Repository: sigstore/fulcio
Pull request #2021 (2025-04-23 19:06:54)

Bump github.com/prometheus/common from 0.62.0 to 0.63.0
Bumps [github.com/prometheus/common](https://github.com/prometheus/common) from 0.62.0 to 0.63.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/prometheus/common/releases">github.com/prometheus/common's releases</a>.</em></p>
<blockquote>
<h2>v0.63.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Making the map a public variable for promtheus-operator by <a href="https://github.com/dongjiang1989"><code>@​dongjiang1989</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/741">prometheus/common#741</a></li>
<li>setup ossf scorecard and codeql workflows by <a href="https://github.com/mmorel-35"><code>@​mmorel-35</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/564">prometheus/common#564</a></li>
<li>feat(promslog): implement reserved keys, rename duplicates by <a href="https://github.com/tjhop"><code>@​tjhop</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/746">prometheus/common#746</a></li>
<li>Bump golang.org/x/oauth2 from 0.24.0 to 0.25.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/750">prometheus/common#750</a></li>
<li>Bump golang.org/x/net from 0.33.0 to 0.34.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/749">prometheus/common#749</a></li>
<li>Bump google.golang.org/protobuf from 1.36.1 to 1.36.3 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/751">prometheus/common#751</a></li>
<li>promslog: Make AllowedLevel concurrency safe. by <a href="https://github.com/bwplotka"><code>@​bwplotka</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/754">prometheus/common#754</a></li>
<li>Fix typo 'the an' by <a href="https://github.com/petern48"><code>@​petern48</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/752">prometheus/common#752</a></li>
<li>Synchronize common files from prometheus/prometheus by <a href="https://github.com/prombot"><code>@​prombot</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/757">prometheus/common#757</a></li>
<li>build(deps): bump google.golang.org/protobuf from 1.36.3 to 1.36.4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/756">prometheus/common#756</a></li>
<li>build(deps): bump google.golang.org/protobuf from 1.36.4 to 1.36.5 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/761">prometheus/common#761</a></li>
<li>build(deps): bump github.com/google/go-cmp from 0.6.0 to 0.7.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/763">prometheus/common#763</a></li>
<li>build(deps): bump golang.org/x/net from 0.34.0 to 0.35.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/762">prometheus/common#762</a></li>
<li>model: Clarify the purpose of model.NameValidationScheme by <a href="https://github.com/ywwg"><code>@​ywwg</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/765">prometheus/common#765</a></li>
<li>Fix spelling mistake in godoc by <a href="https://github.com/grobinson-grafana"><code>@​grobinson-grafana</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/766">prometheus/common#766</a></li>
<li>Synchronize common files from prometheus/prometheus by <a href="https://github.com/prombot"><code>@​prombot</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/767">prometheus/common#767</a></li>
<li>otlptranslator: Add dependency free package that translates OTLP data into Prometheus metric/label names by <a href="https://github.com/ArthurSens"><code>@​ArthurSens</code></a> in <a href="https://redirect.github.com/prometheus/common/pull/768">prometheus/common#768</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/dongjiang1989"><code>@​dongjiang1989</code></a> made their first contribution in <a href="https://redirect.github.com/prometheus/common/pull/741">prometheus/common#741</a></li>
<li><a href="https://github.com/petern48"><code>@​petern48</code></a> made their first contribution in <a href="https://redirect.github.com/prometheus/common/pull/752">prometheus/common#752</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/prometheus/common/compare/v0.62.0...v0.63.0">https://github.com/prometheus/common/compare/v0.62.0...v0.63.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/prometheus/common/commit/cf3c56f7b7d09d67cb46592c5e930651fd2d296e"><code>cf3c56f</code></a> Merge pull request <a href="https://redirect.github.com/prometheus/common/issues/768">#768</a> from prometheus/otlp-translator</li>
<li><a href="https://github.com/prometheus/common/commit/b35ad995d20d280cd0bc1a30386a4e3bbdc032f5"><code>b35ad99</code></a> Add test case for BuildCompliantMetricName with a metric that starts with a d...</li>
<li><a href="https://github.com/prometheus/common/commit/227989ceacbb831801f90965ed5e8c9c55749774"><code>227989c</code></a> otlptranslator: Add dependency free package that translator OTLP data into Pr...</li>
<li><a href="https://github.com/prometheus/common/commit/a9cc7f7df30d52a26a3937c9d32953ef2bf452c6"><code>a9cc7f7</code></a> Update common Prometheus files (<a href="https://redirect.github.com/prometheus/common/issues/767">#767</a>)</li>
<li><a href="https://github.com/prometheus/common/commit/0decf1fe7a23d909d3f5cd400b76b6d178eef576"><code>0decf1f</code></a> Fix spelling mistake in godoc (<a href="https://redirect.github.com/prometheus/common/issues/766">#766</a>)</li>
<li><a href="https://github.com/prometheus/common/commit/6b9636ca14ecb6f8bb49d70aea6019c4cef93aab"><code>6b9636c</code></a> model: Clarify the purpose of model.NameValidationScheme (<a href="https://redirect.github.com/prometheus/common/issues/765">#765</a>)</li>
<li><a href="https://github.com/prometheus/common/commit/56f6f3853a55cff5c626bc5a04993b3871ff260c"><code>56f6f38</code></a> build(deps): bump golang.org/x/net from 0.34.0 to 0.35.0 (<a href="https://redirect.github.com/prometheus/common/issues/762">#762</a>)</li>
<li><a href="https://github.com/prometheus/common/commit/b516f6d622f0d210e24036fe64e2009fcc44885f"><code>b516f6d</code></a> build(deps): bump github.com/google/go-cmp from 0.6.0 to 0.7.0 (<a href="https://redirect.github.com/prometheus/common/issues/763">#763</a>)</li>
<li><a href="https://github.com/prometheus/common/commit/0db99daa6f43d55a09dbb714fe3173182977bf8f"><code>0db99da</code></a> build(deps): bump google.golang.org/protobuf from 1.36.4 to 1.36.5 (<a href="https://redirect.github.com/prometheus/common/issues/761">#761</a>)</li>
<li><a href="https://github.com/prometheus/common/commit/ca40aa08f025cc1a857cec6d6773363e959b4ea4"><code>ca40aa0</code></a> build(deps): bump google.golang.org/protobuf from 1.36.3 to 1.36.4 (<a href="https://redirect.github.com/prometheus/common/issues/756">#756</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/prometheus/common/compare/v0.62.0...v0.63.0">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/prometheus/common&package-manager=go_modules&previous-version=0.62.0&new-version=0.63.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


