merged upstream but unreleased. Temporary pin to the last + # release before the strict check; unpin once a ko release includes #1699. + version: v0.18.1 - uses: imranismail/setup-kustomize@53f941b41dca13ed61874bbc6b4b6e1562877530 # v3.0.0 diff --git a/.github/workflows/kind-e2e-cosigned.yaml b/.github/workflows/kind-e2e-cosigned.yaml index d7051a2b6..43eb3e371 100644 --- a/.github/workflows/kind-e2e-cosigned.yaml +++ b/.github/workflows/kind-e2e-cosigned.yaml @@ -107,6 +107,13 @@ jobs: check-latest: true - uses: ko-build/setup-ko@d006021bd0c28d1ce33a07e7943d48b079944c8d # v0.9 + with: + # Pin ko: v0.19.x (ko-build/ko#1619) rejects kodata symlinks that escape the + # kodata dir, breaking cmd/webhook/kodata (LICENSE, VENDOR-LICENSE, .git links) + # and thus every `ko resolve`/`make ko-policy-controller` run. The relaxation + # (ko-build/ko#1699) is merged upstream but unreleased. Temporary pin to the last + # release before the strict check; unpin once a ko release includes #1699. + version: v0.18.1 - uses: imranismail/setup-kustomize@53f941b41dca13ed61874bbc6b4b6e1562877530 # v3.0.0 diff --git a/.github/workflows/kind-e2e-trustroot-crd.yaml b/.github/workflows/kind-e2e-trustroot-crd.yaml index b30e362f2..30c22db6e 100644 --- a/.github/workflows/kind-e2e-trustroot-crd.yaml +++ b/.github/workflows/kind-e2e-trustroot-crd.yaml @@ -107,6 +107,13 @@ jobs: check-latest: true - uses: ko-build/setup-ko@d006021bd0c28d1ce33a07e7943d48b079944c8d # v0.9 + with: + # Pin ko: v0.19.x (ko-build/ko#1619) rejects kodata symlinks that escape the + # kodata dir, breaking cmd/webhook/kodata (LICENSE, VENDOR-LICENSE, .git links) + # and thus every `ko resolve`/`make ko-policy-controller` run. The relaxation + # (ko-build/ko#1699) is merged upstream but unreleased. Temporary pin to the last + # release before the strict check; unpin once a ko release includes #1699. + version: v0.18.1 - uses: imranismail/setup-kustomize@53f941b41dca13ed61874bbc6b4b6e1562877530 # v3.0.0 diff --git a/.github/workflows/release-snapshot.yaml b/.github/workflows/release-snapshot.yaml index f4102e589..a019d7a0a 100644 --- a/.github/workflows/release-snapshot.yaml +++ b/.github/workflows/release-snapshot.yaml @@ -30,6 +30,13 @@ jobs: - uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0 - uses: ko-build/setup-ko@d006021bd0c28d1ce33a07e7943d48b079944c8d # v0.9 + with: + # Pin ko: v0.19.x (ko-build/ko#1619) rejects kodata symlinks that escape the + # kodata dir, breaking cmd/webhook/kodata (LICENSE, VENDOR-LICENSE, .git links) + # and thus every `ko resolve`/`make ko-policy-controller` run. The relaxation + # (ko-build/ko#1699) is merged upstream but unreleased. Temporary pin to the last + # release before the strict check; unpin once a ko release includes #1699. + version: v0.18.1 - name: Set LDFLAGS id: ldflags diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index b35367e35..212abc6bf 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -42,6 +42,13 @@ jobs: - uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0 - uses: ko-build/setup-ko@d006021bd0c28d1ce33a07e7943d48b079944c8d # v0.9 + with: + # Pin ko: v0.19.x (ko-build/ko#1619) rejects kodata symlinks that escape the + # kodata dir, breaking cmd/webhook/kodata (LICENSE, VENDOR-LICENSE, .git links) + # and thus every `ko resolve`/`make ko-policy-controller` run. The relaxation + # (ko-build/ko#1699) is merged upstream but unreleased. Temporary pin to the last + # release before the strict check; unpin once a ko release includes #1699. + version: v0.18.1 - name: Set up Cloud SDK uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0 From ead6e34a2acd3db92bc88a89faf4234b59333013 Mon Sep 17 00:00:00 2001 From: Nell Shamrell Date: Tue, 28 Jul 2026 17:42:36 +0000 Subject: [PATCH 2/2] Regenerate expired TUF test fixtures The TUF test fixtures across three packages shared a baked-in expiry of 2026-07-18T08:24:13Z, which has now passed. Any test run after that date failed constructing a TUF client with "final root.json is expired", reddening CI on main and every open PR. Affected packages/tests: - pkg/reconciler/trustroot: TestReconcile/With_repository and the trusted_root.json variant (embedded testdata/*). - pkg/apis/policy/v1alpha1: TestTrustRootValidation (inline base64 blobs). - pkg/tuf: TestDownloadTargetFromSerializedMirror and TestClientFromSerializedMirror (inline base64 blobs, byte-identical to the v1alpha1 ones). Regenerate all three together (they must share the same trust anchor): - Reconciler testdata via `make generate-testdata`. - The inline validRepository/rootJSON blobs in pkg/tuf and pkg/apis/policy/v1alpha1 from the freshly generated tufRepo.tar and root.json. Also refresh the stale "next expiration" comments and replace the manual kind-cluster generation notes with a pointer to `make generate-testdata`. Note: the scaffolding repo builder hardcodes a 6-month expiry, so these fixtures will need periodic regeneration (next: 2027-01-28). Fixes #1999 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0ce53efa-a7e9-4046-a24e-34c406601950 Signed-off-by: Nell Shamrell --- .../v1alpha1/trustroot_validation_test.go | 18 ++-- .../trustroot/testdata/ctfeLogID.txt | 2 +- .../trustroot/testdata/ctfePublicKey.pem | 4 +- .../trustroot/testdata/fulcioCertChain.pem | 26 +++--- .../trustroot/testdata/marshalledEntry.json | 86 +++++++++--------- .../testdata/marshalledEntryFromMirrorFS.json | 50 +++++----- .../trustroot/testdata/rekorLogID.txt | 2 +- .../trustroot/testdata/rekorPublicKey.pem | 4 +- pkg/reconciler/trustroot/testdata/root.json | 30 +++--- .../rootWithCustomTrustedRootJSON.json | 30 +++--- .../testdata/rootWithTrustedRootJSON.json | 30 +++--- .../trustroot/testdata/tsaCertChain.pem | 28 +++--- pkg/reconciler/trustroot/testdata/tufRepo.tar | Bin 3015 -> 3021 bytes .../tufRepoWithCustomTrustedRootJSON.tar | Bin 3530 -> 3528 bytes .../testdata/tufRepoWithTrustedRootJSON.tar | Bin 3529 -> 3524 bytes pkg/reconciler/trustroot/trustroot_test.go | 4 +- pkg/tuf/repo_test.go | 18 ++-- 17 files changed, 162 insertions(+), 170 deletions(-) diff --git a/pkg/apis/policy/v1alpha1/trustroot_validation_test.go b/pkg/apis/policy/v1alpha1/trustroot_validation_test.go index 41364ff60..ce0a58797 100644 --- a/pkg/apis/policy/v1alpha1/trustroot_validation_test.go +++ b/pkg/apis/policy/v1alpha1/trustroot_validation_test.go @@ -29,22 +29,18 @@ import ( // encoded. These are vars because conversion to []byte seems to make them not // constant var ( - validRepository = `H4sIAAAAAAAA/+xcW1MbOdPOtX+Fi9t8G0stqSWlai9m7AEMGLBjjl+9ldLRGBsMHoOBt/a/vzXmTA5kF3Cyu/NUJfYcGLW6NU8/oiXG4WSU9yej8eW7NwMhhEghZp+EkKefs+9UUMYo5VDcRxlQ/q4q3s6ke5zlEzN+R8h4NJp8777nrj/t3N8E9/Gv0Q9FHz8c5qPj122j8Ady/q34cyD0SfwFI+JddS5O/JfH/7+V6kLe7x0Hv/Cx+t9KtbrweXJ5EhY+VheKHi/8X3EqPwnu83kY5/3RcXGFfiDXF+7P0dlxuDjpj0Ne3AME8Dcif6OqS9RH4B8p27/+oUG4zG8aqy6QSAQYz7QWSLwUjrOoiPecRxfRUOK4ljRaI5mg0hBkxliQlBOUiKBuHzR77K3lwYMQVM+aK8x3B+HoaxcG4bLvPx+Y/OCzGfZG4/7k4Kgw7f9nl6sL+YEBgTd3zw4FhYXZ0X/uH3FuhndWVBdOzuyw74rGCI02YvCMRm6QRO69A4KKO23RIAAlUTqnqI1MOmWshUhVAEGVoU7o64b+KP7/Y9baApcRwKEJCjToiEIGgRCiMCJKw7k3VkcwHFgwSJxGZkNkURiU2gj7KztLOUN41ECt5AA8MCetit4QrwJ1xHDiQQftvTGcoAJUDgMNmosYpGXsS2dpxRAMs9xozUFxJ6wEQaSXTAXnfVAgWQAXA0dk2tkQg6PgpTSWOUV/YWdZDiC0C5YYDTrISALjPkiHkRLKBYKSyglGI3XOKE2IUggSWCRIePiKs6yAwJRVMjqv0IboKUdLhNPEEaBGRWUcdxSiZDJowZWKwnHJIFCJNvzCzkJEQwWxTAF3Ej2xNHoKlkcilRdoOGXBOhkEmAgyGE45807EEIMO1j90VuXGYQvj0TDck9iMKR96oO8f2v/ikfioq5ODccgPRsOCsOmDEObH5iQ/+K4hL47yDxkyMeNemOTfsePFPPZjdvSPQj4xRyffseTF6ecZS+4GjBsd5/18Eo4nnx8EajI+C5XZHbMkbCZn19mzMO96aM0sLobxiwfRzSjp94qnMSgCgNYFH5V1aLQn3jHwEINwyimhtbfRKs2VkZwbRowMaD2CAq2tQpRcIeccgaEROqDk4AEYBqYcWIFRKrTMg5DeQsDgwQFTzEnGiSj89kel+p/KHz9bAP3L8Uj/347MV54DPKP/KRXwRP8jRVbq/3ngO/r/jqfeYA5wFCbmLn3eJIzZqLvn6mE47k0OiscyFDcEW2iE+7x7rwU+VheEVNyitdZqHxUz3FCjhVUuOiBUCqeUITE4E33gGqWODIC6aJ223oroopHKKMEkiIJNhZHSGwNSUBQsSK2cx2i8Uga9lFJFobHQXYFJq4m8kQk3hj5wyl0e+EGif3GSfkT03DOggQZOVBCojTFUAmHoCJNMeQfOQaA+ghSCaAUCBaWOBURKjDEcLVrjDUXGVNBEMeWokoEIghSLxB11JFojR+2EJQIQlEBng9MCI4GS6H9tPOL/hy/iK7bxDP+DAPGU/wmBkv/nge/w/62OfwP6fzJFWHCTGD6chKOvsb9Uz5M/RqEQBBVKqEidt045RzxDSYjTkjgSKPcO0CDVnmhLNAvSBggYHYlcKqSReu+9NpYq4ilqErjVIUYqNVgTiylKUFY75yUNRChiiLQSNIVAHpO/O8sno6OHhvZ7+WQ0vp8lV6sLZ7npzdxc7y5mt3Pb6kI+MZOzmfcSN+mfh/srZ+N+cfq6qev56KMpfDwbuv7oG17U+ge8SKNHzmIgIZAoOXPKiiK5gKXMoXFIlDdWyOgJiiCYRSG9Z2BBRaRWmUi5pagCISQSCZF5ydApzxQzaLykIiqmFCGRcuKkURhl5KCt8IwIeIkXF2e9fw0/jsNgNH7JYIxWEhGsVp4QkF56rRU3qC2KwJUCxzUKNCJEjtyZaBSSgExZ8C5KEQ1DDgDMqIiKokNBDRUcpSNMWSGJlMRGBhSASBOohagVpww0KFTcvcSNnaLzL/Pin5A6L/49wCOp45QPwiPTIphCqEQRhEUlbTBCREqN9BqoBialgWIaa2JELiJTkRLqQGqC1kltJVhNkGMstBGjRAmromHKcycJJUFp4FJYSXURSCG0YToS9beUOg/y/xtVf/5S/YdyLPP/PFDWf8r6z6/grLL+U9Z/yvpPWf8p6z9l/afE/PBA/79R9ecv1X8I8FL/zwNl/aes/5T1n38vHvD/zWv4+m2QP73+myOKcv33PPBl/Gub5mI5GB/G+QdSe42awDfifhd/EI/HAgEhGL6rXszDAbfxn0dbvyAoquqJmRz8/pWB8LPrQR/uS1qVn+2nfyrmEfbn9L/k+Jj/GaFMlvp/HvitQJotNder9azTbS4260k3m52ttJrNdPOwnorVpJH0snrxr5WMlur106VPLa7TpFVvJeSifpWspL317TRpdZOj9YNWyncb3SZUWo3sYqOR8NZh+6I1HO02ui14cm7auMrWW0m+lNCtLLloZXZp+2D/MN1vpa2lSnp53VLSy+5aTabZckKaSVo/bu2KUWPtNAm1qzwTw4uTE59f5aupzs/rtbWD3a1KurYxUF0Ug/WG/nS5u6RaCX3/6XQHmg73OsdHYgyH789r9U4fh0u7OVlq4GHrKrloJbywyFca0yytTdtZMm0uTRtJLPq5/KmVLTWSnV7aYZNVgRs7q7s4Ojqkm7VBtjM4H/Q72Uk3WU17vdPKweBwY7PdbiS99ZWkkS4l/SzRa/2s+543PrlNt7m2ic3909GAk7o8Z5uXI7LotwZ723XeGfu9eqXZrnfiynS4eGinbLnVXls/7++RenLQU0tJ3jrKTxe3asnKxrCpbG/6+++VWfCy9caXAX0u2J+69VSZu2Cnrx/sbrbWSga3wa7vQTbd6SbdtOduPdVMC7ddf2+l6XS9niSdLd1/v7VxtrzaWcmHp4PQ3Gyp5fNxbeP4YvR+vGMustE5rVyk2fvzw91hLYbF+lGfqV7SbIraVu80294fLortNPVhmO2ntM8vczsdkea03Ug2ZjFtq7SSRJUV/Ux67WljutfY7pBu0l6upcnWNCkGwlXir2/m2WKvveXlp7NwOOwP35+ujHS3VhHp4smaaA46q1vTem+vuTrab14dkmL0NDrTZNpJmj2zOBGddhzsLQ1h0r7c2K3pbkxdXygyrvSOW7WsvhrC+DS9XG3Wm+l5urHEruJOKk8Xt+qj/LCXD4+E6V7srO3ZoffrZnXJjg+vtP5O4L/9/j+n/15jZc2z+o/jU/0HXJb6bx6giN/Ufz97VdWH22Vhpfp7M8wj7M/oPwIIX+g/Tkr9Nw88kASbW+las15dzfZuFMHiYJpN95Zvklg9ad8ltEbSdo12L8lUfW9d1Ae1nph09i/Olt1Zd6iicid8+7jC6PCqv6lHK7BpV7yyhzvbpsE3G921AW5uu81Jf3mShWy9trJOu5PT9mCrl7eG9WgeqZinZv1sj/2z8Fz+f43FjM/nf/k0/zPJy/w/D1CU38z/P3sh64e7pbjlS/9WmEfY/3T+Bylpuf9jLnhh/vfLV2M7PJpGftDK2PuNiVyDVC0Oup52Kp2Y58fDgz58uty6bO+pjeOTddw8XMSJ3PXmcv1iRe7ube+Etf2ktsRXe4K26/LSrtBemf/nhS/f/9dfAv7M+/+V/V8Cebn/dy4o93+V+7/K/V/l/q9y/9e/fv/X3XrpOe//plSwL/7+h6Rl/p8Hvpf/79bPv/UC0Ecrj79Cu0h/RANAoCQSTRmitSFCIJIwQMkjMdKiIJ4rpFwwKr0UTNFoXVDceOlJ8ER5KpkGSwn10jJ0hmtPDZXRW2+shwhFd0Bawp3QIhrFuC74GhljUr3aAtAX70l4xIpKcgyMExaVA8PQWoLKU+RUOWKIi5I5cMEEL50R3AvDKNOUMWBguLPaUO44KzhVWMK1DdHGSJUQgRLhvVQiBssEOCNVcKCNpDwqpqnkQAj/W7JiiRIlSvzz8b8AAAD//1nncb4AXAAA` + validRepository = `H4sIAAAAAAAA/+xcaVMbSdL2Z/0Kgq/zjpVZd03EfGgdFgIECMT5xoajTt2HdSChjfnvGy1ufOBZQPas+4mwJXW3u7IzszKfrszyOIyGk/Z0OL5692YAAJCcp58oOXn4eYt3yAklKBgh8h0gRcnebfC3E+kes8nUjN8BDEKv963rnjt/+yC3n/8Q3Ns/j+/Hw+H0fWcyHLzuGKk+BGNfsz8jgE/sz4ng7zbWosRf3P7/zm1sTtrNQfCbf2z8O7exsflxejUKm39sbKbesPl/6aHJKLiPl2E8aQ8H6Rl8D9cn7o/h6ndYjNrjMEmvIUDk74C/E9VA+QcVfxB6cf2PuuFqcjPYxib1mnMfgtaKgg3AJUdPiHPAwTDJrdAEfCCeCnTWByNIdMiMEKgk5fr2Rqvb3koePOEc9Wq4VHzXCv0vneiGq7b/2DKT1kfTaw7H7Wmrn4r2/6vTG5uTliFc3Fy9+smRbK5+/ev+FpemdyfFxuZoZnttlw4G2gpCddCEg0NDFSEugIs0OiTSEiFtgMCJicECM1EBE8Sx6AQaxQi7Huiv9O+/VqNtcs4EM5QZmipNcooUGY0sqOgNkyxw70kEIcFI7Q3zhHpl0XnPpKeB/MTKsoQ4JhnV3iLTGlRw0WhgIIwHTYmj1GsNWhnFJEYegyQUIvORuWh9+FxZwoHUlHvnnWdOOCUCeie15CIKFBqE98pwz4130gXpAlXc6GAIQR3B/MTKip477pQXQSB6Lr2x6DSzSBT3xHBupfYalYTIIpiouGcWNYk+WOkJ/1xZESAgl0ZyFaSPgUSpJZM+SgWCKmKiBKMks5YG4oIUxBqtvPaKBW18/ImVpUlgzESuiORKMK54dDwQIoR3IH0wTqJ1PkovHffGCu4FCnSGp2nK2ofKyt0obHM87IX7ILaKlA810PYP5X/xtH30qNPWOExaw14asPGBCScDM5q0vinIi4PtdwkyNeNmmE6+IceLp+b3ydHuh8nU9EffkOTFfv+MJHcO44aDSXsyDYPpxweGmo5nIbe6YpWEzXR2nT1T8a5dayVx6sYvdqIbL2k307s5pgSoYJijQqYhAbVmBK01VBuUnGrLogqEcoWGopdWpNyMA6qIwjuNXCsiqLDaAEUlRQTihLYeEV2ANEwHT5XQljAvDFPMCG5JjEY4CytP+iu38a/cXz+aAP3ieMT/bz3zld8BnuH/iJw84f8CGc34/zrwDf5/F6fe4B2gH6Z3BOs2Yay87j5W98KgOW2lt6VC3ATYlCPc5917LpDKgwjSW6I4d9EyxrySYFhkaXTXAEpplMYHBghoAwESuFZCWNDWcEelN4xaEgP31gURfBSO6EiJdCYE1MYTE9HqQKMnQihhvSApUZA2TVb+hibcCPpAKXd54DsD/YuT9KNAT5X3XAgdqAQigFiqBFKvIEB0DqUBpQI47ozV3CGN3CEKaaRCETWESIBLoDpQDF5wqQMKbxQRzjtliTPO+Ui4CNZbKoI1mumoA3jqIwbgWaD/ufEo/j+ciK84xjPxn3Ainq7/SJHF/7XgG/H/lse/Qfh/8oqw6aYxvB+F/peiv1TPB38AZtP3XQ/c06gF0RqVFhzTF1/NKBIpuDQaLeHcG80JsyYyLixKhsRFCsgNiyGGCEpRbi2i0pISpRnXkXrJLAvEGweMayuDoyJQpqNnjAX2OPi72WQ67D8UtN2cTIfjcH9oY3M2Mc2VmouND+Xbd9uNzcnUTGcr7SVu2r4M92dm43Z6+Hqo6/fRx6/ws55rD7+mRQDyHWr0kgKjNEhiQqAUDShNAw/aCyYZQ7RaCPTANJUGmUEMSkjCmdJEa+kpD0ApVx6oiAyEk15Ebpli6F3USsXIoo8ODEYITDEeDBBLuKIcUL5EjR9Wj/8aihyH7nD8Em8UWqd+5a32YKxVkXsqubBEoAtoDRFWOUKUFCFNxMxLp12wlAjKnKRGUk29NYp6qhwVVFHrUEUQllrqInNROeTcA5GgQ7AeInoXQpQ8Wu35S9R4mD78y7T4N7jOixcCHnEdJSQ1RlkqZVSacCqcjkSgIsKA5BKlcN5HZiUVBKWkKAxGbU0EDoGC5YKAs1yZ6Lg2WmE6yZFoL4hHgoQxCN46bhV46WkMlJAQnWNCUAvun8h1HuT/N6r+/Ff1HyQiy//rQFb/yeo/P4OysvpPVv/J6j9Z/Ser/2T1nwzrwwP+/0bVn/+q/gPAMv6/DmT1n6z+k9V/fl08iP830/D1x/j7/d9MMJ71f68Dn9s/f2AWW8H4MJ68h/xrVFaequbJJxAmHvkCEMaYeLexWIcCbu2/jrF+QqAQGyMzbf35BUf40VW197dlwdyP1tL/LtZh9mf4PxDxhP8TiTLb/7EW/J6iUK5U9zYOjgu71eLGTvl8dTBX+9Cdl+fnWzvDi+qyA8Wkfl69+V5K6q5UbyblQmsyNPPi1UKIslF8sHuxLXvnn/aXO1HlPtUPeqeVD2rA9maLk71aYzlTeZr4btz67TjuD3tW9/N7rXl1cbDdGAzixakrJXJUbMz//DO3kqG8V/pMrB+tsf8tPJv/X6Ml4Ln8z+Gz/M9Jlv/XARTq6/n/B7eDvL9vaclm/RthHWZ/bv1PPl3/I0Jk+X89eJD/i+XDRvVDtZg0yjcEoFotHHSKBb6TlJJmuZj+qSXDSrH4qXJUY7qQ1Iq1BBbFZbJdaO6dFJJaI+nvtWoFdlZqVEmuVnJX+6UyrS3Pr2q94VmpUSNPjs1Ly/JeLZlUEjwuJ4ta2VZOWhedwkWtUKvkClfXIyXN8t2oyby8lUA1KezFLa2vjshvB+2eLC5GO4fbJ3RZnu82D+lZYf+3yriTazuXFHQFZzjFBb8YdPufjhATurVnRuX2uNc97gy35NlglN8/xONlJVZOO7VlsqglLJXI50rzciE/r5eTebUyLyUxfc6to1q5UkpOm4V6ez47UB1l7YeD+jgmybk4m12Ud08v26Vkp9Bsfsq1up39g3q9lDT3tpNSoZK0y4ledpaznUZ7PNOjs8PuKd2xn4b9bj6/fYJqi+Rddb7frgytvqwWc9V6MZ/vRne41y1NYdg/auLlpNrYb8bS5JTQY9FuLlX9srjM73zqNx8yp88M+pyxjzrFgjJ3xi68vrEb5d1a0r01dvGclOenjaRRaLpbTVULqdquv9cKhfleMUmOZrMDvTfcujxg1f1yf/f8rFk57dTzO4dQK44WJz0snGEvZ3vFydbk6Gpnerh3HAQ9Oq9WT7YXhwYKfgDDIZr62ZGeDuJFuTDpH8ghVOf1UrK/smldFXJJVOX0OZNmfV6an5dODqGR1LfyheR4nqSOsEz89cWs/KFZP65Odjv5ar5CFg3YofMkV9nvyf5hEcesOS827+hy6j2loySZH9arzbN2+6wjjpuNw+Mdf1xbbqlut7ivuny7upPjojOadPqXsLU9X/RZsVovVtvL/GXbXhwvagx3SLmbn5eOO1XVLe/uY3JcPQktHpdYKh0l3zT+l+f/c/zvNXoZn1//kU/4H2eYrf+sBSjkV/nfj+5jfX/XiZvRv7fCOsz+t9d/KADP+j/Xgheu/4TiFqvt0hNRZleXYM7z57sFNxGxtV08z112dvqXtc7EDU5xMByQCivhiR8NE+FOW9vd30yp2V3sRNWW27tnfkBqe7L/qbZ/xerZ+s+68Pn8f/0W8Gfm/5f2fwmS9X+sBdn+r2z/V7b/K9v/le3/+uX3f931S695/zcip5/9/x8cs/y/Dnwr/9/1z791A+ijzuMvRF2B3xN1pfZKG+8Jg0hFVC5ipEgRQyQcpUDhwGqvUCknNSEcfJTECqmU9lJ6g5EZC9oZAR4ZUUFzD0xIA1EHah2linoXWIzcQIxgUyKgqY4KLYdXawB98Z6ER0GRKIlUOMmU0jZQxnjkjlrpELxTQUflAupolBbAiEbtmNLScmkdi1E6q5VlFLwABlExA57wqNBJqyQxylipAyPee0uiNcpHDEhBcE0I8wDhnxgUM2TIkOEXwH8CAAD//y1E+28AXAAA` // This is valid base64 (hello world), but should not be able to gunzip // untar. invalidRepository = []byte(`aGVsbG8gd29ybGQK`) - // TUF Root json, generated via scaffolding - // IMPORTANT: The next expiration is on '2026-07-18T08:24:13Z' - // Steps to generate: - // 1. cgit clone github.com/sigstore/scaffolding - // 2. run ./hack/setup-kind.sh - // 3. export KO_DOCKER_REPO=registry.local:5001/sigstore - // 4. run ./hack/setup-scaffolding.sh - // 5. get the secrets from the kind cluster - // kubectl get secrets -o yaml -n tuf-system tuf-root - rootJSON = `ewogInNpZ25lZCI6IHsKICAiX3R5cGUiOiAicm9vdCIsCiAgInNwZWNfdmVyc2lvbiI6ICIxLjAiLAogICJ2ZXJzaW9uIjogMSwKICAiZXhwaXJlcyI6ICIyMDI2LTA3LTE4VDA4OjI0OjEzWiIsCiAgImtleXMiOiB7CiAgICIwZjA1MmFkMzk5NTYwZDc1YzQzZjgwZGQ0NGZjZjZhMTBjNDk3MWZiYTczNTE3YTA2M2FhYjI3MTQwNjc2NjI4IjogewogICAgImtleXR5cGUiOiAiZWQyNTUxOSIsCiAgICAic2NoZW1lIjogImVkMjU1MTkiLAogICAgImtleWlkX2hhc2hfYWxnb3JpdGhtcyI6IFsKICAgICAic2hhMjU2IiwKICAgICAic2hhNTEyIgogICAgXSwKICAgICJrZXl2YWwiOiB7CiAgICAgInB1YmxpYyI6ICIwMWZiZjZlZDMxZjRhNjBmNGRkYzIwNjg0YzliNmE2MjIxMGY3Y2M4MWJmMzdjOGFiYjJmMThlMjUxOGExYzU5IgogICAgfQogICB9LAogICAiNDdmMjJjNmFlODI5MjlmNjU3ZTU2MmVmNWE1ZjdhNDRkYWI5ZjJhNDIzZWE2MGM5NjNiZWYzZjVhNjc5YTViOCI6IHsKICAgICJrZXl0eXBlIjogImVkMjU1MTkiLAogICAgInNjaGVtZSI6ICJlZDI1NTE5IiwKICAgICJrZXlpZF9oYXNoX2FsZ29yaXRobXMiOiBbCiAgICAgInNoYTI1NiIsCiAgICAgInNoYTUxMiIKICAgIF0sCiAgICAia2V5dmFsIjogewogICAgICJwdWJsaWMiOiAiOGNhMDRmOTIxYjc0MjI0ZTNjN2I4ZmRhMGQ4ZTFjMGE0MGQyOWU5ZGRhYTQwNjgyNjhjNmUxZTk0NWZlN2IzMyIKICAgIH0KICAgfSwKICAgIjk4MzYyYTNiNGE5OTQyODRjNWI3MjUwN2Q3MzhlY2RkZTgyNzNlMmNmZTQ2NjM5Y2JlZmVjMTJkNzdhYjNjODEiOiB7CiAgICAia2V5dHlwZSI6ICJlZDI1NTE5IiwKICAgICJzY2hlbWUiOiAiZWQyNTUxOSIsCiAgICAia2V5aWRfaGFzaF9hbGdvcml0aG1zIjogWwogICAgICJzaGEyNTYiLAogICAgICJzaGE1MTIiCiAgICBdLAogICAgImtleXZhbCI6IHsKICAgICAicHVibGljIjogImI0MjI1OWNlYjBhOTI5ZTdmMGUzNGRlN2M2ZjEwMTQ1NjI4NzhjNTMxZjFjY