Repository: sigstore/fulcio
Pull request #2022 (2025-04-23 19:07:02)

Bump sigstore/cosign-installer from 3.8.1 to 3.8.2 in the all group
Bumps the all group with 1 update: [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer).

Updates `sigstore/cosign-installer` from 3.8.1 to 3.8.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/sigstore/cosign-installer/releases">sigstore/cosign-installer's releases</a>.</em></p>
<blockquote>
<h2>v3.8.2</h2>
<h2>What's Changed</h2>
<ul>
<li>install cosign v2 from main in <a href="https://redirect.github.com/sigstore/cosign-installer/pull/186">sigstore/cosign-installer#186</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/sigstore/cosign-installer/compare/v3...v3.8.2">https://github.com/sigstore/cosign-installer/compare/v3...v3.8.2</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/sigstore/cosign-installer/commit/3454372f43399081ed03b604cb2d021dabca52bb"><code>3454372</code></a> install cosign v2 from main (<a href="https://redirect.github.com/sigstore/cosign-installer/issues/186">#186</a>)</li>
<li><a href="https://github.com/sigstore/cosign-installer/commit/b6ee8f83b9a8b8ef7f46b5a8ff326f488b386693"><code>b6ee8f8</code></a> Bump actions/setup-go from 5.3.0 to 5.4.0 (<a href="https://redirect.github.com/sigstore/cosign-installer/issues/185">#185</a>)</li>
<li>See full diff in <a href="https://github.com/sigstore/cosign-installer/compare/d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a...3454372f43399081ed03b604cb2d021dabca52bb">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=sigstore/cosign-installer&package-manager=github_actions&previous-version=3.8.1&new-version=3.8.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions


</details>


Patch:
diff --git a/.github/workflows/container-build.yml b/.github/workflows/container-build.yml
index d19ca1a..b5e7da1 100644
--- a/.github/workflows/container-build.yml
+++ b/.github/workflows/container-build.yml
@@ -37,7 +37,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: sigstore/cosign-installer@d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a # v3.8.1
+      - uses: sigstore/cosign-installer@3454372f43399081ed03b604cb2d021dabca52bb # v3.8.2
 
       - name: Extract version of Go to use
         run: echo "GOVERSION=$(awk -F'[:@]' '/FROM golang/{print $2; exit}' Dockerfile)" >> $GITHUB_ENV
diff --git a/go.mod b/go.mod
index 9918342..40e707c 100644
--- a/go.mod
+++ b/go.mod
@@ -23,7 +23,7 @@ require (
 	github.com/magiconair/properties v1.8.10
 	github.com/prometheus/client_golang v1.22.0
 	github.com/prometheus/client_model v0.6.2
-	github.com/prometheus/common v0.62.0
+	github.com/prometheus/common v0.63.0
 	github.com/rs/cors v1.11.1
 	github.com/sigstore/protobuf-specs v0.4.1
 	github.com/sigstore/sigstore v1.9.3
diff --git a/go.sum b/go.sum
index fa1e213..88569c6 100644
--- a/go.sum
+++ b/go.sum
@@ -280,8 +280,8 @@ github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:
 github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
 github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
 github.com/prometheus/common v0.0.0-20181126121408-4724e9255275/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
-github.com/prometheus/common v0.62.0 h1:xasJaQlnWAeyHdUBeGjXmutelfJHWMRr+Fg4QszZ2Io=
-github.com/prometheus/common v0.62.0/go.mod h1:vyBcEuLSvWos9B1+CyL7JZ2up+uFzXhkqml0W5zIY1I=
+github.com/prometheus/common v0.63.0 h1:YR/EIY1o3mEFP/kZCD7iDMnLPlGyuU2Gb3HIcXnA98k=
+github.com/prometheus/common v0.63.0/go.mod h1:VVFF/fBIoToEnWRVkYoXEkq3R3paCoxG9PXP74SnV18=
 github.com/prometheus/procfs v0.0.0-20181204211112-1dc9a6cbc91a/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
 github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
diff --git a/pkg/config/config.go b/pkg/config/config.go
index 3eda753..22b1120 100644
--- a/pkg/config/config.go
+++ b/pkg/config/config.go
@@ -22,13 +22,13 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"html/template"
 	"net/http"
 	"net/url"
 	"os"
 	"reflect"
 	"regexp"
 	"strings"
+	"text/template"
 	"time"
 
 	"github.com/coreos/go-oidc/v3/oidc"
@@ -526,7 +526,7 @@ func validateCIIssuerMetadata(fulcioConfig *FulcioConfig) error {
 
 	for _, ciIssuerMetadata := range fulcioConfig.CIIssuerMetadata {
 		v := reflect.ValueOf(ciIssuerMetadata.ExtensionTemplates)
-		for i := 0; i < v.NumField(); i++ {
+		for i := range v.NumField() {
 			s := v.Field(i).String()
 			err := checkParse(s)
 			if err != nil {
diff --git a/pkg/identity/ciprovider/principal.go b/pkg/identity/ciprovider/principal.go
index 48ccf1f..9510ac4 100644
--- a/pkg/identity/ciprovider/principal.go
+++ b/pkg/identity/ciprovider/principal.go
@@ -20,19 +20,20 @@ import (
 	"crypto/x509"
 	"encoding/json"
 	"fmt"
-	"html/template"
+	"maps"
 	"math"
 	"net/url"
 	"reflect"
 	"strconv"
 	"strings"
+	"text/template"
 
 	"github.com/coreos/go-oidc/v3/oidc"
 	"github.com/sigstore/fulcio/pkg/config"
 	"github.com/sigstore/fulcio/pkg/identity"
 )
 