Patch:
diff --git a/go.mod b/go.mod
index 9918342..40e707c 100644
--- a/go.mod
+++ b/go.mod
@@ -23,7 +23,7 @@ require (
 	github.com/magiconair/properties v1.8.10
 	github.com/prometheus/client_golang v1.22.0
 	github.com/prometheus/client_model v0.6.2
-	github.com/prometheus/common v0.62.0
+	github.com/prometheus/common v0.63.0
 	github.com/rs/cors v1.11.1
 	github.com/sigstore/protobuf-specs v0.4.1
 	github.com/sigstore/sigstore v1.9.3
diff --git a/go.sum b/go.sum
index fa1e213..88569c6 100644
--- a/go.sum
+++ b/go.sum
@@ -280,8 +280,8 @@ github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:
 github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
 github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
 github.com/prometheus/common v0.0.0-20181126121408-4724e9255275/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
-github.com/prometheus/common v0.62.0 h1:xasJaQlnWAeyHdUBeGjXmutelfJHWMRr+Fg4QszZ2Io=
-github.com/prometheus/common v0.62.0/go.mod h1:vyBcEuLSvWos9B1+CyL7JZ2up+uFzXhkqml0W5zIY1I=
+github.com/prometheus/common v0.63.0 h1:YR/EIY1o3mEFP/kZCD7iDMnLPlGyuU2Gb3HIcXnA98k=
+github.com/prometheus/common v0.63.0/go.mod h1:VVFF/fBIoToEnWRVkYoXEkq3R3paCoxG9PXP74SnV18=
 github.com/prometheus/procfs v0.0.0-20181204211112-1dc9a6cbc91a/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
 github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
diff --git a/pkg/config/config.go b/pkg/config/config.go
index 3eda753..22b1120 100644
--- a/pkg/config/config.go
+++ b/pkg/config/config.go
@@ -22,13 +22,13 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"html/template"
 	"net/http"
 	"net/url"
 	"os"
 	"reflect"
 	"regexp"
 	"strings"
+	"text/template"
 	"time"
 
