refactor: extract sigstore-tuf module

settings.gradle.kts

@@ -14,6 +14,7 @@ includeBuild("build-logic-commons")
 includeBuild("build-logic")
 
 include("sigstore-common")
+include("sigstore-tuf")
 include("sigstore-java")
 include("sigstore-gradle:sigstore-gradle-sign-base-plugin")
 include("sigstore-gradle:sigstore-gradle-sign-plugin")

sigstore-cli/src/main/java/dev/sigstore/cli/Sign.java

@@ -21,8 +21,8 @@
 import dev.sigstore.bundle.Bundle;
 import dev.sigstore.oidc.client.OidcClients;
 import dev.sigstore.oidc.client.TokenStringOidcClient;
+import dev.sigstore.trustroot.SigstoreTufClient;
 import dev.sigstore.tuf.RootProvider;
-import dev.sigstore.tuf.SigstoreTufClient;
 import java.net.URI;
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;

sigstore-cli/src/main/java/dev/sigstore/cli/Verify.java

@@ -24,8 +24,8 @@
 import dev.sigstore.VerificationOptions.CertificateMatcher;
 import dev.sigstore.bundle.Bundle;
 import dev.sigstore.strings.StringMatcher;
+import dev.sigstore.trustroot.SigstoreTufClient;
 import dev.sigstore.tuf.RootProvider;
-import dev.sigstore.tuf.SigstoreTufClient;
 import java.net.URI;
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Path;

sigstore-gradle/sigstore-gradle-sign-base-plugin/build.gradle.kts

@@ -9,6 +9,7 @@ dependencies {
     compileOnly(project(":sigstore-java"))
 
     sigstoreJavaRuntime(project(":sigstore-common"))
+    sigstoreJavaRuntime(project(":sigstore-tuf"))
     sigstoreJavaRuntime(project(":sigstore-java")) {
         because("Test code needs access locally-built sigstore-java as a Maven repository")
     }

sigstore-gradle/sigstore-gradle-sign-plugin/build.gradle.kts

@@ -9,6 +9,7 @@ dependencies {
     api(project(":sigstore-gradle:sigstore-gradle-sign-base-plugin"))
 
     sigstoreJavaRuntime(project(":sigstore-common"))
+    sigstoreJavaRuntime(project(":sigstore-tuf"))
     sigstoreJavaRuntime(project(":sigstore-java")) {
         because("Test code needs access locally-built sigstore-java as a Maven repository")
     }

sigstore-java/build.gradle.kts

@@ -18,6 +18,7 @@ tasks.jar {
 
 dependencies {
     api(project(":sigstore-common"))
+    api(project(":sigstore-tuf"))
 
     compileOnly("org.immutables:gson:2.12.2")
     compileOnly("org.immutables:value-annotations:2.12.2")

sigstore-java/src/main/java/dev/sigstore/KeylessSigner.java

@@ -67,7 +67,7 @@
 import dev.sigstore.timestamp.client.TimestampVerifier;
 import dev.sigstore.trustroot.Service;
 import dev.sigstore.trustroot.SigstoreConfigurationException;
-import dev.sigstore.tuf.SigstoreTufClient;
+import dev.sigstore.trustroot.SigstoreTufClient;
 import java.io.IOException;
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Path;

sigstore-java/src/main/java/dev/sigstore/KeylessVerifier.java

@@ -47,7 +47,7 @@
 import dev.sigstore.timestamp.client.TimestampVerificationException;
 import dev.sigstore.timestamp.client.TimestampVerifier;
 import dev.sigstore.trustroot.SigstoreConfigurationException;
-import dev.sigstore.tuf.SigstoreTufClient;
+import dev.sigstore.trustroot.SigstoreTufClient;
 import java.io.IOException;
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Path;

sigstore-java/src/main/java/dev/sigstore/SigningConfigProvider.java

@@ -18,7 +18,7 @@
 import com.google.common.base.Preconditions;
 import dev.sigstore.trustroot.SigstoreConfigurationException;
 import dev.sigstore.trustroot.SigstoreSigningConfig;
-import dev.sigstore.tuf.SigstoreTufClient;
+import dev.sigstore.trustroot.SigstoreTufClient;
 import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.Path;