-func mapValuesToString(claims map[string]interface{}) map[string]string {
+func mapValuesToString(claims map[string]any) map[string]string {
 	newMap := make(map[string]string)
 	for k, v := range claims {
 		vType := reflect.ValueOf(v)
@@ -53,7 +54,7 @@ func mapValuesToString(claims map[string]interface{}) map[string]string {
 }
 
 func getTokenClaims(token *oidc.IDToken) (map[string]string, error) {
-	var tokenClaims map[string]interface{}
+	var tokenClaims map[string]any
 	if err := token.Claims(&tokenClaims); err != nil {
 		return nil, err
 	}
@@ -73,12 +74,8 @@ func applyTemplateOrReplace(
 	// with the default data.
 	// The claimed data will have priority over the default data.
 	mergedData := make(map[string]string)
-	for k, v := range issuerMetadata {
-		mergedData[k] = v
-	}
-	for k, v := range tokenClaims {
-		mergedData[k] = v
-	}
+	maps.Copy(mergedData, issuerMetadata)
+	maps.Copy(mergedData, tokenClaims)
 
 	if strings.Contains(extValueTemplate, "{{") {
 		var doc bytes.Buffer
@@ -165,7 +162,7 @@ func (principal ciPrincipal) Embed(_ context.Context, cert *x509.Certificate) er
 	// Type of the reflect value is needed as it is necessary
 	// for getting the field name.
 	vType := v.Type()
-	for i := 0; i < v.NumField(); i++ {
+	for i := range v.NumField() {
 		s := v.Field(i).String() // value of each field, e.g the template string
 		// We check the field name to avoid to apply the template for the Issuer
 		// Issuer field should always come from the token issuer


Test patch:
diff --git a/pkg/identity/ciprovider/principal_test.go b/pkg/identity/ciprovider/principal_test.go
index 3cb27be..c72b911 100644
--- a/pkg/identity/ciprovider/principal_test.go
+++ b/pkg/identity/ciprovider/principal_test.go
@@ -71,7 +71,7 @@ func TestWorkflowPrincipalFromIDToken(t *testing.T) {
 
 	for name, test := range tests {
 		t.Run(name, func(t *testing.T) {
-			claims, err := json.Marshal(map[string]interface{}{
+			claims, err := json.Marshal(map[string]any{
 				"issuer":                "https://token.actions.githubusercontent.com",
 				"event_name":            "trigger",
 				"sha":                   "sha",
@@ -138,11 +138,11 @@ func withClaims(token *oidc.IDToken, data []byte) {
 
 func TestName(t *testing.T) {
 	tests := map[string]struct {
-		Claims     map[string]interface{}
+		Claims     map[string]any
 		ExpectName string
 	}{
 		`Valid token authenticates with correct claims`: {
-			Claims: map[string]interface{}{
+			Claims: map[string]any{
 				"aud":                   "sigstore",
 				"event_name":            "push",
 				"exp":                   "0",
@@ -216,7 +216,7 @@ func TestName(t *testing.T) {
 
 func TestGetTokenClaims(t *testing.T) {
 
-	tokenClaims := map[string]interface{}{
+	tokenClaims := map[string]any{
 		"aud":                "sigstore",
 		"exp":                "0",
 		"iss":                "https://example.com",
@@ -231,7 +231,7 @@ func TestGetTokenClaims(t *testing.T) {
 
 	tests := map[string]struct {
 		Claim          string
-		InputClaims    map[string]interface{}
+		InputClaims    map[string]any
 		ExpectedResult string
 		ExpectErr      bool
 	}{
@@ -333,6 +333,7 @@ func TestApplyTemplateOrReplace(t *testing.T) {
 		"ref_gitlab":            "main",
 		"ref_type_tag":          "tag",
 		"ref_tag":               "1.0.0",
+		"html_claim":            "<alert()/>",
 		"claim_foo":             "bar",
 	}
 	issuerMetadata := map[string]string{
@@ -352,6 +353,12 @@ func TestApplyTemplateOrReplace(t *testing.T) {
 			ExpectedResult: "https://github.com/sigstore/fulcio/actions/runs/42/attempts/1",
 			ExpectErr:      false,
 		},
+		// Tests fix for https://github.com/pypa/gh-action-pypi-publish/issues/355
+		`Template with HTML`: {
+			Template:       "{{ .html_claim }}",
+			ExpectedResult: "<alert()/>",
+			ExpectErr:      false,
+		},
 		`Empty template`: {
 			Template:       "{{}}",
 			ExpectedResult: "",
@@ -432,7 +439,7 @@ func TestEmbed(t *testing.T) {
 		WantFacts map[string]func(x509.Certificate) error
 		Principal ciPrincipal
 	}{
-		`Github workflow challenge should have all Github workflow extensions and issuer set`: {
+		`GitHub workflow challenge should have all GitHub workflow extensions and issuer set`: {
 			WantFacts: map[string]func(x509.Certificate) error{
 				`Certifificate should have correct issuer`:                       factDeprecatedExtensionIs(asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 57264, 1, 1}, "https://token.actions.githubusercontent.com"),
 				`Certificate has correct trigger extension`:                      factDeprecatedExtensionIs(asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 57264, 1, 2}, "trigger"),
@@ -491,7 +498,7 @@ func TestEmbed(t *testing.T) {
 	for name, test := range tests {
 		t.Run(name, func(t *testing.T) {
 			var cert x509.Certificate
-			claims, err := json.Marshal(map[string]interface{}{
+			claims, err := json.Marshal(map[string]any{
 				"event_name":            "trigger",
 				"sha":                   "sha",
 				"workflow":              "workflowname",