Repository: sigstore/rekor
Pull request #1490 (2023-05-16 07:41:31)

Remove requirement of PayloadHash for intoto 0.0.1
The payload hash was added later on, so old committed entries are missing the payload hash. This means that canonicalization will fail when searching for the entry if we require the payload hash.

<!--
Thanks for opening a pull request! Please do not just delete this text.  The three fields below are mandatory.

Please remember to:
- This PR requires an issue. If it is a new feature, the issue should proceed the PR and will have allowed sufficent time for discussions to take place. Please use
issue tags such as "Closes #XYZ" or "Resolves sigstore/repo-name#XYZ".
  [documentation](https://docs.github.com/en/github/managing-your-work-on-github/linking-a-pull-request-to-an-issue#linking-a-pull-request-to-an-issue-using-a-keyword)
- ensure your commits are signed-off, as sigstore uses the [DCO](https://en.wikipedia.org/wiki/Developer_Certificate_of_Origin) using `git commit -s`, or `git commit -s --amend` if you want to amend already existing commits
- lastly, ensure there are no merge commits!

Thank you :)
-->

#### Summary
<!--
 Explain the **motivation** for making this change. What existing problem does the pull request solve? How can reviewers test this PR?
-->

#### Release Note
<!--
Add a release note for each of the following conditions:

* Config changes (additions, deletions, updates)
* API additions—new endpoint, new response fields, or newly accepted request parameters
* Database changes (any)
* Websocket additions or changes
* Anything noteworthy to an administrator running private sigstore instances (err on the side of over-communicating)
* New features and improvements, including behavioural changes, UI changes and CLI changes
* Bug fixes and fixes of previous known issues
* Deprecation warnings, breaking changes, or compatibility notes

If no release notes are required write NONE. Use past-tense.

-->

#### Documentation
<!--

Does this change require an update to documentation? How will users implement your new feature?

Please reference a PR within https://docs.sigstore.dev

-->


codecov[bot]: ## [Codecov](https://app.codecov.io/gh/sigstore/rekor/pull/1490?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore) Report
> Merging [#1490](https://app.codecov.io/gh/sigstore/rekor/pull/1490?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore) (b359a00) into [main](https://app.codecov.io/gh/sigstore/rekor/commit/9b3707490e2698722ab382082ad74ac431f18a82?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore) (9b37074) will **decrease** coverage by `19.57%`.
> The diff coverage is `72.72%`.

```diff
@@             Coverage Diff             @@
##             main    #1490       +/-   ##
===========================================
- Coverage   66.47%   46.91%   -19.57%     
===========================================
  Files          80       72        -8     
  Lines        8022     7399      -623     
===========================================
- Hits         5333     3471     -1862     
- Misses       2038     3589     +1551     
+ Partials      651      339      -312     
```

| Flag | Coverage Δ | |
|---|---|---|
| e2etests | `?` | |
| unittests | `46.91% <72.72%> (+0.09%)` | :arrow_up: |

Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore#carryforward-flags-in-the-pull-request-comment) to find out more.

| [Impacted Files](https://app.codecov.io/gh/sigstore/rekor/pull/1490?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore) | Coverage Δ | |
|---|---|---|
| [pkg/types/intoto/v0.0.1/entry.go](https://app.codecov.io/gh/sigstore/rekor/pull/1490?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore#diff-cGtnL3R5cGVzL2ludG90by92MC4wLjEvZW50cnkuZ28=) | `55.55% <72.72%> (-12.13%)` | :arrow_down: |

... and [53 files with indirect coverage changes](https://app.codecov.io/gh/sigstore/rekor/pull/1490/indirect-changes?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=sigstore)



Patch:
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index ae237fd..1d1d5e8 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -35,12 +35,12 @@ jobs:
 
     steps:
       - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
-      - uses: sigstore/cosign-installer@204a51a57a74d190b284a0ce69b44bc37201f343 # v3.0.3
+      - uses: sigstore/cosign-installer@dd6b2e2b610a11fd73dd187a43d57cc1394e35f9 # v3.0.5
 
       - name: Extract version of Go to use
         run: echo "GOVERSION=$(cat Dockerfile|grep golang | awk ' { print $2 } ' | cut -d '@' -f 1 | cut -d ':' -f 2 | uniq)" >> $GITHUB_ENV
 
-      - uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0
+      - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
         with:
           go-version: ${{ env.GOVERSION }}
 
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 173e0d9..b8d485a 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -36,7 +36,7 @@ jobs:
       - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
       - name: Extract version of Go to use
         run: echo "GOVERSION=$(cat Dockerfile|grep golang | awk ' { print $2 } ' | cut -d '@' -f 1 | cut -d ':' -f 2 | uniq)" >> $GITHUB_ENV
-      - uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0
+      - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
         with:
           go-version: ${{ env.GOVERSION }}
 
@@ -47,7 +47,7 @@ jobs:
       - name: Test
         run: go test -v -coverprofile=coverage.txt -covermode=atomic ./...
       - name: Upload Coverage Report
-        uses: codecov/codecov-action@894ff025c7b54547a9a2a1e9f228beae737ad3c2 # v3.1.3
+        uses: codecov/codecov-action@eaaf4bedf32dbdc6b720b63067d99c4d77d6047d # v3.1.4
         with:
           flags: unittests
       - name: Ensure no files were modified as a result of the build
@@ -59,7 +59,7 @@ jobs:
       - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
       - name: Extract version of Go to use
         run: echo "GOVERSION=$(cat Dockerfile|grep golang | awk ' { print $2 } ' | cut -d '@' -f 1 | cut -d ':' -f 2 | uniq)" >> $GITHUB_ENV
-      - uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0
+      - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
         with:
           go-version: ${{ env.GOVERSION }}
 
@@ -82,7 +82,7 @@ jobs:
       - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
       - name: Extract version of Go to use
         run: echo "GOVERSION=$(cat Dockerfile|grep golang | awk ' { print $2 } ' | cut -d '@' -f 1 | cut -d ':' -f 2 | uniq)" >> $GITHUB_ENV
-      - uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0
+      - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
         with:
           go-version: ${{ env.GOVERSION }}
       - name: install gocovmerge
@@ -99,7 +99,7 @@ jobs:
           name: E2E Docker Compose logs
           path: /tmp/docker-compose.log
       - name: Upload Coverage Report
-        uses: codecov/codecov-action@894ff025c7b54547a9a2a1e9f228beae737ad3c2 # v3.1.3
+        uses: codecov/codecov-action@eaaf4bedf32dbdc6b720b63067d99c4d77d6047d # v3.1.4
         with:
           files: /tmp/rekor-merged.cov,/tmp/pkg-rekor-merged.cov
           flags: e2etests
@@ -116,7 +116,7 @@ jobs:
         run: docker-compose build
       - name: Extract version of Go to use
         run: echo "GOVERSION=$(cat Dockerfile|grep golang | awk ' { print $2 } ' | cut -d '@' -f 1 | cut -d ':' -f 2 | uniq)" >> $GITHUB_ENV
-      - uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0
+      - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
         with:
           go-version: ${{ env.GOVERSION }}
 
@@ -139,7 +139,7 @@ jobs:
         run: docker-compose build
       - name: Extract version of Go to use
         run: echo "GOVERSION=$(cat Dockerfile|grep golang | awk ' { print $2 } ' | cut -d '@' -f 1 | cut -d ':' -f 2 | uniq)" >> $GITHUB_ENV
-      - uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0
+      - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
         with:
           go-version: ${{ env.GOVERSION }}
 
