Repository: sigstore/rekor
Pull request #1362 (2023-02-27 12:00:52)

build(deps): bump github.com/in-toto/in-toto-golang from 0.3.4-0.20211211042327-af1f9fb822bf to 0.7.0
Bumps [github.com/in-toto/in-toto-golang](https://github.com/in-toto/in-toto-golang) from 0.3.4-0.20211211042327-af1f9fb822bf to 0.7.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/in-toto/in-toto-golang/releases">github.com/in-toto/in-toto-golang's releases</a>.</em></p>
<blockquote>
<h2>v0.7.0</h2>
<p><strong>NOTE: This release changes the interface of <code>DSSESigner.SignPayload</code> and <code>DSSESigner.Verify</code> due to a change in go-securesystemslib.</strong></p>
<p>For more information, see <a href="https://github-redirect.dependabot.com/in-toto/in-toto-golang/pull/206">in-toto/in-toto-golang#206</a> and <a href="https://github-redirect.dependabot.com/secure-systems-lab/go-securesystemslib/pull/34">secure-systems-lab/go-securesystemslib#34</a>.</p>
<h2>v0.6.0</h2>
<ul>
<li>Updates symlink handling to more closely mirror Python implementation (<a href="https://github-redirect.dependabot.com/in-toto/in-toto-golang/issues/194">#194</a>), adds parameter to <code>InTotoRun</code> and <code>InTotoRecord</code> APIs</li>
<li>Various dependency updates</li>
<li>Clean up of readme</li>
</ul>
<h2>v0.5.0</h2>
<p><strong>Since v0.4.0, we've welcomed Parth Patel (<a href="https://github.com/pxp928"><code>@​pxp928</code></a>) as a maintainer of in-toto-golang!</strong></p>
<ul>
<li>Adds Godoc documentation for SLSA Provenance v0.2 fields (<a href="https://github.com/wlynch"><code>@​wlynch</code></a>)</li>
<li>Updates CycloneDX predicate type (<a href="https://github.com/lehors"><code>@​lehors</code></a>)</li>
<li>Adds ability to use <code>InTotoRun</code> without a command (<a href="https://github.com/shibumi"><code>@​shibumi</code></a>, <a href="https://github.com/adityasaky"><code>@​adityasaky</code></a>)</li>
</ul>
<h2>v0.4.0</h2>
<p><strong>This release includes the changes introduced in v0.4.0-prerelease and some more changes. The changelog includes all the changes since v0.3.3.</strong></p>
<ul>
<li>Removes DSSE code and moves it to <a href="https://github.com/secure-systems-lab/go-securesystemslib">https://github.com/secure-systems-lab/go-securesystemslib</a> (<a href="https://github.com/shibumi"><code>@​shibumi</code></a>)</li>
<li>Uses go-securesystemslib for canonical JSON</li>
<li>Adds SPIFFE integration (<a href="https://github.com/pxp928"><code>@​pxp928</code></a>, <a href="https://github.com/mikhailswift"><code>@​mikhailswift</code></a>)</li>
<li>Re-organizes SLSA provenance formats based on versioning, adds v0.2 (<a href="https://github.com/priyawadhwa"><code>@​priyawadhwa</code></a>), makes provenance API version explicit (<a href="https://github.com/chuangw6"><code>@​chuangw6</code></a>)</li>
<li>Adds CycloneDX predicate (<a href="https://github.com/puerco"><code>@​puerco</code></a>)</li>
</ul>
<h2>v0.4.0-prerelease</h2>
<p><strong>This is a prerelease of v0.4.0, cut from the <code>next</code> branch. v0.4.0 will follow when some <code>next</code>-only features are merged into <code>master</code>.</strong></p>
<ul>
<li>Removes DSSE code and moves it to <a href="https://github.com/secure-systems-lab/go-securesystemslib">https://github.com/secure-systems-lab/go-securesystemslib</a> (<a href="https://github.com/shibumi"><code>@​shibumi</code></a>)</li>
<li>Adds SPIFFE integration (<a href="https://github.com/pxp928"><code>@​pxp928</code></a>, <a href="https://github.com/mikhailswift"><code>@​mikhailswift</code></a>)</li>
<li>Re-organizes SLSA provenance formats based on versioning, adds v0.2 (<a href="https://github.com/priyawadhwa"><code>@​priyawadhwa</code></a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a href="https://github.com/in-toto/in-toto-golang/commits/v0.7.0">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/in-toto/in-toto-golang&package-manager=go_modules&previous-version=0.3.4-0.20211211042327-af1f9fb822bf&new-version=0.7.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>

asraa: Requires a sigstore/sigstore update as well: https://github.com/sigstore/sigstore/blob/6ad37d69e1a924dc6acacd15cb7d3ffde09971db/pkg/signature/dsse/adapters.go
cpanato: @bobcallaway @asraa PTAL

