Repository: sigstore/fulcio
Pull request #2019 (2025-04-23 19:06:48)

Bump github.com/spf13/cobra from 1.8.1 to 1.9.1
Bumps [github.com/spf13/cobra](https://github.com/spf13/cobra) from 1.8.1 to 1.9.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/spf13/cobra/releases">github.com/spf13/cobra's releases</a>.</em></p>
<blockquote>
<h2>v1.9.1</h2>
<h3>🐛 Fixes</h3>
<ul>
<li>Fix CompletionFunc implementation by <a href="https://github.com/ccoVeille"><code>@​ccoVeille</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2234">spf13/cobra#2234</a></li>
<li>Revert &quot;Make detection for test-binary more universal (<a href="https://redirect.github.com/spf13/cobra/issues/2173">#2173</a>)&quot; by <a href="https://github.com/marckhouzam"><code>@​marckhouzam</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2235">spf13/cobra#2235</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/spf13/cobra/compare/v1.9.0...v1.9.1">https://github.com/spf13/cobra/compare/v1.9.0...v1.9.1</a></p>
<h2>v1.9.0</h2>
<h2>✨ Features</h2>
<ul>
<li>Allow linker to perform deadcode elimination for program using Cobra by <a href="https://github.com/aarzilli"><code>@​aarzilli</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1956">spf13/cobra#1956</a></li>
<li>Add default completion command even if there are no other sub-commands by <a href="https://github.com/marckhouzam"><code>@​marckhouzam</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1559">spf13/cobra#1559</a></li>
<li>Add CompletionWithDesc helper by <a href="https://github.com/ccoVeille"><code>@​ccoVeille</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2231">spf13/cobra#2231</a></li>
</ul>
<h2>🐛 Fixes</h2>
<ul>
<li>Fix deprecation comment for Command.SetOutput by <a href="https://github.com/thaJeztah"><code>@​thaJeztah</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2172">spf13/cobra#2172</a></li>
<li>Replace deprecated ioutil usage by <a href="https://github.com/nirs"><code>@​nirs</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2181">spf13/cobra#2181</a></li>
<li>Fix --version help and output for plugins by <a href="https://github.com/nirs"><code>@​nirs</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2180">spf13/cobra#2180</a></li>
<li>Allow to reset the templates to the default by <a href="https://github.com/marckhouzam"><code>@​marckhouzam</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2229">spf13/cobra#2229</a></li>
</ul>
<h2>🤖 Completions</h2>
<ul>
<li>Make Powershell completion work in constrained mode by <a href="https://github.com/lstemplinger"><code>@​lstemplinger</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2196">spf13/cobra#2196</a></li>
<li>Improve detection for flags that accept multiple values by <a href="https://github.com/thaJeztah"><code>@​thaJeztah</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2210">spf13/cobra#2210</a></li>
<li>add CompletionFunc type to help with completions by <a href="https://github.com/ccoVeille"><code>@​ccoVeille</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2220">spf13/cobra#2220</a></li>
<li>Add similar whitespace escape logic to bash v2 completions than in other completions by <a href="https://github.com/kangasta"><code>@​kangasta</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/1743">spf13/cobra#1743</a></li>
<li>Print ActiveHelp for bash along other completions by <a href="https://github.com/marckhouzam"><code>@​marckhouzam</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2076">spf13/cobra#2076</a></li>
<li>fix(completions): Complete map flags multiple times by <a href="https://github.com/gabe565"><code>@​gabe565</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2174">spf13/cobra#2174</a></li>
<li>fix(bash): nounset unbound file filter variable on empty extension by <a href="https://github.com/scop"><code>@​scop</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2228">spf13/cobra#2228</a></li>
</ul>
<h2>🧪 Testing</h2>
<ul>
<li>Test also with go 1.23 by <a href="https://github.com/nirs"><code>@​nirs</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2182">spf13/cobra#2182</a></li>
<li>Make detection for test-binary more universal by <a href="https://github.com/thaJeztah"><code>@​thaJeztah</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2173">spf13/cobra#2173</a></li>