sigstore-java/src/main/java/dev/sigstore/TrustedRootProvider.java

@@ -18,7 +18,7 @@
 import com.google.common.base.Preconditions;
 import dev.sigstore.trustroot.SigstoreConfigurationException;
 import dev.sigstore.trustroot.SigstoreTrustedRoot;
-import dev.sigstore.tuf.SigstoreTufClient;
+import dev.sigstore.trustroot.SigstoreTufClient;
 import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.Path;

sigstore-java/src/main/java/dev/sigstore/rekor/client/RekorEntryFetcher.java

@@ -20,8 +20,8 @@
 import dev.sigstore.encryption.certificates.Certificates;
 import dev.sigstore.trustroot.Service;
 import dev.sigstore.trustroot.SigstoreConfigurationException;
+import dev.sigstore.trustroot.SigstoreTufClient;
 import dev.sigstore.trustroot.TransparencyLog;
-import dev.sigstore.tuf.SigstoreTufClient;
 import java.io.IOException;
 import java.nio.file.Path;
 import java.security.cert.CertificateExpiredException;

sigstore-java/src/main/java/dev/sigstore/tuf/SigstoreTufClient.java → sigstore-java/src/main/java/dev/sigstore/trustroot/SigstoreTufClient.java

@@ -13,15 +13,19 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package dev.sigstore.tuf;
+package dev.sigstore.trustroot;
 
 import com.google.common.annotations.VisibleForTesting;
 import com.google.common.base.Preconditions;
 import dev.sigstore.common.http.URIFormat;
 import dev.sigstore.common.json.JsonParseException;
-import dev.sigstore.trustroot.SigstoreConfigurationException;
-import dev.sigstore.trustroot.SigstoreSigningConfig;
-import dev.sigstore.trustroot.SigstoreTrustedRoot;
+import dev.sigstore.tuf.FileSystemTufStore;
+import dev.sigstore.tuf.HttpFetcher;
+import dev.sigstore.tuf.MetaFetcher;
+import dev.sigstore.tuf.PassthroughCacheMetaStore;
+import dev.sigstore.tuf.RootProvider;
+import dev.sigstore.tuf.TrustedMetaStore;
+import dev.sigstore.tuf.Updater;
 import java.io.IOException;
 import java.net.URI;
 import java.nio.file.Files;

sigstore-java/src/test/java/dev/sigstore/KeylessTest.java

@@ -27,7 +27,7 @@
 import dev.sigstore.testkit.oidc.ConformanceTestingToken;
 import dev.sigstore.trustroot.ImmutableSigstoreSigningConfig;
 import dev.sigstore.trustroot.Service;
-import dev.sigstore.tuf.SigstoreTufClient;
+import dev.sigstore.trustroot.SigstoreTufClient;
 import java.io.IOException;
 import java.io.StringReader;
 import java.net.URI;

sigstore-java/src/test/java/dev/sigstore/rekor/client/RekorClientHttpTest.java

@@ -25,7 +25,7 @@
 import dev.sigstore.encryption.signers.Signers;
 import dev.sigstore.testing.CertGenerator;
 import dev.sigstore.trustroot.Service;
-import dev.sigstore.tuf.SigstoreTufClient;
+import dev.sigstore.trustroot.SigstoreTufClient;
 import java.io.IOException;
 import java.nio.charset.StandardCharsets;
 import java.security.InvalidKeyException;

sigstore-java/src/test/java/dev/sigstore/rekor/v2/client/RekorV2ClientHttpTest.java

@@ -28,7 +28,7 @@
 import dev.sigstore.proto.rekor.v2.Verifier;
 import dev.sigstore.testing.CertGenerator;
 import dev.sigstore.trustroot.Service;
-import dev.sigstore.tuf.SigstoreTufClient;
+import dev.sigstore.trustroot.SigstoreTufClient;
 import java.io.IOException;
 import java.nio.charset.StandardCharsets;
 import java.security.InvalidKeyException;

sigstore-java/src/test/java/dev/sigstore/timestamp/client/TimestampClientHttpTest.java

@@ -23,7 +23,7 @@
 
 import dev.sigstore.AlgorithmRegistry;
 import dev.sigstore.trustroot.Service;
-import dev.sigstore.tuf.SigstoreTufClient;
+import dev.sigstore.trustroot.SigstoreTufClient;
 import java.nio.charset.StandardCharsets;
 import java.security.MessageDigest;
 import java.util.List;

sigstore-java/src/test/java/dev/sigstore/tuf/SigstoreTufClientTest.java → sigstore-java/src/test/java/dev/sigstore/trustroot/SigstoreTufClientTest.java