Patch:
diff --git a/Dockerfile b/Dockerfile
index c21a1e7..f941ed7 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -13,7 +13,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM golang:1.20.1@sha256:2edf6aab2d57644f3fe7407132a0d1770846867465a39c2083770cf62734b05d AS builder
+FROM golang:1.20.1@sha256:13cc469331206a70ef5194ad85644ca81324d4f04ef6df3bf13500c99856de1d AS builder
 ENV APP_ROOT=/opt/app-root
 ENV GOPATH=$APP_ROOT
 
@@ -31,7 +31,7 @@ RUN CGO_ENABLED=0 go build -gcflags "all=-N -l" -ldflags "${SERVER_LDFLAGS}" -o
 RUN go test -c -ldflags "${SERVER_LDFLAGS}" -cover -covermode=count -coverpkg=./... -o rekor-server_test ./cmd/rekor-server
 
 # Multi-Stage production build
-FROM golang:1.20.1@sha256:2edf6aab2d57644f3fe7407132a0d1770846867465a39c2083770cf62734b05d as deploy
+FROM golang:1.20.1@sha256:13cc469331206a70ef5194ad85644ca81324d4f04ef6df3bf13500c99856de1d as deploy
 
 # Retrieve the binary from the previous stage
 COPY --from=builder /opt/app-root/src/rekor-server /usr/local/bin/rekor-server
diff --git a/go.mod b/go.mod
index ba1e254..ab5e65d 100644
--- a/go.mod
+++ b/go.mod
@@ -20,7 +20,7 @@ require (
 	github.com/google/go-cmp v0.5.9
 	github.com/google/rpmpack v0.0.0-20210518075352-dc539ef4f2ea
 	github.com/google/trillian v1.5.1
-	github.com/in-toto/in-toto-golang v0.3.4-0.20211211042327-af1f9fb822bf
+	github.com/in-toto/in-toto-golang v0.7.0
 	github.com/jedisct1/go-minisign v0.0.0-20211028175153-1c139d1cc84b
 	github.com/mediocregopher/radix/v4 v4.1.2
 	github.com/mitchellh/go-homedir v1.1.0
@@ -29,8 +29,8 @@ require (
 	github.com/prometheus/client_golang v1.14.0
 	github.com/rs/cors v1.8.3
 	github.com/sassoftware/relic v0.0.0-20210427151427-dfb082b79b74
-	github.com/secure-systems-lab/go-securesystemslib v0.4.0
-	github.com/sigstore/sigstore v1.5.2
+	github.com/secure-systems-lab/go-securesystemslib v0.5.0
+	github.com/sigstore/sigstore v1.6.0
 	github.com/spf13/cobra v1.6.1
 	github.com/spf13/pflag v1.0.5
 	github.com/spf13/viper v1.15.0
diff --git a/go.sum b/go.sum
index 0a26494..ac160ef 100644
--- a/go.sum
+++ b/go.sum
@@ -538,9 +538,9 @@ github.com/aws/aws-sdk-go-v2 v1.17.5 h1:TzCUW1Nq4H8Xscph5M/skINUitxM5UBAyvm2s7XB
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.9 h1:RKci2D7tMwpvGpDNZnGQw9wk6v7o/xSwFcUAuNPoB8k=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.9/go.mod h1:vCmV1q1VK8eoQJ5+aYE7PkK1K6v41qJ5pJdK3ggCDvg=
 github.com/aws/aws-sdk-go-v2/config v1.18.3/go.mod h1:BYdrbeCse3ZnOD5+2/VE/nATOK8fEUpBtmPMdKSyhMU=
-github.com/aws/aws-sdk-go-v2/config v1.18.14 h1:rI47jCe0EzuJlAO5ptREe3LIBAyP5c7gR3wjyYVjuOM=
+github.com/aws/aws-sdk-go-v2/config v1.18.15 h1:509yMO0pJUGUugBP2H9FOFyV+7Mz7sRR+snfDN5W4NY=
 github.com/aws/aws-sdk-go-v2/credentials v1.13.3/go.mod h1:/rOMmqYBcFfNbRPU0iN9IgGqD5+V2yp3iWNmIlz0wI4=
-github.com/aws/aws-sdk-go-v2/credentials v1.13.14 h1:jE34fUepssrhmYpvPpdbd+d39PHpuignDpNPNJguP60=
+github.com/aws/aws-sdk-go-v2/credentials v1.13.15 h1:0rZQIi6deJFjOEgHI9HI2eZcLPPEGQPictX66oRFLL8=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.19/go.mod h1:VihW95zQpeKQWVPGkwT+2+WJNQV8UXFfMTWdU6VErL8=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.23 h1:Kbiv9PGnQfG/imNI4L/heyUXvzKmcWSBeDvkrQz5pFc=