</ul>
<h2>✍🏼 Documentation</h2>
<ul>
<li>docs: update README.md by <a href="https://github.com/eltociear"><code>@​eltociear</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2197">spf13/cobra#2197</a></li>
<li>Improve site formatting by <a href="https://github.com/nirs"><code>@​nirs</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2183">spf13/cobra#2183</a></li>
<li>doc: add Conduit by <a href="https://github.com/raulb"><code>@​raulb</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2230">spf13/cobra#2230</a></li>
<li>doc: azion project added to the list of CLIs that use cobra by <a href="https://github.com/maxwelbm"><code>@​maxwelbm</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2198">spf13/cobra#2198</a></li>
<li>Fix broken links in active_help.md by <a href="https://github.com/vuil"><code>@​vuil</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2202">spf13/cobra#2202</a></li>
<li>chore: fix function name in comment by <a href="https://github.com/zhuhaicity"><code>@​zhuhaicity</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2216">spf13/cobra#2216</a></li>
</ul>
<h2>🔧 Dependency upgrades</h2>
<ul>
<li>build(deps): bump github.com/cpuguy83/go-md2man/v2 from 2.0.5 to 2.0.6 by <a href="https://github.com/thaJeztah"><code>@​thaJeztah</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2206">spf13/cobra#2206</a></li>
<li>Update to latest go-md2man by <a href="https://github.com/mikelolasagasti"><code>@​mikelolasagasti</code></a> in <a href="https://redirect.github.com/spf13/cobra/pull/2201">spf13/cobra#2201</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/spf13/cobra/commit/40b5bc1437a564fc795d388b23835e84f54cd1d1"><code>40b5bc1</code></a> Revert &quot;Make detection for test-binary more universal (<a href="https://redirect.github.com/spf13/cobra/issues/2173">#2173</a>)&quot; (<a href="https://redirect.github.com/spf13/cobra/issues/2235">#2235</a>)</li>
<li><a href="https://github.com/spf13/cobra/commit/a97f9fd47b290016526c8af2dac0531fea5cd773"><code>a97f9fd</code></a> fix CompletionFunc implementation (<a href="https://redirect.github.com/spf13/cobra/issues/2234">#2234</a>)</li>
<li><a href="https://github.com/spf13/cobra/commit/5f9c40898e795a9fb0fd5ca83b6e05c3720523d1"><code>5f9c408</code></a> chore: Upgrade dependencies for v1.9.0 (<a href="https://redirect.github.com/spf13/cobra/issues/2233">#2233</a>)</li>
<li><a href="https://github.com/spf13/cobra/commit/24ada7fe71e3a3a8741dd52e0a7fc3b97450535a"><code>24ada7f</code></a> Remove the default &quot;completion&quot; cmd if it is alone (<a href="https://redirect.github.com/spf13/cobra/issues/1559">#1559</a>)</li>
<li><a href="https://github.com/spf13/cobra/commit/680936a2200be363c61feda8cd29287f0726a48c"><code>680936a</code></a> New logo</li>
<li><a href="https://github.com/spf13/cobra/commit/8cb30f9ca53a004a6fe88c5cfcc79ac7b24fc638"><code>8cb30f9</code></a> feat: add CompletionWithDesc helper (<a href="https://redirect.github.com/spf13/cobra/issues/2231">#2231</a>)</li>
<li><a href="https://github.com/spf13/cobra/commit/17b6dca2ffaf6113cbd1cf433ec988fa7d63c6f3"><code>17b6dca</code></a> doc: add Conduit (<a href="https://redirect.github.com/spf13/cobra/issues/2230">#2230</a>)</li>
<li><a href="https://github.com/spf13/cobra/commit/ab5cadcc1bbe224b329726fc5f8b99d6f93e9805"><code>ab5cadc</code></a> Allow to reset the templates to the default (<a href="https://redirect.github.com/spf13/cobra/issues/2229">#2229</a>)</li>
<li><a href="https://github.com/spf13/cobra/commit/4ba5566f5704a9c0d205e1ef3efc4896156d33fa"><code>4ba5566</code></a> fix(bash): nounset unbound file filter variable on empty extension (<a href="https://redirect.github.com/spf13/cobra/issues/2228">#2228</a>)</li>
<li><a href="https://github.com/spf13/cobra/commit/41b26ec8bb59dfba580f722201bf371c4f5703dd"><code>41b26ec</code></a> Print ActiveHelp for bash along other completions (<a href="https://redirect.github.com/spf13/cobra/issues/2076">#2076</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/spf13/cobra/compare/v1.8.1...v1.9.1">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/spf13/cobra&package-manager=go_modules&previous-version=1.8.1&new-version=1.9.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


