Repository: sigstore/fulcio
Pull request #2018 (2025-04-23 19:06:44)

Bump sigs.k8s.io/release-utils from 0.9.0 to 0.11.1
Bumps [sigs.k8s.io/release-utils](https://github.com/kubernetes-sigs/release-utils) from 0.9.0 to 0.11.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/kubernetes-sigs/release-utils/releases">sigs.k8s.io/release-utils's releases</a>.</em></p>
<blockquote>
<h2>v0.11.1</h2>
<p>No release notes provided.</p>
<h2>v0.11.0</h2>
<h2>Changes by Kind</h2>
<h3>Feature</h3>
<ul>
<li>Http: Added <code>WithWaitTime</code> and <code>WithMaxWaitTime</code> to allow specifying the HTTP retry wait times. (<a href="https://redirect.github.com/kubernetes-sigs/release-utils/issues/126">#126</a>, <a href="https://github.com/saschagrunert"><code>@​saschagrunert</code></a>) [SIG Release]</li>
</ul>
<h2>Dependencies</h2>
<h3>Added</h3>
<p><em>Nothing has changed.</em></p>
<h3>Changed</h3>
<p><em>Nothing has changed.</em></p>
<h3>Removed</h3>
<p><em>Nothing has changed.</em></p>
<h2>v0.10.0</h2>
<h2>Dependencies</h2>
<h3>Added</h3>
<p><em>Nothing has changed.</em></p>
<h3>Changed</h3>
<ul>
<li>github.com/Azure/go-ansiterm: <a href="https://github.com/Azure/go-ansiterm/compare/306776e...faa5f7b">306776e → faa5f7b</a></li>
<li>github.com/moby/term: <a href="https://github.com/moby/term/compare/v0.5.1...v0.5.2">v0.5.1 → v0.5.2</a></li>
</ul>
<h3>Removed</h3>
<p><em>Nothing has changed.</em></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/kubernetes-sigs/release-utils/commit/16d798b2ea0ae0d3c51740282fd87ff909bcb4c2"><code>16d798b</code></a> Merge pull request <a href="https://redirect.github.com/kubernetes-sigs/release-utils/issues/132">#132</a> from saschagrunert/lint</li>
<li><a href="https://github.com/kubernetes-sigs/release-utils/commit/96f8ac4009301c963a6a6ce477fa9821125c76b2"><code>96f8ac4</code></a> Switch to golangci-lint v2</li>
<li><a href="https://github.com/kubernetes-sigs/release-utils/commit/9aec958a6e9d2cdc25f06e0917174f87a0d573e5"><code>9aec958</code></a> Merge pull request <a href="https://redirect.github.com/kubernetes-sigs/release-utils/issues/131">#131</a> from kubernetes-sigs/dependabot/github_actions/action...</li>
<li><a href="https://github.com/kubernetes-sigs/release-utils/commit/bfc6f685abfad006539103dcab0e6982d848989d"><code>bfc6f68</code></a> build(deps): bump actions/setup-go in the actions group</li>
<li><a href="https://github.com/kubernetes-sigs/release-utils/commit/4873467be9da7142735da1aaa742f1e434432e3c"><code>4873467</code></a> Merge pull request <a href="https://redirect.github.com/kubernetes-sigs/release-utils/issues/130">#130</a> from cpanato/updates</li>
<li><a href="https://github.com/kubernetes-sigs/release-utils/commit/538d777e3ea18eb6b24cfe9f982d2e25ab14de56"><code>538d777</code></a> update external deps</li>
<li><a href="https://github.com/kubernetes-sigs/release-utils/commit/3d31c3671708a61fe276766549e9b68ff84d56ae"><code>3d31c36</code></a> update dependencies</li>
<li><a href="https://github.com/kubernetes-sigs/release-utils/commit/f6de01024ea1f7e75599a6c64a7887edc78374b9"><code>f6de010</code></a> bump cosign and golanci-lint</li>
<li><a href="https://github.com/kubernetes-sigs/release-utils/commit/9c55b4eac4bcff18c62fb22548fc65fde314848f"><code>9c55b4e</code></a> Merge pull request <a href="https://redirect.github.com/kubernetes-sigs/release-utils/issues/129">#129</a> from kubernetes-sigs/dependabot/go_modules/all-3cc2e6...</li>
<li><a href="https://github.com/kubernetes-sigs/release-utils/commit/0444df04661126455e81c8bb8f4ecd79740020d3"><code>0444df0</code></a> build(deps): bump github.com/avast/retry-go/v4 in the all group</li>
<li>Additional commits viewable in <a href="https://github.com/kubernetes-sigs/release-utils/compare/v0.9.0...v0.11.1">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=sigs.k8s.io/release-utils&package-manager=go_modules&previous-version=0.9.0&new-version=0.11.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