 github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.42 h1:bxgBYvvBh+W1RnNYP4ROXEB8N+HSSucDszfE7Rb+kfU=
@@ -562,7 +562,7 @@ github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.23 h1:QoOybhwRf
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.13.19 h1:piDBAaWkaxkkVV3xJJbTehXCZRXYs49kvpi/LG6LR2o=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.13.19/go.mod h1:BmQWRVkLTmyNzYPFAZgon53qKLWBNSvonugD1MrSWUs=
 github.com/aws/aws-sdk-go-v2/service/kms v1.19.0/go.mod h1:kZodDPTQjSH/qM6/OvyTfM5mms5JHB/EKYp5dhn/vI4=
-github.com/aws/aws-sdk-go-v2/service/kms v1.20.4 h1:FOY3JSIwgItCdaeuLKjtijD8Enx6BHy5nSS/V6COOeA=
+github.com/aws/aws-sdk-go-v2/service/kms v1.20.5 h1:HKBjhFr7yVOYWTBmYmIHSHyLwmybF0ly7sPCBn/OiJk=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.29.4 h1:QgmmWifaYZZcpaw3y1+ccRlgH6jAvLm4K/MBGUc7cNM=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.29.4/go.mod h1:/NHbqPRiwxSPVOB2Xr+StDEH+GWV/64WwnUjv4KYzV0=
 github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.16.8/go.mod h1:k6CPuxyzO247nYEM1baEwHH1kRtosRCvgahAepaaShw=
@@ -570,11 +570,11 @@ github.com/aws/aws-sdk-go-v2/service/sns v1.18.6/go.mod h1:2cPUjR63iE9MPMPJtSyzY
 github.com/aws/aws-sdk-go-v2/service/sqs v1.19.15/go.mod h1:DKX/7/ZiAzHO6p6AhArnGdrV4r+d461weby8KeVtvC4=
 github.com/aws/aws-sdk-go-v2/service/ssm v1.33.1/go.mod h1:rEsqsZrOp9YvSGPOrcL3pR9+i/QJaWRkAYbuxMa7yCU=
 github.com/aws/aws-sdk-go-v2/service/sso v1.11.25/go.mod h1:IARHuzTXmj1C0KS35vboR0FeJ89OkEy1M9mWbK2ifCI=
-github.com/aws/aws-sdk-go-v2/service/sso v1.12.3 h1:bUeZTWfF1vBdZnoNnnq70rB/CzdZD7NR2Jg2Ax+rvjA=
+github.com/aws/aws-sdk-go-v2/service/sso v1.12.4 h1:qJdM48OOLl1FBSzI7ZrA1ZfLwOyCYqkXV5lko1hYDBw=
 github.com/aws/aws-sdk-go-v2/service/ssooidc v1.13.8/go.mod h1:er2JHN+kBY6FcMfcBBKNGCT3CarImmdFzishsqBmSRI=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.3 h1:G/+7NUi+q+H0LG3v32jfV4OkaQIcpI92g0owbXKk6NY=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.4 h1:YRkWXQveFb0tFC0TLktmmhGsOcCgLwvq88MC2al47AA=
 github.com/aws/aws-sdk-go-v2/service/sts v1.17.5/go.mod h1:bXcN3koeVYiJcdDU89n3kCYILob7Y34AeLopUbZgLT4=
-github.com/aws/aws-sdk-go-v2/service/sts v1.18.4 h1:j0USUNbl9c/8tBJ8setEbwxc7wva0WyoeAaFRiyTUT8=
+github.com/aws/aws-sdk-go-v2/service/sts v1.18.5 h1:L1600eLr0YvTT7gNh3Ni24yGI7NSHkq9Gp62vijPRCs=
 github.com/aws/smithy-go v1.13.4/go.mod h1:Tg+OJXh4MB2R/uN61Ko2f6hTZwB/ZYGOtib8J3gBHzA=
 github.com/aws/smithy-go v1.13.5 h1:hgz0X/DX0dGqTYpGALqXJoRKRj5oQ7150i5FdTePzO8=
 github.com/beevik/etree v1.1.0/go.mod h1:r8Aw8JqVegEf0w2fDnATrX9VpkMcyFeM0FhwO62wh+A=
@@ -1304,8 +1304,8 @@ github.com/imdario/mergo v0.3.8/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJ
 github.com/imdario/mergo v0.3.10/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
 github.com/imdario/mergo v0.3.11/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
 github.com/imdario/mergo v0.3.12/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