@@ -161,7 +161,7 @@ jobs:
         run: git switch -c harness-test-branch
       - name: Extract version of Go to use
         run: echo "GOVERSION=$(cat Dockerfile|grep golang | awk ' { print $2 } ' | cut -d '@' -f 1 | cut -d ':' -f 2 | uniq)" >> $GITHUB_ENV
-      - uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0
+      - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
         with:
           go-version: ${{ env.GOVERSION }}
 
diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index fbfaf54..cf7bc4a 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -32,7 +32,7 @@ jobs:
       - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
       - name: Extract version of Go to use
         run: echo "GOVERSION=$(cat Dockerfile|grep golang | awk ' { print $2 } ' | cut -d '@' -f 1 | cut -d ':' -f 2 | uniq)" >> $GITHUB_ENV
-      - uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0
+      - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
         with:
           go-version: ${{ env.GOVERSION }}
 
@@ -51,7 +51,7 @@ jobs:
       - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
       - name: Extract version of Go to use
         run: echo "GOVERSION=$(cat Dockerfile|grep golang | awk ' { print $2 } ' | cut -d '@' -f 1 | cut -d ':' -f 2 | uniq)" >> $GITHUB_ENV
-      - uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0
+      - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
         with:
           go-version: ${{ env.GOVERSION }}
 
diff --git a/Dockerfile b/Dockerfile
index cec63c5..2f8beb4 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -13,7 +13,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM golang:1.20.4@sha256:685a22e459f9516f27d975c5cc6accc11223ee81fdfbbae60e39cc3b87357306 AS builder
+FROM golang:1.20.4@sha256:690e4135bf2a4571a572bfd5ddfa806b1cb9c3dea0446ebadaf32bc2ea09d4f9 AS builder
 ENV APP_ROOT=/opt/app-root
 ENV GOPATH=$APP_ROOT
 
@@ -31,7 +31,7 @@ RUN CGO_ENABLED=0 go build -gcflags "all=-N -l" -ldflags "${SERVER_LDFLAGS}" -o
 RUN go test -c -ldflags "${SERVER_LDFLAGS}" -cover -covermode=count -coverpkg=./... -o rekor-server_test ./cmd/rekor-server
 
 # Multi-Stage production build
-FROM golang:1.20.4@sha256:685a22e459f9516f27d975c5cc6accc11223ee81fdfbbae60e39cc3b87357306 as deploy
+FROM golang:1.20.4@sha256:690e4135bf2a4571a572bfd5ddfa806b1cb9c3dea0446ebadaf32bc2ea09d4f9 as deploy
 
 # Retrieve the binary from the previous stage
 COPY --from=builder /opt/app-root/src/rekor-server /usr/local/bin/rekor-server
diff --git a/cmd/backfill-redis/main.go b/cmd/backfill-redis/main.go
index 5c0df33..04608ca 100644
--- a/cmd/backfill-redis/main.go
+++ b/cmd/backfill-redis/main.go
@@ -50,9 +50,7 @@ import (
 	_ "github.com/sigstore/rekor/pkg/types/hashedrekord/v0.0.1"
 	_ "github.com/sigstore/rekor/pkg/types/helm/v0.0.1"
 	_ "github.com/sigstore/rekor/pkg/types/intoto/v0.0.1"
-
-	// remove 0.0.2 intoto type due to bugs
-	// _ "github.com/sigstore/rekor/pkg/types/intoto/v0.0.2"
+	_ "github.com/sigstore/rekor/pkg/types/intoto/v0.0.2"
 	_ "github.com/sigstore/rekor/pkg/types/jar/v0.0.1"
 	_ "github.com/sigstore/rekor/pkg/types/rekord/v0.0.1"
 	_ "github.com/sigstore/rekor/pkg/types/rfc3161/v0.0.1"
diff --git a/cmd/rekor-cli/app/search.go b/cmd/rekor-cli/app/search.go
index 4552a1c..2b1e89d 100644
--- a/cmd/rekor-cli/app/search.go
+++ b/cmd/rekor-cli/app/search.go
@@ -201,7 +201,9 @@ var searchCmd = &cobra.Command{
 			return nil, fmt.Errorf("no matching entries found")
 		}
 
-		fmt.Fprintln(os.Stderr, "Found matching entries (listed by UUID):")
+		if viper.GetString("format") != "json" {
+			fmt.Fprintln(os.Stderr, "Found matching entries (listed by UUID):")
+		}
 