2E4OTAwODg2MjcyM2YwNjA0ZTMiCiAgICB9CiAgIH0sCiAgICJiNTJlMzhiODdmY2Q4NmJlZmQxNDZiMDVjOTBjMDIxYThmOGFjNGMxMmY3MzdlOTU0ODhmNWM0NzMyZTE3NmJlIjogewogICAgImtleXR5cGUiOiAiZWQyNTUxOSIsCiAgICAic2NoZW1lIjogImVkMjU1MTkiLAogICAgImtleWlkX2hhc2hfYWxnb3JpdGhtcyI6IFsKICAgICAic2hhMjU2IiwKICAgICAic2hhNTEyIgogICAgXSwKICAgICJrZXl2YWwiOiB7CiAgICAgInB1YmxpYyI6ICI2NjZhMTUwYjM4MjRjNzZkMGIxZmQxMmI0ZjA3OGQ1NmE0MTNlYmM3ZTUyYWYyN2VhNDE0M2RjNWZlZmU5ZWJkIgogICAgfQogICB9CiAgfSwKICAicm9sZXMiOiB7CiAgICJyb290IjogewogICAgImtleWlkcyI6IFsKICAgICAiOTgzNjJhM2I0YTk5NDI4NGM1YjcyNTA3ZDczOGVjZGRlODI3M2UyY2ZlNDY2MzljYmVmZWMxMmQ3N2FiM2M4MSIKICAgIF0sCiAgICAidGhyZXNob2xkIjogMQogICB9LAogICAic25hcHNob3QiOiB7CiAgICAia2V5aWRzIjogWwogICAgICJiNTJlMzhiODdmY2Q4NmJlZmQxNDZiMDVjOTBjMDIxYThmOGFjNGMxMmY3MzdlOTU0ODhmNWM0NzMyZTE3NmJlIgogICAgXSwKICAgICJ0aHJlc2hvbGQiOiAxCiAgIH0sCiAgICJ0YXJnZXRzIjogewogICAgImtleWlkcyI6IFsKICAgICAiNDdmMjJjNmFlODI5MjlmNjU3ZTU2MmVmNWE1ZjdhNDRkYWI5ZjJhNDIzZWE2MGM5NjNiZWYzZjVhNjc5YTViOCIKICAgIF0sCiAgICAidGhyZXNob2xkIjogMQogICB9LAogICAidGltZXN0YW1wIjogewogICAgImtleWlkcyI6IFsKICAgICAiMGYwNTJhZDM5OTU2MGQ3NWM0M2Y4MGRkNDRmY2Y2YTEwYzQ5NzFmYmE3MzUxN2EwNjNhYWIyNzE0MDY3NjYyOCIKICAgIF0sCiAgICAidGhyZXNob2xkIjogMQogICB9CiAgfSwKICAiY29uc2lzdGVudF9zbmFwc2hvdCI6IHRydWUKIH0sCiAic2lnbmF0dXJlcyI6IFsKICB7CiAgICJrZXlpZCI6ICI5ODM2MmEzYjRhOTk0Mjg0YzViNzI1MDdkNzM4ZWNkZGU4MjczZTJjZmU0NjYzOWNiZWZlYzEyZDc3YWIzYzgxIiwKICAgInNpZyI6ICIzMjIyYzY2YmNlZGY4YmM2YTlkMGRjMzJkMmZlNWM4Yzg1OTlkYmZiODk0OGE3NDRhMzBhN2U2YmQ2MjgyOTliODY2NzQ4NjQ0NDYyMzZhNTllNjc0MmQyMjM2ZTM4YzJiNTZmNzg2YjNkMjU3ZGIyZTZlZDJjMjM4M2M3MzQwNSIKICB9CiBdCn0=` + // TUF Root json for the above validRepository. + // IMPORTANT: The next expiration is on '2027-01-28T17:36:23Z' + // To regenerate rootJSON and the matching validRepository above, run + // `make generate-testdata` and base64-encode the resulting + // pkg/reconciler/trustroot/testdata/root.json and tufRepo.tar respectively. + rootJSON = `ewogInNpZ25lZCI6IHsKICAiX3R5cGUiOiAicm9vdCIsCiAgInNwZWNfdmVyc2lvbiI6ICIxLjAiLAogICJ2ZXJzaW9uIjogMSwKICAiZXhwaXJlcyI6ICIyMDI3LTAxLTI4VDE3OjM2OjIzWiIsCiAgImtleXMiOiB7CiAgICIzZDk1NWRlZTk5ODMwYmUwNTc1MWQyMmNjMDUwYTQ3NWI2OTIwZGUyZDM2MWNiZGVhNjJmYzE0YTY2MTg3MzU5IjogewogICAgImtleXR5cGUiOiAiZWQyNTUxOSIsCiAgICAic2NoZW1lIjogImVkMjU1MTkiLAogICAgImtleWlkX2hhc2hfYWxnb3JpdGhtcyI6IFsKICAgICAic2hhMjU2IiwKICAgICAic2hhNTEyIgogICAgXSwKICAgICJrZXl2YWwiOiB7CiAgICAgInB1YmxpYyI6ICIwOWI2MjM5ZTkyNTBjMWEzODIyY2UwY2YzZmMxMjdiMjY3YmUwZTUyYWZlYjA0YWY4MDQ2MmM0ZmM2MWE4NDI0IgogICAgfQogICB9LAogICAiNTU0NjRhMzRhMzk1NWQ3NTMxMzE0M2Y0ZThmZGE0NzRlNWRkMmYwNjcwYTc5ZGE0ZDIzZDhiMWNkZDQ3ZDNlMiI6IHsKICAgICJrZXl0eXBlIjogImVkMjU1MTkiLAogICAgInNjaGVtZSI6ICJlZDI1NTE5IiwKICAgICJrZXlpZF9oYXNoX2FsZ29yaXRobXMiOiBbCiAgICAgInNoYTI1NiIsCiAgICAgInNoYTUxMiIKICAgIF0sCiAgICAia2V5dmFsIjogewogICAgICJwdWJsaWMiOiAiYjIyYzQ3NDM5ZGIxNDk5MDhlY2ZhOTA0MDZhZDA5MzJjMzNkOTkwOThhODQ3MWY1ZmU3MjMwZjRkZjRjZmJkZSIKICAgIH0KICAgfSwKICAgIjZjMDc5MzVkY2RjZDRjNmM4NmUxZGM3OTc1NmY2MTY5MDZkZDhhNWQ1YWRjN2NlN2NlMzg1YTllYTIyMTlmMGEiOiB7CiAgICAia2V5dHlwZSI6ICJlZDI1NTE5IiwKICAgICJzY2hlbWUiOiAiZWQyNTUxOSIsCiAgICAia2V5aWRfaGFzaF9hbGdvcml0aG1zIjogWwogICAgICJzaGEyNTYiLAogICAgICJzaGE1MTIiCiAgICBdLAogICAgImtleXZhbCI6IHsKICAgICAicHVibGljIjogImZkNWM1YzhkNmU2MTFkNTdkYWIxYzk0YjEyODVkMmE1NWI3OWQ5MTg3MGY0ZjBhZjg1ZDRiMTkyZmRlYjdkMjUiCiAgICB9CiAgIH0sCiAgICJmMDBlMTU3YTc1OGU3ZGZlMmY3OTc0N2RmNzgwNjM4MmFmNzBhODc0YmIzZTJjZTc2MmJhOThkOWQ4NGU5YWRmIjogewogICAgImtleXR5cGUiOiAiZWQyNTUxOSIsCiAgICAic2NoZW1lIjogImVkMjU1MTkiLAogICAgImtleWlkX2hhc2hfYWxnb3JpdGhtcyI6IFsKICAgICAic2hhMjU2IiwKICAgICAic2hhNTEyIgogICAgXSwKICAgICJrZXl2YWwiOiB7CiAgICAgInB1YmxpYyI6ICI5MmU0NGFmNTgyNzU4NjQ1ODVmYzVlMjI2NmRjMDdkZWFjNzFiY2RmN2Q3YzVkYWI2NWQ2MTYxY2E1MDAxN2JiIgogICAgfQogICB9CiAgfSwKICAicm9sZXMiOiB7CiAgICJyb290IjogewogICAgImtleWlkcyI6IFsKICAgICAiNTU0NjRhMzRhMzk1NWQ3NTMxMzE0M2Y0ZThmZGE0NzRlNWRkMmYwNjcwYTc5ZGE0ZDIzZDhiMWNkZDQ3ZDNlMiIKICAgIF0sCiAgICAidGhyZXNob2xkIjogMQogICB9LAogICAic25hcHNob3QiOiB7CiAgICAia2V5aWRzIjogWwogICAgICIzZDk1NWRlZTk5ODMwYmUwNTc1MWQyMmNjMDUwYTQ3NWI2OTIwZGUyZDM2MWNiZGVhNjJmYzE0YTY2MTg3MzU5IgogICAgXSwKICAgICJ0aHJlc2hvbGQiOiAxCiAgIH0sCiAgICJ0YXJnZXRzIjogewogICAgImtleWlkcyI6IFsKICAgICAiNmMwNzkzNWRjZGNkNGM2Yzg2ZTFkYzc5NzU2ZjYxNjkwNmRkOGE1ZDVhZGM3Y2U3Y2UzODVhOWVhMjIxOWYwYSIKICAgIF0sCiAgICAidGhyZXNob2xkIjogMQogICB9LAogICAidGltZXN0YW1wIjogewogICAgImtleWlkcyI6IFsKICAgICAiZjAwZTE1N2E3NThlN2RmZTJmNzk3NDdkZjc4MDYzODJhZjcwYTg3NGJiM2UyY2U3NjJiYTk4ZDlkODRlOWFkZiIKICAgIF0sCiAgICAidGhyZXNob2xkIjogMQogICB9CiAgfSwKICAiY29uc2lzdGVudF9zbmFwc2hvdCI6IHRydWUKIH0sCiAic2lnbmF0dXJlcyI6IFsKICB7CiAgICJrZXlpZCI6ICI1NTQ2NGEzNGEzOTU1ZDc1MzEzMTQzZjRlOGZkYTQ3NGU1ZGQyZjA2NzBhNzlkYTRkMjNkOGIxY2RkNDdkM2UyIiwKICAgInNpZyI6ICJjNDg2MDhlYTRjMzY3N2QyNTE5OTQyMWJiYTM5YTE3NTM5YjRmOGUyMzU4MWEzMWQ3YjY2NDIyNTAxOGYxNmRjOTE1OTgyNjM2YjlhMDMxODc2ZjAyYzY5YmQxMTFjZTA4YTg0ZWQzODY5YjI0ZDZhNDg0YTY1YjJmZmE2Y2IwOSIKICB9CiBdCn0=` ) func TestTrustRootValidation(t *testing.T) { diff --git a/pkg/reconciler/trustroot/testdata/ctfeLogID.txt b/pkg/reconciler/trustroot/testdata/ctfeLogID.txt index 8c973e312..2a6153331 100644 --- a/pkg/reconciler/trustroot/testdata/ctfeLogID.txt +++ b/pkg/reconciler/trustroot/testdata/ctfeLogID.txt @@ -1 +1 @@ -d740b8dd64c961855e8953f4276369f184d833716a6a990844c923a9083d9296 \ No newline at end of file +81d03a327a6882b67c8210715900539ffc6b1dee1b1f9ad871a09bfecfecf041 \ No newline at end of file diff --git a/pkg/reconciler/trustroot/testdata/ctfePublicKey.pem b/pkg/reconciler/trustroot/testdata/ctfePublicKey.pem index dae353eb9..900a2294f 100644 --- a/pkg/reconciler/trustroot/testdata/ctfePublicKey.pem +++ b/pkg/reconciler/trustroot/testdata/ctfePublicKey.pem @@ -1,4 +1,4 @@ -----BEGIN PUBLIC KEY----- -MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE8CYN5Ck/g5tRZxuHcuTl8f8cp4Vn -31lziP9oJ2PbJd8bjWVaD4PDTLk6PVcPtiHtEeEN/JN1TtqQkUgsMlCfaw== +MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEBhsoawCyx66Ea85nLZJ7lYqOzKf8 +qQPlWGF8n4NuxVNMTzu8/3AdkfH+UfOolb9m/NhwIxPJTnnfZWcDA7pCTw== -----END PUBLIC KEY----- diff --git a/pkg/reconciler/trustroot/testdata/fulcioCertChain.pem b/pkg/reconciler/trustroot/testdata/fulcioCertChain.pem index 2d8ae1430..c50cf2272 100644 --- a/pkg/reconciler/trustroot/testdata/fulcioCertChain.pem +++ b/pkg/reconciler/trustroot/testdata/fulcioCertChain.pem @@ -1,18 +1,18 @@ -----BEGIN CERTIFICATE----- MIIBPjCB5KADAgECAgECMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2 -MDExODA4MjQxMloXDTM2MDExODA4MjQxMlowDzENMAsGA1UEAxMEbGVhZjBZMBMG -ByqGSM49AgEGCCqGSM49AwEHA0IABCnMX5oDLqAe/zsE5lxppdszsKB9svC/LhXU -BLOk8T65kND9SyXG8MA1+SqW2Ic6YRnm5r2j+v/CRi6lGXs0GD6jMzAxMA4GA1Ud -DwEB/wQEAwIGwDAfBgNVHSMEGDAWgBR3tK56OWKX6omj1P/kEWkvkiREpTAKBggq -hkjOPQQDAgNJADBGAiEA9LiET+4DScPcPLP6IZqok40C7v3Pyo0FdUkYVC4RrdYC -IQCRfJwlFjbw3HMQLNviY0CAhg8GAsMmsqFU/AJOlI8bgw== +MDcyODE3MzYyMloXDTM2MDcyODE3MzYyMlowDzENMAsGA1UEAxMEbGVhZjBZMBMG +ByqGSM49AgEGCCqGSM49AwEHA0IABNfH99yS2+Pil7CxpKRJV3zEwLgR3XBO+Grj +iccAB9G1u1t1x5ZnkmqS11A3HNapEirlkUjoH7Xnp/OR1UzGfGWjMzAxMA4GA1Ud +DwEB/wQEAwIGwDAfBgNVHSMEGDAWgBQiwuP8j8bbFPQrfAAY6XuZELWviDAKBggq +hkjOPQQDAgNJADBGAiEA9zjzuKTiru9pXRkW3Kbqomk//JV18H2/cIwOiGob9vIC +IQC//kfcRNkDt0omSg1vsITOgfDsW23U6igz8QvCz/Kqmg== -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- -MIIBSTCB8aADAgECAgEBMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2 -MDExODA4MjQxMloXDTM2MDExODA4MjQxMlowDTELMAkGA1UEAxMCY2EwWTATBgcq -hkjOPQIBBggqhkjOPQMBBwNCAARU9i+UOuHKRJslqkeIPM8Hvr/Onxo+rWaxEov1 -xBE+vjXl/feFCmi38gAII5/UgqEVZlF5VBBdelEZB1i4ysbwo0IwQDAOBgNVHQ8B -Af8EBAMCAgQwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUd7Suejlil+qJo9T/ -5BFpL5IkRKUwCgYIKoZIzj0EAwIDRwAwRAIgaFt5RQfkYGl2tQyOX/9TfBci580r -gnM/ECKeerqByKICIBvBOG3zfWB7qFUCosjgslm5aTxWLYblddNaKGbrjz99 +MIIBSjCB8aADAgECAgEBMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2 +MDcyODE3MzYyMloXDTM2MDcyODE3MzYyMlowDTELMAkGA1UEAxMCY2EwWTATBgcq +hkjOPQIBBggqhkjOPQMBBwNCAASuuP9NoHvP4IOEmLYXgGWjQ/KR0MCpxVl1BX1l +blCsHsSyKtRNUe63SYIIVJxRa0Bdn0oo1aQXS9tnfZEBsmP7o0IwQDAOBgNVHQ8B +Af8EBAMCAgQwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUIsLj/I/G2xT0K3wA +GOl7mRC1r4gwCgYIKoZIzj0EAwIDSAAwRQIgXiiXj6UgTRUKdUMzH8kkCO8k5JIK +56jpsjmv0HJwxm4CIQCIiz/vibZUxM41K2Ek/wDUjI8kELO1AUIVeh5fz1DDSA== -----END CERTIFICATE----- diff --git a/pkg/reconciler/trustroot/testdata/marshalledEntry.json