From 561d9cedf72a1f7b93b749b9f29c12e55474a4ed Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Mon, 27 Jul 2026 10:29:33 +0000 Subject: [PATCH 1/2] Update org.bouncycastle to v1.85 --- sigstore-java/build.gradle.kts | 4 ++-- sigstore-maven-plugin/build.gradle.kts | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/sigstore-java/build.gradle.kts b/sigstore-java/build.gradle.kts index f074fd404..3fa36530a 100644 --- a/sigstore-java/build.gradle.kts +++ b/sigstore-java/build.gradle.kts @@ -35,8 +35,8 @@ dependencies { compileOnly("org.apache.tomcat:annotations-api:6.0.53") // java 9+ only implementation("com.google.code.gson:gson:2.14.0") - implementation("org.bouncycastle:bcutil-jdk18on:1.84") - implementation("org.bouncycastle:bcpkix-jdk18on:1.84") + implementation("org.bouncycastle:bcutil-jdk18on:1.85") + implementation("org.bouncycastle:bcpkix-jdk18on:1.85") implementation(platform("com.google.oauth-client:google-oauth-client-bom:1.39.0")) implementation("com.google.oauth-client:google-oauth-client") diff --git a/sigstore-maven-plugin/build.gradle.kts b/sigstore-maven-plugin/build.gradle.kts index 0e6a06d66..1a02c28da 100644 --- a/sigstore-maven-plugin/build.gradle.kts +++ b/sigstore-maven-plugin/build.gradle.kts @@ -14,7 +14,7 @@ dependencies { compileOnly("org.apache.maven.plugin-tools:maven-plugin-annotations:3.15.2") implementation(project(":sigstore-java")) - implementation("org.bouncycastle:bcutil-jdk18on:1.84") + implementation("org.bouncycastle:bcutil-jdk18on:1.85") implementation("org.apache.maven.plugins:maven-gpg-plugin:3.2.8") testImplementation("org.apache.maven.shared:maven-verifier:1.8.0") From 81b4d854d7905275afc75c2a84cb9658dea650a5 Mon Sep 17 00:00:00 2001 From: Appu Date: Fri, 31 Jul 2026 14:29:05 -0400 Subject: [PATCH 2/2] Fix TimestampClientHttpTest for Bouncy Castle 1.85 Update expected error message to match Bouncy Castle 1.85's hardened ASN.1 parsing. TAG=agy CONV=34327f37-2d6d-4892-b442-ac8e71a7f8eb Signed-off-by: Appu --- .../dev/sigstore/timestamp/client/TimestampClientHttpTest.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sigstore-java/src/test/java/dev/sigstore/timestamp/client/TimestampClientHttpTest.java b/sigstore-java/src/test/java/dev/sigstore/timestamp/client/TimestampClientHttpTest.java index 14cba6df2..79f7bf7ba 100644 --- a/sigstore-java/src/test/java/dev/sigstore/timestamp/client/TimestampClientHttpTest.java +++ b/sigstore-java/src/test/java/dev/sigstore/timestamp/client/TimestampClientHttpTest.java @@ -189,7 +189,7 @@ public void timestamp_failure_responseBodyReadError() throws Exception { client.timestamp(tsReq); }); assertEquals( - "Timestamp response validation or parsing failed: unknown tag 0 encountered", + "Timestamp response validation or parsing failed: corrupted stream - out of bounds length found: 105 > 101", tse.getMessage()); } }