 		return &searchCmdOutput{
 			UUIDs: resp.GetPayload(),
diff --git a/go.mod b/go.mod
index 0620a12..aadc344 100644
--- a/go.mod
+++ b/go.mod
@@ -15,7 +15,7 @@ require (
 	github.com/go-openapi/strfmt v0.21.7
 	github.com/go-openapi/swag v0.22.3
 	github.com/go-openapi/validate v0.22.1
-	github.com/go-playground/validator/v10 v10.13.0
+	github.com/go-playground/validator/v10 v10.14.0
 	github.com/google/go-cmp v0.5.9
 	github.com/google/rpmpack v0.0.0-20210518075352-dc539ef4f2ea
 	github.com/google/trillian v1.5.2
@@ -34,7 +34,7 @@ require (
 	github.com/spf13/viper v1.15.0
 	github.com/theupdateframework/go-tuf v0.5.2
 	github.com/transparency-dev/merkle v0.0.2
-	github.com/veraison/go-cose v1.0.0
+	github.com/veraison/go-cose v1.1.0
 	github.com/zalando/go-keyring v0.1.1 // indirect
 	go.uber.org/goleak v1.2.1
 	go.uber.org/zap v1.24.0
@@ -67,6 +67,7 @@ require (
 	github.com/cyphar/filepath-securejoin v0.2.3 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
+	github.com/gabriel-vasile/mimetype v1.4.2 // indirect
 	github.com/go-logr/logr v1.2.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/google/s2a-go v0.1.3 // indirect
@@ -108,7 +109,7 @@ require (
 	github.com/howeyc/gopass v0.0.0-20190910152052-7cb4b85ec19c // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
-	github.com/leodido/go-urn v1.2.3 // indirect
+	github.com/leodido/go-urn v1.2.4 // indirect
 	github.com/letsencrypt/boulder v0.0.0-20221109233200-85aa52084eaf // indirect
 	github.com/magiconair/properties v1.8.7 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
diff --git a/go.sum b/go.sum
index fa9dca1..77fdd29 100644
--- a/go.sum
+++ b/go.sum
@@ -923,6 +923,8 @@ github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbS
 github.com/fullsailor/pkcs7 v0.0.0-20190404230743-d7302db945fa/go.mod h1:KnogPXtdwXqoenmZCw6S+25EAm2MkxbG0deNDu4cbSA=
 github.com/fxamacker/cbor/v2 v2.4.0 h1:ri0ArlOR+5XunOP8CRUowT0pSJOwhW098ZCUyskZD88=
 github.com/fxamacker/cbor/v2 v2.4.0/go.mod h1:TA1xS00nchWmaBnEIxPSE5oHLuJBAVvqrtAnWBwBCVo=
+github.com/gabriel-vasile/mimetype v1.4.2 h1:w5qFW6JKBz9Y393Y4q372O9A7cUSequkh1Q7OhCmWKU=
+github.com/gabriel-vasile/mimetype v1.4.2/go.mod h1:zApsH/mKG4w07erKIaJPFiX0Tsq9BFQgN3qGY5GnNgA=
 github.com/garyburd/redigo v0.0.0-20150301180006-535138d7bcd7/go.mod h1:NR3MbYisc3/PwhQ00EMzDiPmrwpPxAn5GI05/YaO1SY=
 github.com/getkin/kin-openapi v0.76.0/go.mod h1:660oXbgy5JFMKreazJaQTw7o+X00qeSyhcnluiMv+Xg=
 github.com/getsentry/raven-go v0.2.0/go.mod h1:KungGk8q33+aIAZUIVWZDr2OfAEBsO49PX4NzFV5kcQ=
@@ -1022,8 +1024,8 @@ github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJn
 github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
 github.com/go-playground/validator/v10 v10.2.0/go.mod h1:uOYAAleCW8F/7oMFd6aG0GOhaH6EGOAJShg8Id5JGkI=
 github.com/go-playground/validator/v10 v10.4.1/go.mod h1:nlOn6nFhuKACm19sB/8EGNn9GlaMV7XkbRSipzJ0Ii4=
-github.com/go-playground/validator/v10 v10.13.0 h1:cFRQdfaSMCOSfGCCLB20MHvuoHb/s5G8L5pu2ppK5AQ=
-github.com/go-playground/validator/v10 v10.13.0/go.mod h1:dwu7+CG8/CtBiJFZDz4e+5Upb6OLw04gtBYw0mcG/z4=
+github.com/go-playground/validator/v10 v10.14.0 h1:vgvQWe3XCz3gIeFDm/HnTIbj6UGmg/+t63MyGU2n5js=
+github.com/go-playground/validator/v10 v10.14.0/go.mod h1:9iXMNT7sEkjXb0I+enO7QXmzG6QCsPWY4zveKFVRSyU=
 github.com/go-redis/redismock/v9 v9.0.3 h1:mtHQi2l51lCmXIbTRTqb1EiHYe9tL5Yk5oorlSJJqR0=
 github.com/go-redis/redismock/v9 v9.0.3/go.mod h1:F6tJRfnU8R/NZ0E+Gjvoluk14MqMC5ueSZX6vVQypc0=
 github.com/go-resty/resty/v2 v2.1.1-0.20191201195748-d7b97669fe48/go.mod h1:dZGr0i9PLlaaTD4H/hoZIDjQ+r6xq8mgbRzHZf7f2J8=
@@ -1473,8 +1475,8 @@ github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/kylelemons/godebug v0.0.0-20170820004349-d65d576e9348/go.mod h1:B69LEHPfb2qLo0BaaOLcbitczOKLWTsrBG9LczfCD4k=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/leodido/go-urn v1.2.0/go.mod h1:+8+nEpDfqqsY+g338gtMEUOtuK+4dEMhiQEgxpxOKII=
-github.com/leodido/go-urn v1.2.3 h1:6BE2vPT0lqoz3fmOesHZiaiFh7889ssCo2GMvLCfiuA=
-github.com/leodido/go-urn v1.2.3/go.mod h1:7ZrI8mTSeBSHl/UaRyKQW1qZeMgak41ANeCNaVckg+4=
+github.com/leodido/go-urn v1.2.4 h1:XlAE/cm/ms7TE/VMVoduSpNBoyc2dOxHs5MZSwAN63Q=
+github.com/leodido/go-urn v1.2.4/go.mod h1:7ZrI8mTSeBSHl/UaRyKQW1qZeMgak41ANeCNaVckg+4=
 github.com/letsencrypt/boulder v0.0.0-20221109233200-85aa52084eaf h1:ndns1qx/5dL43g16EQkPV/i8+b3l5bYQwLeoSBe7tS8=
 github.com/letsencrypt/boulder v0.0.0-20221109233200-85aa52084eaf/go.mod h1:aGkAgvWY/IUcVFfuly53REpfv5edu25oij+qHRFaraA=
 github.com/lib/pq v1.0.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
@@ -1926,8 +1928,8 @@ github.com/urfave/cli v0.0.0-20171014202726-7bc6a0acffa5/go.mod h1:70zkFmudgCuE/
 github.com/urfave/cli v1.20.0/go.mod h1:70zkFmudgCuE/ngEzBv17Jvp/497gISqfk5gWijbERA=
 github.com/urfave/cli v1.22.1/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
 github.com/urfave/cli v1.22.2/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
-github.com/veraison/go-cose v1.0.0 h1:Jxirc0rl3gG7wUFgW+82tBQNeK8T8e2Bk1Vd298ob4A=
-github.com/veraison/go-cose v1.0.0/go.mod h1:7ziE85vSq4ScFTg6wyoMXjucIGOf4JkFEZi/an96Ct4=
+github.com/veraison/go-cose v1.1.0 h1:AalPS4VGiKavpAzIlBjrn7bhqXiXi4jbMYY/2+UC+4o=
+github.com/veraison/go-cose v1.1.0/go.mod h1:7ziE85vSq4ScFTg6wyoMXjucIGOf4JkFEZi/an96Ct4=
 github.com/vishvananda/netlink v0.0.0-20181108222139-023a6dafdcdf/go.mod h1:+SR5DhBJrl6ZM7CoCKvpw5BKroDKQ+PJqOg65H/2ktk=
 github.com/vishvananda/netlink v1.1.0/go.mod h1:cTgwzPIzzgDAYoQrMm0EdrjRUBkTqKYppBueQtXaqoE=
 github.com/vishvananda/netlink v1.1.1-0.20201029203352-d40f9887b852/go.mod h1:twkDnbuQxJYemMlGd4JFIcuhgX83tXhKS2B/PRMpOho=
diff --git a/pkg/types/intoto/v0.0.1/entry.go b/pkg/types/intoto/v0.0.1/entry.go
index 66af807..1018d4c 100644
--- a/pkg/types/intoto/v0.0.1/entry.go
+++ b/pkg/types/intoto/v0.0.1/entry.go
@@ -193,9 +193,8 @@ func (v *V001Entry) Canonicalize(_ context.Context) ([]byte, error) {
 	if v.IntotoObj.Content.Hash == nil {
 		return nil, errors.New("missing envelope hash")
 	}
-	if v.IntotoObj.Content.PayloadHash == nil {
-		return nil, errors.New("missing payload hash")
-	}
+	// PayloadHash is not present for old entries
+
 	pk, err := v.keyObj.CanonicalValue()
 	if err != nil {
 		return nil, err
@@ -209,12 +208,15 @@ func (v *V001Entry) Canonicalize(_ context.Context) ([]byte, error) {
 				Algorithm: v.IntotoObj.Content.Hash.Algorithm,
 				Value:     v.IntotoObj.Content.Hash.Value,
 			},
-			PayloadHash: &models.IntotoV001SchemaContentPayloadHash{
-				Algorithm: v.IntotoObj.Content.PayloadHash.Algorithm,
-				Value:     v.IntotoObj.Content.PayloadHash.Value,
-			},
 		},
 	}
+	// Set PayloadHash if present
+	if v.IntotoObj.Content.PayloadHash != nil {
+		canonicalEntry.Content.PayloadHash = &models.IntotoV001SchemaContentPayloadHash{
+			Algorithm: v.IntotoObj.Content.PayloadHash.Algorithm,
+			Value:     v.IntotoObj.Content.PayloadHash.Value,
+		}
+	}
 
 	itObj := models.Intoto{}
 	itObj.APIVersion = swag.String(APIVERSION)
@@ -237,10 +239,11 @@ func (v *V001Entry) validate() error {
 		} else if err := v.IntotoObj.Content.Hash.Validate(strfmt.Default); err != nil {
 			return fmt.Errorf("validation error on envelope hash: %w", err)
 		}
-		if v.IntotoObj.Content.PayloadHash == nil {
-			return fmt.Errorf("missing hash value for payload")
-		} else if err := v.IntotoObj.Content.PayloadHash.Validate(strfmt.Default); err != nil {
-			return fmt.Errorf("validation error on payload hash: %w", err)
+		// PayloadHash is not present for old entries
+		if v.IntotoObj.Content.PayloadHash != nil {
+			if err := v.IntotoObj.Content.PayloadHash.Validate(strfmt.Default); err != nil {
+				return fmt.Errorf("validation error on payload hash: %w", err)
+			}
 		}
 		// if there is no envelope, and hash/payloadHash are valid, then there's nothing else to do here
 		return nil