 	"github.com/coreos/go-oidc/v3/oidc"
@@ -526,7 +526,7 @@ func validateCIIssuerMetadata(fulcioConfig *FulcioConfig) error {
 
 	for _, ciIssuerMetadata := range fulcioConfig.CIIssuerMetadata {
 		v := reflect.ValueOf(ciIssuerMetadata.ExtensionTemplates)
-		for i := 0; i < v.NumField(); i++ {
+		for i := range v.NumField() {
 			s := v.Field(i).String()
 			err := checkParse(s)
 			if err != nil {
diff --git a/pkg/identity/ciprovider/principal.go b/pkg/identity/ciprovider/principal.go
index 48ccf1f..9510ac4 100644
--- a/pkg/identity/ciprovider/principal.go
+++ b/pkg/identity/ciprovider/principal.go
@@ -20,19 +20,20 @@ import (
 	"crypto/x509"
 	"encoding/json"
 	"fmt"
-	"html/template"
+	"maps"
 	"math"
 	"net/url"
 	"reflect"
 	"strconv"
 	"strings"
+	"text/template"
 
 	"github.com/coreos/go-oidc/v3/oidc"
 	"github.com/sigstore/fulcio/pkg/config"
 	"github.com/sigstore/fulcio/pkg/identity"
 )
 
-func mapValuesToString(claims map[string]interface{}) map[string]string {
+func mapValuesToString(claims map[string]any) map[string]string {
 	newMap := make(map[string]string)
 	for k, v := range claims {
 		vType := reflect.ValueOf(v)
@@ -53,7 +54,7 @@ func mapValuesToString(claims map[string]interface{}) map[string]string {
 }
 
 func getTokenClaims(token *oidc.IDToken) (map[string]string, error) {
-	var tokenClaims map[string]interface{}
+	var tokenClaims map[string]any
 	if err := token.Claims(&tokenClaims); err != nil {
 		return nil, err
 	}
@@ -73,12 +74,8 @@ func applyTemplateOrReplace(
 	// with the default data.
 	// The claimed data will have priority over the default data.
 	mergedData := make(map[string]string)
-	for k, v := range issuerMetadata {
-		mergedData[k] = v
-	}
-	for k, v := range tokenClaims {
-		mergedData[k] = v
-	}
+	maps.Copy(mergedData, issuerMetadata)
+	maps.Copy(mergedData, tokenClaims)
 
 	if strings.Contains(extValueTemplate, "{{") {
 		var doc bytes.Buffer
@@ -165,7 +162,7 @@ func (principal ciPrincipal) Embed(_ context.Context, cert *x509.Certificate) er
 	// Type of the reflect value is needed as it is necessary
 	// for getting the field name.
 	vType := v.Type()
-	for i := 0; i < v.NumField(); i++ {
+	for i := range v.NumField() {
 		s := v.Field(i).String() // value of each field, e.g the template string
 		// We check the field name to avoid to apply the template for the Issuer
 		// Issuer field should always come from the token issuer