-github.com/in-toto/in-toto-golang v0.3.4-0.20211211042327-af1f9fb822bf h1:FU8tuL4IWx/Hq55AO4+13AZn3Kd6uk3Z44OCIZ9coTw=
-github.com/in-toto/in-toto-golang v0.3.4-0.20211211042327-af1f9fb822bf/go.mod h1:twl9XmClqj6/h/HANQQYaJZVKPPW/Mz53bd2t6UXGQA=
+github.com/in-toto/in-toto-golang v0.7.0 h1:sSTxj28v8vEx7d7KB7pWfS5bkR9qB+6Zuee0cwW5v94=
+github.com/in-toto/in-toto-golang v0.7.0/go.mod h1:uL5siwLtGflIjlgOPh5j+GBKulIy+UL+LVDpe5d1AeM=
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
 github.com/inconshreveable/mousetrap v1.0.1 h1:U3uMjPSQEBMNp1lFxmllqCPM6P5u/Xq7Pgzkat/bFNc=
 github.com/inconshreveable/mousetrap v1.0.1/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
@@ -1745,8 +1745,8 @@ github.com/sclevine/spec v1.2.0/go.mod h1:W4J29eT/Kzv7/b9IWLB055Z+qvVC9vt0Arko24
 github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
 github.com/seccomp/libseccomp-golang v0.9.1/go.mod h1:GbW5+tmTXfcxTToHLXlScSlAvWlF4P2Ca7zGrPiEpWo=
 github.com/seccomp/libseccomp-golang v0.9.2-0.20210429002308-3879420cc921/go.mod h1:JA8cRccbGaA1s33RQf7Y1+q9gHmZX1yB/z9WDN1C6fg=
-github.com/secure-systems-lab/go-securesystemslib v0.4.0 h1:b23VGrQhTA8cN2CbBw7/FulN9fTtqYUdS5+Oxzt+DUE=
-github.com/secure-systems-lab/go-securesystemslib v0.4.0/go.mod h1:FGBZgq2tXWICsxWQW1msNf49F0Pf2Op5Htayx335Qbs=
+github.com/secure-systems-lab/go-securesystemslib v0.5.0 h1:oTiNu0QnulMQgN/hLK124wJD/r2f9ZhIUuKIeBsCBT8=
+github.com/secure-systems-lab/go-securesystemslib v0.5.0/go.mod h1:uoCqUC0Ap7jrBSEanxT+SdACYJTVplRXWLkGMuDjXqk=
 github.com/shibumi/go-pathspec v1.3.0 h1:QUyMZhFo0Md5B8zV8x2tesohbb5kfbpTi9rBnKh5dkI=
 github.com/shibumi/go-pathspec v1.3.0/go.mod h1:Xutfslp817l2I1cZvgcfeMQJG5QnU2lh5tVaaMCl3jE=
 github.com/shoenig/test v0.4.3/go.mod h1:xYtyGBC5Q3kzCNyJg/SjgNpfAa2kvmgA0i5+lQso8x0=
@@ -1755,8 +1755,8 @@ github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFR
 github.com/shurcooL/httpfs v0.0.0-20190707220628-8d4bc4ba7749/go.mod h1:ZY1cvUeJuFPAdZ/B6v7RHavJWZn2YPVFQ1OSXhCGOkg=
 github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
 github.com/shurcooL/vfsgen v0.0.0-20200824052919-0d455de96546/go.mod h1:TrYk7fJVaAttu97ZZKrO9UbRa8izdowaMIZcxYMbVaw=
-github.com/sigstore/sigstore v1.5.2 h1:rvZSPJDH2ysoc8kjW9v4nv1UX3XwSA8y4x6Dk7hA0D4=
-github.com/sigstore/sigstore v1.5.2/go.mod h1:wxhp9KoaOpeb1VLKILruD283KJqPSqX+3TuBByVDZ6E=
+github.com/sigstore/sigstore v1.6.0 h1:0fYHVoUlPU3WM8o3U1jT9SI2lqQE68XbG+qWncXaZC8=
+github.com/sigstore/sigstore v1.6.0/go.mod h1:+55pf6HZ15kf60c08W+GH95JQbAcnVyUBquQGSVdsto=
 github.com/sirupsen/logrus v1.0.4-0.20170822132746-89742aefa4b2/go.mod h1:pMByvHTf9Beacp5x1UXfOR9xyW/9antXMhjMPG0dEzc=
 github.com/sirupsen/logrus v1.0.6/go.mod h1:pMByvHTf9Beacp5x1UXfOR9xyW/9antXMhjMPG0dEzc=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
diff --git a/pkg/types/intoto/v0.0.2/entry.go b/pkg/types/intoto/v0.0.2/entry.go
index a798ef0..083e937 100644
--- a/pkg/types/intoto/v0.0.2/entry.go
+++ b/pkg/types/intoto/v0.0.2/entry.go
@@ -294,7 +294,7 @@ func (v *verifier) Public() crypto.PublicKey {
 	return nil
 }
 