Test patch:
diff --git a/pkg/types/alpine/v0.0.1/fuzz_test.go b/pkg/types/alpine/v0.0.1/fuzz_test.go
index 568e1d7..9b96e75 100644
--- a/pkg/types/alpine/v0.0.1/fuzz_test.go
+++ b/pkg/types/alpine/v0.0.1/fuzz_test.go
@@ -21,8 +21,11 @@ import (
 	"testing"
 
 	fuzz "github.com/AdamKorcz/go-fuzz-headers-1"
+	"github.com/go-openapi/swag"
 
 	fuzzUtils "github.com/sigstore/rekor/pkg/fuzz"
+	"github.com/sigstore/rekor/pkg/generated/models"
+	"github.com/sigstore/rekor/pkg/types"
 	"github.com/sigstore/rekor/pkg/types/alpine"
 )
 
@@ -47,10 +50,48 @@ func FuzzAlpineCreateProposedEntry(f *testing.F) {
 		if err != nil {
 			t.Skip()
 		}
-		c, err := it.UnmarshalEntry(entry)
+
+		ei, err := types.CreateVersionedEntry(entry)
 		if err != nil {
 			t.Skip()
 		}
-		_, _ = c.IndexKeys()
+
+		if ok, err := ei.Insertable(); !ok || err != nil {
+			t.Errorf("entry created via CreateProposedEntry should be insertable: %v", err)
+		}
+
+		if _, err := types.CanonicalizeEntry(context.Background(), ei); err != nil {
+			t.Errorf("valid insertable entry should be able to be canonicalized: %v", err)
+		}
+
+		_, _ = ei.IndexKeys()
+	})
+}
+
+func FuzzAlpineUnmarshalAndCanonicalize(f *testing.F) {
+	f.Fuzz(func(t *testing.T, entryData []byte) {
+		initter.Do(fuzzUtils.SetFuzzLogger)
+
+		ff := fuzz.NewConsumer(entryData)
+
+		targetV001 := &models.AlpineV001Schema{}
+
+		if err := ff.GenerateStruct(targetV001); err != nil {
+			t.Skip()
+		}
+
+		targetEntry := &models.Alpine{
+			APIVersion: swag.String(APIVERSION),
+			Spec:       targetV001,
+		}
+
+		ei, err := types.UnmarshalEntry(targetEntry)
+		if err != nil {
+			t.Skip()
+		}
+
+		if _, err := types.CanonicalizeEntry(context.Background(), ei); err != nil {
+			t.Errorf("error canonicalizing unmarshalled entry: %v", err)
+		}
 	})
 }
diff --git a/pkg/types/cose/v0.0.1/fuzz_test.go b/pkg/types/cose/v0.0.1/fuzz_test.go
index d7520d8..5545c48 100644
--- a/pkg/types/cose/v0.0.1/fuzz_test.go
+++ b/pkg/types/cose/v0.0.1/fuzz_test.go
@@ -21,8 +21,11 @@ import (
 	"testing"
 
 	fuzz "github.com/AdamKorcz/go-fuzz-headers-1"
+	"github.com/go-openapi/swag"
 
 	fuzzUtils "github.com/sigstore/rekor/pkg/fuzz"
+	"github.com/sigstore/rekor/pkg/generated/models"
+	"github.com/sigstore/rekor/pkg/types"
 	"github.com/sigstore/rekor/pkg/types/cose"
 )
 
@@ -47,9 +50,48 @@ func FuzzCoseCreateProposedEntry(f *testing.F) {
 		if err != nil {
 			t.Skip()
 		}
-		_, err = it.UnmarshalEntry(entry)
+
+		ei, err := types.CreateVersionedEntry(entry)
 		if err != nil {
 			t.Skip()
 		}
+
+		if ok, err := ei.Insertable(); !ok || err != nil {
+			t.Errorf("entry created via CreateProposedEntry should be insertable: %v", err)
+		}
+
+		if _, err := types.CanonicalizeEntry(context.Background(), ei); err != nil {
+			t.Errorf("valid insertable entry should be able to be canonicalized: %v", err)
+		}
+
+		_, _ = ei.IndexKeys()
+	})
+}
+
+func FuzzCoseUnmarshalAndCanonicalize(f *testing.F) {
+	f.Fuzz(func(t *testing.T, entryData []byte) {
+		initter.Do(fuzzUtils.SetFuzzLogger)
+
+		ff := fuzz.NewConsumer(entryData)
+
+		targetV001 := &models.CoseV001Schema{}
+
+		if err := ff.GenerateStruct(targetV001); err != nil {
+			t.Skip()
+		}
+
+		targetEntry := &models.Cose{
+			APIVersion: swag.String(APIVERSION),
+			Spec:       targetV001,
+		}
+
+		ei, err := types.UnmarshalEntry(targetEntry)
+		if err != nil {
+			t.Skip()
+		}
+
+		if _, err := types.CanonicalizeEntry(context.Background(), ei); err != nil {
+			t.Errorf("error canonicalizing unmarshalled entry: %v", err)
+		}
 	})
 }
diff --git a/pkg/types/hashedrekord/v0.0.1/fuzz_test.go b/pkg/types/hashedrekord/v0.0.1/fuzz_test.go
index 7adb281..4a3d546 100644
--- a/pkg/types/hashedrekord/v0.0.1/fuzz_test.go
+++ b/pkg/types/hashedrekord/v0.0.1/fuzz_test.go
@@ -21,8 +21,11 @@ import (
 	"testing"
 
 	fuzz "github.com/AdamKorcz/go-fuzz-headers-1"
+	"github.com/go-openapi/swag"
 
 	fuzzUtils "github.com/sigstore/rekor/pkg/fuzz"
+	"github.com/sigstore/rekor/pkg/generated/models"
+	"github.com/sigstore/rekor/pkg/types"
 	"github.com/sigstore/rekor/pkg/types/hashedrekord"
 )
 
@@ -47,10 +50,48 @@ func FuzzHashedRekordCreateProposedEntry(f *testing.F) {
 		if err != nil {
 			t.Skip()
 		}
-		c, err := it.UnmarshalEntry(entry)
+
+		ei, err := types.CreateVersionedEntry(entry)
 		if err != nil {
 			t.Skip()
 		}
-		_, _ = c.IndexKeys()
+
+		if ok, err := ei.Insertable(); !ok || err != nil {
+			t.Errorf("entry created via CreateProposedEntry should be insertable: %v", err)
+		}
+
+		if _, err := types.CanonicalizeEntry(context.Background(), ei); err != nil {
+			t.Errorf("valid insertable entry should be able to be canonicalized: %v", err)
+		}
+
+		_, _ = ei.IndexKeys()
+	})
+}
+
+func FuzzHashedRekordUnmarshalAndCanonicalize(f *testing.F) {
+	f.Fuzz(func(t *testing.T, entryData []byte) {
+		initter.Do(fuzzUtils.SetFuzzLogger)
+
+		ff := fuzz.NewConsumer(entryData)
+
+		targetV001 := &models.HashedrekordV001Schema{}
+
+		if err := ff.GenerateStruct(targetV001); err != nil {
+			t.Skip()
+		}
+
+		targetEntry := &models.Hashedrekord{
+			APIVersion: swag.String(APIVERSION),
+			Spec:       targetV001,
+		}
+
+		ei, err := types.UnmarshalEntry(targetEntry)
+		if err != nil {
+			t.Skip()
+		}
+
+		if _, err := types.CanonicalizeEntry(context.Background(), ei); err != nil {
+			t.Errorf("error canonicalizing unmarshalled entry: %v", err)
+		}
 	})
 }
diff --git a/pkg/types/helm/v0.0.1/fuzz_test.go b/pkg/types/helm/v0.0.1/fuzz_test.go
index 5e091ee..717f27a 100644
--- a/pkg/types/helm/v0.0.1/fuzz_test.go
+++ b/pkg/types/helm/v0.0.1/fuzz_test.go
@@ -22,8 +22,11 @@ import (
 	"testing"
 
 	fuzz "github.com/AdamKorcz/go-fuzz-headers-1"
+	"github.com/go-openapi/swag"
 
 	fuzzUtils "github.com/sigstore/rekor/pkg/fuzz"
+	"github.com/sigstore/rekor/pkg/generated/models"
+	"github.com/sigstore/rekor/pkg/types"
 	"github.com/sigstore/rekor/pkg/types/helm"
 )
 
