[sinelaw]

Updates sigstore-verify 0.8.0 → 0.10.0 and adapts the calling code.

GitHub rotated its Sigstore TSA certificate in late June 2026. mise verifies
GitHub attestations against the trusted root embedded in sigstore-verify, and
0.8.0's snapshot predates the new cert, so releases timestamped after the
rotation fail:

TSA timestamp verification failed: Failed to verify timestamp signature:
no certificate matches issuer and serial number

0.10.0 is the first release whose embedded GitHub root contains the rotated cert.
0.9.0 (proposed in #10640) does not, and also fails to compile.

API changes adapted:

• SigningScheme::uses_sha256() removed → use supports_prehashed() alone
  (equivalent; the only prehashed scheme mise emits is EcdsaP256Sha256).
• verify_signature_prehashed() takes &[u8] not &Sha256Hash → artifact_hash.as_bytes().
• Artifact::from_digest() takes &[u8] → Artifact::from(&digest).
• TufConfig::custom() dropped its root arg → .with_root(...) builder.

Cargo.lock swaps the tough TUF stack for the in-house sigstore-tuf crate.

The GitHub root stays embedded. 0.10.0 also adds TufConfig::github(), which
enables fetching it over GitHub's TUF URL so future rotations are picked up
automatically — left to a follow-up PR.

Summary by CodeRabbit

• Bug Fixes
  • Improved signature verification reliability for signed artifacts, including more correct handling of prehashed verification.
  • Fixed how trust roots are selected when using a custom Sigstore URL, improving TUF behavior consistency.
  • Enhanced artifact digest handling during verification to better support signature checks.
• Chores
  • Updated the Sigstore verification dependency to a newer version (no default feature changes).

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 40dae1b1-b7f3-4216-9372-2e55b366b607

📥 Commits

Reviewing files that changed from the base of the PR and between a0466ce and d1eb6a0.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (2)

• crates/mise-sigstore/Cargo.toml
• crates/mise-sigstore/src/lib.rs

🚧 Files skipped from review as they are similar to previous changes (2)

• crates/mise-sigstore/Cargo.toml
• crates/mise-sigstore/src/lib.rs

---

📝 Walkthrough

Walkthrough

Bumps sigstore-verify from 0.8.0 to 0.10.0 and updates mise-sigstore call sites for prehashed verification, TUF config construction, and digest-to-Artifact conversion.

Changes

Sigstore-verify Dependency Upgrade

Layer / File(s)	Summary
Dependency version bump crates/mise-sigstore/Cargo.toml	sigstore-verify is bumped from 0.8.0 to 0.10.0 while keeping default-features = false.
Prehashed verification path crates/mise-sigstore/src/lib.rs	verify_public_key_bundle now selects the prehashed branch with scheme.supports_prehashed() and passes artifact_hash.as_bytes() into verify_signature_prehashed.
TUF and artifact adapter updates crates/mise-sigstore/src/lib.rs	select_tuf_config uses TufConfig::custom(url).with_root(PRODUCTION_TUF_ROOT), and verify_bundle_for_any_artifact uses Artifact::from(&digest).

Estimated code review effort: 2 (Simple) | ~10 minutes

Poem

A tiny hare did hop and cheer,
A version bump is now quite clear.
New roots, new bytes, a gentler way,
The sigstore path still runs today. 🐇

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and accurately summarizes the main change: upgrading sigstore-verify to 0.10.0.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​sigstore-verify@​0.8.0 ⏵ 0.10.0

View full report

[sinelaw]

Motivation: sinelaw/fresh#2528

[greptile-apps]

Greptile Summary

This PR updates sigstore-verify from 0.8.0 to 0.10.0 to fix attestation verification failures caused by GitHub's TSA certificate rotation in late June 2026, and adapts the call sites to the new API.

• lib.rs: Four call-site adaptations — supports_prehashed() replaces the removed uses_sha256() && supports_prehashed() guard (equivalent for the single prehashed scheme in use, EcdsaP256Sha256); verify_signature_prehashed now receives artifact_hash.as_bytes() (&[u8] instead of &Sha256Hash); Artifact::from(&digest) replaces Artifact::from_digest(digest); and TufConfig::custom(url).with_root(PRODUCTION_TUF_ROOT) follows the new builder API.
• Cargo.lock: All sigstore-* sub-crates bumped to 0.10.0; the tough TUF stack (and snafu, olpc-cjson, async-recursion) removed, replaced by the new in-house sigstore-tuf crate; minor deduplication of typed-path and wasm-streams versions.

Confidence Score: 5/5

Safe to merge — fixes a live breakage (TSA cert rotation) with minimal, well-scoped API adaptations and no behavioural changes beyond the dependency upgrade.

All three code changes are direct, mechanical API adaptations driven by removed/renamed symbols in the new library version. The supports_prehashed() simplification is correct because uses_sha256() was only ever jointly true with supports_prehashed() for the single prehashed scheme (EcdsaP256Sha256) that mise uses. The security properties of the TUF bootstrapping path are preserved: PRODUCTION_TUF_ROOT is still pinned via .with_root(...). Dependency graph changes in Cargo.lock are consistent with replacing the tough TUF stack with the new sigstore-tuf crate.

No files require special attention.

Important Files Changed

Filename	Overview
crates/mise-sigstore/src/lib.rs	Three targeted API adaptations for sigstore-verify 0.10.0: supports_prehashed() replaces the removed uses_sha256() && supports_prehashed() guard, artifact_hash.as_bytes() adapts to the new &[u8] signature, and Artifact::from(&digest) / TufConfig::custom(url).with_root(...) follow the updated builder patterns. All changes are minimal and semantically equivalent.
crates/mise-sigstore/Cargo.toml	Single version bump for sigstore-verify from 0.8.0 to 0.10.0, keeping default-features = false.
Cargo.lock	Lock file updated to reflect the sigstore-verify 0.10.0 dependency tree: all sigstore-* sub-crates bump to 0.10.0, tough/snafu/olpc-cjson removed, new sigstore-tuf crate added, and minor deduplication of typed-path / wasm-streams versions.

_{Reviews (3): Last reviewed commit: "Merge branch 'main' into fix-sigstore-ve..." | Re-trigger Greptile}