Patch:
diff --git a/.github/workflows/container-build.yml b/.github/workflows/container-build.yml
index d19ca1a..b5e7da1 100644
--- a/.github/workflows/container-build.yml
+++ b/.github/workflows/container-build.yml
@@ -37,7 +37,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: sigstore/cosign-installer@d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a # v3.8.1
+      - uses: sigstore/cosign-installer@3454372f43399081ed03b604cb2d021dabca52bb # v3.8.2
 
       - name: Extract version of Go to use
         run: echo "GOVERSION=$(awk -F'[:@]' '/FROM golang/{print $2; exit}' Dockerfile)" >> $GITHUB_ENV
diff --git a/go.mod b/go.mod
index 9918342..41d8c6d 100644
--- a/go.mod
+++ b/go.mod
@@ -23,7 +23,7 @@ require (
 	github.com/magiconair/properties v1.8.10
 	github.com/prometheus/client_golang v1.22.0
 	github.com/prometheus/client_model v0.6.2
-	github.com/prometheus/common v0.62.0
+	github.com/prometheus/common v0.63.0
 	github.com/rs/cors v1.11.1
 	github.com/sigstore/protobuf-specs v0.4.1
 	github.com/sigstore/sigstore v1.9.3
@@ -31,7 +31,7 @@ require (
 	github.com/sigstore/sigstore/pkg/signature/kms/azure v1.9.3
 	github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.9.3
 	github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.8.12
-	github.com/spf13/cobra v1.8.1
+	github.com/spf13/cobra v1.9.1
 	github.com/spf13/pflag v1.0.6
 	github.com/spf13/viper v1.20.1
 	github.com/spiffe/go-spiffe/v2 v2.5.0
diff --git a/go.sum b/go.sum
index fa1e213..37527df 100644
--- a/go.sum
+++ b/go.sum
@@ -104,7 +104,7 @@ github.com/common-nighthawk/go-figure v0.0.0-20210622060536-734e95fb86be h1:J5BL
 github.com/common-nighthawk/go-figure v0.0.0-20210622060536-734e95fb86be/go.mod h1:mk5IQ+Y0ZeO87b858TlA645sVcEcbiX6YqP98kt+7+w=
 github.com/coreos/go-oidc/v3 v3.14.1 h1:9ePWwfdwC4QKRlCXsJGou56adA/owXczOzwKdOumLqk=
 github.com/coreos/go-oidc/v3 v3.14.1/go.mod h1:HaZ3szPaZ0e4r6ebqvsLWlk2Tn+aejfmrfah6hnSYEU=
-github.com/cpuguy83/go-md2man/v2 v2.0.4/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
@@ -280,8 +280,8 @@ github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:
 github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
 github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
 github.com/prometheus/common v0.0.0-20181126121408-4724e9255275/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
-github.com/prometheus/common v0.62.0 h1:xasJaQlnWAeyHdUBeGjXmutelfJHWMRr+Fg4QszZ2Io=
-github.com/prometheus/common v0.62.0/go.mod h1:vyBcEuLSvWos9B1+CyL7JZ2up+uFzXhkqml0W5zIY1I=
+github.com/prometheus/common v0.63.0 h1:YR/EIY1o3mEFP/kZCD7iDMnLPlGyuU2Gb3HIcXnA98k=
+github.com/prometheus/common v0.63.0/go.mod h1:VVFF/fBIoToEnWRVkYoXEkq3R3paCoxG9PXP74SnV18=
 github.com/prometheus/procfs v0.0.0-20181204211112-1dc9a6cbc91a/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
 github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
@@ -326,9 +326,8 @@ github.com/spf13/afero v1.12.0 h1:UcOPyRBYczmFn6yvphxkn9ZEOY65cpwGKb5mL36mrqs=
 github.com/spf13/afero v1.12.0/go.mod h1:ZTlWwG4/ahT8W7T0WQ5uYmjI9duaLQGy3Q2OAl4sk/4=
 github.com/spf13/cast v1.7.1 h1:cuNEagBQEHWN1FnbGEjCXL2szYEXqfJPbP2HNUaca9Y=
 github.com/spf13/cast v1.7.1/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
-github.com/spf13/cobra v1.8.1 h1:e5/vxKd/rZsfSJMUX1agtjeTDf+qv1/JdBF8gg5k9ZM=
-github.com/spf13/cobra v1.8.1/go.mod h1:wHxEcudfqmLYa8iTfL+OuZPbBZkmvliBWKIezN3kD9Y=
-github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
+github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
 github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
 github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/viper v1.20.1 h1:ZMi+z/lvLyPSCoNtFCpqjy0S4kPbirhpTMwl8BkW9X4=
diff --git a/pkg/config/config.go b/pkg/config/config.go
index 3eda753..22b1120 100644
--- a/pkg/config/config.go
+++ b/pkg/config/config.go
@@ -22,13 +22,13 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"html/template"
 	"net/http"
 	"net/url"
 	"os"
 	"reflect"
 	"regexp"
 	"strings"
+	"text/template"
 	"time"
 