@@ -48,11 +51,48 @@ func FuzzHelmCreateProposedEntry(f *testing.F) {
 		if err != nil {
 			t.Skip()
 		}
-		c, err := it.UnmarshalEntry(entry)
+		ei, err := types.CreateVersionedEntry(entry)
 		if err != nil {
 			t.Skip()
 		}
-		_, _ = c.IndexKeys()
+
+		if ok, err := ei.Insertable(); !ok || err != nil {
+			t.Errorf("entry created via CreateProposedEntry should be insertable: %v", err)
+		}
+
+		if _, err := types.CanonicalizeEntry(context.Background(), ei); err != nil {
+			t.Errorf("valid insertable entry should be able to be canonicalized: %v", err)
+		}
+
+		_, _ = ei.IndexKeys()
+	})
+}
+
+func FuzzHelmUnmarshalAndCanonicalize(f *testing.F) {
+	f.Fuzz(func(t *testing.T, entryData []byte) {
+		initter.Do(fuzzUtils.SetFuzzLogger)
+
+		ff := fuzz.NewConsumer(entryData)
+
+		targetV001 := &models.HelmV001Schema{}
+
+		if err := ff.GenerateStruct(targetV001); err != nil {
+			t.Skip()
+		}
+
+		targetEntry := &models.Helm{
+			APIVersion: swag.String(APIVERSION),
+			Spec:       targetV001,
+		}
+
+		ei, err := types.UnmarshalEntry(targetEntry)
+		if err != nil {
+			t.Skip()
+		}
+
+		if _, err := types.CanonicalizeEntry(context.Background(), ei); err != nil {
+			t.Errorf("error canonicalizing unmarshalled entry: %v", err)
+		}
 	})
 }
 
diff --git a/pkg/types/intoto/e2e_test.go b/pkg/types/intoto/e2e_test.go
index 597d2fb..2bb4130 100644
--- a/pkg/types/intoto/e2e_test.go
+++ b/pkg/types/intoto/e2e_test.go
@@ -394,3 +394,35 @@ func TestValidationSearchIntotoV002MissingPayloadHash(t *testing.T) {
 		t.Fatalf("expected status 400, got %d instead: %v", resp.StatusCode, string(c))
 	}
 }
+
+func TestValidationSearchIntotoV001MissingPayloadHash(t *testing.T) {
+	body := `{
+		"entries":[
+			{
+				"kind":"intoto",
+				"apiVersion": "0.0.1",
+				"spec":{
+					"content":{
+						"hash":{
+							"algorithm":"sha256",
+							"value":"ebbfddda6277af199e93c5bb5cf5998a79311de238e49bcc8ac24102698761bb"
+						}
+					},
+					"publicKey":"LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNwRENDQWlxZ0F3SUJBZ0lVYWhsOEFRd1lZV05ZbnV6dlFvOEVrN1dMTURvd0NnWUlLb1pJemowRUF3TXcKTnpFVk1CTUdBMVVFQ2hNTWMybG5jM1J2Y21VdVpHVjJNUjR3SEFZRFZRUURFeFZ6YVdkemRHOXlaUzFwYm5SbApjbTFsWkdsaGRHVXdIaGNOTWpJd09ESTJNREV4TnpFM1doY05Nakl3T0RJMk1ERXlOekUzV2pBQU1Ga3dFd1lICktvWkl6ajBDQVFZSUtvWkl6ajBEQVFjRFFnQUVLWmZEQzlpalVyclpBWE9jWFYrQXFHRUlTSlEzVHRqSndJdEEKdTE3Rml2aWpnSk1hYUhGNDcrT3Z2OVR1ekFDQ3lpSUV5UDUyZXI2ZmF5bmZKYVVqOEtPQ0FVa3dnZ0ZGTUE0RwpBMVVkRHdFQi93UUVBd0lIZ0RBVEJnTlZIU1VFRERBS0JnZ3JCZ0VGQlFjREF6QWRCZ05WSFE0RUZnUVVHQldUCkMwdUU3dTRQcURVRjFYV0c0QlVWVUpBd0h3WURWUjBqQkJnd0ZvQVUzOVBwejFZa0VaYjVxTmpwS0ZXaXhpNFkKWkQ4d0pRWURWUjBSQVFIL0JCc3dHWUVYYzJGemIyRnJhWEpoTmpFeE5FQm5iV0ZwYkM1amIyMHdLUVlLS3dZQgpCQUdEdnpBQkFRUWJhSFIwY0hNNkx5OWhZMk52ZFc1MGN5NW5iMjluYkdVdVkyOXRNSUdMQmdvckJnRUVBZFo1CkFnUUNCSDBFZXdCNUFIY0FDR0NTOENoUy8yaEYwZEZySjRTY1JXY1lyQlk5d3pqU2JlYThJZ1kyYjNJQUFBR0MKMTdtSmhnQUFCQU1BU0RCR0FpRUFoS09BSkdWVlhCb1cxTDR4alk5eWJWOGZUUXN5TStvUEpIeDk5S29LYUpVQwpJUURCZDllc1Q0Mk1STng3Vm9BM1paKzV4akhNZWR6amVxQ2ZoZTcvd1pxYTlUQUtCZ2dxaGtqT1BRUURBd05vCkFEQmxBakVBcnBkeXlFRjc3b2JyTENMUXpzYmIxM2lsNjd3dzM4Y050amdNQml6Y2VUakRiY2VLeVFSN1RKNHMKZENsclkxY1BBakE4aXB6SUQ4VU1CaGxkSmUvZXJGcGdtN2swNWFic2lPN3V5dVZuS29VNk0rTXJ6VVUrZTlGdwpJRGhCanVRa1dRYz0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo="
+				}
+			}
+		]
+	}
+	`
+	resp, err := http.Post(fmt.Sprintf("%s/api/v1/log/entries/retrieve", rekorServer()),
+		"application/json",
+		bytes.NewBuffer([]byte(body)))
+	if err != nil {
+		t.Fatal(err)
+	}
+	c, _ := ioutil.ReadAll(resp.Body)
+	// No failure when payload hash is not present for canonicalization
+	if resp.StatusCode != 200 {
+		t.Fatalf("expected status 200, got %d instead: %v", resp.StatusCode, string(c))
+	}
+}
diff --git a/pkg/types/intoto/v0.0.1/entry_test.go b/pkg/types/intoto/v0.0.1/entry_test.go
index d48b2b4..9a6b2ee 100644
--- a/pkg/types/intoto/v0.0.1/entry_test.go
+++ b/pkg/types/intoto/v0.0.1/entry_test.go
@@ -362,6 +362,43 @@ func TestV001Entry_Unmarshal(t *testing.T) {
 	}
 }
 