-func (v *verifier) Sign(data []byte) (sig []byte, err error) {
+func (v *verifier) Sign(_ context.Context, data []byte) (sig []byte, err error) {
 	if v.s == nil {
 		return nil, errors.New("nil signer")
 	}
@@ -305,7 +305,7 @@ func (v *verifier) Sign(data []byte) (sig []byte, err error) {
 	return sig, nil
 }
 
-func (v *verifier) Verify(data, sig []byte) error {
+func (v *verifier) Verify(_ context.Context, data, sig []byte) error {
 	if v.v == nil {
 		return errors.New("nil verifier")
 	}
@@ -430,7 +430,7 @@ func verifyEnvelope(allPubKeyBytes [][]byte, env *dsse.Envelope) (map[string]*x5
 			return nil, fmt.Errorf("could not use public key as a dsse verifier: %w", err)
 		}
 
-		accepted, err := dsseVfr.Verify(env)
+		accepted, err := dsseVfr.Verify(context.Background(), env)
 		if err != nil {
 			return nil, fmt.Errorf("could not verify envelope: %w", err)
 		}


Test patch:
diff --git a/pkg/pki/x509/e2e.go b/pkg/pki/x509/e2e.go
index e15cb7c..62a4599 100644
--- a/pkg/pki/x509/e2e.go
+++ b/pkg/pki/x509/e2e.go
@@ -20,6 +20,7 @@ package x509
 
 import (
 	"bytes"
+	"context"
 	"crypto"
 	"crypto/rand"
 	"crypto/rsa"
@@ -173,7 +174,7 @@ func (v *Verifier) Public() crypto.PublicKey {
 	return v.v.PublicKey
 }
 
-func (v *Verifier) Sign(data []byte) (sig []byte, err error) {
+func (v *Verifier) Sign(_ context.Context, data []byte) (sig []byte, err error) {
 	if v.S == nil {
 		return nil, errors.New("nil signer")
 	}
@@ -184,7 +185,7 @@ func (v *Verifier) Sign(data []byte) (sig []byte, err error) {
 	return sig, nil
 }
 
-func (v *Verifier) Verify(data, sig []byte) error {
+func (v *Verifier) Verify(_ context.Context, data, sig []byte) error {
 	if v.v == nil {
 		return errors.New("nil Verifier")
 	}
diff --git a/pkg/types/intoto/e2e_test.go b/pkg/types/intoto/e2e_test.go
index 00a0f10..597d2fb 100644
--- a/pkg/types/intoto/e2e_test.go
+++ b/pkg/types/intoto/e2e_test.go
@@ -19,6 +19,7 @@ package intoto
 
 import (
 	"bytes"
+	"context"
 	"crypto"
 	"crypto/ecdsa"
 	"crypto/rsa"
@@ -37,6 +38,7 @@ import (
 