b/pkg/reconciler/trustroot/testdata/marshalledEntry.json index 1025d792c..2646b0475 100644 --- a/pkg/reconciler/trustroot/testdata/marshalledEntry.json +++ b/pkg/reconciler/trustroot/testdata/marshalledEntry.json @@ -1,78 +1,78 @@ { - "mediaType": "application/vnd.dev.sigstore.trustedroot+json;version=0.1", - "tlogs": [ + "mediaType": "application/vnd.dev.sigstore.trustedroot+json;version=0.1", + "tlogs": [ { - "baseUrl": "https://rekor.example.com", - "hashAlgorithm": "SHA2_256", - "publicKey": { - "rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEdHzrblmwf4hME3+Ot7L2B8FkTd1RRfssnlhi2SyUyQY8OnpN6PjF6t7XdayNxJ7XYVWeLZA/G4Kg51QC7ybJ1g==", - "keyDetails": "PKIX_ECDSA_P256_SHA_256", - "validFor": { - "start": "1970-01-01T00:00:00Z" + "baseUrl": "https://rekor.example.com", + "hashAlgorithm": "SHA2_256", + "publicKey": { + "rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEeCH4ML3V6E4yv0aY/YLBcs6fhJCYvjKmvMjscnW1non2G4D1VdpoA6cWhJk+aDgkxKf8i7JLXdn2MN7mqMOy4Q==", + "keyDetails": "PKIX_ECDSA_P256_SHA_256", + "validFor": { + "start": "1970-01-01T00:00:00Z" } }, - "logId": { - "keyId": "M2E3ZWZjYTk3MGUzMGY2N2U2MTI0MzQ3MzZlMzVkNTRjMDYxZDM4OThlZmY1YjA2Mjc5ZmQ3MjIwNDM4OTY4NQ==" + "logId": { + "keyId": "YWFlNjQyODViOTNlYWQ3Nzg3ZWE5MWEwYmNhYjQwMDU5MWY0MmM5N2YwMWIxMzcyMjEyNjhiNmQ2NGExZGYxMw==" } } ], - "certificateAuthorities": [ + "certificateAuthorities": [ { - "subject": { - "organization": "fulcio-organization", - "commonName": "fulcio-common-name" + "subject": { + "organization": "fulcio-organization", + "commonName": "fulcio-common-name" }, - "uri": "https://fulcio.example.com", - "certChain": { - "certificates": [ + "uri": "https://fulcio.example.com", + "certChain": { + "certificates": [ { - "rawBytes": "MIIBPjCB5KADAgECAgECMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2MDExODA4MjQxMloXDTM2MDExODA4MjQxMlowDzENMAsGA1UEAxMEbGVhZjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABCnMX5oDLqAe/zsE5lxppdszsKB9svC/LhXUBLOk8T65kND9SyXG8MA1+SqW2Ic6YRnm5r2j+v/CRi6lGXs0GD6jMzAxMA4GA1UdDwEB/wQEAwIGwDAfBgNVHSMEGDAWgBR3tK56OWKX6omj1P/kEWkvkiREpTAKBggqhkjOPQQDAgNJADBGAiEA9LiET+4DScPcPLP6IZqok40C7v3Pyo0FdUkYVC4RrdYCIQCRfJwlFjbw3HMQLNviY0CAhg8GAsMmsqFU/AJOlI8bgw==" + "rawBytes": "MIIBPjCB5KADAgECAgECMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2MDcyODE3MzYyMloXDTM2MDcyODE3MzYyMlowDzENMAsGA1UEAxMEbGVhZjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABNfH99yS2+Pil7CxpKRJV3zEwLgR3XBO+GrjiccAB9G1u1t1x5ZnkmqS11A3HNapEirlkUjoH7Xnp/OR1UzGfGWjMzAxMA4GA1UdDwEB/wQEAwIGwDAfBgNVHSMEGDAWgBQiwuP8j8bbFPQrfAAY6XuZELWviDAKBggqhkjOPQQDAgNJADBGAiEA9zjzuKTiru9pXRkW3Kbqomk//JV18H2/cIwOiGob9vICIQC//kfcRNkDt0omSg1vsITOgfDsW23U6igz8QvCz/Kqmg==" }, { - "rawBytes": "MIIBSTCB8aADAgECAgEBMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2MDExODA4MjQxMloXDTM2MDExODA4MjQxMlowDTELMAkGA1UEAxMCY2EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARU9i+UOuHKRJslqkeIPM8Hvr/Onxo+rWaxEov1xBE+vjXl/feFCmi38gAII5/UgqEVZlF5VBBdelEZB1i4ysbwo0IwQDAOBgNVHQ8BAf8EBAMCAgQwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUd7Suejlil+qJo9T/5BFpL5IkRKUwCgYIKoZIzj0EAwIDRwAwRAIgaFt5RQfkYGl2tQyOX/9TfBci580rgnM/ECKeerqByKICIBvBOG3zfWB7qFUCosjgslm5aTxWLYblddNaKGbrjz99" + "rawBytes": "MIIBSjCB8aADAgECAgEBMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2MDcyODE3MzYyMloXDTM2MDcyODE3MzYyMlowDTELMAkGA1UEAxMCY2EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASuuP9NoHvP4IOEmLYXgGWjQ/KR0MCpxVl1BX1lblCsHsSyKtRNUe63SYIIVJxRa0Bdn0oo1aQXS9tnfZEBsmP7o0IwQDAOBgNVHQ8BAf8EBAMCAgQwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUIsLj/I/G2xT0K3wAGOl7mRC1r4gwCgYIKoZIzj0EAwIDSAAwRQIgXiiXj6UgTRUKdUMzH8kkCO8k5JIK56jpsjmv0HJwxm4CIQCIiz/vibZUxM41K2Ek/wDUjI8kELO1AUIVeh5fz1DDSA==" } ] }, - "validFor": { - "start": "1970-01-01T00:00:00Z" + "validFor": { + "start": "1970-01-01T00:00:00Z" } } ], - "ctlogs": [ + "ctlogs": [ { - "baseUrl": "https://ctfe.example.com", - "hashAlgorithm": "SHA2_256", - "publicKey": { - "rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE8CYN5Ck/g5tRZxuHcuTl8f8cp4Vn31lziP9oJ2PbJd8bjWVaD4PDTLk6PVcPtiHtEeEN/JN1TtqQkUgsMlCfaw==", - "keyDetails": "PKIX_ECDSA_P256_SHA_256", - "validFor": { - "start": "1970-01-01T00:00:00Z" + "baseUrl": "https://ctfe.example.com", + "hashAlgorithm": "SHA2_256", + "publicKey": { + "rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEBhsoawCyx66Ea85nLZJ7lYqOzKf8qQPlWGF8n4NuxVNMTzu8/3AdkfH+UfOolb9m/NhwIxPJTnnfZWcDA7pCTw==", + "keyDetails": "PKIX_ECDSA_P256_SHA_256", + "validFor": { + "start": "1970-01-01T00:00:00Z" } }, - "logId": { - "keyId": "ZDc0MGI4ZGQ2NGM5NjE4NTVlODk1M2Y0Mjc2MzY5ZjE4NGQ4MzM3MTZhNmE5OTA4NDRjOTIzYTkwODNkOTI5Ng==" + "logId": { + "keyId": "ODFkMDNhMzI3YTY4ODJiNjdjODIxMDcxNTkwMDUzOWZmYzZiMWRlZTFiMWY5YWQ4NzFhMDliZmVjZmVjZjA0MQ==" } } ], - "timestampAuthorities": [ + "timestampAuthorities": [ { - "subject": { - "organization": "tsa-organization", - "commonName": "tsa-common-name" + "subject": { + "organization": "tsa-organization", + "commonName": "tsa-common-name" }, - "uri": "https://tsa.example.com", - "certChain": { - "certificates": [ + "uri": "https://tsa.example.com", + "certChain": { + "certificates": [ { - "rawBytes": "MIIBOzCB5KADAgECAgECMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2MDExODA4MjQxMloXDTM2MDExODA4MjQxMlowDzENMAsGA1UEAxMEbGVhZjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABHwOEW5q24H4uVDrH17YcWhI/LpzrOZzHCOkbQMU7IoLzpjgPydzaQWQp83vQdFai/OHe5vI7r+zKS1oyu675V+jMzAxMA4GA1UdDwEB/wQEAwIEEDAfBgNVHSMEGDAWgBTFKWL5YXMWOmTHuhZWTiocLIkMcTAKBggqhkjOPQQDAgNGADBDAiBTsXT0nv40DIsqkLmMFxWxsBm+0mkc+ySwXEEG3LbCEAIfGS/GLJZmABwvlAfjkvVZLuzyWA4uCX3hBK6ocqm8Dw==" + "rawBytes": "MIIBPDCB5KADAgECAgECMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2MDcyODE3MzYyMloXDTM2MDcyODE3MzYyMlowDzENMAsGA1UEAxMEbGVhZjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABMxhoTbaq7vWvLICwquXpE64STqeZw+Wx+qtHYHL19sBpJiPiivEe/YKhUqCUdqmsO57Y0lB1zS0nX7sw347gHSjMzAxMA4GA1UdDwEB/wQEAwIEEDAfBgNVHSMEGDAWgBTdx9sWd18mL/lyfqBw9RVbdidLWTAKBggqhkjOPQQDAgNHADBEAiBMl/DhdSsjD8KHFnW9t271rC3hRa3NS67UBfoK19isbAIgTrmygW/NY8WRU1uoyL7XJVn7BFdVAb25M3URQrUlIWM=" }, { - "rawBytes": "MIIBSTCB8aADAgECAgEBMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2MDExODA4MjQxMloXDTM2MDExODA4MjQxMlowDTELMAkGA1UEAxMCY2EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARUAPrDDnECjXNrkWdfUsIt7ceI3XHMmBakiX0Z8wabBO9U2SdiS4qWE1QGIIcOxFVtnoOb2WQJSYW14C/I+ipyo0IwQDAOBgNVHQ8BAf8EBAMCAgQwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUxSli+WFzFjpkx7oWVk4qHCyJDHEwCgYIKoZIzj0EAwIDRwAwRAIgdqkiRNmnW2fA9Fg6dG7ee0gQKP7MY/XSQo8vte++W/wCIFO9GS7HG4CIwb9nFfNw9zI8yW6Kqi4rClx2fRNNiMKy" + "rawBytes": "MIIBSjCB8aADAgECAgEBMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2MDcyODE3MzYyMloXDTM2MDcyODE3MzYyMlowDTELMAkGA1UEAxMCY2EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAT7YRx35JhDQwmwPMSctkjPtKgoezKwLldnECn7Z0mI14I3o/NJF+NGlI780tnDJOJUWHQySAYO2I3+XNA1977fo0IwQDAOBgNVHQ8BAf8EBAMCAgQwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU3cfbFndfJi/5cn6gcPUVW3YnS1kwCgYIKoZIzj0EAwIDSAAwRQIhALkHO49mvG4mp2EV3X+QmESpEj0H9uGlFv0mOID5xNLDAiB4sAB0Up49NLBi55BywyrYzBh34F+p2MQztc5ZjAGEDA==" } ] }, - "validFor": { - "start": "1970-01-01T00:00:00Z" + "validFor": { + "start": "1970-01-01T00:00:00Z" } } ] diff --git a/pkg/reconciler/trustroot/testdata/marshalledEntryFromMirrorFS.json b/pkg/reconciler/trustroot/testdata/marshalledEntryFromMirrorFS.json index c21b3647a..4b460e33d 100644 --- a/pkg/reconciler/trustroot/testdata/marshalledEntryFromMirrorFS.json +++ b/pkg/reconciler/trustroot/testdata/marshalledEntryFromMirrorFS.json @@ -1,48 +1,48 @@ { - "tlogs": [ + "tlogs": [ { - "hashAlgorithm": "SHA2_256", - "publicKey": { - "rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEdHzrblmwf4hME3+Ot7L2B8FkTd1RRfssnlhi2SyUyQY8OnpN6PjF6t7XdayNxJ7XYVWeLZA/G4Kg51QC7ybJ1g==", - "keyDetails": "PKIX_ECDSA_P256_SHA_256", - "validFor": { - "start": "1970-01-01T00:00:00Z" + "hashAlgorithm": "SHA2_256", + "publicKey": { + "rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEeCH4ML3V6E4yv0aY/YLBcs6fhJCYvjKmvMjscnW1non2G4D1VdpoA6cWhJk+aDgkxKf8i7JLXdn2MN7mqMOy4Q==", + "keyDetails": "PKIX_ECDSA_P256_SHA_256", + "validFor": { + "start": "1970-01-01T00:00:00Z" } }, - "logId": { - "keyId": "M2E3ZWZjYTk3MGUzMGY2N2U2MTI0MzQ3MzZlMzVkNTRjMDYxZDM4OThlZmY1YjA2Mjc5ZmQ3MjIwNDM4OTY4NQ==" + "logId": { + "keyId": "YWFlNjQyODViOTNlYWQ3Nzg3ZWE5MWEwYmNhYjQwMDU5MWY0MmM5N2YwMWIxMzcyMjEyNjhiNmQ2NGExZGYxMw==" } } ], - "certificateAuthorities": [ + "certificateAuthorities": [ { - "certChain": { - "certificates": [ + "certChain": { + "certificates": [ { - "rawBytes": "MIIBPjCB5KADAgECAgECMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2MDExODA4MjQxMloXDTM2MDExODA4MjQxMlowDzENMAsGA1UEAxMEbGVhZjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABCnMX5oDLqAe/zsE5lxppdszsKB9svC/LhXUBLOk8T65kND9SyXG8MA1+SqW2Ic6YRnm5r2j+v/CRi6lGXs0GD6jMzAxMA4GA1UdDwEB/wQEAwIGwDAfBgNVHSMEGDAWgBR3tK56OWKX6omj1P/kEWkvkiREpTAKBggqhkjOPQQDAgNJADBGAiEA9LiET+4DScPcPLP6IZqok40C7v3Pyo0FdUkYVC4RrdYCIQCRfJwlFjbw3HMQLNviY0CAhg8GAsMmsqFU/AJOlI8bgw==" + "rawBytes": "MIIBPjCB5KADAgECAgECMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2MDcyODE3MzYyMloXDTM2MDcyODE3MzYyMlowDzENMAsGA1UEAxMEbGVhZjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABNfH99yS2+Pil7CxpKRJV3zEwLgR3XBO+GrjiccAB9G1u1t1x5ZnkmqS11A3HNapEirlkUjoH7Xnp/OR1UzGfGWjMzAxMA4GA1UdDwEB/wQEAwIGwDAfBgNVHSMEGDAWgBQiwuP8j8bbFPQrfAAY6XuZELWviDAKBggqhkjOPQQDAgNJADBGAiEA9zjzuKTiru9pXRkW3Kbqomk//JV18H2/cIwOiGob9vICIQC//kfcRNkDt0omSg1vsITOgfDsW23U6igz8QvCz/Kqmg==" }, { - "rawBytes": "MIIBSTCB8aADAgECAgEBMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2MDExODA4MjQxMloXDTM2MDExODA4MjQxMlowDTELMAkGA1UEAxMCY2EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARU9i+UOuHKRJslqkeIPM8Hvr/Onxo+rWaxEov1xBE+vjXl/feFCmi38gAII5/UgqEVZlF5VBBdelEZB1i4ysbwo0IwQDAOBgNVHQ8BAf8EBAMCAgQwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUd7Suejlil+qJo9T/5BFpL5IkRKUwCgYIKoZIzj0EAwIDRwAwRAIgaFt5RQfkYGl2tQyOX/9TfBci580rgnM/ECKeerqByKICIBvBOG3zfWB7qFUCosjgslm5aTxWLYblddNaKGbrjz99" + "rawBytes": "MIIBSjCB8aADAgECAgEBMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2MDcyODE3MzYyMloXDTM2MDcyODE3MzYyMlowDTELMAkGA1UEAxMCY2EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASuuP9NoHvP4IOEmLYXgGWjQ/KR0MCpxVl1BX1lblCsHsSyKtRNUe63SYIIVJxRa0Bdn0oo1aQXS9tnfZEBsmP7o0IwQDAOBgNVHQ8BAf8EBAMCAgQwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUIsLj/I/G2xT0K3wAGOl7mRC1r4gwCgYIKoZIzj0EAwIDSAAwRQIgXiiXj6UgTRUKdUMzH8kkCO8k5JIK56jpsjmv0HJwxm4CIQCIiz/vibZUxM41K2Ek/wDUjI8kELO1AUIVeh5fz1DDSA==" } ] }, - "validFor": { - "start": "1970-01-01T00:00:00Z" + "validFor": { + "start": "1970-01-01T00:00:00Z" } } ], - "ctlogs": [ + "ctlogs": [ { - "hashAlgorithm": "SHA2_256", - "publicKey": { - "rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE8CYN5Ck/g5tRZxuHcuTl8f8cp4Vn31lziP9oJ2PbJd8bjWVaD4PDTLk6PVcPtiHtEeEN/JN1TtqQkUgsMlCfaw==", - "keyDetails": "PKIX_ECDSA_P256_SHA_256", - "validFor": { - "start": "1970-01-01T00:00:00Z" + "hashAlgorithm": "SHA2_256", + "publicKey": { + "rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEBhsoawCyx66Ea85nLZJ7lYqOzKf8qQPlWGF8n4NuxVNMTzu8/3AdkfH+UfOolb9m/NhwIxPJTnnfZWcDA7pCTw==", + "keyDetails": "PKIX_ECDSA_P256_SHA_256", + "validFor": { + "start": "1970-01-01T00:00:00Z" } }, - "logId": { - "keyId": "ZDc0MGI4ZGQ2NGM5NjE4NTVlODk1M2Y0Mjc2MzY5ZjE4NGQ4MzM3MTZhNmE5OTA4NDRjOTIzYTkwODNkOTI5Ng==" + "logId": { + "keyId": "ODFkMDNhMzI3YTY4ODJiNjdjODIxMDcxNTkwMDUzOWZmYzZiMWRlZTFiMWY5YWQ4NzFhMDliZmVjZmVjZjA0MQ==" } } ] diff --git a/pkg/reconciler/trustroot/testdata/rekorLogID.txt b/pkg/reconciler/trustroot/testdata/rekorLogID.txt index 83fb21861..5a43ed259 100644 --- a/pkg/reconciler/trustroot/testdata/rekorLogID.txt +++ b/pkg/reconciler/trustroot/testdata/rekorLogID.txt @@ -1 +1 @@ -3a7efca970e30f67e612434736e35d54c061d3898eff5b06279fd72204389685 \ No newline at end of file +aae64285b93ead7787ea91a0bcab400591f42c97f01b137221268b6d64a1df13 \ No newline at end of file diff --git a/pkg/reconciler/trustroot/testdata/rekorPublicKey.pem b/pkg/reconciler/trustroot/testdata/rekorPublicKey.pem index 60df77731..1589e2c2a 100644 --- a/pkg/reconciler/trustroot/testdata/rekorPublicKey.pem +++ b/pkg/reconciler/trustroot/testdata/rekorPublicKey.pem @@ -1,4 +1,4 @@ -----BEGIN PUBLIC KEY----- -MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEdHzrblmwf4hME3+Ot7L2B8FkTd1R -Rfssnlhi2SyUyQY8OnpN6PjF6t7XdayNxJ7XYVWeLZA/G4Kg51QC7ybJ1g== +MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEeCH4ML3V6E4yv0aY/YLBcs6fhJCY +vjKmvMjscnW1non2G4D1VdpoA6cWhJk+aDgkxKf8i7JLXdn2MN7mqMOy4Q== -----END PUBLIC KEY----- diff --git a/pkg/reconciler/trustroot/testdata/root.json b/pkg/reconciler/trustroot/testdata/root.json index 279ff4472..4926c667b 100644 --- a/pkg/reconciler/trustroot/testdata/root.json +++ b/pkg/reconciler/trustroot/testdata/root.json @@ -3,9 +3,9 @@ "_type": "root", "spec_version": "1.0", "version": 1, - "expires": "2026-07-18T08:24:13Z", + "expires": "2027-01-28T17:36:23Z", "keys": { - "0f052ad399560d75c43f80dd44fcf6a10c4971fba73517a063aab27140676628": { + "3d955dee99830be05751d22cc050a475b6920de2d361cbdea62fc14a66187359": { "keytype": "ed25519", "scheme": "ed25519", "keyid_hash_algorithms": [ @@ -13,10 +13,10 @@ "sha512" ], "keyval": { - "public": "01fbf6ed31f4a60f4ddc20684c9b6a62210f7cc81bf37c8abb2f18e2518a1c59" + "public": "09b6239e9250c1a3822ce0cf3fc127b267be0e52afeb04af80462c4fc61a8424" } }, - "47f22c6ae82929f657e562ef5a5f7a44dab9f2a423ea60c963bef3f5a679a5b8": { + "55464a34a3955d75313143f4e8fda474e5dd2f0670a79da4d23d8b1cdd47d3e2": { "keytype": "ed25519", "scheme": "ed25519", "keyid_hash_algorithms": [ @@ -24,10 +24,10 @@ "sha512" ], "keyval": { - "public": "8ca04f921b74224e3c7b8fda0d8e1c0a40d29e9ddaa4068268c6e1e945fe7b33" + "public": "b22c47439db149908ecfa90406ad0932c33d99098a8471f5fe7230f4df4cfbde" } }, - "98362a3b4a994284c5b72507d738ecdde8273e2cfe46639cbefec12d77ab3c81": { + "6c07935dcdcd4c6c86e1dc79756f616906dd8a5d5adc7ce7ce385a9ea2219f0a": { "keytype": "ed25519", "scheme": "ed25519", "keyid_hash_algorithms": [ @@ -35,10 +35,10 @@ "sha512" ], "keyval": { - "public": "b42259ceb0a929e7f0e34de7c6f1014562878c531f1cca89008862723f0604e3" + "public": "fd5c5c8d6e611d57dab1c94b1285d2a55b79d91870f4f0af85d4b192fdeb7d25" } }, - "b52e38b87fcd86befd146b05c90c021a8f8ac4c12f737e95488f5c4732e176be": { + "f00e157a758e7dfe2f79747df7806382af70a874bb3e2ce762ba98d9d84e9adf": { "keytype": "ed25519", "scheme": "ed25519", "keyid_hash_algorithms": [ @@ -46,32 +46,32 @@ "sha512" ], "keyval": { - "public": "666a150b3824c76d0b1fd12b4f078d56a413ebc7e52af27ea4143dc5fefe9ebd" + "public": "92e44af58275864585fc5e2266dc07deac71bcdf7d7c5dab65d6161ca50017bb" } } }, "roles": { "root": { "keyids": [ - "98362a3b4a994284c5b72507d738ecdde8273e2cfe46639cbefec12d77ab3c81" + "55464a34a3955d75313143f4e8fda474e5dd2f0670a79da4d23d8b1cdd47d3e2" ], "threshold": 1 }, "snapshot": { "keyids": [ - "b52e38b87fcd86befd146b05c90c021a8f8ac4c12f737e95488f5c4732e176be" + "3d955dee99830be05751d22cc050a475b6920de2d361cbdea62fc14a66187359" ], "threshold": 1 }, "targets": { "keyids": [ - "47f22c6ae82929f657e562ef5a5f7a44dab9f2a423ea60c963bef3f5a679a5b8" + "6c07935dcdcd4c6c86e1dc79756f616906dd8a5d5adc7ce7ce385a9ea2219f0a" ], "threshold": 1 }, "timestamp": { "keyids": [ - "0f052ad399560d75c43f80dd44fcf6a10c4971fba73517a063aab27140676628" + "f00e157a758e7dfe2f79747df7806382af70a874bb3e2ce762ba98d9d84e9adf" ], "threshold": 1 } @@ -80,8 +80,8 @@ }, "signatures": [ { - "keyid": "98362a3b4a994284c5b72507d738ecdde8273e2cfe46639cbefec12d77ab3c81", - "sig": "3222c66bcedf8bc6a9d0dc32d2fe5c8c8599dbfb8948a744a30a7e6bd628299b86674864446236a59e6742d2236e38c2b56f786b3d257db2e6ed2c2383c73405" + "keyid": "55464a34a3955d75313143f4e8fda474e5dd2f0670a79da4d23d8b1cdd47d3e2", + "sig": "c48608ea4c3677d25199421bba39a17539b4f8e23581a31d7b664225018f16dc915982636b9a031876f02c69bd111ce08a84ed3869b24d6a484a65b2ffa6cb09" } ] } \ No newline at end of file diff --git a/pkg/reconciler/trustroot/testdata/rootWithCustomTrustedRootJSON.json b/pkg/reconciler/trustroot/testdata/rootWithCustomTrustedRootJSON.json index e92872ab9..9d861c956 100644 --- a/pkg/reconciler/trustroot/testdata/rootWithCustomTrustedRootJSON.json +++ b/pkg/reconciler/trustroot/testdata/rootWithCustomTrustedRootJSON.json @@ -3,9 +3,9 @@ "_type": "root", "spec_version": "1.0", "version": 