+// Demonstrates that Unmarshal and Canonicalize will succeed with only a hash,
+// since committed entries will have no envelope and may have no payload hash
+func TestV001EntryWithoutEnvelopeOrPayloadHash(t *testing.T) {
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	der, err := x509.MarshalPKIXPublicKey(&key.PublicKey)
+	if err != nil {
+		t.Fatal(err)
+	}
+	pub := pem.EncodeToMemory(&pem.Block{
+		Bytes: der,
+		Type:  "PUBLIC KEY",
+	})
+	m := &models.IntotoV001Schema{
+		PublicKey: p(pub),
+		Content: &models.IntotoV001SchemaContent{
+			Hash: &models.IntotoV001SchemaContentHash{
+				Algorithm: swag.String(models.IntotoV001SchemaContentHashAlgorithmSha256),
+				Value:     swag.String("1a1707bb54e5fb4deddd19f07adcb4f1e022ca7879e3c8348da8d4fa496ae8e2"),
+			},
+		},
+	}
+	v := &V001Entry{}
+	it := &models.Intoto{
+		Spec: m,
+	}
+	if err := v.Unmarshal(it); err != nil {
+		t.Fatalf("error umarshalling intoto without envelope: %v", err)
+	}
+	_, err = v.Canonicalize(context.TODO())
+	if err != nil {
+		t.Fatalf("error canonicalizing intoto without envelope: %v", err)
+	}
+}
+
 func TestV001Entry_IndexKeys(t *testing.T) {
 	h := sha256.Sum256([]byte("foo"))
 	dataSHA := hex.EncodeToString(h[:])
diff --git a/pkg/types/intoto/v0.0.1/fuzz_test.go b/pkg/types/intoto/v0.0.1/fuzz_test.go
index eecbfe0..a023a4d 100644
--- a/pkg/types/intoto/v0.0.1/fuzz_test.go
+++ b/pkg/types/intoto/v0.0.1/fuzz_test.go
@@ -21,8 +21,11 @@ import (
 	"testing"
 
 	fuzz "github.com/AdamKorcz/go-fuzz-headers-1"
+	"github.com/go-openapi/swag"
 
 	fuzzUtils "github.com/sigstore/rekor/pkg/fuzz"
+	"github.com/sigstore/rekor/pkg/generated/models"
+	"github.com/sigstore/rekor/pkg/types"
 	"github.com/sigstore/rekor/pkg/types/intoto"
 )
 
@@ -47,10 +50,47 @@ func FuzzIntotoCreateProposedEntry(f *testing.F) {
 		if err != nil {
 			t.Skip()
 		}
-		c, err := it.UnmarshalEntry(entry)
+		ei, err := types.CreateVersionedEntry(entry)
 		if err != nil {
 			t.Skip()
 		}
-		_, _ = c.IndexKeys()
+
+		if ok, err := ei.Insertable(); !ok || err != nil {
+			t.Errorf("entry created via CreateProposedEntry should be insertable: %v", err)
+		}
+
+		if _, err := types.CanonicalizeEntry(context.Background(), ei); err != nil {
+			t.Errorf("valid insertable entry should be able to be canonicalized: %v", err)
+		}
+
+		_, _ = ei.IndexKeys()
+	})
+}
+
+func FuzzIntotoUnmarshalAndCanonicalize(f *testing.F) {
+	f.Fuzz(func(t *testing.T, entryData []byte) {
+		initter.Do(fuzzUtils.SetFuzzLogger)
+
+		ff := fuzz.NewConsumer(entryData)
+
+		targetV001 := &models.IntotoV001Schema{}
+
+		if err := ff.GenerateStruct(targetV001); err != nil {
+			t.Skip()
+		}
+
+		targetEntry := &models.Intoto{
+			APIVersion: swag.String(APIVERSION),
+			Spec:       targetV001,
+		}
+
+		ei, err := types.UnmarshalEntry(targetEntry)
+		if err != nil {
+			t.Skip()
+		}
+
+		if _, err := types.CanonicalizeEntry(context.Background(), ei); err != nil {
+			t.Errorf("error canonicalizing unmarshalled entry: %v", err)
+		}
 	})
 }
diff --git a/pkg/types/intoto/v0.0.2/fuzz_test.go b/pkg/types/intoto/v0.0.2/fuzz_test.go
index 7ef866a..ab9b232 100644
--- a/pkg/types/intoto/v0.0.2/fuzz_test.go
+++ b/pkg/types/intoto/v0.0.2/fuzz_test.go
@@ -21,8 +21,11 @@ import (
 	"testing"
 
 	fuzz "github.com/AdamKorcz/go-fuzz-headers-1"
+	"github.com/go-openapi/swag"
 
 	fuzzUtils "github.com/sigstore/rekor/pkg/fuzz"
+	"github.com/sigstore/rekor/pkg/generated/models"
+	"github.com/sigstore/rekor/pkg/types"
 	"github.com/sigstore/rekor/pkg/types/intoto"
 )
 
@@ -47,10 +50,47 @@ func FuzzIntotoCreateProposedEntry(f *testing.F) {
 		if err != nil {
 			t.Skip()
 		}
-		c, err := it.UnmarshalEntry(entry)
+		ei, err := types.CreateVersionedEntry(entry)
 		if err != nil {
 			t.Skip()
 		}
-		_, _ = c.IndexKeys()
+
+		if ok, err := ei.Insertable(); !ok || err != nil {
+			t.Errorf("entry created via CreateProposedEntry should be insertable: %v", err)
+		}
+
+		if _, err := types.CanonicalizeEntry(context.Background(), ei); err != nil {
+			t.Errorf("valid insertable entry should be able to be canonicalized: %v", err)
+		}
+
+		_, _ = ei.IndexKeys()
+	})
+}
+
+func FuzzIntotoUnmarshalAndCanonicalize(f *testing.F) {
+	f.Fuzz(func(t *testing.T, entryData []byte) {
+		initter.Do(fuzzUtils.SetFuzzLogger)
+
+		ff := fuzz.NewConsumer(entryData)
+
+		targetV002 := &models.IntotoV002Schema{}
+
+		if err := ff.GenerateStruct(targetV002); err != nil {
+			t.Skip()
+		}
+
+		targetEntry := &models.Intoto{
+			APIVersion: swag.String(APIVERSION),
+			Spec:       targetV002,
+		}
+
+		ei, err := types.UnmarshalEntry(targetEntry)
+		if err != nil {
+			t.Skip()
+		}
+
+		if _, err := types.CanonicalizeEntry(context.Background(), ei); err != nil {
+			t.Errorf("error canonicalizing unmarshalled entry: %v", err)
+		}
 	})
 }
diff --git a/pkg/types/jar/v0.0.1/fuzz_test.go b/pkg/types/jar/v0.0.1/fuzz_test.go
index d9b4108..70f420f 100644
--- a/pkg/types/jar/v0.0.1/fuzz_test.go
+++ b/pkg/types/jar/v0.0.1/fuzz_test.go
@@ -23,10 +23,13 @@ import (
 	"testing"
 
 	fuzz "github.com/AdamKorcz/go-fuzz-headers-1"
+	"github.com/go-openapi/swag"
 
 	jarutils "github.com/sassoftware/relic/lib/signjar"
 
 	fuzzUtils "github.com/sigstore/rekor/pkg/fuzz"
+	"github.com/sigstore/rekor/pkg/generated/models"
+	"github.com/sigstore/rekor/pkg/types"
 	"github.com/sigstore/rekor/pkg/types/jar"
 )
 