Test patch:
diff --git a/pkg/identity/ciprovider/principal_test.go b/pkg/identity/ciprovider/principal_test.go
index 3cb27be..c72b911 100644
--- a/pkg/identity/ciprovider/principal_test.go
+++ b/pkg/identity/ciprovider/principal_test.go
@@ -71,7 +71,7 @@ func TestWorkflowPrincipalFromIDToken(t *testing.T) {
 
 	for name, test := range tests {
 		t.Run(name, func(t *testing.T) {
-			claims, err := json.Marshal(map[string]interface{}{
+			claims, err := json.Marshal(map[string]any{
 				"issuer":                "https://token.actions.githubusercontent.com",
 				"event_name":            "trigger",
 				"sha":                   "sha",
@@ -138,11 +138,11 @@ func withClaims(token *oidc.IDToken, data []byte) {
 
 func TestName(t *testing.T) {
 	tests := map[string]struct {
-		Claims     map[string]interface{}
+		Claims     map[string]any
 		ExpectName string
 	}{
 		`Valid token authenticates with correct claims`: {
-			Claims: map[string]interface{}{
+			Claims: map[string]any{
 				"aud":                   "sigstore",
 				"event_name":            "push",
 				"exp":                   "0",
@@ -216,7 +216,7 @@ func TestName(t *testing.T) {
 
 func TestGetTokenClaims(t *testing.T) {
 
-	tokenClaims := map[string]interface{}{
+	tokenClaims := map[string]any{
 		"aud":                "sigstore",
 		"exp":                "0",
 		"iss":                "https://example.com",
@@ -231,7 +231,7 @@ func TestGetTokenClaims(t *testing.T) {
 
 	tests := map[string]struct {
 		Claim          string
-		InputClaims    map[string]interface{}
+		InputClaims    map[string]any
 		ExpectedResult string
 		ExpectErr      bool
 	}{
@@ -333,6 +333,7 @@ func TestApplyTemplateOrReplace(t *testing.T) {
 		"ref_gitlab":            "main",
 		"ref_type_tag":          "tag",
 		"ref_tag":               "1.0.0",
+		"html_claim":            "<alert()/>",
 		"claim_foo":             "bar",
 	}
 	issuerMetadata := map[string]string{
@@ -352,6 +353,12 @@ func TestApplyTemplateOrReplace(t *testing.T) {
 			ExpectedResult: "https://github.com/sigstore/fulcio/actions/runs/42/attempts/1",
 			ExpectErr:      false,
 		},
+		// Tests fix for https://github.com/pypa/gh-action-pypi-publish/issues/355
+		`Template with HTML`: {
+			Template:       "{{ .html_claim }}",
+			ExpectedResult: "<alert()/>",
+			ExpectErr:      false,
+		},
 		`Empty template`: {
 			Template:       "{{}}",
 			ExpectedResult: "",
@@ -432,7 +439,7 @@ func TestEmbed(t *testing.T) {
 		WantFacts map[string]func(x509.Certificate) error
 		Principal ciPrincipal
 	}{
-		`Github workflow challenge should have all Github workflow extensions and issuer set`: {
+		`GitHub workflow challenge should have all GitHub workflow extensions and issuer set`: {
 			WantFacts: map[string]func(x509.Certificate) error{
 				`Certifificate should have correct issuer`:                       factDeprecatedExtensionIs(asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 57264, 1, 1}, "https://token.actions.githubusercontent.com"),
 				`Certificate has correct trigger extension`:                      factDeprecatedExtensionIs(asn1.ObjectIdentifier{1, 3, 6, 1, 4, 1, 57264, 1, 2}, "trigger"),
@@ -491,7 +498,7 @@ func TestEmbed(t *testing.T) {
 	for name, test := range tests {
 		t.Run(name, func(t *testing.T) {
 			var cert x509.Certificate
-			claims, err := json.Marshal(map[string]interface{}{
+			claims, err := json.Marshal(map[string]any{
 				"event_name":            "trigger",
 				"sha":                   "sha",
 				"workflow":              "workflowname",