 	"github.com/coreos/go-oidc/v3/oidc"
@@ -526,7 +526,7 @@ func validateCIIssuerMetadata(fulcioConfig *FulcioConfig) error {
 
 	for _, ciIssuerMetadata := range fulcioConfig.CIIssuerMetadata {
 		v := reflect.ValueOf(ciIssuerMetadata.ExtensionTemplates)
-		for i := 0; i < v.NumField(); i++ {
+		for i := range v.NumField() {
 			s := v.Field(i).String()
 			err := checkParse(s)
 			if err != nil {
diff --git a/pkg/identity/ciprovider/principal.go b/pkg/identity/ciprovider/principal.go
index 48ccf1f..9510ac4 100644
--- a/pkg/identity/ciprovider/principal.go
+++ b/pkg/identity/ciprovider/principal.go
@@ -20,19 +20,20 @@ import (
 	"crypto/x509"
 	"encoding/json"
 	"fmt"
-	"html/template"
+	"maps"
 	"math"
 	"net/url"
 	"reflect"
 	"strconv"
 	"strings"
+	"text/template"
 
 	"github.com/coreos/go-oidc/v3/oidc"
 	"github.com/sigstore/fulcio/pkg/config"
 	"github.com/sigstore/fulcio/pkg/identity"
 )
 
-func mapValuesToString(claims map[string]interface{}) map[string]string {
+func mapValuesToString(claims map[string]any) map[string]string {
 	newMap := make(map[string]string)
 	for k, v := range claims {
 		vType := reflect.ValueOf(v)
@@ -53,7 +54,7 @@ func mapValuesToString(claims map[string]interface{}) map[string]string {
 }
 
 func getTokenClaims(token *oidc.IDToken) (map[string]string, error) {
-	var tokenClaims map[string]interface{}
+	var tokenClaims map[string]any
 	if err := token.Claims(&tokenClaims); err != nil {
 		return nil, err
 	}
@@ -73,12 +74,8 @@ func applyTemplateOrReplace(
 	// with the default data.
 	// The claimed data will have priority over the default data.
 	mergedData := make(map[string]string)
-	for k, v := range issuerMetadata {
-		mergedData[k] = v
-	}
-	for k, v := range tokenClaims {
-		mergedData[k] = v
-	}
+	maps.Copy(mergedData, issuerMetadata)
+	maps.Copy(mergedData, tokenClaims)
 
 	if strings.Contains(extValueTemplate, "{{") {
 		var doc bytes.Buffer
@@ -165,7 +162,7 @@ func (principal ciPrincipal) Embed(_ context.Context, cert *x509.Certificate) er
 	// Type of the reflect value is needed as it is necessary
 	// for getting the field name.
 	vType := v.Type()
-	for i := 0; i < v.NumField(); i++ {
+	for i := range v.NumField() {
 		s := v.Field(i).String() // value of each field, e.g the template string
 		// We check the field name to avoid to apply the template for the Issuer
 		// Issuer field should always come from the token issuer