@@ -51,11 +54,48 @@ func FuzzJarCreateProposedEntry(f *testing.F) {
 		if err != nil {
 			t.Skip()
 		}
-		c, err := it.UnmarshalEntry(entry)
+		ei, err := types.CreateVersionedEntry(entry)
 		if err != nil {
 			t.Skip()
 		}
-		_, _ = c.IndexKeys()
+
+		if ok, err := ei.Insertable(); !ok || err != nil {
+			t.Errorf("entry created via CreateProposedEntry should be insertable: %v", err)
+		}
+
+		if _, err := types.CanonicalizeEntry(context.Background(), ei); err != nil {
+			t.Errorf("valid insertable entry should be able to be canonicalized: %v", err)
+		}
+
+		_, _ = ei.IndexKeys()
+	})
+}
+
+func FuzzJarUnmarshalAndCanonicalize(f *testing.F) {
+	f.Fuzz(func(t *testing.T, entryData []byte) {
+		initter.Do(fuzzUtils.SetFuzzLogger)
+
+		ff := fuzz.NewConsumer(entryData)
+
+		targetV001 := &models.JarV001Schema{}
+
+		if err := ff.GenerateStruct(targetV001); err != nil {
+			t.Skip()
+		}
+
+		targetEntry := &models.Jar{
+			APIVersion: swag.String(APIVERSION),
+			Spec:       targetV001,
+		}
+
+		ei, err := types.UnmarshalEntry(targetEntry)
+		if err != nil {
+			t.Skip()
+		}
+
+		if _, err := types.CanonicalizeEntry(context.Background(), ei); err != nil {
+			t.Errorf("error canonicalizing unmarshalled entry: %v", err)
+		}
 	})
 }
 
diff --git a/pkg/types/rekord/v0.0.1/fuzz_test.go b/pkg/types/rekord/v0.0.1/fuzz_test.go
index d669f70..a4e9ef3 100644
--- a/pkg/types/rekord/v0.0.1/fuzz_test.go
+++ b/pkg/types/rekord/v0.0.1/fuzz_test.go
@@ -21,8 +21,11 @@ import (
 	"testing"
 
 	fuzz "github.com/AdamKorcz/go-fuzz-headers-1"
+	"github.com/go-openapi/swag"
 
 	fuzzUtils "github.com/sigstore/rekor/pkg/fuzz"
+	"github.com/sigstore/rekor/pkg/generated/models"
+	"github.com/sigstore/rekor/pkg/types"
 	"github.com/sigstore/rekor/pkg/types/rekord"
 )
 
@@ -47,10 +50,47 @@ func FuzzRekordCreateProposedEntry(f *testing.F) {
 		if err != nil {
 			t.Skip()
 		}
-		c, err := it.UnmarshalEntry(entry)
+		ei, err := types.CreateVersionedEntry(entry)
 		if err != nil {
 			t.Skip()
 		}
-		_, _ = c.IndexKeys()
+
+		if ok, err := ei.Insertable(); !ok || err != nil {
+			t.Errorf("entry created via CreateProposedEntry should be insertable: %v", err)
+		}
+
+		if _, err := types.CanonicalizeEntry(context.Background(), ei); err != nil {
+			t.Errorf("valid insertable entry should be able to be canonicalized: %v", err)
+		}
+
+		_, _ = ei.IndexKeys()
+	})
+}
+
+func FuzzRekordUnmarshalAndCanonicalize(f *testing.F) {
+	f.Fuzz(func(t *testing.T, entryData []byte) {
+		initter.Do(fuzzUtils.SetFuzzLogger)
+
+		ff := fuzz.NewConsumer(entryData)
+
+		targetV001 := &models.RekordV001Schema{}
+
+		if err := ff.GenerateStruct(targetV001); err != nil {
+			t.Skip()
+		}
+
+		targetEntry := &models.Rekord{
+			APIVersion: swag.String(APIVERSION),
+			Spec:       targetV001,
+		}
+
+		ei, err := types.UnmarshalEntry(targetEntry)
+		if err != nil {
+			t.Skip()
+		}
+
+		if _, err := types.CanonicalizeEntry(context.Background(), ei); err != nil {
+			t.Errorf("error canonicalizing unmarshalled entry: %v", err)
+		}
 	})
 }
diff --git a/pkg/types/rfc3161/v0.0.1/fuzz_test.go b/pkg/types/rfc3161/v0.0.1/fuzz_test.go
index 15e0f41..65f5c7a 100644
--- a/pkg/types/rfc3161/v0.0.1/fuzz_test.go
+++ b/pkg/types/rfc3161/v0.0.1/fuzz_test.go
@@ -21,8 +21,11 @@ import (
 	"testing"
 
 	fuzz "github.com/AdamKorcz/go-fuzz-headers-1"
+	"github.com/go-openapi/swag"
 
 	fuzzUtils "github.com/sigstore/rekor/pkg/fuzz"
+	"github.com/sigstore/rekor/pkg/generated/models"
+	"github.com/sigstore/rekor/pkg/types"
 	"github.com/sigstore/rekor/pkg/types/rfc3161"
 )
 
@@ -47,10 +50,47 @@ func FuzzRfc3161CreateProposedEntry(f *testing.F) {
 		if err != nil {
 			t.Skip()
 		}
-		c, err := it.UnmarshalEntry(entry)
+		ei, err := types.CreateVersionedEntry(entry)
 		if err != nil {
 			t.Skip()
 		}
-		_, _ = c.IndexKeys()
+
+		if ok, err := ei.Insertable(); !ok || err != nil {
+			t.Errorf("entry created via CreateProposedEntry should be insertable: %v", err)
+		}
+
+		if _, err := types.CanonicalizeEntry(context.Background(), ei); err != nil {
+			t.Errorf("valid insertable entry should be able to be canonicalized: %v", err)
+		}
+
+		_, _ = ei.IndexKeys()
+	})
+}
+
+func FuzzRfc3161UnmarshalAndCanonicalize(f *testing.F) {
+	f.Fuzz(func(t *testing.T, entryData []byte) {
+		initter.Do(fuzzUtils.SetFuzzLogger)
+
+		ff := fuzz.NewConsumer(entryData)
+
+		targetV001 := &models.Rfc3161V001Schema{}
+
+		if err := ff.GenerateStruct(targetV001); err != nil {
+			t.Skip()
+		}
+
+		targetEntry := &models.Rfc3161{
+			APIVersion: swag.String(APIVERSION),
+			Spec:       targetV001,
+		}
+
+		ei, err := types.UnmarshalEntry(targetEntry)
+		if err != nil {
+			t.Skip()
+		}
+
+		if _, err := types.CanonicalizeEntry(context.Background(), ei); err != nil {
+			t.Errorf("error canonicalizing unmarshalled entry: %v", err)
+		}
 	})
 }
diff --git a/pkg/types/rpm/v0.0.1/fuzz_test.go b/pkg/types/rpm/v0.0.1/fuzz_test.go
index 0f0de91..33686b8 100644
--- a/pkg/types/rpm/v0.0.1/fuzz_test.go
+++ b/pkg/types/rpm/v0.0.1/fuzz_test.go
@@ -21,8 +21,11 @@ import (
 	"testing"
 
 	fuzz "github.com/AdamKorcz/go-fuzz-headers-1"
+	"github.com/go-openapi/swag"
 
 	fuzzUtils "github.com/sigstore/rekor/pkg/fuzz"
+	"github.com/sigstore/rekor/pkg/generated/models"
+	"github.com/sigstore/rekor/pkg/types"
 	"github.com/sigstore/rekor/pkg/types/rpm"
 )
 