Patch:
diff --git a/.github/workflows/container-build.yml b/.github/workflows/container-build.yml
index d19ca1a..b5e7da1 100644
--- a/.github/workflows/container-build.yml
+++ b/.github/workflows/container-build.yml
@@ -37,7 +37,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: sigstore/cosign-installer@d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a # v3.8.1
+      - uses: sigstore/cosign-installer@3454372f43399081ed03b604cb2d021dabca52bb # v3.8.2
 
       - name: Extract version of Go to use
         run: echo "GOVERSION=$(awk -F'[:@]' '/FROM golang/{print $2; exit}' Dockerfile)" >> $GITHUB_ENV
diff --git a/go.mod b/go.mod
index 9918342..4979540 100644
--- a/go.mod
+++ b/go.mod
@@ -23,7 +23,7 @@ require (
 	github.com/magiconair/properties v1.8.10
 	github.com/prometheus/client_golang v1.22.0
 	github.com/prometheus/client_model v0.6.2
-	github.com/prometheus/common v0.62.0
+	github.com/prometheus/common v0.63.0
 	github.com/rs/cors v1.11.1
 	github.com/sigstore/protobuf-specs v0.4.1
 	github.com/sigstore/sigstore v1.9.3
@@ -31,7 +31,7 @@ require (
 	github.com/sigstore/sigstore/pkg/signature/kms/azure v1.9.3
 	github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.9.3
 	github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.8.12
-	github.com/spf13/cobra v1.8.1
+	github.com/spf13/cobra v1.9.1
 	github.com/spf13/pflag v1.0.6
 	github.com/spf13/viper v1.20.1
 	github.com/spiffe/go-spiffe/v2 v2.5.0
@@ -47,7 +47,7 @@ require (
 	google.golang.org/grpc v1.71.1
 	google.golang.org/protobuf v1.36.6
 	gopkg.in/yaml.v3 v3.0.1
-	sigs.k8s.io/release-utils v0.9.0
+	sigs.k8s.io/release-utils v0.11.1
 )
 
 require (
diff --git a/go.sum b/go.sum
index fa1e213..6e41f49 100644
--- a/go.sum
+++ b/go.sum
@@ -104,7 +104,7 @@ github.com/common-nighthawk/go-figure v0.0.0-20210622060536-734e95fb86be h1:J5BL
 github.com/common-nighthawk/go-figure v0.0.0-20210622060536-734e95fb86be/go.mod h1:mk5IQ+Y0ZeO87b858TlA645sVcEcbiX6YqP98kt+7+w=
 github.com/coreos/go-oidc/v3 v3.14.1 h1:9ePWwfdwC4QKRlCXsJGou56adA/owXczOzwKdOumLqk=
 github.com/coreos/go-oidc/v3 v3.14.1/go.mod h1:HaZ3szPaZ0e4r6ebqvsLWlk2Tn+aejfmrfah6hnSYEU=
-github.com/cpuguy83/go-md2man/v2 v2.0.4/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
@@ -280,8 +280,8 @@ github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:
 github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
 github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
 github.com/prometheus/common v0.0.0-20181126121408-4724e9255275/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
-github.com/prometheus/common v0.62.0 h1:xasJaQlnWAeyHdUBeGjXmutelfJHWMRr+Fg4QszZ2Io=
-github.com/prometheus/common v0.62.0/go.mod h1:vyBcEuLSvWos9B1+CyL7JZ2up+uFzXhkqml0W5zIY1I=
+github.com/prometheus/common v0.63.0 h1:YR/EIY1o3mEFP/kZCD7iDMnLPlGyuU2Gb3HIcXnA98k=
+github.com/prometheus/common v0.63.0/go.mod h1:VVFF/fBIoToEnWRVkYoXEkq3R3paCoxG9PXP74SnV18=
 github.com/prometheus/procfs v0.0.0-20181204211112-1dc9a6cbc91a/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
 github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
@@ -326,9 +326,8 @@ github.com/spf13/afero v1.12.0 h1:UcOPyRBYczmFn6yvphxkn9ZEOY65cpwGKb5mL36mrqs=
 github.com/spf13/afero v1.12.0/go.mod h1:ZTlWwG4/ahT8W7T0WQ5uYmjI9duaLQGy3Q2OAl4sk/4=
 github.com/spf13/cast v1.7.1 h1:cuNEagBQEHWN1FnbGEjCXL2szYEXqfJPbP2HNUaca9Y=
 github.com/spf13/cast v1.7.1/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
-github.com/spf13/cobra v1.8.1 h1:e5/vxKd/rZsfSJMUX1agtjeTDf+qv1/JdBF8gg5k9ZM=
-github.com/spf13/cobra v1.8.1/go.mod h1:wHxEcudfqmLYa8iTfL+OuZPbBZkmvliBWKIezN3kD9Y=
-github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
+github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
 github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
 github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/viper v1.20.1 h1:ZMi+z/lvLyPSCoNtFCpqjy0S4kPbirhpTMwl8BkW9X4=
@@ -537,5 +536,5 @@ honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
 k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
-sigs.k8s.io/release-utils v0.9.0 h1:+JYA8E5YXzVj2Eh929woeRn1U82vLUQbpqKsgZPEmEo=
-sigs.k8s.io/release-utils v0.9.0/go.mod h1:xZoCJyajMJ0wtgGXWuznbC1r9dw7iJzMp/+dCkf1UGw=
+sigs.k8s.io/release-utils v0.11.1 h1:hzvXGpHgHJfLOJB6TRuu14bzWc3XEglHmXHJqwClSZE=
+sigs.k8s.io/release-utils v0.11.1/go.mod h1:ybR2V/uQAOGxYfzYtBenSYeXWkBGNP2qnEiX77ACtpc=
diff --git a/pkg/config/config.go b/pkg/config/config.go
index 3eda753..22b1120 100644
--- a/pkg/config/config.go
+++ b/pkg/config/config.go
@@ -22,13 +22,13 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"html/template"
 	"net/http"
 	"net/url"
 	"os"
 	"reflect"
 	"regexp"
 	"strings"
+	"text/template"
 	"time"
 