1, - "expires": "2026-07-18T08:24:13Z", + "expires": "2027-01-28T17:36:23Z", "keys": { - "09d76913304c807681f051c1f6a405e69dce88567987a9a05ef832619c37a515": { + "a0b9452b80cd34c62f8ca7ec53227c2781aa81b62d599afc92a85253b9b2e3d4": { "keytype": "ed25519", "scheme": "ed25519", "keyid_hash_algorithms": [ @@ -13,10 +13,10 @@ "sha512" ], "keyval": { - "public": "c708835bb3f9da4e15246f1fe2bd6307c2bbdc790fa4dd706ab326737ecf18ac" + "public": "1aba272d9f42bf9db9e67c15549722a7d4ca3e9d94efaa9946cb76a0a9ff7bc2" } }, - "98e2eb5de033b49093df9c572db565df0c419c6ee8f966ef283ede2b9605e3f6": { + "a2031764f95a4eefcc448920e7f7f585e6e9187e168f5bca9828413c7df736f8": { "keytype": "ed25519", "scheme": "ed25519", "keyid_hash_algorithms": [ @@ -24,10 +24,10 @@ "sha512" ], "keyval": { - "public": "2d412e542604beb9d3f8d3c6297db756ae7867ad464b04113223f6e296ae619c" + "public": "83dff562309be43e410cff55e6619614a62048ea056e3eb3078beb08a27a6ad0" } }, - "99c6f2ed68ee12a1f79774e065c2aaf64926474903fc635df181c69354b42a45": { + "a49b7303a06d9b64abd836e575e1a57698ddd0cbaf6a4bd589d8f752cd820e1a": { "keytype": "ed25519", "scheme": "ed25519", "keyid_hash_algorithms": [ @@ -35,10 +35,10 @@ "sha512" ], "keyval": { - "public": "a8074014766cd5e954d8fb0052c1d96a3ea24a8f57713f8b565bf59738fbd930" + "public": "af4e935f1b07bdc4c3ddaf3bba427ba704d83b31ec5f75705f60324bd706a480" } }, - "ef4513aee940067b6e65576b145c78bf4e4b0578937ac90a5988fad0015aa7d2": { + "d8d64f3c26f6ee1cec851cdbd4714d5c71cbe87de954a416a87a445c1187d8df": { "keytype": "ed25519", "scheme": "ed25519", "keyid_hash_algorithms": [ @@ -46,32 +46,32 @@ "sha512" ], "keyval": { - "public": "f5843909df3a7ee84bceda784a600f533d5068f0a4d8386dd0e4af385e761aeb" + "public": "d222157c26a20193b6f5770bdef84c1d37e33aa741dc3d83c535bd1856dee592" } } }, "roles": { "root": { "keyids": [ - "98e2eb5de033b49093df9c572db565df0c419c6ee8f966ef283ede2b9605e3f6" + "a49b7303a06d9b64abd836e575e1a57698ddd0cbaf6a4bd589d8f752cd820e1a" ], "threshold": 1 }, "snapshot": { "keyids": [ - "99c6f2ed68ee12a1f79774e065c2aaf64926474903fc635df181c69354b42a45" + "d8d64f3c26f6ee1cec851cdbd4714d5c71cbe87de954a416a87a445c1187d8df" ], "threshold": 1 }, "targets": { "keyids": [ - "ef4513aee940067b6e65576b145c78bf4e4b0578937ac90a5988fad0015aa7d2" + "a2031764f95a4eefcc448920e7f7f585e6e9187e168f5bca9828413c7df736f8" ], "threshold": 1 }, "timestamp": { "keyids": [ - "09d76913304c807681f051c1f6a405e69dce88567987a9a05ef832619c37a515" + "a0b9452b80cd34c62f8ca7ec53227c2781aa81b62d599afc92a85253b9b2e3d4" ], "threshold": 1 } @@ -80,8 +80,8 @@ }, "signatures": [ { - "keyid": "98e2eb5de033b49093df9c572db565df0c419c6ee8f966ef283ede2b9605e3f6", - "sig": "03f03fab4f85f76889ab26fb1c7c9e062c9bc1deb0682f892930d1ab5b8754027d1fc68ea4525288d75215b52908ac409e4d31f4978a239adef46e5143a8030a" + "keyid": "a49b7303a06d9b64abd836e575e1a57698ddd0cbaf6a4bd589d8f752cd820e1a", + "sig": "4e484b0e09dc6884959d566781e698ce454ce5aedfc560a890beecf57fcf843a6653aa5c179ad56727bec994e5c25f59f374fcd70e02613f09d1a6eec41af301" } ] } \ No newline at end of file diff --git a/pkg/reconciler/trustroot/testdata/rootWithTrustedRootJSON.json b/pkg/reconciler/trustroot/testdata/rootWithTrustedRootJSON.json index c3c4b0387..6713f981d 100644 --- a/pkg/reconciler/trustroot/testdata/rootWithTrustedRootJSON.json +++ b/pkg/reconciler/trustroot/testdata/rootWithTrustedRootJSON.json @@ -3,9 +3,9 @@ "_type": "root", "spec_version": "1.0", "version": 1, - "expires": "2026-07-18T08:24:13Z", + "expires": "2027-01-28T17:36:23Z", "keys": { - "3148238dd2571a8ab01d2f7ca1dcbd2ef39a2d8a8ac4e119239619ecd7f64073": { + "68112049b36f72691c2ada4409c273fae84a98cb19abb7e348025d8374b9d293": { "keytype": "ed25519", "scheme": "ed25519", "keyid_hash_algorithms": [ @@ -13,10 +13,10 @@ "sha512" ], "keyval": { - "public": "0b28494b749a5ae017b322c8523e24495bc7f50033447f510932aef2858d4932" + "public": "120951fa65543ab7d3f8af0e42052cb5e3a8ec594fc948610cad79b73de9d4c0" } }, - "37c1f6aac7da789076c751c18a47136aff269196076faa48fb990923a0489882": { + "a0986ef13d95e0885948fa0aa9dc6d15efe784e8738baa9007754302fc5223af": { "keytype": "ed25519", "scheme": "ed25519", "keyid_hash_algorithms": [ @@ -24,10 +24,10 @@ "sha512" ], "keyval": { - "public": "7c0b12362a6238bf8894aa2bf7b1f4c12c8c2060eeeaff9be9ad46c599210b65" + "public": "cdd30d1c75ed83815a2cdd2c6a1c4df1f5dfaf4899ac2257ac6db20a9a151f8d" } }, - "a967817408b2856cbaca2df5504d1632a7a50898daf5f1c8a9aa5e061ffd3556": { + "aef156f2d58836ca19117799ae800f21447401858b8291ab8828f7fd6e3424b0": { "keytype": "ed25519", "scheme": "ed25519", "keyid_hash_algorithms": [ @@ -35,10 +35,10 @@ "sha512" ], "keyval": { - "public": "aa1f6ee30b54597b7b18fe40d29abde301cf3cf7bbfab15e5b326be465f20293" + "public": "8a79523b2748baf9b1855412160886880dccee5ba56b3eaea4b74c1ef15004c1" } }, - "b75ab36dcd12107f9f22fe6438e0653ca9053bb98d94db85f1be0468d5a46974": { + "ebfef09f31ba1666ce3e31a60513412185af79f1ab3cbd6040aeb5a988f7c3b9": { "keytype": "ed25519", "scheme": "ed25519", "keyid_hash_algorithms": [ @@ -46,32 +46,32 @@ "sha512" ], "keyval": { - "public": "aefcc8af52bdb4c46cf00521d74e4fce5579ac74be43f3bf0079b5e1f6d7fbc8" + "public": "bca24fece172faca39582b5b930564a0955062795201bfb0e5bb1d8ab273ff5e" } } }, "roles": { "root": { "keyids": [ - "3148238dd2571a8ab01d2f7ca1dcbd2ef39a2d8a8ac4e119239619ecd7f64073" + "ebfef09f31ba1666ce3e31a60513412185af79f1ab3cbd6040aeb5a988f7c3b9" ], "threshold": 1 }, "snapshot": { "keyids": [ - "a967817408b2856cbaca2df5504d1632a7a50898daf5f1c8a9aa5e061ffd3556" + "a0986ef13d95e0885948fa0aa9dc6d15efe784e8738baa9007754302fc5223af" ], "threshold": 1 }, "targets": { "keyids": [ - "b75ab36dcd12107f9f22fe6438e0653ca9053bb98d94db85f1be0468d5a46974" + "aef156f2d58836ca19117799ae800f21447401858b8291ab8828f7fd6e3424b0" ], "threshold": 1 }, "timestamp": { "keyids": [ - "37c1f6aac7da789076c751c18a47136aff269196076faa48fb990923a0489882" + "68112049b36f72691c2ada4409c273fae84a98cb19abb7e348025d8374b9d293" ], "threshold": 1 } @@ -80,8 +80,8 @@ }, "signatures": [ { - "keyid": "3148238dd2571a8ab01d2f7ca1dcbd2ef39a2d8a8ac4e119239619ecd7f64073", - "sig": "7fc9e6ee840c2b617a6feb54d9896769f50c51a6b01fece37f4417a1fab379fb523f1f48632076693af6b04f7e736a5e9ee8a9673c4294f2735749ddd456ab0c" + "keyid": "ebfef09f31ba1666ce3e31a60513412185af79f1ab3cbd6040aeb5a988f7c3b9", + "sig": "e1177d9464a0b3720c927ddba90e665c3e547c1edbec01831ac761aabc0105cb6a7dbe2887cee94da4fbde385e461df207bcca1e249393f2bde89465fc014b08" } ] } \ No newline at end of file diff --git a/pkg/reconciler/trustroot/testdata/tsaCertChain.pem b/pkg/reconciler/trustroot/testdata/tsaCertChain.pem index f800f71e6..110b9bd73 100644 --- a/pkg/reconciler/trustroot/testdata/tsaCertChain.pem +++ b/pkg/reconciler/trustroot/testdata/tsaCertChain.pem @@ -1,18 +1,18 @@ -----BEGIN CERTIFICATE----- -MIIBOzCB5KADAgECAgECMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2 -MDExODA4MjQxMloXDTM2MDExODA4MjQxMlowDzENMAsGA1UEAxMEbGVhZjBZMBMG -ByqGSM49AgEGCCqGSM49AwEHA0IABHwOEW5q24H4uVDrH17YcWhI/LpzrOZzHCOk -bQMU7IoLzpjgPydzaQWQp83vQdFai/OHe5vI7r+zKS1oyu675V+jMzAxMA4GA1Ud -DwEB/wQEAwIEEDAfBgNVHSMEGDAWgBTFKWL5YXMWOmTHuhZWTiocLIkMcTAKBggq -hkjOPQQDAgNGADBDAiBTsXT0nv40DIsqkLmMFxWxsBm+0mkc+ySwXEEG3LbCEAIf -GS/GLJZmABwvlAfjkvVZLuzyWA4uCX3hBK6ocqm8Dw== +MIIBPDCB5KADAgECAgECMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2 +MDcyODE3MzYyMloXDTM2MDcyODE3MzYyMlowDzENMAsGA1UEAxMEbGVhZjBZMBMG +ByqGSM49AgEGCCqGSM49AwEHA0IABMxhoTbaq7vWvLICwquXpE64STqeZw+Wx+qt +HYHL19sBpJiPiivEe/YKhUqCUdqmsO57Y0lB1zS0nX7sw347gHSjMzAxMA4GA1Ud +DwEB/wQEAwIEEDAfBgNVHSMEGDAWgBTdx9sWd18mL/lyfqBw9RVbdidLWTAKBggq +hkjOPQQDAgNHADBEAiBMl/DhdSsjD8KHFnW9t271rC3hRa3NS67UBfoK19isbAIg +TrmygW/NY8WRU1uoyL7XJVn7BFdVAb25M3URQrUlIWM= -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- -MIIBSTCB8aADAgECAgEBMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2 -MDExODA4MjQxMloXDTM2MDExODA4MjQxMlowDTELMAkGA1UEAxMCY2EwWTATBgcq -hkjOPQIBBggqhkjOPQMBBwNCAARUAPrDDnECjXNrkWdfUsIt7ceI3XHMmBakiX0Z -8wabBO9U2SdiS4qWE1QGIIcOxFVtnoOb2WQJSYW14C/I+ipyo0IwQDAOBgNVHQ8B -Af8EBAMCAgQwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUxSli+WFzFjpkx7oW -Vk4qHCyJDHEwCgYIKoZIzj0EAwIDRwAwRAIgdqkiRNmnW2fA9Fg6dG7ee0gQKP7M -Y/XSQo8vte++W/wCIFO9GS7HG4CIwb9nFfNw9zI8yW6Kqi4rClx2fRNNiMKy +MIIBSjCB8aADAgECAgEBMAoGCCqGSM49BAMCMA0xCzAJBgNVBAMTAmNhMB4XDTI2 +MDcyODE3MzYyMloXDTM2MDcyODE3MzYyMlowDTELMAkGA1UEAxMCY2EwWTATBgcq +hkjOPQIBBggqhkjOPQMBBwNCAAT7YRx35JhDQwmwPMSctkjPtKgoezKwLldnECn7 +Z0mI14I3o/NJF+NGlI780tnDJOJUWHQySAYO2I3+XNA1977fo0IwQDAOBgNVHQ8B +Af8EBAMCAgQwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU3cfbFndfJi/5cn6g +cPUVW3YnS1kwCgYIKoZIzj0EAwIDSAAwRQIhALkHO49mvG4mp2EV3X+QmESpEj0H +9uGlFv0mOID5xNLDAiB4sAB0Up49NLBi55BywyrYzBh34F+p2MQztc5ZjAGEDA== -----END CERTIFICATE----- diff --git a/pkg/reconciler/trustroot/testdata/tufRepo.tar b/pkg/reconciler/trustroot/testdata/tufRepo.tar index 402fadbda8106cf7fda9e6a7820bcb834d2868b6..bbef6cdbdf4778d7d2d141f1fe2c506bd6a012b1 100644 GIT binary patch literal 3021 zcmV;;3o`T{iwFP!00000|Lk08QyWRr_GkSHg0J(Am05R9#C&KS76Jqa#QDaCqfXt2 zbs(XQ`R^MoZhYWbK=!QriLfPgx4W`4vofEq%cUX+t<1k6DAwcBsfWH&fK=}t1e-L_c z{g1lgYH~B!