@@ -47,10 +50,47 @@ func FuzzRpmCreateProposedEntry(f *testing.F) {
 		if err != nil {
 			t.Skip()
 		}
-		c, err := it.UnmarshalEntry(entry)
+		ei, err := types.CreateVersionedEntry(entry)
 		if err != nil {
 			t.Skip()
 		}
-		_, _ = c.IndexKeys()
+
+		if ok, err := ei.Insertable(); !ok || err != nil {
+			t.Errorf("entry created via CreateProposedEntry should be insertable: %v", err)
+		}
+
+		if _, err := types.CanonicalizeEntry(context.Background(), ei); err != nil {
+			t.Errorf("valid insertable entry should be able to be canonicalized: %v", err)
+		}
+
+		_, _ = ei.IndexKeys()
+	})
+}
+
+func FuzzRpmUnmarshalAndCanonicalize(f *testing.F) {
+	f.Fuzz(func(t *testing.T, entryData []byte) {
+		initter.Do(fuzzUtils.SetFuzzLogger)
+
+		ff := fuzz.NewConsumer(entryData)
+
+		targetV001 := &models.RpmV001Schema{}
+
+		if err := ff.GenerateStruct(targetV001); err != nil {
+			t.Skip()
+		}
+
+		targetEntry := &models.Rpm{
+			APIVersion: swag.String(APIVERSION),
+			Spec:       targetV001,
+		}
+
+		ei, err := types.UnmarshalEntry(targetEntry)
+		if err != nil {
+			t.Skip()
+		}
+
+		if _, err := types.CanonicalizeEntry(context.Background(), ei); err != nil {
+			t.Errorf("error canonicalizing unmarshalled entry: %v", err)
+		}
 	})
 }
diff --git a/pkg/types/tuf/v0.0.1/fuzz_test.go b/pkg/types/tuf/v0.0.1/fuzz_test.go
index bd52cf3..9d6d79b 100644
--- a/pkg/types/tuf/v0.0.1/fuzz_test.go
+++ b/pkg/types/tuf/v0.0.1/fuzz_test.go
@@ -21,8 +21,11 @@ import (
 	"testing"
 
 	fuzz "github.com/AdamKorcz/go-fuzz-headers-1"
+	"github.com/go-openapi/swag"
 
 	fuzzUtils "github.com/sigstore/rekor/pkg/fuzz"
+	"github.com/sigstore/rekor/pkg/generated/models"
+	"github.com/sigstore/rekor/pkg/types"
 	"github.com/sigstore/rekor/pkg/types/tuf"
 )
 
@@ -47,10 +50,47 @@ func FuzzTufCreateProposedEntry(f *testing.F) {
 		if err != nil {
 			t.Skip()
 		}
-		c, err := it.UnmarshalEntry(entry)
+		ei, err := types.CreateVersionedEntry(entry)
 		if err != nil {
 			t.Skip()
 		}
-		_, _ = c.IndexKeys()
+
+		if ok, err := ei.Insertable(); !ok || err != nil {
+			t.Errorf("entry created via CreateProposedEntry should be insertable: %v", err)
+		}
+
+		if _, err := types.CanonicalizeEntry(context.Background(), ei); err != nil {
+			t.Errorf("valid insertable entry should be able to be canonicalized: %v", err)
+		}
+
+		_, _ = ei.IndexKeys()
+	})
+}
+
+func FuzzTufUnmarshalAndCanonicalize(f *testing.F) {
+	f.Fuzz(func(t *testing.T, entryData []byte) {
+		initter.Do(fuzzUtils.SetFuzzLogger)
+
+		ff := fuzz.NewConsumer(entryData)
+
+		targetV001 := &models.TUFV001Schema{}
+
+		if err := ff.GenerateStruct(targetV001); err != nil {
+			t.Skip()
+		}
+
+		targetEntry := &models.TUF{
+			APIVersion: swag.String(APIVERSION),
+			Spec:       targetV001,
+		}
+
+		ei, err := types.UnmarshalEntry(targetEntry)
+		if err != nil {
+			t.Skip()
+		}
+
+		if _, err := types.CanonicalizeEntry(context.Background(), ei); err != nil {
+			t.Errorf("error canonicalizing unmarshalled entry: %v", err)
+		}
 	})
 }
diff --git a/tests/oss_fuzz.sh b/tests/oss_fuzz.sh
index e1eed1b..9369838 100755
--- a/tests/oss_fuzz.sh
+++ b/tests/oss_fuzz.sh
@@ -35,20 +35,31 @@ compile_native_go_fuzzer github.com/sigstore/rekor/pkg/sharding FuzzValidateTree
 compile_native_go_fuzzer github.com/sigstore/rekor/pkg/sharding FuzzValidateEntryID FuzzValidateEntryID
 compile_native_go_fuzzer github.com/sigstore/rekor/pkg/signer FuzzNewFile FuzzNewFile
 compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/cose/v0.0.1 FuzzCoseCreateProposedEntry FuzzCoseCreateProposedEntry
+compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/cose/v0.0.1 FuzzCoseUnmarshalAndCanonicalize FuzzCoseUnmarshalAndCanonicalize
+compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/hashedrekord FuzzHashedRekord FuzzHashedRekord
 compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/hashedrekord/v0.0.1 FuzzHashedRekordCreateProposedEntry FuzzHashedRekordCreateProposedEntry
+compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/hashedrekord/v0.0.1 FuzzHashedRekordUnmarshalAndCanonicalize FuzzHashedRekordUnmarshalAndCanonicalize
 compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/alpine FuzzPackageUnmarshal FuzzPackageUnmarshal
 compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/alpine/v0.0.1 FuzzAlpineCreateProposedEntry FuzzAlpineCreateProposedEntry
+compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/alpine/v0.0.1 FuzzAlpineUnmarshalAndCanonicalize FuzzAlpineUnmarshalAndCanonicalize
 compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/jar FuzzJarUnmarshal FuzzJarUnmarshal
 compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/jar/v0.0.1 FuzzJarCreateProposedEntry FuzzJarCreateProposedEntry
-compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/hashedrekord FuzzHashedRekord FuzzHashedRekord
+compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/jar/v0.0.1 FuzzJarUnmarshalAndCanonicalize FuzzJarUnmarshalAndCanonicalize
 compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/intoto/v0.0.1 FuzzIntotoCreateProposedEntry FuzzIntotoCreateProposedEntry_v001
+compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/intoto/v0.0.1 FuzzIntotoUnmarshalAndCanonicalize FuzzIntotoUnmarshalAndCanonicalize_v001
 compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/intoto/v0.0.2 FuzzIntotoCreateProposedEntry FuzzIntotoCreateProposedEntry_v002
+compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/intoto/v0.0.2 FuzzIntotoUnmarshalAndCanonicalize FuzzIntotoUnmarshalAndCanonicalize_v002
 compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/tuf/v0.0.1 FuzzTufCreateProposedEntry FuzzTufCreateProposedEntry
+compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/tuf/v0.0.1 FuzzTufUnmarshalAndCanonicalize FuzzTufUnmarshalAndCanonicalize
 compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/rfc3161/v0.0.1 FuzzRfc3161CreateProposedEntry FuzzRfc3161CreateProposedEntry
+compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/rfc3161/v0.0.1 FuzzRfc3161UnmarshalAndCanonicalize FuzzRfc3161UnmarshalAndCanonicalize
 compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/rpm/v0.0.1 FuzzRpmCreateProposedEntry FuzzRpmCreateProposedEntry
+compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/rpm/v0.0.1 FuzzRpmUnmarshalAndCanonicalize FuzzRpmUnmarshalAndCanonicalize
 compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/helm/v0.0.1 FuzzHelmCreateProposedEntry FuzzHelmCreateProposedEntry
+compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/helm/v0.0.1 FuzzHelmUnmarshalAndCanonicalize FuzzHelmUnmarshalAndCanonicalize
 compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/helm/v0.0.1 FuzzHelmProvenanceUnmarshal FuzzHelmProvenanceUnmarshal
 compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/rekord/v0.0.1 FuzzRekordCreateProposedEntry FuzzRekordCreateProposedEntry
+compile_native_go_fuzzer github.com/sigstore/rekor/pkg/types/rekord/v0.0.1 FuzzRekordUnmarshalAndCanonicalize FuzzRekordUnmarshalAndCanonicalize
 
 # Test 3rd party API that rekor/pkg/types/jar/v0.0.1 uses
 go mod edit -replace github.com/sassoftware/relic=$SRC/relic