@@ -13,15 +13,15 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package dev.sigstore.tuf;
+package dev.sigstore.trustroot;
 
 import com.google.protobuf.util.JsonFormat;
 import dev.sigstore.proto.trustroot.v1.ServiceConfiguration;
 import dev.sigstore.proto.trustroot.v1.ServiceSelector;
 import dev.sigstore.proto.trustroot.v1.SigningConfig;
 import dev.sigstore.proto.trustroot.v1.TrustedRoot;
-import dev.sigstore.trustroot.SigstoreSigningConfig;
-import dev.sigstore.trustroot.SigstoreTrustedRoot;
+import dev.sigstore.tuf.TargetStore;
+import dev.sigstore.tuf.Updater;
 import java.io.ByteArrayInputStream;
 import java.io.IOException;
 import java.io.InputStream;

sigstore-maven-plugin/build.gradle.kts

@@ -22,6 +22,7 @@ dependencies {
     testImplementation(project(":sigstore-testkit"))
 
     sigstoreJavaRuntime(project(":sigstore-common"))
+    sigstoreJavaRuntime(project(":sigstore-tuf"))
     sigstoreJavaRuntime(project(":sigstore-java")) {
         because("Test code needs access locally-built sigstore-java as a Maven repository")
     }

sigstore-tuf/build.gradle.kts

@@ -0,0 +1,45 @@
+plugins {
+    id("build-logic.java-published-library")
+    id("build-logic.test-junit5")
+}
+
+description = "The Update Framework (TUF) client implementation for Sigstore Java"
+
+tasks.jar {
+    manifest {
+        attributes["Automatic-Module-Name"] = "dev.sigstore.tuf"
+    }
+}
+
+dependencies {
+    compileOnly("org.immutables:gson:2.12.2")
+    compileOnly("org.immutables:value-annotations:2.12.2")
+    annotationProcessor("org.immutables:value:2.12.2")
+
+    api(project(":sigstore-common"))
+
+    implementation("org.bouncycastle:bcutil-jdk18on:1.85")
+    implementation("org.bouncycastle:bcpkix-jdk18on:1.85")
+    implementation("com.google.guava:guava:33.7.1-jre")
+
+    testImplementation(platform("org.junit:junit-bom:5.14.4"))
+    testRuntimeOnly("org.junit.jupiter:junit-jupiter-engine")
+    testImplementation("org.assertj:assertj-core:3.27.7")
+    testImplementation(platform("org.mockito:mockito-bom:5.23.0"))
+    testImplementation("org.mockito:mockito-core")
+    testImplementation("org.mockito:mockito-junit-jupiter")
+
+    testImplementation("com.squareup.okhttp3:mockwebserver:5.5.0")
+    testImplementation("io.github.netmikey.logunit:logunit-core:2.0.0")
+    testRuntimeOnly("io.github.netmikey.logunit:logunit-jul:2.0.0")
+    testImplementation("org.hamcrest:hamcrest:3.0")
+    testImplementation("org.apache.commons:commons-lang3:3.17.0")
+    testImplementation("commons-io:commons-io:2.18.0")
+    testImplementation("org.jetbrains:annotations:26.0.2")
+}
+
+forbiddenApis {
+    signaturesFiles = files("$rootDir/config/forbiddenApis.txt")
+    suppressAnnotations = setOf("dev.sigstore.common.forbidden.SuppressForbidden")
+    ignoreSignaturesOfMissingClasses = true
+}

sigstore-java/src/main/java/dev/sigstore/tuf/Updater.java → sigstore-tuf/src/main/java/dev/sigstore/tuf/Updater.java

@@ -563,12 +563,12 @@ void downloadTarget(String targetName, TargetData targetData) throws IOException
   }
 
   @VisibleForTesting
-  TargetStore getTargetStore() {
+  public TargetStore getTargetStore() {
     return targetStore;
   }
 
   @VisibleForTesting
-  TrustedMetaStore getMetaStore() {
+  public TrustedMetaStore getMetaStore() {
     return trustedMetaStore;
   }
 

tuf-cli/build.gradle.kts

@@ -11,7 +11,7 @@ repositories {
 }
 
 dependencies {
-    implementation(project(":sigstore-java"))
+    implementation(project(":sigstore-tuf"))
     implementation("info.picocli:picocli:4.7.6")
     implementation("com.google.guava:guava:33.7.1-jre")