#wPWeb031%ih>QmB}Y$)bHKqc$*s@?d?20*bk+wWNOZ`I5U3>O`u0Yv z+ulkZJmDPmYPeK<*9!eFo#=+Ew*S~Nlh#MmYYxZlX{(=#_W!HX8=I4sAza*Cz52;4v(rgtaB#^z{ddu^8v2HFZjbysOSxoEO75h1R=pl?G5vUdS%gh z&!ne;{KU$#gg7P{)!ri08dPx6XkZ|W2Th5i)N2h|8O0<<9)lzlBJ+{CXnpuxS;B$T zlzZo$XHGaJ0(vL4q6_sU?#>N(F){Vxk12 zB(s(V;(`>!8m+wciUnHREQOPQD?>i>K!I$hI zq6&m^g@&S+R;1jF1FDF^JB?f`BB-$107WH51mc9Y9uZxDG)xCimC%+jFAP)62yRJ? zMmP&APx>pj@vq!pKbipj;&{aWZ$0ys-vOTC|A?GC;r{{|&G`R1@D2Wd7pLCf9iShk zcLeJ;VXVCFK34a_pgC=&x1~bd1lW`#+~?hUE|AKD2+~`kICs%9#=MeXSY&B**8oas zl*R`J2xtQV61Y}ESkTsRN2NE6S`q{I)&&uK6prXfiF76e)W#DN(ds~>CqgJ;y&x%3 zkTy+L{)Q&p2>L)NcX{AD1O1DW^rJvemG@i-9jF8%fLN*oQm-IDbPlBfr2;tajMdyB zjocv$X{16CHH1ijOQ1SX3|?@l0}5{x5zaehi8IdmNVo{rTPlJzn(3$mc83HfABFyxqQ6wn2Y&!& z)AwBu+|#H9(HfN&9MczH%_tHnxHK9q;oKX|39}|LE-Xrh#6=3o4T~X$2ue|IEuzwr z5~Uf}k$TB23&a}-jB6`{qaskIqi2i-_Bi;v*6gp*!GZkb}}UDQg& z$fA!93`Ph{F&+#MOSqyOP`*TsA6Ae58j2i;?r{7PZxmXme&wz9V60Vrh1ymRjl}b5S|u+yjxIL$Dqq zdKW^JJX-DfOVoInKK#qH_&2!Dix&bOaUCTjHAYz~WmKAQDx8i)pd!M61hm$?88@{U@vcWc8m6>%#;7|3=lH z|Em52z%u^74rKM8tp1bLe|}v&i2pa!@b$;|`~BZcFrM{)uLGakKYw5rTfz7+p1gEBQtIN`2|P#(N(qgw`IZHkJi%v zF4kf8XZSx5@r3^qi89;&u@?NEqEN0>_cjiW3%k|g#!mTsbud@^(4Cj(=UY3&i|Voi z#iV{-z4=~B>aJ98CgnnFGBoqz)k27}QGBp_u`PS&pZ1qKQRP0>4|=DS4{E^nW{Z=( zT4Om=d7Aic-1_Y}?hkub_w#$Ld3ABH-53nw#i=VLa#U>0|NJwzlA*j;`b?}Jt+D?t zJe&Vtqb1g)Oc2e*T~zi(;DX8jvs9cF)S{ZBq!|06{;4IyO0oE`k zS{I$dMXgY)6O7NwP!}<_PEzQ?hLo&* zwX;zN{8=)p{|X??!jH*DXz9*gtCG<)qr!Z^qK(l+a_*ZZ1{*vbfCeeCjtJ zGN;cB`kb+kI>mxAcg8NfzOftS-CEMUHFoiwl;@|7q)}+PTTN99soJi;*9wLCUNK3I zX0rpmH{7~BVAcI{fA{>XSvl?0^E-!7D~=W?JuIAIFK2tj$=2lPYG-=5cN_#gI>>b<@7m|W_@0opO;P!p^?h-8J}POkx%#^XPB-3 ztOY3KSNY$M?qhv_*NL0azqi6V%>K96e<%RY`ajo#7q0(=;ufpz(i2f;SC?SU^XIz- zHxaS5T|CcSc6R!gwa&y1PH`|CkP0i|i60FU;Z9rI-QP^9*+=@7hAK}Y2R>S&Y}z=%fen9|a6X&sAE zI;)js6ubZiQ85Fa@Tky9t0XbXSg8Xe-g`@;HOfZ}NI`H-2=f5ppBNM~WXO==7r=i4 P00960Ekyfo09*h7y5I3) literal 3015 zcmV;&3pn&2iwFP!00000|Lj~_QyV$c&b5Dqi`#q~OD(A-rD`u`>;ViIuw#y2y_M3@ z7#j>8gMqj9zrQu+Ob%ohaI(AeR3-Kt7`3`JPd}n1#^Gd?_a~$A<-0cnA%sXFW}k$R zr=PR$R8Yn!8TH$N#^T>O$V{9S6VgvHIUiwYu3(b;jhIO&f=Ufcr&@HZlVqpC~PN8leR+rR#y zLAcCs8mlglNCX(qv=&Ib6ppi~i1(aF7tv7SxRx|pBblJm5M;(!kdzaYh@fsCG<)o= z<-vmxRL`0#%y$Rj=xY}S;j-^PADH~$vl;eAG&g`)7ipB_yHe&FMMsAQq?!5zoiaTx5AOIy%I;W_OOgd$(g-BHZ zL6xCS=5x}7d3N+}5LI!~lqA(&#!?`zBM=%^%Fi4z6Wq-E?&XKBR{471#5 z%|US|tOP-%mrMoceNZ4-02c#CWZKyfgQMW3G?qC}?4j{A(mKY5>$VdX?K1hd= z63PXFlFA82BX!OwO^8wm5?CZic=(F5tbo9jRWdrS(1z$KM@xj$#1WuIMP(d!6ryA@ zXu*|=!g0wUP>DAD!p=fOLj|!+0e2ETu{3%LmPaC$7ic(T!8#cPmqlY?={4@Sd+u<3&k=EvqFKlrX8FOKpL z88R{BUYO+HvE#)&_G5PRk3v2%MEG~xeiwDuoDCzf#r!go3fYt>cm33&eC*Cpe5QA{aDWSEu(JIZA zk(?Vwj0|W!frLX=z~=Ny5d5jvpc-~kv0rW{y-Q7W{|gOJ`rz~I3FQ_M-mi75Q` zN2U6o${#;l0R7AHNdMoC%vYWRJfr_974Ss=BSlu~|9Rj$`u~on-e3-J6ei{_ecmLD z*{Hkc>R~wUO%963G88uiTWEy)ynC+&K2{fmRNSJq)@mOWGu%+4g;g#(AXEyclp!%V z6Mf(srH%}Mx@euY-iqj=k;*8+B#44dg^|)515!{FEJ&@K$7sA#2ECM0MWM0KU4cof ziM){sH-Q7TH_5x##GQmG3BU|fe3;Wi^LsuBw8a!?Sv%)5R^b?gVO>dfs*KdZ9L-t zhcDtQw($)Ag8=cA{|SMT|L1}4@c*rje*^k|GDTQ$lNdgngrl#qzf{kYKSrSt1QklC zNS(J%IY&H0Nr=;uI1(uL4$vUgo@h%n3(^J%7#)dRDx{Hm@4YsbD&i?>61deNMk+N} z6N@QIP*ywVB@ILhW2~;WHi2?C0DBpXSwOk++6Q2X18Owv-le3xk5;y6ehx;pM<9>1ax~c2==%XooJR7?H=o??E9 zG$KTf+?i+;l7LKE@GeRb4MPq9%&3TpqC-Iq6&$4_Oj#j`l*C2`6o5z*sD-E%rwlYG zRNTG9jh&+NFZ1G`kUB5^J-{QWJ|IKUo`fZRuz5bgcigNw;Jn&`wYn$d`IT#E7m4WcH>p>sxOInqm?Wcb#<`MSi z^uOfznEx4}OqTk89{8<5nk_ZgtM#nYZ7w$JNjICFt+blWbn~#Diq)i%^s;*Kua%6J z>h;s5Pc5#~q*ZSv6oJN_u(SQqs%rT1}?eazdI(T0d^>icw?j zGzqnQ9yQEqPegEln2bvD|I>$$1 z42SQ}YxPbahfBLTS!&>6>ngcuCA_f6R~pkStxelmGHotR8%Zqsx%{b>Ej5yzUfN-k zRe>8jtGhTlI;5MmLAEnEAM`ufNjF(dd%e@j!QgOXv)yhaz4eu(kuD|uEYWNItoxof zKDkY|xweVT{nOEale#=-o0lW9=(h%Y+jZU<`@MRl*{*lu%5=DRXs2ws)m~da@9&X% za?n#tN!~ijPZzgp$;!sCscdih`|p)m@Ur#BmjQh)*q^%fRGGVAr>`IEZnoA+2Dibk z??E=*=_cK@=WadKObfSNe{ZGfbiJM=oh{vezqN6;yxLjGho^(k+-#}k^KotC_+s>a zykjo1(K)SLq}luP!`)#mhQ<0(pQ&EbY>L`e?=;)qA1;dRH1%Pa?WeTQFLOH`k><4B zNH%6MZL74BM3oi&OnU8UW4hPa?vQTMUaqCd)-)*w!d2q0Z|2!zuf65vr?YT4><{0c zu8efIRuSpq$(m>mI;&gLdT+0}I@)hu9g<@7G&<8{+DV!{vp5l*b{y<24Pny0+}N$@ zZcJTYC^D|}j$5^?z8b>#G`(DH)|=^hy0OHr;!Y}07q{x8{IHh~kA&%7?5yqCq4(=% zb;*toueAP7;J^L;Kd1j*V`a^=`j6vN{Rdo@`fnbfh~LzIKYLZxhudXgrTTj_%p>g2 z=syAoU+6zhO8qwvJdgyNTj^S}UR}-hZWO`dV46+$mT!_+J!#)1v_{f)jdm}|RDEw< z)CaYmm~{3p&X(O-cc`LrCw%+3!szg-zo|znuxVGkvWGj{rolHG-L(O3ZoAD%e|eIH zY`wO!PP>!S_F$`*w}$m-9;uk8X8mlB{j=~~{(p_djL+wP`85AC$;O@o zA?t^`rMTrw|5lhs*#C6?2PtW}|6?wAVgC2aS7SRonnr%m%GmpjiClwJEe^V#b}F5i z=f}f?K76{|x@_;MjpLJb+&o;wiQM((a{XdO?(S{xgth&ow!~L^g0}1O(yq{6ng8d7 zFW>*yUjqKj`~Q{wUjli#|937Z_kWf9zsmhz<^Hd7|JT2M|JU7m={fKJrc|&m{{Dxg zW&WQBzL)>+*3ZB70?)z1MR!12!ky3}8pXIS_!=2wQoY&& z&=>DXc*KfIatw?U7L^0T&{~4ZQ{+@RVu*{9IdH)QFP#zG3&SYWlrdmnxUzr zRanBc4bjF(l@Ngv;k{HM2FnCEBUNyqjifv(rm5sW2>)BMVu=zZO8oQjzW@LL|NmL% JalQat003YQ_x%6> diff --git a/pkg/reconciler/trustroot/testdata/tufRepoWithCustomTrustedRootJSON.tar b/pkg/reconciler/trustroot/testdata/tufRepoWithCustomTrustedRootJSON.tar index 2661e75db300ed69ec8f742264eab843098bb714..2a4c1b73a34fbe323c025ae19fd109c9a23ba26a 100644 GIT binary patch literal 3528 zcmV;(4L9;1iwFP!00000|Ll8Na~jFgwy*sw6uR{pQ~TmCe9_Pd5NZ$tgwPigidv!B z8qtkdCj8&uXtdiN+cUN`K4-`<2C9p$tjz4^$;v7%+&oF+ELm(`{WJjp08VNC4mm|n z-|yuWqzEI(2txc7fEaS}>VW<{l^$i8W@_;YfSH?2zSQq)*Y78C|NdVhkNz*fw~Hjn z-j32__G8D$?ZF87Gyf9=;79(ah|yOEFJi=hx&QxoeQ=n@gPF63?+*TWeQ^AA$UKKEPL82G}L^uT~bJ%GNxX?}mp%7P0S@0QS z5ve%_SOI3GW<+T#Fmses2NmT^3TrJeT6w03wp2(fJg3N5fq;YR7dDpi#7Rs&)PQSi zh{4t>kF{0=ajiHYR$z^xGt_g+0rd=EM6~6ADIz{&EGsM{9vj3wa}FA31cks79j*FH;5?&pv0Pa$~n;1c|i=cm^+M>;sjcQ zt-yw2sx1_hS?8#H_87jtGuYuGnYc#~+acvs3&i%R{@)#m&!(CU7cLzplN_+&6Bnj4 zHBX0MROGw8{7s5vYB6wG`Xz&WFOGei9`V$rnVQbOq{;Wv&sQ{g2pE&h(m2iBEW3K* zsBE!xuXjCmB&@RKEqmtb-GMf(o)8_fR0IF z9HGQGs+{$PGN6P6+BxGX_r?o?6=M`DMGfRqS;{!#+8HT{qXtn=rN^9jV>xgDF^D~o z7AoePAy9b?U~ab$uMd8I{o$WZfd1w3EdRfc%pbf4_)7i{A^kZ2XON(M{{Is4h5Y{k zr+&g3VCu4m1nZtKc2W0;)e|=xWW&RE2OPsYe9cpYN7{W%1#)-A{J+oRe**k}v_v>G%QQ=- zSJ`5jX3kzc)FD5^23P?6bviKEVdeltnp>2wXVh~ zx2`O{cQy8mag@i#dYc>4;M}%WdJ9m_I^IfQgwVuO<`@G|;C#v9iBSS!K!t@0dZD>1}T$rJqlN!9WshTcmG6;YSqGKQ_%r?*K9O zEEWKwn7~&D>z6RVz5icgtY1)|KnHV`4c~tz5dP^+l(&DjE%f@Iw%Y%WyolSsod5Gr z_J0wl6z=o?mykbhvvC`%&RyEC=JQExR2C<*!p+RSweIHa{eI=!yGJp965r%c;{UtL zbl-!w@NR2&k_;XzEDyVzTBWYLnB)TtvuvKeD-;%PoGjkDwVKW+?yX6tkNcW=q95Fs z0`uRrs{y)tQUts&@YUVs$sX##!Qn!!iks|q`4JtBSLIc|T2C%(+Yu-Qt$yw9a~QNt z*ct?7SE`ce1fR1q+1votFZ54}CS`tjTeHKOl$u!&&XO6bkPx2Rc@i+w8y=6} zsBkb|*S(1O@yUgqp{T*9*HLprTJPUKD0-XQhb~j`WT(|>y>@X`E`{yj>J(9S)vgB5 zW|l7>)Fie?$>Q16Za0D#*>3SAImj1Q0CoU)xBGW__|Wsi-KP%^#+oF9ntg7lvD@sL z4*R{MNn_O7G{f__*=bDry%uh42l%pArctlF>Q5WP{;0Kz!Y++^eGp9}+CcqP)T^zd zt=UAQ@}@Bw#*JwUH7e!xWu?E4R`1{6>+`rP{rhbt%q_Cm=Mmdijl~U=t(vFBM22m*r zz`C>zj*ElFc`=AO!L%`qisT~f)KCF0wV~$acrh7wM@f}m%;tsW8SHK=zS0{-+h839 zB-h7=t8%fhYL$akt+EOOpU<({j>?rV=naakc(ptgBcb)tX=~wwpwBLrm*tb*O&kXG z;$Uz+9FLl(tyUNe8plCctORj6klWFAS?|P)rJP@!jeEGRuaoJxP&ht^qKXQpwra+e zM9Z66sn#kL3S)218sjhn$+SIyH)*ZY9QZKpA>3v0U@KZTrEQ^pJsmto_p|8v1|PRa zrJ_&|J}&-nA9uWN@~sW z^rU|=sPsmyLj4RxrTO}N0*e=Lq9>)anzlFf?5xps47dBW+WGPNOo5`Efh2*dbGYH*ptfp-L38KJmM8{Zl=C?TgVris^~3Ws&XeP<>1cWbs>iGKl;l3I#oNM7tS`Ikh`>53j|;1?JF1Cs`J@ShZtdI+ zso%mdYzH6t{NeNOpJ2#m;rrXb`xCJIb~-hgcmFh-7Kdq~R;A6Fv9c0$c5->lC;jW@ zw(iAs>vYnq9ElleEZ66asIy&)0uJohSKoAfGnr^PEi{I!+WPdkGn@I#o(Tg!FLhS` zO>Ei>kH%5h7)IL~?sxj686L-tksUR|+Byo&y3rZuOuB9ME~owNWgPX+CYPO~IO_Fj zzt)-B3X5i`dMOGGe^CmJ*2AQu z)iuBA-JH})tLx>(yv#_ubL}oyZ+h!D*IBh+J%KVU&X42MIKC;nLcc!jUYEM|dYU#V z?