 	"github.com/coreos/go-oidc/v3/oidc"
@@ -526,7 +526,7 @@ func validateCIIssuerMetadata(fulcioConfig *FulcioConfig) error {
 
 	for _, ciIssuerMetadata := range fulcioConfig.CIIssuerMetadata {
 		v := reflect.ValueOf(ciIssuerMetadata.ExtensionTemplates)
-		for i := 0; i < v.NumField(); i++ {
+		for i := range v.NumField() {
 			s := v.Field(i).String()
 			err := checkParse(s)
 			if err != nil {
diff --git a/pkg/identity/ciprovider/principal.go b/pkg/identity/ciprovider/principal.go
index 48ccf1f..9510ac4 100644
--- a/pkg/identity/ciprovider/principal.go
+++ b/pkg/identity/ciprovider/principal.go
@@ -20,19 +20,20 @@ import (
 	"crypto/x509"
 	"encoding/json"
 	"fmt"
-	"html/template"
+	"maps"
 	"math"
 	"net/url"
 	"reflect"
 	"strconv"
 	"strings"
+	"text/template"
 
 	"github.com/coreos/go-oidc/v3/oidc"
 	"github.com/sigstore/fulcio/pkg/config"
 	"github.com/sigstore/fulcio/pkg/identity"
 )
 
-func mapValuesToString(claims map[string]interface{}) map[string]string {
+func mapValuesToString(claims map[string]any) map[string]string {
 	newMap := make(map[string]string)
 	for k, v := range claims {
 		vType := reflect.ValueOf(v)
@@ -53,7 +54,7 @@ func mapValuesToString(claims map[string]interface{}) map[string]string {
 }
 
 func getTokenClaims(token *oidc.IDToken) (map[string]string, error) {
-	var tokenClaims map[string]interface{}
+	var tokenClaims map[string]any
 	if err := token.Claims(&tokenClaims); err != nil {
 		return nil, err
 	}
@@ -73,12 +74,8 @@ func applyTemplateOrReplace(
 	// with the default data.
 	// The claimed data will have priority over the default data.
 	mergedData := make(map[string]string)
-	for k, v := range issuerMetadata {
-		mergedData[k] = v
-	}
-	for k, v := range tokenClaims {
-		mergedData[k] = v
-	}
+	maps.Copy(mergedData, issuerMetadata)
+	maps.Copy(mergedData, tokenClaims)
 
 	if strings.Contains(extValueTemplate, "{{") {
 		var doc bytes.Buffer
@@ -165,7 +162,7 @@ func (principal ciPrincipal) Embed(_ context.Context, cert *x509.Certificate) er
 	// Type of the reflect value is needed as it is necessary
 	// for getting the field name.
 	vType := v.Type()
-	for i := 0; i < v.NumField(); i++ {
+	for i := range v.NumField() {
 		s := v.Field(i).String() // value of each field, e.g the template string
 		// We check the field name to avoid to apply the template for the Issuer
 		// Issuer field should always come from the token issuer