 	"github.com/google/go-cmp/cmp"
 	"github.com/in-toto/in-toto-golang/in_toto"
+	"github.com/in-toto/in-toto-golang/in_toto/slsa_provenance/common"
 	slsa "github.com/in-toto/in-toto-golang/in_toto/slsa_provenance/v0.2"
 	"github.com/secure-systems-lab/go-securesystemslib/dsse"
 	"github.com/sigstore/rekor/pkg/generated/models"
@@ -70,14 +72,14 @@ func TestIntoto(t *testing.T) {
 			Subject: []in_toto.Subject{
 				{
 					Name: "foobar",
-					Digest: slsa.DigestSet{
+					Digest: common.DigestSet{
 						"foo": "bar",
 					},
 				},
 			},
 		},
 		Predicate: slsa.ProvenancePredicate{
-			Builder: slsa.ProvenanceBuilder{
+			Builder: common.ProvenanceBuilder{
 				ID: "foo" + id,
 			},
 		},
@@ -106,7 +108,7 @@ func TestIntoto(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	env, err := signer.SignPayload(in_toto.PayloadType, b)
+	env, err := signer.SignPayload(context.Background(), in_toto.PayloadType, b)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -177,14 +179,14 @@ func TestIntotoMultiSig(t *testing.T) {
 			Subject: []in_toto.Subject{
 				{
 					Name: "foobar",
-					Digest: slsa.DigestSet{
+					Digest: common.DigestSet{
 						"foo": "bar",
 					},
 				},
 			},
 		},
 		Predicate: slsa.ProvenancePredicate{
-			Builder: slsa.ProvenanceBuilder{
+			Builder: common.ProvenanceBuilder{
 				ID: "foo" + id,
 			},
 		},
@@ -232,7 +234,7 @@ func TestIntotoMultiSig(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	env, err := signer.SignPayload(in_toto.PayloadType, b)
+	env, err := signer.SignPayload(context.Background(), in_toto.PayloadType, b)
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/pkg/types/intoto/v0.0.1/entry_test.go b/pkg/types/intoto/v0.0.1/entry_test.go
index 3f24216..d63c033 100644
--- a/pkg/types/intoto/v0.0.1/entry_test.go
+++ b/pkg/types/intoto/v0.0.1/entry_test.go
@@ -42,6 +42,7 @@ import (
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/in-toto/in-toto-golang/in_toto"
+	"github.com/in-toto/in-toto-golang/in_toto/slsa_provenance/common"
 	slsa "github.com/in-toto/in-toto-golang/in_toto/slsa_provenance/v0.2"
 	"github.com/secure-systems-lab/go-securesystemslib/dsse"
 	"github.com/sigstore/rekor/pkg/generated/models"
@@ -387,7 +388,7 @@ func TestV001Entry_IndexKeys(t *testing.T) {
 			want: []string{"sha256:bar", hashkey},
 			statement: in_toto.Statement{
 				Predicate: slsa.ProvenancePredicate{
-					Materials: []slsa.ProvenanceMaterial{
+					Materials: []common.ProvenanceMaterial{
 						{
 							URI: "foo",
 							Digest: map[string]string{
diff --git a/pkg/types/intoto/v0.0.2/entry_test.go b/pkg/types/intoto/v0.0.2/entry_test.go
index 444ea56..b4075b5 100644
--- a/pkg/types/intoto/v0.0.2/entry_test.go
+++ b/pkg/types/intoto/v0.0.2/entry_test.go
@@ -40,6 +40,7 @@ import (
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/in-toto/in-toto-golang/in_toto"
+	"github.com/in-toto/in-toto-golang/in_toto/slsa_provenance/common"
 	slsa "github.com/in-toto/in-toto-golang/in_toto/slsa_provenance/v0.2"
 	"github.com/secure-systems-lab/go-securesystemslib/dsse"
 	"github.com/sigstore/rekor/pkg/generated/models"
@@ -72,7 +73,7 @@ func envelope(t *testing.T, k *ecdsa.PrivateKey, payload []byte) *dsse.Envelope
 	if err != nil {
 		t.Fatal(err)
 	}
-	dsseEnv, err := signer.SignPayload(payload)
+	dsseEnv, err := signer.SignPayload(context.Background(), payload)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -96,7 +97,7 @@ func multiSignEnvelope(t *testing.T, k []*ecdsa.PrivateKey, payload []byte) *dss
 	if err != nil {
 		t.Fatal(err)
 	}
-	dsseEnv, err := signer.SignPayload(in_toto.PayloadType, payload)
+	dsseEnv, err := signer.SignPayload(context.Background(), in_toto.PayloadType, payload)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -411,7 +412,7 @@ func TestV002Entry_IndexKeys(t *testing.T) {
 			want: []string{"sha256:bar"},
 			statement: in_toto.Statement{
 				Predicate: slsa.ProvenancePredicate{
-					Materials: []slsa.ProvenanceMaterial{
+					Materials: []common.ProvenanceMaterial{
 						{
 							URI: "foo",
 							Digest: map[string]string{
@@ -436,7 +437,7 @@ func TestV002Entry_IndexKeys(t *testing.T) {
 					},
 				},
 				Predicate: slsa.ProvenancePredicate{
-					Materials: []slsa.ProvenanceMaterial{
+					Materials: []common.ProvenanceMaterial{
 						{
 							URI: "foo",
 							Digest: map[string]string{
diff --git a/tests/harness_test.go b/tests/harness_test.go
index ec26781..ca49969 100644
--- a/tests/harness_test.go
+++ b/tests/harness_test.go
@@ -19,6 +19,7 @@ package e2e
 