}JGZZrfmX!P6Bcd{Axw8HJY1pHOJWu4US@P)tt>la0SFuH@Odwy{0wbv~icY7iF7 zL0pU`g>Y!w=_nNS>d~wxGsNMdgokGeH`;+2Q@OHKxbIu(g`5PNTNT#-r1$K1kfQzB-xM zS-CXhmtb0hq=u71Ufzqx1xP;&0Smp-xa`eW@iFwXv2tE{X)%SyL8h_Lk~^;vG>$n$ zh9wh{Ic5>J7&EJov_uNTA$LSG#jsY)5w<@8w3of?WiP*|{9gb70RR6^uYB16Q~&_K CrUTIc literal 3530 zcmV;*4K?x~iwFP!00000|Lj}obK1(XKcDkgxct>GVfH1j@-X#FnatfRN#iV;um1RD0ssJ<(#&@QY{#CY`x&8Nh`}vIb z|0i!sXU<&Rx_KHW)BFy62evmJ+u-KATh8LSOY=SmAodpUw@|c!c#p_?h^_1<`|`%X-KHyLVMzf29yhl zxiS(cDuwXM0syH}+@jyuSe^=kC6Lx*#hnvG8)p?4L@@w7#n@87ga?XPfd#V`IHEij z)Nuxt(@%}{=FVXI^JMHEL2QGRPc0DJr~3c!Yx``f*~Nwb3{a;~x&9yC{kK`O^UQ0DGm07u0hmgj53;T+Cb|x zU;=p|k;K44rKuL25`egc-Z0@5p@y+0iiIEKzQOQWymU` zt(3$YPMy?3I>(h&1bZtvQwUlhy+F=T1B_w-0S_t4k%}n9C52LI0|2Mq00;rJNPF%G zVTfxjp)^XkyDZ^O(I+-}pn>nj`5)!zXE<*W(nKk5m8Qg7ODz_JKm$3$f&nKnHds@N zj57{Xt`Wz^6Gp5;5HiWA1&%7jAd`es&hPR9A+ z)z~w}QIV{eM^g-_`$j_5WS{ei+=YUH<i@g? z|36or;Q!rg`18jAfBF0`VT|t1|GtKN>i@!tTGpJhZl1mag`ZJK|AOBi{ErxW77GAT zMDZVc%hxc#z5ichtlvly_g+7JBn{TkXF`Uc>F*$p1O!>^c5p z0KqQ*e--)HHXFCGYH!p2y?r&Cjbo#-IGGl1r}mw7x9{#ZEZ^O|i@7xp@>lVH?^4|l z;2pf%+Z`wUJh#28u{`W=YL&Y4`FJzLAj@Xy`$A#vM#=o0TdK)y?B1DV^0>8`=la2Y zHE{Ezvs!?zo)iM_i+o3JmEXS~Xm4+St`^}c+ho{#`%z`IC@;FTqoh|~4?!_#b?bN6 zrJ!X>t$t9pwe?(&CksyoQ5hdJGk%OhQ5m%@JU#VkIvo#UbhbKQwYs7?oi*6Wu);Ea zY1OK+Jmi<%i;g?)1%)a(>QmS%@|8Y>{SO}=RNZFyC6}pqyjAPusD61>E|$)Ms}n@o z)mbfgHo1Hip~kVTB=hI9+inQYv&~bWwH+tummkIq7Ufz1>OokXMwc`x9bX5ouujW#yqwK!x=xQmncfx) z$AioB@VGe=ZAM3pk~~{oRz(!RgR|=nsvFilolfW+4G(S$#nYILtCuOLme?>_2g@iR zxjweED2Ihbs~jxq)kP`r`5bF!QMptsYgk>BEzRRSvZeAK-t zlGC~E7VE9zsXttdD?`1&wWxL6xQ)A@7!3NN8l=%Ay{?=Wg2U#xE_8qK80F6*=zE-e z)-HxZJvcf1=}vB!kE398@8n_^l^30M&<^|N&Pes}(O^*+E*ixkI6ar~!Flthc654} zj;}|qeiDh=?Yz*OE|Y_KM=i_AEnJ4>gWKWdxZqu-IEk_72lYBFocFKG7rk+XUWB1_ z<8m*AFzU>(?PUsA60 zTj!Ra-MHa69v@sECbC_iVP$qq>!Z`7^F^`$fb4nDluj4H;xwrDRVAaREkEj3$0%#9 znwJIH_MwTX0Q3GdDwK;y&dsmG)lt1z4{yU}6|a3K3Bj_d)Ybe>an#A zbyU^!;abXP4u81*^AiyHJdS@SihqKce}!L7=G|{VucFv((Bi1jr`c(5c~dht?XmE} z%*e$Q!|^&kk;x%C(T7&(Vdp}X$VsVvJYpvo<|K=2S=p5vg~JAHXVJ%AH)u@CwAl_w zqjWlKw(IL|d$eel8lz^rP8)(`9Yl~*N zL$493k(-OsyasvKbO!ap@oYVB_SUsxbEI3*Ij<+j>)Eh>va)N{>a=D8-?nT;#f4_g z(c3zoAFPkgV6wVloL(G!iBrqvPdK$*IqDqK?q$?zPTIAbL9f$}6LVZ2MdnjZtp=sA z6vSaWy=;T&Edix^dObRxM3rS{nTC@CFd3PH)!E{*T(06{T`UK6Up*^Sj}Lp3AY9yz z13w(yUi6M{)~ilHZi<(95FW9_Tu(&lzmZRalXd@KdUo>cGnmgH|2E_+;Th-i00lBh!8dyC}kx<#&9jHb^Li+va*VWn%F{z6k!AzL5RNr5JOJh9MGSq(xWWXOfB93Fmsd1x9-Ph>fBg@UNB@ z??!1d`>}oG_F#nkk^cz-@H78Y#ORxYS25y0-2eZ2dvKV>gPF63?+^a<_Tb>~W44*Q z!}kY=c{CjUPu`Tyo%wj<7HOQ!@++Il=2?!A&Qe);hViFpptRe(RgE;oe38JJh8cL-#cbEu(s1=wKEiIDx z{z1FP-fQkGq7=$qce(mz=%!!0Fm{{RejKWF_)$#;$s*2%(_FRx+g(05Oos|lc6ayg zBZcU2_v!b?N8G5%gBAye^QE4|W@jY?B!ylvN(ok)TkM7Mz!3x}GMYN9gfmnUZzK^6 z0;4RKnq%vvB?jDf^eO-U)2_Ee1*BlkLu@5=KnN;{@Cqm;tzi~Y=N%Ws366zUN&>(+ zB^V%YC_-5IU)Wg2S_~{SoH{G8fK(x4Eiz0&L#&6MTCY42QYwQG<;pOt5l~V=3cavj zF_!a?GLI}30yCqagphM7l@kDX1PS2;KtY8TNJ6EBK*DoxnZpDT4Sr!`3B@HvSR+n^ zR$gi-C?ya<283Wj0BekMR4d9fcFHNDIWaId2mr*uFOB82cOFQOp;nMFW*l}HDh4RT z`GW;jo=Xpv#ztEP2vAN_C57PSVQbaV74l=Eo!@_7Q ztd>l1=yG-gP%y#;%|k5Df}qDl5Q>#y#&|3sbkZT4q3|M~8(Vy-VePWXb8u(6}e=$ct!})wYA-ETgU?wGi0D0z=^;`i- zAb`*rAg!{3S_HJg+7btH8q~%hM2zK-DDS-2TpI|15{d#KjX*>z&Z!4dDi6JP9_I-> zgG?KUmC?ou3D_Rze{p$+|4%345A5U5@E;@cdHsh|w#Wb1kZ<7seIEZ4;QzBF!eO>p zrkS%J9}19Pp#dxa{&OBM*kR@XM4DSfnRSS02^|1PVk-rA!g?;8lY#(&j2FyX1c-JD zF^DWC9(jg122eT(F>rukkDVZhBI}6&S~;P(_e|`t*byig@EmF-xwYsy513_|CDW&h z#)C9V7Vfd>;Bc9$!Oq~_*?5+$X7>x-gTpja*>Y#fz+~}_d%Ut-#Ch{=Z?}unCri}t zrJ9#6!=6(O1d3WDi6l-ip`auNY6lsI5Nd4*fm9%cyi}SRPXzHsFrc8+1TzW|gUTAg z3>HE;;W!r5QcWF_TmUJF(oP$Xa#e-$+HgR*=MV!XwE$*MHGf5(;Qvpm{{N-=KSX={ ze-+u+|M&I(U%^=W`v1QEzpwxA>;L=u|Gxgem)Dag`TtL<{{N-=KLB{2|G$Rp>;L=u z|GxhJ&y^?me>V+(d>{Y*`Cq~a-Jkz`4f)dlg)_CTI%VA=eFq9ZqMrV_X+C=ei1KH# z01(9lzByRGh5_#V{~CS$f&w``n5%5~;VXggckiXV`(j(@?cZ&#|2laUw|_hT=NRMX z_>VZHaG(FbhWzU`8@I9Q+@<|$KA*%!WpOeq+|2Ad>u%oNZ(H8a$b3Q`noI=s$Z=qSGDa3l!8{jcK1FES|)4_ zg0d@BNpy-YSea~Yfa(|er$v)8KRhY*Z$|a$O*Bf)tOsYw3{^-7FYG)CnCT5q#z!g~ zjMsH9Vt#UZX=f;E@ac8b+>q9X4-bmo=Juh>R6N;fbylxkek_;5cJT2GQTDN24W5lG zUp}ZwY>$)0v!UJY2QRYS;!ARnFRTFU0PueI@9Oa3&QEvmK0O#~k_>A0xuM2xvuir+ z_l_rxQESr-FXCpWG3obOxUn7Jt6rH#z4EF*Z4CRP)+!3SH0t$1G>vEj^;c1^wvM)D z6OGE7#%LHfrY+Q{l-F04{yJKH_;9b!f25J^>chQ+E@0Sx3C%-*wequE60cQ@ZQ{x-{7zp&KZ#`=AX-hSol zL7ESwG*t2Ixr$H5_oUKz@N{fni`81Kcs42(X*~#oLAjLwML|+2m98u8h{$3Pm7)Nw zOWWY2IA~lHgQycs8^fqbF2ha@MWNX=!!nMx{Y^AUF2hdrdD|-7mK#x!Rsz^92kWS; zD;LA7QSmA&MwQ~`wx3{7e&{n;m8$`$1;vK1O1WvHqqBIzOY3?4{Nw^}%d6ADIle45 zk1C5%Y)nv;6}W^MT+^%BczWH2Fu>J@nwR6nWZWGkRem{}7netACb;kv#~rsG24dhIcHOte} z{^g+38?_4ca}bs0>x&62Uc!lG;C+l+sigpH)1gh3$TV^wV zRW7E}GoFCjsuc#!oiAIW73Xj>KI zaj7ZB^rTj&Y&1_t(;HAdS*@oe_jxVe7H(pF)m=vf)=_y}ScTnDO^nN@O&D}*7j8)X z7KULv_{`@I?|=USL%s^%-v{1bfaUkosmZ+iyVlV0Um%t&LozGy_9?NStQV8_0C)b-6|qUE&E7_MsTvy;wj=C67t4EVg%S^X!m zX)`62!75;sP6)C_CuC^YLvXPh(Xw%NOy_P1AY)H|PCb&lhx*Qfnn zi!`>!!zi4@SJR8p?r#);sP)He`mo9MaxTqM^_@hT-}&#bXqKwiqR{XcrO;?SOgdU! z^PAqyX|1%nUS7`2jI=w~?rL?^TOVC#)qeF9%CtB?iO=HrrtAv+`mlRl>e}mR+N8V> zCPlbygV`ldSD5fYwf#pFS}uP_O#def3z5P}Hl(v!2Wlhl>&(o-5pFGu|!wqz+}A>Yz60ET)@5uh8g=-gy@;lg%l= zJh_{ z`WMdsGsyS#pVyH6`Tza-|NZ&@f37^m|NEuHYybWWQvAj5fA{tO*O71G|HJvopM3!6 z*~zo7KtF^0JCI*1ZMBj_GwO)95JSo>qh48WtRqZAj)1lTK|(1Z2ouGiGROfBH6~6- zjvRuJ3xK7{S%E?zz2O)uD!oA#G3k_%$V#KQ^GZ=*hz5{32K5g+0rcWCsn1V(8p42u z)N)L`6Ba|vIj4quLp`F}2@0LJh8e`TQJ5N!B|roKC6MAC6XK|{m}~D5*A`HUF$6Xz yMu}|xC?c6N#!10B6^;UloN=0QCjlUPSl-KC_Oh2>QvN>x0RR87ufxOuQ~&_ITI}}# literal 3529 zcmV;)4L0&0iwFP!00000|Ll8Na~jFg_FVf{D7e+JseSPmzUYQ#k<=h0Bm`efIBJDv zYeY95>i4z#A5ZSTL>~QLgm1QUd^60_ z>5m;_YY#@qpZT9406+3S#en{H@FGV1m;3*ZR|kbG=}(<4ygm5i)xkmGeZHQ#!rOzw zcE*MOY@4!~Gw*NQJWJB)_6~dlZf`uc!QE%Knk93WZTldA*lWOFL(vA}Eh29r?%jTA z!^%0?rJl&_JOGhnOkv5tC3dz?oNy2(P6C5@7|1 zkV2qe*jU^E4H0HYF@%NoLP(+%(w=MRiGj!ng8&20Ipw|7PAW^7p;96UG^3vyOG(BB z=!ncQqVK!Fwm4x$u-wd zct?OmQfccjfW~9vxz=83NFCJ}G3^MW9swlrr^eEpDvg;n79t3^mmVSS7{S5;MzK*6 zP^`5SRuZcP^-w!Nn6Ok4COP?)jpe*CLV1d`)x;2HJOC6y%ZVf2I7+!xh7;`w_E>uW zxYX1^&n)-ah^NMSb!V``JRQ475ZfW;Qwt>ass7)ManGij59Tf#q~k4M!zV7xrfQZA zzNpA|zY^c1NUr96muFwl5S+)eZMPaKuc z7w*-r$Bu+mzPM%2t$MeiwbOVT#@`)8cTtk`cW~>Cbj&$HfI*r;u9$b45-WvdoJmiC zp-?dmpm)Y$?g@chL9aCC(rb#ahn@(A5#WqTtUS|zc*hU*R1WDo%$CMLk zttFHx4b0YVA6^~&{_4X&odEsI>VZD*2xAv@k61l+(|$fEyglHE+~MmsMR=s$$5i0$LBV2Xj3Z1aCK1sbaP6V+ z7J6;9LeL0`4dsM7&nc9aLaC60$U1Kw!pLyWErE(CAOtqT0ECg}!~wshAdVs74k@6O zHijc9Jpf25uast*@cS&`PSGbed7y!B#QE>$=w~>Ogh1LW4hTVndxwFA#$YM10*q^E zu%N;z4V`4xU}%YA!aB{IWZoOCp%-2VZ!98K1Ewvv2x)CGBLpZ7D8K>(;|wHBAVr+P zUK;>~M1}#h$N67ep5gz~7x4#<@iqL%h7<#NE@`7p#w9wicN*pi@`R6=f7FnK7o+_I3 zvpk)<$EJhAB2)dH!7rwxX}X-=FLVzIS+4TM&Xj@4lN52;QNNLD zzIz$=jB1qioFHlp;$Cv7y#<0(E)0NndjSzML;|mwRv2*zys(;T%eN~RL$E^LA%G0` zz$ikfaM*b*goB7F#ta0GNQr=y$RZ9TX5LyZIR#QE2=tz6{*FAs|DRO-|6BEcNcQ;u zBC@al@9Y1+g0c4X|9$;`U;p3N|M&I(ef@tgFDFm(|DRO-|6BEcfbc&5e+k*w|M&I( zef|I6D^KwM?lt`JV}QSW{+BRD_ve3KLO%6>@l>s9PFXk4-hkqdsHgvl-yi&sD1R0U z08vEoZwITFFu=Y4Ut+9ZP#~uVGnEhCeI^k8>AjRUpKJ@g`lrqHKPNBY_OIms9CP*@ z|1p4IpZ~vz{BfI&+eEc*)Bb~kn$5)x3@b^``g_1uEz4P&8b!9F6QIi5Q99QWp9hcxf`YPH*TdSv$1<)(#hiv=Qh_5 z?yG^jFP+x{^!`a9@V>}*?AF`+_X8aq6y|CfuJc`neNc!iqh+-0){fI&eKQ25pw+G4 zU6+HFDYyDTWNVwb9#58@4B`kMHgkT0LQxsDEj&B(SvDOH5_G=4Shu>OIh{4w>9E3b zer46Vu{z>c-OG+U=>^3qIqp-~D)F^Gg8g^z9#p-}@XIb&$@o^S)8qQp`>0et58j_5 z%HE&Xf@hQ4t|HVpv6XcGe0I0{!t;Fh6eu}(4d814+W@@X{p%GTx_-F3`tV?}aoVrj zkE}Iv>)WNgep?iC^E~m}SaZQ5A8dV{xX;B- zw$MXo@{bfx=Y2IzHoHjO>F*a~lccYowLh_^NhgzZ+E5eswD)c6>*==n6MNn6vp)vx z?RP#OvD?{{1}d3;q~?=ZKAGFCJay|Qfm^SKr^8Z6kArg1k4oGBagbI^rR(Z>Ok^0u zr8oeq(k3_x`;E&mh}*%WF^EHQRc_Z&T#i=FazNr?YZZ^vt8zR3xNTY9M2$GessX%+ zf>j*p>gAv}40~}HSHtz~I6*&p7&BN#wE)zEur!UYXj(qG4qS1QMRdHH&1|;GjzgK< zl!_;VtBdfYITCF~M~$*PUtd*49Kgf#>kg_L);*g}=o}3XZ;GX}gpI3L8K{=oFx~{K zI3QbnY{4ZMRf!mCpRpa$FheC9cJ-lg3Tb1*Krn7u6t(C)su7q8J=C$919m%f~2x7D3Ut=(0Di(91Bi zZXESOn2>d*mno<(Tjij+b7o6~ffvzsjzPb*EHAs|%QMgpTD4*rTr7ia0Biz#+m}R@ ze(S>W^MxCZlkws8Q7YR-8dhc}v_3jJzF3y}56Hd^n)2B)Se^y-zN+N(tmQ}D>KNs% zb@Qqy+dec26=2?<#>J>~?A-i1Tp!m<_3$QaR`JGnLVjJjD5cr3pN%I}wO5^!t{z+4 zP{&n0A8w?4=J1E>-#-D7&*S(vqWCA6`B(VWeVU*3R*RZhw8z2= zGb5K%49A<~RHjGhR3BNPhn-7RCa2~0$%vg^n$tX~<&ldT#iIsn=hv;#ML&zjC9jtM zb@bXR8xU9Pq*raBMm465VMH43%W<C)b|z1kx2CdP5QH)u>E+H41; zQ9c_s+x1PiJz6%)jZw2*r;Yxf)9b?q*bgDsJX7DwtlO@CiB|JWy&R`DH@_&S)|Snv zL$493k;P?sUW2@AI)i%gWVV?%dz)IRInu58g4ffN&1~2|UE7Unby_olZ(6pZl47&w z=uMr^4>!l>FkLSgrHiSvWZalaV=GpD(YXsESW?DGKVodS0xa9Q7taxV#w$ zemJ_h?42w&>rOxxr7JuLk6CK2C!+kn$fv>Syj-3}rQua$KI&M1k=1iw6zWzji@qAVJCzE(rNCEw2U#wpaupRLACPEV~r7G%p2km zVT2+Gh*HQX013g62&f%HmJ6ylwOSC!A(mV!%9vCh5yOB(4hqDO^??1b6F}d6CiNLC zGb^dVggfG?W!ND>xYk4g?JyDo0OFX2mMTM(R@NdSlru(g&j|pYYqT|@RMb)}v0