Test patch:
diff --git a/pkg/identity/ciprovider/principal_test.go b/pkg/identity/ciprovider/principal_test.go
index 3cb27be..c72b911 100644
--- a/pkg/identity/ciprovider/principal_test.go
+++ b/pkg/identity/ciprovider/principal_test.go
@@ -71,7 +71,7 @@ func TestWorkflowPrincipalFromIDToken(t *testing.T) {
 
 	for name, test := range tests {
 		t.Run(name, func(t *testing.T) {
-			claims, err := json.Marshal(map[string]interface{}{
+			claims, err := json.Marshal(map[string]any{
 				"issuer":                "https://token.actions.githubusercontent.com",
 				"event_name":            "trigger",
 				"sha":                   "sha",
@@ -138,11 +138,11 @@ func withClaims(token *oidc.IDToken, data []byte) {
 
 func TestName(t *testing.T) {
 	tests := map[string]struct {
-		Claims     map[string]interface{}
+		Claims     map[string]any
 		ExpectName string
 	}{
 		`Valid token authenticates with correct claims`: {
-			Claims: map[string]interface{}{
+			Claims: map[string]any{
 				"aud":                   "sigstore",
 				"event_name":            "push",
 				"exp":                   "0",
@@ -216,7 +216,7 @@ func TestName(t *testing.T) {
 
 func TestGetTokenClaims(t *testing.T) {
 
-	tokenClaims := map[string]interface{}{
+	tokenClaims := map[string]any{
 		"aud":                "sigstore",
 		"exp":                "0",
 		"iss":                "https://example.com",
@@ -231,7 +231,7 @@ func TestGetTokenClaims(t *testing.T) {
 
 	tests := map[string]struct {
 		Claim          string
-		InputClaims    map[string]interface{}
+		InputClaims    map[string]any
 		ExpectedResult string
 		ExpectErr      bool
 	}{
@@ -333,6 +333,7 @@ func TestApplyTemplateOrReplace(t *testing.T) {
 		"ref_gitlab":            "main",
 		"ref_type_tag":          "tag",
 		"ref_tag":               "1.0.0",
+		"html_claim":            "<alert()/>",
 		"claim_foo":             "bar",
 	}
 	issuerMetadata := map[string]string{
@@ -352,6 +353,12 @@ func TestApplyTemplateOrReplace(t *testing.T) {
 			ExpectedResult: "https://github.com/sigstore/fulcio/actions/runs/42/attempts/1",
 			ExpectErr:      false,
 		},
+		// Tests fix for https://github.com/pypa/gh-action-pypi-publish/issues/355
+		`Template with HTML`: {
+			Template:       "{{ .html_claim }}",
+			ExpectedResult: "<alert()/>",
+			ExpectErr:      false,
+		},
 		`Empty template`: {
 			Template:       "{{}}",
 			ExpectedResult: "",
@@ -432,7 +439,7 @@ func TestEmbed(t *testing.T) {
 		WantFacts map[string]func(x509.Certificate) error
 		Principal ciPrincipal
 	}{
-		`Github workflow challenge should have all Github workflow extensions and issuer set`: {
+		`GitHub workflow challenge should have all GitHub workflow extensions and issuer set`: {
 			WantFacts: map[string]func(x509.Certificate) error{
 				`Certifificate should have correct issuer`:                       factDeprecatedExtensionIs(asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 57264, 1, 1}, "https://token.actions.githubusercontent.com"),
 				`Certificate has correct trigger extension`:                      factDeprecatedExtensionIs(asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 57264, 1, 2}, "trigger"),
@@ -491,7 +498,7 @@ func TestEmbed(t *testing.T) {
 	for name, test := range tests {
 		t.Run(name, func(t *testing.T) {
 			var cert x509.Certificate
-			claims, err := json.Marshal(map[string]interface{}{
+			claims, err := json.Marshal(map[string]any{
 				"event_name":            "trigger",
 				"sha":                   "sha",
 				"workflow":              "workflowname",