Test patch:
diff --git a/pkg/identity/ciprovider/principal_test.go b/pkg/identity/ciprovider/principal_test.go
index 3cb27be..c72b911 100644
--- a/pkg/identity/ciprovider/principal_test.go
+++ b/pkg/identity/ciprovider/principal_test.go
@@ -71,7 +71,7 @@ func TestWorkflowPrincipalFromIDToken(t *testing.T) {
 
 	for name, test := range tests {
 		t.Run(name, func(t *testing.T) {
-			claims, err := json.Marshal(map[string]interface{}{
+			claims, err := json.Marshal(map[string]any{
 				"issuer":                "https://token.actions.githubusercontent.com",
 				"event_name":            "trigger",
 				"sha":                   "sha",
@@ -138,11 +138,11 @@ func withClaims(token *oidc.IDToken, data []byte) {
 
 func TestName(t *testing.T) {
 	tests := map[string]struct {
-		Claims     map[string]interface{}
+		Claims     map[string]any
 		ExpectName string
 	}{
 		`Valid token authenticates with correct claims`: {
-			Claims: map[string]interface{}{
+			Claims: map[string]any{
 				"aud":                   "sigstore",
 				"event_name":            "push",
 				"exp":                   "0",
@@ -216,7 +216,7 @@ func TestName(t *testing.T) {
 
 func TestGetTokenClaims(t *testing.T) {
 
-	tokenClaims := map[string]interface{}{
+	tokenClaims := map[string]any{
 		"aud":                "sigstore",
 		"exp":                "0",
 		"iss":                "https://example.com",
@@ -231,7 +231,7 @@ func TestGetTokenClaims(t *testing.T) {
 
 	tests := map[string]struct {
 		Claim          string
-		InputClaims    map[string]interface{}
+		InputClaims    map[string]any
 		ExpectedResult string
 		ExpectErr      bool
 	}{
@@ -333,6 +333,7 @@ func TestApplyTemplateOrReplace(t *testing.T) {
 		"ref_gitlab":            "main",
 		"ref_type_tag":          "tag",
 		"ref_tag":               "1.0.0",
+		"html_claim":            "<alert()/>",
 		"claim_foo":             "bar",
 	}
 	issuerMetadata := map[string]string{
@@ -352,6 +353,12 @@ func TestApplyTemplateOrReplace(t *testing.T) {
 			ExpectedResult: "https://github.com/sigstore/fulcio/actions/runs/42/attempts/1",
 			ExpectErr:      false,
 		},
+		// Tests fix for https://github.com/pypa/gh-action-pypi-publish/issues/355
+		`Template with HTML`: {
+			Template:       "{{ .html_claim }}",
+			ExpectedResult: "<alert()/>",
+			ExpectErr:      false,
+		},
 		`Empty template`: {
 			Template:       "{{}}",
 			ExpectedResult: "",
@@ -432,7 +439,7 @@ func TestEmbed(t *testing.T) {
 		WantFacts map[string]func(x509.Certificate) error
 		Principal ciPrincipal
 	}{
-		`Github workflow challenge should have all Github workflow extensions and issuer set`: {
+		`GitHub workflow challenge should have all GitHub workflow extensions and issuer set`: {
 			WantFacts: map[string]func(x509.Certificate) error{
 				`Certifificate should have correct issuer`:                       factDeprecatedExtensionIs(asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 57264, 1, 1}, "https://token.actions.githubusercontent.com"),
 				`Certificate has correct trigger extension`:                      factDeprecatedExtensionIs(asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 57264, 1, 2}, "trigger"),
@@ -491,7 +498,7 @@ func TestEmbed(t *testing.T) {
 	for name, test := range tests {
 		t.Run(name, func(t *testing.T) {
 			var cert x509.Certificate
-			claims, err := json.Marshal(map[string]interface{}{
+			claims, err := json.Marshal(map[string]any{
 				"event_name":            "trigger",
 				"sha":                   "sha",
 				"workflow":              "workflowname",