 import (
 	"bytes"
+	"context"
 	"crypto"
 	"crypto/ecdsa"
 	"crypto/sha256"
@@ -38,6 +39,7 @@ import (
 
 	"github.com/google/go-cmp/cmp"
 	"github.com/in-toto/in-toto-golang/in_toto"
+	"github.com/in-toto/in-toto-golang/in_toto/slsa_provenance/common"
 	slsa "github.com/in-toto/in-toto-golang/in_toto/slsa_provenance/v0.2"
 	"github.com/secure-systems-lab/go-securesystemslib/dsse"
 	"github.com/sigstore/rekor/pkg/generated/models"
@@ -104,14 +106,14 @@ func TestHarnessAddIntoto(t *testing.T) {
 			Subject: []in_toto.Subject{
 				{
 					Name: "foobar",
-					Digest: slsa.DigestSet{
+					Digest: common.DigestSet{
 						"foo": "bar",
 					},
 				},
 			},
 		},
 		Predicate: slsa.ProvenancePredicate{
-			Builder: slsa.ProvenanceBuilder{
+			Builder: common.ProvenanceBuilder{
 				ID: "foo" + id,
 			},
 		},
@@ -140,7 +142,7 @@ func TestHarnessAddIntoto(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	env, err := signer.SignPayload("application/vnd.in-toto+json", b)
+	env, err := signer.SignPayload(context.Background(), "application/vnd.in-toto+json", b)
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/tests/rekor-harness.sh b/tests/rekor-harness.sh
index acdcdd6..626334c 100755
--- a/tests/rekor-harness.sh
+++ b/tests/rekor-harness.sh
@@ -30,7 +30,7 @@ function start_server () {
     else
         echo "turning down rekor and restarting at version $server_version"
         docker stop $(docker ps --filter name=rekor-server --format {{.ID}})
-        
+
         # Replace log in docker-compose.yml with the Tree ID we want
         search="# Uncomment this for production logging"
         replace="\"--trillian_log_server.tlog_id=$TREE_ID\","
@@ -75,7 +75,7 @@ function run_tests () {
     trap "rm -rf $REKORTMPDIR" EXIT
 
     go clean -testcache
-    if ! REKORTMPDIR=$REKORTMPDIR SERVER_VERSION=$1 CLI_VERSION=$2 go test -run TestHarness -v -tags=e2e ./tests/ ; then 
+    if ! REKORTMPDIR=$REKORTMPDIR SERVER_VERSION=$1 CLI_VERSION=$2 go test -run TestHarness -v -tags=e2e ./tests/ ; then
         docker-compose logs --no-color > /tmp/docker-compose.log
         exit 1
     fi
@@ -104,10 +104,10 @@ echo $VERSIONS
 export REKOR_HARNESS_TMPDIR="$(mktemp -d -t rekor_test_harness.XXXXXX)"
 docker-compose down
 
-for server_version in $VERSIONS 
+for server_version in $VERSIONS
 do
     start_server $server_version
-    for cli_version in $VERSIONS 
+    for cli_version in $VERSIONS
     do
         echo "======================================================="
         echo "Running tests with server version $server_version and CLI version $cli_version"